Incident Investigation Techniques for the Practicing Safety Professional

Is It Really Necessary?

Why are incident investigations important anyway? A simple answer would be to prevent the incident from happening again in the future. What you may want to know further is, how do these benefit my facility? Well, incident investigations lead to improved employee safety, directly impacts reduction in workers’ compensation claims, and ultimately impacts a facility’s Modification Factor, or “MOD Rating”, reducing cost of insurance. 

In ‘traditional safety’ investigations mainly stated the employee was operating at-risk, or there was a spill but no one cleaned it up. But these only really stated what happened. A root cause is the causes(s) of an incident and need to be addressed in order to ensure the incident does not occur again; this would be considered why the incident happened.

What Versus Why: The Safety Professional’s Inquisitive Nature 

It is always easy to say what happened but not go into much depth as to why it happened. In determining possible root causes of an incident, I always feel like I am asking everyone involved a million questions. Maybe that is just something to be included within the job description of a safety professional!

Luckily, I am a very intrigued individual and I enjoy learning why people or things are the way they are. In investigations, I learn why they happened the way they did when I ask questions such as: Why was the employee acting in that manner? Was it a Standard Operating Procedure? Was that the current best practice? Was the workstation set up properly? Is there a proper preventative maintenance schedule in place? I use a standard process to simplify investigating. 

Standard Investigation Process

Incident investigations have a straight-forward approach. Collect information, identify factors, create solutions, implement to processes. Here is a general outline of what to include in an investigation. 

Step 1: Gather information.

Interview those directly involved and witnesses to the incident. This step is to collect enough information to understand the basics of what happened.

Step 2: Search for and establish facts.

Examine the incident scene, looking for things that will help in understanding what happened. This includes looking for dents, cracks, scrapes, or splits in the equipment; tire tracks or footprints; spills or leaks; scattered or broken parts; and so on. Be sure to take pictures.

Step 3: Establish essential contributing factors.

These include environmental factors, design factors, systems and procedures, and human behavior. Design factors include workplace layout, design of tools and equipment, and maintenance. Systems and procedures factors include lack of systems and procedures, inappropriate systems and procedures, inadequate training procedures, and housekeeping. Human behavior is common in incidents and includes carelessness, rushing and fatigue, among others.

Step 4: Find root causes.

There are almost always multiple causes that contribute to an incident. Try to identify all of the underlying causes as well as the primary cause.

Step 5: Determine corrective actions.

Once you know what happened and why it happened, you are ready to determine how to fix the problem so that you avoid repeat incidents. Think about not only what is the short-term band-aid fix, but what is the long-term solution. 

Step 6: Implement corrective actions.

Put your corrective actions into place and follow up to make sure that they were sufficient to mitigate the hazard and/or address the issues.

Incident Investigation Techniques: Applying the Process

Depending on the organization and how it is structured, a safety professional may conduct an incident investigation, but most of the time management conduct the investigations. This is important to consider, as whoever is conducting the incident investigation, needs to be properly trained. If a company has a safety professional, they may train management; some insurance providers also offer safety resources which may be used to train.

In order for an incident investigation to be productive, individuals who are involved in the incident need to understand the purpose of the investigation is prevention, not accusation. This will help to ensure the investigation can be more open and honest.

How to Ask Questions

I always try my best to not come off as interrogating an individual, which is slightly against my nature; those who know me understand how direct I can be! I stress to employees that I genuinely care about them and I am collecting this information to benefit other employees from getting hurt in the future. Open ended questions always help to piggy-back many different questions after another. 

Who to Interview

  • Those who were participants in the incident
  • Witnesses
  • Individuals not involved in the event but have knowledge about processes, device manufactures and the like

Interview Questions 

One of my old bosses, who I deeply admire as a strong mentor, gave me a guide which I found to be super straightforward and helpful in simplifying incident investigations. The guide is called, Guidelines for Conducting an HFACS Interview by HFACS. It has a general mix of questions which are all cause and effect focused. I mix and match these questions based on the situation and have always successfully found root causes to incidents.

Preconditions for Unsafe Acts

Situational Factors

Physical Environment (Refers to the setting in which individuals or teams perform their work)

  • How would you describe the situation in the room/location at the time of the event. (Was it chaotic? Were there a lot of distractions/interruptions? Was it difficult to concentrate on what you were doing?)
  • How would you describe the physical environment you were working in? (Was it adequately illuminated? Was there a lot of noise in the room? Was there anything that interfered with your ability to see or hear important information?)
  • How would you describe the layout of the workspace you were in? (Was it small, crowded, cluttered, disorganized? Was the work area designed to support the function it was being used for?)

Tools/Technology (Refers to the materials, software and documents individuals and teams use to perform their work)

  • Did existing documentation provide adequate information? (Did orders, progress notes, records, etc provide a clear picture of the plan?
  • Was there anything wrong with the equipment being used at the time of the event? (Were the displays, controls, alarms working properly? Was any of the equipment outdated, poorly maintained, or malfunctioning?)
  • Was the use of the equipment effectively integrated into the workflow? (Was it conveniently located or did it create extra workload? Was its use smoothly integrated with the clinical activities or procedures related to the event? Did it fit easily within the workspace?)
Condition of Operators

Mental States (Refers to the psychological of the individual at the time of the event)

  • Describe what you were thinking at the time of the event. (What was going through your mind?)
  • Was there anything confusing about what was going on? (Did you have all the information you needed at the time? Were things going as expected?)
  • When did you realize there was a problem? (What were the indicators? What did you think was happening?)
  • What did you decide to do once you realized there was a problem? (How well did it work? Did you try anything else?)
  • Were your actions or reactions planned or did they occur naturally? (Was your action simply a routine habit? Did you just respond without having to think too much about it?)
  • Was there anything else that you planned to do but forgot? (Did something distract you, making you forget about your intentions?)
  • How would you describe your workload on the day of the incident? (Were you in a hurry at the time the event happened? Were there any time pressures or incentives to work faster or cut corners?)
  • Were you tired? (Would you say that you were tired? If so, was it due to a lack of sleep or just a long day?)

Physiological States (Refers to the individual’s physical condition at the time of the event)

  • How were you feeling physically at the time of the event? (Were you feeling physically fatigued, hungry, dehydrated, or suffering from a cold/illness?)

Physical/Mental Limitations (Refers to permanent physical/mental disabilities that may adversely impact performance)

  • Do you have any injuries or limitations, such as eyesight or hearing problems, that impact your work? (Do you wear glasses/contact/hearing aids? Were you wearing them at the time of the event?)
Personnel Factors

Communication, Coordination and Planning (Refers to the interrelationship among team members)

  • How would you describe the communication of information among your team? (Was information effectively shared or requested? Was information complete, timely and unamibigous?
  • How would you describe the process for ensuring that communication/information is understood among your team? (Do you use a standard vocabulary? Do you use read backs or repeat backs to confirm shared information/communication?)
  • Do you use particular jargon or slang that may not be fully understood by the entire team? (What sorts of shorthand or acronyms are used routinely in your task? Is the jargon/acronyms universal or local?)
  • What sorts of non-verbal communication do you use? (Do you use hand gestures or other non-verbal communication when carrying out the task? Are all team members clear on the non-verbal communication gestures used?)
  • How does your team plan or coordinate activities? (Do you conduct team huddles/briefings? How are roles and responsibilities assigned or clarified?)
  • Describe how your team supports each other or assists in performing their work. (How do you monitor or back up each other? Do you conduct debriefs?)
  • How would you describe the composition of your team? (Would you consider your team like-minded or from multiple schools of thought? Are team members static or are members drawn from multiple areas and rotate frequently?

Fitness for Duty (Refers to activities performed off the job that influence an individual’s ability to perform their work safely)

  • Given your work schedule, how would you describe your work-life balance? (Are you able to adequately rest when away from work? Were you feeling alert or mentally drowsy at the time of the event? Describe your schedule starting two days before the event happened.)
  • Is there anything going on outside of work that might affect your ability to perform at your peak while on duty? (Are you working a second job, going to night school, overwhelmed with family obligations?)
  • How would you describe your general health at the time of the event? (Were you feeling well? Were you taking any over-the-counter or prescribed medications that may have impacted your performance?)

Supervisory Factors

Inadequate Supervision (Refers to the performance of basic supervisory activities)

  • How would you describe your interactions with your supervisor? (How often do you meet together? How does your supervisor communicate or share information with you and others in your work area? Do you feel comfortable speaking to your supervisor about different issues?)
  • Can you describe your supervisor’s style? (Do you consider your supervisor more of a coach or boss? Does your supervisor provide a professional and enjoyable workplace?)
  • How would you describe the training you were provided to perform your work? (When was training provided? What were the goals of the training? Was it adequate? How was learning assessed? Were results of the training monitored over time?)
  • How would you describe the oversight or guidance your supervisor provides during the performance of your job? (Were you provided with an orientation of the policies, equipment, and safety hazards related to your job? How often does your supervisor monitor your work or the work of others in your group? How is feedback provided?)

Supervisory Violations (Refers to supervisor’s intentional disregard for rules)

  • Was there anything that your supervisor said or did to suggest that you were not expected to adhere to established policies or procedures related to this event? (If yes, please explain.)
  • Does your supervisor adhere to the rules? (Does your supervisor enforce the rules? Is your supervisor known to work around the rules? Does your supervisor scribe to the view of “Do as I say, not as I do?”)

Planned Inappropriate Operations (Refers how staff and work activities are managed)

  • What was the staffing like at the time of the event? (Were there enough staff on-hand for the workload at the time? Was there the right mix on staff?)
  • What was the staffs’ work schedule like? (How many shifts were they working? Were they provided enough time to get rest? How frequently did they take breaks?)
  • Were the staff involved in the event properly qualified or trained to perform their duties or use the equipment? (What process is used to assign staff to perform their duties or operate certain equipment?)

Failure to Correct Known Problems (Refers to the correction of known deficiencies by the supervisor)

  • Describe any other past incidents that are similar to the event currently being investigated. (What happened? Was the problem ever fixed?)
  • Describe any other problems with equipment or staff performance related to the current event that were previously known but left uncorrected. (How often did these problems offer? What prevented these problems from being adequately addressed?)
  • How are conflicts resolved in your workplace? (Does management engage in conflict resolution or do they peter to let individuals try and work out problems on their own? Does management prefer not to be told “bad” news?)

Organizational Influences

Organizational Culture (Refers to the priority placed on safety relative to other organizational goals or initiatives)

  • How would you describe your organization’s culture or attitude about safety? (Are suggestions from staff about problems encouraged or welcomes? Would you consider your organization a hierarchical organization with a well-defined chain-of-command or a flat organization with little guidance from upper management?)
  • How transparent do you feel your organization is when problems occur? (Are problems concealed or are lessons learned shared openly? Is information/suggestions filtered by upper management?)
  • How would you describe your department’s relationship with other departments it commonly interacts with? (Is there good communication and collaboration or is the relationship more adversarial/strained?)

Operational Process (Refers to how an organization plans to achieve its objective)

  • Were there written policies/procedures that addressed the work processes related to the event? (Were these appropriate and current? Were they consistent withe external guidelines or other internal policies? Were they clear and readily available to staff? How were they disseminated?)
  • Did management have an audit or quality control system to inform them of how key processes related to the event were functioning? (Was leadership engaged or have an appreciation of operational risks? Was there a management plan for addressing risk and assigning responsibility for risk?)

Resource Management (Refers to the support provided to accomplish the objectives of the organization)

  • Does the facility have the appropriate expertise, equipment and support services to provide the services associated with this event? (Doyon have enough staff to provide optimal performance? Are the right people hired?)
  • Are resources in place to ensure that staff are adequately current and qualified? (Is training provided by the organization? Are employees encouraged and provided resources to maintain currency?)
  • Was there adequate equipment to perform the work tasks? (Did the equipment involved meet current codes, specifications and regulations? How was it determined that the equipment was a good match between the users and the tasks they performed? Was there a safety review of the equipment?)
  • Was there a maintenance program in place to maintain the equipment involved in the event? (Is there a maintenance program or a regular inspection performed on the equipment involved in this event? Were adequate time and resource allocated for equipment repairs/upgrades? Were emergency provision and back-up systems available in case of equipment failure?)

Root Cause Presentation: Corrective Action Development

Investigations, and really all of safety in general, is all about a systems approach. We must think about all of the possible causes which contributed to the incident. Once all of the incident investigation information is collected, my favorite way to present a complex root cause investigation is the fishbone diagram. When all of the information is presented in an easy to read manner, everyone (safety, employees, management, etc) can take a look and brainstorm corrective actions. 

Based upon the amazingly stated questions above, here is what the fishbone diagram would look like.


Incident investigations are critical to understand underlying risk factors which will lead to an incident. In order to prevent the incident from happening again, it is important to ask the right questions as well as follow up on implementation. Sometimes it is difficult to come up with a solution and having a team of employees aid, such as the safety committee, is wonderful. Implementation is the most important part and having employee buy in and management commitment through enforcement is super important, otherwise the incident will happen again. 

Incident investigation corrective actions are just the same as continuous improvement projects; I have learned how evaluation of improvements are critical to keep the safety program up and running. If something isn’t working, that is okay, but another solution will need to be developed.

Thank you for reading and always feel free to reach out!


Krystal Sibert GSP Blog Signature


  • “6 Steps to a Basic Incident Investigation.” pswct, Puget Sound Educational Service District, 2014, 
  • “Guidelines for Conducting an HFCS Interview.” Quality, Safety, Efficiency, HFCS Inc., 2016, p. 11-18.