Get FREE 12-month access to the AI-Powered Knowledge Base worth $450
with your ISO 9001 toolkit purchase
Limited-time offer – ends June 27, 2024

How to perform incident investigation according to ISO 45001

No management system can prevent all incidents from happening, and there will always be some mishaps in the workplace – all we can do is analyze them, find out the cause, and try our best to prevent them from recurring. ISO 45001 can help you create an effective occupational health and safety management system and reduce the number of incidents to a minimum.

What is an incident related to occupational health and safety, and what should be done in case of an incident? ISO 45001:2018 describes an incident as a work-related event in which an injury or ill health (regardless of severity) or fatality occurred, or could have occurred. This means that, besides events causing injuries or fatality,  the events where no injury, ill health, or fatality occur are also referred to as incidents, and are called a “near-miss,” “near-hit,” “close call,” or “dangerous occurrence.”

What has happened?

The first thing that needs to be done is to determine what really happened, who participated, and in which process the incident occurred. A detailed description of the incident will be a good base for further incident investigation; it will also help you determine whether the organization’s employees are capable of conducting the incident investigation. In some cases, the organization won’t have the authority to investigate the incident and some of the legal authorities must be involved. For example, in the case of fire or an incident with fatal consequences, the fire department and police will definitely be involved in investigation of the incident. While the objective of a police investigation is to determine who is responsible for the incident, your investigation will have the objective to determine where your OHSMS (Occupational Health & Safety Management System) has failed and what needs to be done to prevent recurrence.

Analyzing the incident

Before starting the incident investigation, you need to determine what you expect out of the incident investigation, i.e., the objectives of the investigation. Incident investigation should result with findings that will determine which part of your OHSMS has failed, what corrective actions need to be taken, is there any room for preventive actions, and what needs to be done to improve your occupational health and safety management system.

While keeping in mind the objectives of incident investigation, you should determine the possible causes of the incident, taking into account all causes that could make an incident. Once you determine the possible causes, you need to compare them to each other in order to determine which one is the most probable. When gathering evidence and determining the most probable cause of an incident, you should try to prevent under-reporting, and when interviewing the people involved in the incident, try to ask open questions and assure them that identifying the root cause of the incident is in the interest of all employees.

A root cause is an initiating cause of either a condition or a sequence of events that leads to an incident. If the source or the root is not supported by the facts, then it won’t be considered anymore. If the source or the root is supported by the facts, it becomes a possible cause. All possible causes need to be tested for their confirmation in order to determine the real cause of the incident. The real cause (root or source) is the source of the event or occasions that directly triggered the incident. If more than one cause has been identified, then each must be analyzed in order to determine which one is the primary real cause.

When conducting the investigation of the real cause, you need to apply the following steps:

  • physical researching
  • observation of the process in order to determine whether the situation is repeated – trying to determine the mechanism of the activation of the incident
  • repetition and assessment of what is happening in a controlled environment
  • interviewing witnesses who might have seen what triggered the incident
  • consulting with experts who know the processes well and have insight into them

All the findings of the incident investigation must be contained in an incident investigation report that will be delivered to the management. Once the investigation report is created, the management can determine the corrective and preventive actions (for more information, see Seven steps for corrective and preventive actions in the OH&S management system needed for preventing the recurrence of the incident.


As in any other case when corrective actions are taken, there needs to be a follow-up to determine whether the corrective actions have resulted in the removal of the cause of the incident. If the corrective actions haven’t resulted in the desired results, then new corrective actions need to be taken so you make sure that the incident won’t happen again.

Occupational health and safety incidents are always unfortunate events, especially if they cause injuries or fatal consequences. Unfortunately, we can’t prevent every incident and they will happen, but we must do everything in our power to prevent them and improve the occupational health and safety, and this is only possible if we thoroughly and minutely investigate every incident and provide valid information for initiating corrective actions and improvement of the system.

To learn more about incident investigation and other requirements of ISO 45001, download this free white paper: Clause-by-clause explanation of ISO 45001:2018

Advisera Strahinja Stojanovic
Strahinja Stojanovic

Strahinja Stojanovic is certified as a lead auditor for the ISO 13485, ISO 9001, ISO 14001, and OHSAS 18001 standards by RABQSA. He participated in the implementation of these standards in more than 100 SMEs, through the creation of documentation and performing in-house training for maintaining management systems, internal audits, and management reviews.