What should an incident investigation report include?

The facts (what happened, where, when, people by reference), the immediate actions, a timeline with a source for each event, the immediate, underlying and root causes, actions with owners and dates ranked by the hierarchy of controls, a check that the actions worked, and sign-off. OSHA's guide sums it up in four steps: preserve the scene, collect information, determine root causes, implement corrective actions.

What is the difference between a root cause and a contributing factor?

In HSG245 terms, the immediate cause is the most obvious reason, underlying causes are the conditions and practices that allowed it, and root causes are the management, planning or organisational failings they grow from. Contributing factors usually means the immediate and underlying causes. Fix all three levels, the root causes especially.

Is this incident recordable on the OSHA 300 log?

For US employers, a work-related new case is recordable if it leads to death, days away, restricted work or transfer, medical treatment beyond first aid, loss of consciousness or a significant diagnosed injury or illness (29 CFR 1904.7). The Excel screen walks through those questions, but the regulation decides; check it or ask your recordkeeper. The free TRIR and DART calculator turns the log into rates.

When do I have to report an incident to OSHA?

Under 29 CFR 1904.39, a work-related fatality within 8 hours, and an in-patient hospitalization, amputation or loss of an eye within 24 hours; if you only learn of it later, the time counts from when you do. Other countries have their own rules, such as RIDDOR in Great Britain; check the ones that apply to your site. This is a summary, not legal advice.

How do you protect the injured person's privacy in the report?

Refer to people by letter and keep names, clinic notes and medical details in the confidential records, not in the report that gets shared. On the OSHA 300 log, privacy concern cases such as an injury to an intimate body part or a mental illness are entered as privacy case instead of a name (1904.29(b)(6) to (9)).

Free template

Updated October 9, 2026

Incident investigation report template

An incident investigation report records what happened in a workplace incident, why it happened and what was done so it does not happen again. It covers injuries, ill health, damage and close calls. Good investigations put facts first, look for causes instead of someone to blame, and fix the management failings behind the obvious cause. This template follows OSHA's four steps (preserve and document the scene, collect information, determine root causes, implement corrective actions) and the three levels of cause in the UK HSE's guide HSG245: immediate, underlying and root. Actions are ranked by the NIOSH hierarchy of controls, from elimination to PPE. People are named by reference letter only, so the shared report carries no names or medical details. The Excel version checks the timeline order and sources, flags causes with no action or with only administrative and PPE controls, tracks each action to a check on the floor, counts actions by control type, compares weekly counts before and after, and has a screen for US employers that points to 29 CFR 1904: whether the case looks recordable or a DART case, whether OSHA must be told within 8 or 24 hours, and whether it is a privacy case.

Free to use: print it, copy it and edit it for your team. Enter your name and work email once to download.

Page 1 of the incident investigation report — People by reference letterWorst credible outcome and levelSourced timelineImmediate, underlying, root causesActions by hierarchy of controlsBefore and after countsUS recordkeeping screenClosure check

Filled-in Incident investigation report template: a cut hand clearing a jam on a case erector — The same sheet filled in with the worked example (page 3 of the PDF, illustrative numbers). Open full size (opens the picture in a new tab)

When to use it

When to use an incident investigation report

After any injury or ill health, including first aid cases, so the causes are found while they are small.
After a close call (near miss) whose worst credible outcome is serious: HSG245 sets the depth of an investigation by what could have happened, not only by what did.
After property or equipment damage, a fire, a spill or a vehicle incident.
When an incident has to be recorded on the OSHA 300 log or reported to OSHA, and you need the investigation behind the entry.

How to fill it in

1
Make it safe and preserve the scene
Care for the injured, make the area safe and keep the scene as it was: tape, photos, a sketch. Record what was done straight away.
2
Record the facts and choose the depth
Type, people by reference letter, the actual outcome and the worst credible one, and how likely it is to happen again. Use those to choose the level of investigation.
3
Build the timeline
One event a row, in time order, each with its source: a statement, a record, a photo or physical evidence. Mark anything with one source only as to verify. Interview promptly, as fact-finding, not fault-finding.
4
Find causes at three levels
The immediate cause, the underlying causes (the unsafe act or condition and why it existed) and the root causes, which are usually management, planning or organisational failings. Verify each one.
5
Act with the strongest control
An action for every underlying and root cause, ranked by the hierarchy of controls. If only administrative controls or PPE are planned for a hazard, write why nothing higher is practicable.
6
Check, record and share
Check each action on the floor, compare the counts before and after, answer the recordkeeping questions if you are a US employer, and share the lessons with areas that have the same hazard.

Three levels of cause

Immediate, underlying and root causes

From the UK HSE's investigation guide HSG245. Stopping at the immediate cause fixes one sequence; fixing the root causes prevents a whole family of incidents.

Level	What it is	In the example
Immediate	The most obvious reason it happened, for example the guard is missing or the person slipped	The hand reached the running transfer arm through a guard door with no interlock
Underlying	The less obvious system or organisational reason: the unsafe act or condition and what allowed it	Clearing jams with the machine running was normal; a worn guide caused jams several times a shift
Root	The failing all the others grow from, generally management, planning or organisation	The guide was not on the PM list; jams were never raised as a safety problem and the risk assessment missed jam clearing

Immediate
What it is
The most obvious reason it happened, for example the guard is missing or the person slipped
In the example
The hand reached the running transfer arm through a guard door with no interlock
Underlying
What it is
The less obvious system or organisational reason: the unsafe act or condition and what allowed it
In the example
Clearing jams with the machine running was normal; a worn guide caused jams several times a shift
Root
What it is
The failing all the others grow from, generally management, planning or organisation
In the example
The guide was not on the PM list; jams were never raised as a safety problem and the risk assessment missed jam clearing

A filled-in example

Illustrative, not a benchmark

An example (illustrative): an operator cuts two fingers clearing a jammed carton from a case erector with the machine running. The area manager, a safety lead and an operator from another shift investigate. The PDF page 3 and the Excel Example sheets hold the same report.

The example's causes at three levels, and the result

Immediate cause
The hand reached the running arm through a guard door with no interlock
Underlying causes
Clearing jams with the machine running was normal practice; a guide worn 3 mm caused 112 jams in 6 weeks
Root causes
The guide was not on the PM list, and jams were never raised as a safety problem, so the risk assessment missed jam clearing

Jams a week on the case erector

Before: 18.7 (112 in 6 weeks)
After: 2.75 (11 in 4 weeks)

The chain ends at things the plant controls, not at the operator. Half of the six actions are engineering controls: an interlocked door, the same on the two other case erectors, and a new guide.

Facts: the third jam of the shift; the guard door opened and the machine kept running because the door had no interlock. Sutures at the clinic and 5 days restricted from using the left hand. Worst credible outcome: major (an amputation), likely to happen again, so a high level investigation.
Timeline: 11 events, each with a source (CCTV, the jam log, statements A and W1, photos, the worn guide itself), all facts. Two operators from other shifts confirmed jams were cleared with the machine running on every shift.
Causes: immediate, the hand reached the running arm through a door with no interlock; underlying, clearing jams running was normal practice, and a guide worn 3 mm caused jams several times a shift (112 in 6 weeks); root, the guide was not on the PM list, and jams were never raised as a safety problem, so the risk assessment missed jam clearing.
Actions: 6, all done and checked on the floor: an interlocked door and the same on the two other case erectors, and a new guide (engineering); the guide on the PM checklist, lockout for every jam with training, and jams logged and reviewed weekly with the risk assessment revised (administrative).
US recordkeeping screen: work-related, a new case, sutures (medical treatment beyond first aid) and restricted work, so it looks recordable and a DART case. No report to OSHA under 1904.39: no fatality, in-patient hospitalization, amputation or loss of an eye.

Jams fell from 112 in the 6 weeks before (18.7 a week) to 11 in the 4 weeks after the new guide (2.75 a week), 85% fewer. Half the actions are engineering controls or stronger. The interlock was tested on the floor 30 days after it was fitted, every closure check reads Yes after 38 days, and the lessons went to both other packing lines.

Common mistakes

Stopping at human error
"Operator did not follow the procedure" is where the questions start. OSHA's guide is blunt: an investigation focused on finding fault stops short of the root causes. Ask why it made sense at the time.
Judging depth by the injury
A close call with a fatal worst case deserves more than a cut that could never have been worse. Set the level from the worst credible outcome and the likelihood of it happening again.
Training and PPE as the fix
They sit at the bottom of the hierarchy of controls because they rely on people every time. Look first for a way to remove, substitute or guard the hazard.
Names and medical details in the report
The report gets shared; medical information should not. Use reference letters and keep the key, the clinic notes and any privacy case details with the confidential records.
Closing without checking
An action marked done is not an action that works. Check it on the floor and compare the counts before and after before you sign the report off.

Download the template

Free to use: print it, copy it and edit it for your team. Enter your name and work email once to download.

Run this template in LeanSuite

LeanSuite has templates for incident investigations, root cause analysis and safety alerts, and a serious hazard report can become a CAPA project with its own approval steps, root cause analysis and action plan, signed off at every step.

See it in a 45-minute demo

In the lean glossary

Free tools

Guides

Put it on the wall

FAQ