What should an incident investigation report include?

The facts (what happened, where, when and to whom), the immediate actions, the evidence and timeline, the root causes and contributing factors, the corrective actions with owners and dates, and sign-off once the actions are checked.

How soon should an incident be investigated?

Start the same day once the area is safe. Evidence and memories change quickly, and a fast start shows people the incident is taken seriously.

What is the difference between a root cause and a contributing factor?

A root cause is one that, if removed, stops the incident happening again. A contributing factor made it more likely or worse. Most incidents have more than one of each, and both are worth fixing.

Who should investigate an incident?

Usually the supervisor or area manager with a safety lead, and someone who does the job. For serious incidents add people from outside the area so the investigation is not marking its own work.

Do I have to report the incident outside the company?

Some incidents must be reported to a regulator, often within a set time. The rules depend on where you are and how serious the incident is, so check the ones that apply to your site. The form has a field to record who was told and when.

Free template

Incident investigation report template

An incident investigation report records an injury, illness, damage or other incident and the work done to find out why it happened and stop it happening again. A good investigation looks for causes, not someone to blame. Page 1 of this template covers the facts: the type and outcome, the people involved, the immediate actions and what happened, in order. Page 2 lists the evidence collected, a timeline and space for a sketch of the scene and witness notes. Page 3 is the analysis: a 5 Whys, a checklist of contributing factors (people, equipment, materials, environment, method and management), the root causes, corrective actions by type of control with owners and due dates, and sign-off.

Free to use: print it, copy it and edit it for your team. Enter your name and work email once to download.

Page 1 of the incident investigation report: fields for the report number, date, time, area and investigator, tick boxes for the type and outcome, a table of people involved, a section for immediate actions and a ruled box for what happened. — Type and outcomePeople involvedImmediate actionsEvidence and timeline5 Whys and contributing factorsCorrective actions by control typeSign-off

When to use it

When to use an incident investigation report

After any injury, including first aid cases, so the causes are found while they are small.
After property or equipment damage, a fire, a spill or a vehicle incident.
After a serious near miss, when the potential outcome calls for a full investigation.
Where your process or customer requires a written investigation for each incident.

How to fill it in

1
Make it safe first
Care for the injured, make the area safe and keep the scene as it was where you can.
2
Record the facts
Type, outcome, people, what was done right away and what happened, in order, without opinions.
3
Collect the evidence
Photos, a sketch, statements, the equipment, training and maintenance records. Note who holds each item.
4
Build the timeline
What led up to it, what happened and what followed, from the statements and records.
5
Find the root causes
Ask why until you reach causes you can fix, and check each contributing factor. There is usually more than one.
6
Act, check and share
Give each action an owner and a date, choose the strongest control, check it works on the floor and share the lessons with other areas.

A filled-in example

Illustrative, not a benchmark

An example: a hand injury on a packing line, investigated by the area manager and a safety lead (illustrative).

What happened: an operator cut two fingers clearing a jammed carton from the case erector with the machine still running.
Evidence: photos of the guard, the lockout log, the operator's and a colleague's statements, and six weeks of jam records.
5 Whys: the guard was open because jams happened several times a shift, the jams came from a worn carton guide, and the guide was not on the PM list.
Contributing factors: equipment (worn guide, guard with no interlock), method (clearing jams without lockout was normal) and management (the jams were known but not logged as a problem).
Actions: an interlocked guard (engineering), the carton guide added to the PM checklist, and lockout for every jam (administrative), each with an owner and a date.

Jams fell to a few a week once the guide was replaced, the interlock was checked on the floor a month later, and the same fix went to the two other case erectors in the plant.

Common mistakes

Stopping at human error
"Operator did not follow the procedure" is where the questions start. Ask why it made sense at the time.
Waiting to start
Memories fade and scenes get cleaned up. Start the same day.
One cause only
Most incidents have several causes. Check each contributing factor.
Retraining as the fix
Training is a weak control on its own. Look for a way to remove or guard the hazard.
Closing without checking
Check the actions in the area before you sign the report off.

Download the template

Free to use: print it, copy it and edit it for your team. Enter your name and work email once to download.

Run this template in LeanSuite

LeanSuite has templates for incident investigations, root cause analysis and safety alerts, and a serious hazard report can become a CAPA project with its own approval steps, root cause analysis and action plan, signed off at every step.

In the lean glossary

Free tools

All free lean calculators

Guides

FAQ