Safety incident investigation process flowchart (scene to controls)
Safety incident investigation process flowchart: preserve the scene, classify potential severity, notify the regulator, gather evidence, interview witnesses, reach the organisational causes, verify the controls.
What the safety incident investigation process flowchart (scene to controls) process is
An investigation starts where the report stops. The event has been raised and recorded by the route at /templates/workplace-incident-reporting-process, somebody has been told inside the window, and the organisation now has to find out what actually happened. Investigations fail in four familiar ways, and none of them is for want of a form. The scene is tidied within the hour because the line has to restart, so the guard position, the damaged part and the state of the isolation are gone before anyone arrives with a camera. Witnesses spend the afternoon together in the mess room, and by the time they are interviewed there is one agreed story rather than five accounts. The event is classified on the injury that happened rather than the injury that nearly happened, so something that could have killed somebody is logged as a first-aid case and investigated by nobody. And the analysis stops at the person: the report names an operator who took a shortcut, the action is a toolbox talk and a reminder to follow the procedure, and eleven months later somebody takes the same shortcut, because the shortcut was still faster and nothing about the job changed.
The page this one continues from is /templates/workplace-incident-reporting-process: first aid, telling the manager inside the window, the accident book, the statutory report, and the decision about what level of investigation the event earns. It hands the serious ones onward, and this page is what those serious ones get. The first minutes are a different process again, drawn at /templates/emergency-response-flowchart: is it safe to approach, evacuate or shelter, the roll call, the all-clear. The analysis technique itself is generic and lives at /templates/root-cause-analysis-process, with the choice between 5 Whys, a fault tree and a fishbone worked through at /templates/root-cause-analysis-flowchart; this chart assumes you already have a method and shows where the safety-specific evidence enters it. If the outcome has to become a controlled quality record with its own effectiveness review and register, that is /templates/capa-process. And /templates/incident-management-process borrows the word for something else entirely: an IT service desk getting a system running again, where nothing is preserved, nobody is interviewed and no authority has to be told.
Four decisions the chart draws are usually left implicit in written procedures. "Potential severity high?" is asked before the team is appointed rather than after the report is written, so the size of the investigation follows what could have happened rather than what did, and the near miss gets the lead that the fatality it nearly was would have got. "Has the scene been released?" is a real branch with an ending behind it: after a serious event the inspector or the police hold the scene, and the Held by the authorities route leaves this procedure altogether at "Regulator's investigation takes primacy", where you cooperate and preserve what you hold rather than running your own evidence gathering over the top of theirs. "Causes reach organisational factors?" is a gate rather than a formality: its backward branch, labelled Stops at the person, sends the analysis round again to ask what made that error likely, which is the difference between a just-culture investigation and a blame exercise with a fishbone attached. And "Can the hazard be eliminated?" has to be answered and refused explicitly before anything in the action list may be personal protective equipment. The lanes are unbalanced on purpose: the site supervisor appears only at the two ends, securing the scene and then owning the actions, because the controls have to survive the person who runs the job.
What this flowchart covers
In this template
- Four swimlanes (Site supervisor, HSE adviser, Investigation lead and Site leadership) laid across six phases: Secure the scene, Classify and notify, Gather evidence, Analyse causes, Choose controls, and Act and verify.
- A scene phase before any analysis: "Care for the injured person" first, then "Make the scene safe and preserve it", so isolations, guard positions and damaged parts are photographed before the area is cleaned and the line restarted.
- "Classify actual and potential severity" feeding "Reportable to the regulator?", whose Reportable branch runs "Notify the regulator within the clock" and then "Has the scene been released?": the primacy question most procedures never draw.
- "Potential severity high?" answered by site leadership before the team exists: High leads to "Appoint an independent lead and team", and the Lower, line-led branch sends the event straight into evidence gathering without one.
- "Secure physical and paper evidence" and "Interview witnesses separately" in the investigation lead's lane, with an "Evidence complete enough?" decision whose Gaps remain branch loops back to collection before "Build the sequence of events" is attempted.
- Three endings rather than one: "Regulator's investigation takes primacy" when the authorities hold the scene, "Control refused, risk escalated" when leadership will not fund the control, and "Closed and lessons shared across sites" only once "Controls effective?" has been answered yes.
When to use this template
- You are writing or revising an incident investigation procedure and need one page showing who preserves the scene, who investigates, who approves the controls and who verifies them.
- Your investigation reports keep naming a person in the cause and a briefing in the action, and you want the analysis pushed one level further before the report may be written.
- A near miss that could have killed somebody was closed with a line in the register because nobody was hurt, and you want potential severity rather than actual outcome to set the depth of the investigation.
- Actions from previous investigations are all marked complete, and yet the job is still done the same way, because nobody went back to the floor to see whether the control was fitted, used or quietly removed.
- An auditor or an inspector has asked to see your last three investigations, and you want the route that produced them (who led, what evidence was taken, how the causes were determined and how the actions were checked) visible on one page.
How it works
Rename the lanes to your own site
Replace Site supervisor, HSE adviser, Investigation lead and Site leadership with the roles that genuinely exist where you operate. Where there is no safety professional, put whoever actually holds the duty into that lane instead of deleting it: the statutory clocks in it still have to be watched by somebody. Add a contractor lane if your incidents routinely involve one, because the permit, the induction record and the equipment history you will need belong to them and not to you. If two of these lanes are the same person on a night shift, say so on the chart rather than pretending otherwise.
Write your own reportability criteria onto the decision
"Reportable to the regulator?" is inert until you attach the categories and deadlines that bind you. Replace the generic wording with your jurisdiction's list — in Great Britain that is RIDDOR 2013 and its specified injuries, over-seven-day injuries, occupational diseases and dangerous occurrences; in the United States it is the OSHA eight-hour and twenty-four-hour rules. Name the person who makes the call and a deputy for holidays and night shifts, and record the time the notification was made, because the first question after a late report is who knew and when.
Define potential severity and what each level triggers
"Potential severity high?" only scales anything if the words behind it are written down. Most sites use a small matrix of realistic worst outcome against how likely that outcome was, and set the threshold where a plausible fatality or life-changing injury falls. Then state what each level actually buys: who leads, how many people, how long they get, and who receives the report. Without that the level is set by whoever is free that week, and the Lower, line-led branch quietly becomes the default. Say on that branch who holds the investigation lead's role, so the lane still has an owner.
List the evidence and its shelf life
Turn "Secure physical and paper evidence" into a named checklist rather than a heading. CCTV and machine logs overwrite on a fixed cycle, so write the cycle down and name who can freeze them at three in the morning, because that is when the request will come. Then list the paper you will want and rarely have: the permit, the risk assessment for that task, the shift roster, the maintenance history, training and competence records, and the last three versions of the procedure people were actually working to. Say who holds each one.
Turn the hierarchy of controls into a written test
Make "Can the hazard be eliminated?" a question the team has to answer on the record, and require a written reason with a name against it before the answer is allowed to drop a level. Test each proposed action the same way: would it still work on a night shift, with a new starter, under time pressure, with the usual person off sick? Ask what it costs the operator in time, because a control that makes the job slower is a control somebody will defeat. And put a review date against the level you refused, so it can be reopened when the money exists.
Fix the verification date, then walk it through and publish
Set the date for "Verify the controls in the workplace" at the moment the action is assigned, not when the action is closed, and put it in the same diary as the audit programme so it survives a change of safety adviser. Decide what evidence the verifier has to bring back with them. Then walk the finished chart through with a supervisor, the HSE adviser, somebody who has been interviewed as a witness and whoever signs the reports, correct it to what they really do, and publish that revision while keeping the earlier ones so anyone opening it later knows which version they are reading.
Frequently asked questions
What are the steps in a safety incident investigation process?
Care for the injured person, make the scene safe and preserve it, classify the actual and the potential severity, decide whether the event is reportable and notify the regulator within the statutory deadline, scale the investigation team to the potential severity, gather physical and documentary evidence before it decays, interview witnesses separately and early, build a timeline of what actually happened, analyse the causes with a systemic method until they reach organisational factors, choose controls by working down the hierarchy from elimination, get them approved and funded, assign actions with owners and dates, verify in the workplace that the controls are working, then approve the report, close it and share the lessons. Methods label these differently — ICAM separates absent or failed defences, individual and team actions, task and environmental conditions and organisational factors — but the spine is the same. The step organisations skip is verification.
How is this different from the workplace incident reporting process?
They are consecutive, not alternative. The workplace incident reporting process covers what happens to an event as an event: first aid, telling the line manager inside your internal window, the accident book entry, the statutory report, and a decision about what level of investigation it earns. It ends by handing the serious ones on. This page picks up at exactly that point, and it is far deeper in the middle: scene preservation as a step of its own, evidence ordered by how fast it perishes, witnesses interviewed separately, a timeline, a cause analysis that has to reach organisational factors before it may proceed, and controls selected against the hierarchy. If you are documenting how an incident gets reported and recorded, use the reporting template. If you are documenting how it gets investigated, use this one. Most organisations need both, and the join between them is the level-of-investigation decision.
How do you stop an investigation ending at operator error?
Treat operator error as the start of the analysis rather than the end of it. The quickest check is the substitution test: would a competent colleague, in the same conditions, with the same information and under the same pressure, probably have done the same thing? If the honest answer is yes, the person is not the cause. It also helps to name the kind of error — a slip or a lapse in a routine action, a mistake in judgement, or a deliberate departure from the procedure — because each has a different set of conditions behind it, and a departure that everybody on the shift makes is evidence about the procedure rather than about the individual. Then ask what would have to change for the same action to stop being the easiest one to take. This chart enforces the discipline structurally: the decision "Causes reach organisational factors?" has a backward branch labelled Stops at the person that sends the analysis round again instead of letting the report be written.
What is the hierarchy of controls and how does it change the actions?
It is the order in which control measures are considered: eliminate the hazard, substitute something less hazardous, engineer a control such as a guard, an interlock or an extraction system, then administrative controls like procedures, permits and training, and personal protective equipment last. The order is not a preference. Elimination and substitution remove the exposure whatever anybody does next, while administrative controls and PPE work only while people behave exactly as intended, every shift, including the bad ones. It changes the actions because it forces a stated reason for each level you skip. A corrective action list made entirely of retraining, briefings and new signage is a list of the two weakest controls available, and it is the single most reliable predictor that the same incident will happen again.
How do you verify that a safety control is actually working?
Not by looking at whether the action was closed. Verification means going back to the workplace after the control has been in place long enough for ordinary work to have tested it, and answering three separate questions: does the control exist as it was described, does it do what it was meant to do, and are people using it rather than working around it? The third catches most of the failures, because a control that costs the operator time gets defeated quietly and nobody reports it. Look as well for the hazard the control introduced — a guard that pushes maintenance into a worse position, an interlock that invites a bypass, a permit that adds an hour to a job people already start late. Give the check to somebody other than the person who owned the action, and let an observation or a measurement carry more weight than a completed field in a tracker. ISO 45001 clause 10.2 expects the effectiveness of corrective action to be evaluated, which is why this chart loops "Controls effective?" back to control selection instead of straight to closure.
Where this process fits
In most operations this process follows Workplace incident reporting process flowchart (health and safety) and hands off to CAPA process flowchart (corrective and preventive action).
It is one step in Safety incidents.
Step 1: Near miss reporting process flowchart (close calls and high potential)
Step 2: Workplace incident reporting process flowchart (health and safety)
Workplace incident reporting process flowchart for accidents and near misses: first aid, reporting window, statutory report, investigation, corrective actions.
Step 3: Safety incident investigation process flowchart (scene to controls) You are here
Safety incident investigation process flowchart: preserve the scene, classify potential severity, notify the regulator, gather evidence, interview witnesses, reach the organisational causes, verify the controls.