An incident investigation is what happens after the first report: somebody works out why it happened and what has to change. This form covers the whole of it — a timeline of events, a logged chain of evidence, every person involved with their injuries recorded separately, a root cause analysis, and the corrective actions with owners and dates against them.
This is not the same document as the incident report
The first report is written within hours, by whoever was there, and its job is to capture facts before memory reorders them. This one is written days later, by somebody who was probably not present, and its job is to explain.
Keep them separate. An investigation that overwrites the original account destroys the most valuable thing about it — that it was written before anybody had a theory. If you filed an incident report, attach it here and investigate alongside it rather than rewriting it.
Root cause is not the last thing that went wrong
The most common failure in this document is stopping at the immediate cause. "The operator did not clip on" is the last event in the chain, not its cause. Ask why it was possible, why it was normal, and why nobody noticed.
The usual method is to ask "why?" repeatedly — five times is the conventional number, though the real rule is to keep going until the answer stops being about a person and starts being about a system. If your root cause is somebody's name, you have not finished.
Why the evidence log has a chain of custody
Photographs get deleted, damaged parts get thrown away, and CCTV overwrites itself — often within a week. The evidence section asks who is holding each item because that is the question that turns out to matter months later, when somebody asks to see it.
Log the thing and the holder on the day you find it. An investigation that cites a photograph nobody can produce is weaker than one that never mentioned it.
Honest gaps beat confident guesses
You will not resolve everything. Where you cannot, say so and say what you would need — a statement you could not obtain, a part that had already been scrapped, a witness who has left the company.
A report with a named gap in it is stronger than one that quietly smooths over the same gap, because the smoothing is exactly what gets found and picked apart later. There is a question in the root cause section specifically for this, and using it is not a failure.
Common questions
Who should carry out an incident investigation?
Somebody competent who was not directly involved. Independence matters more than seniority — a supervisor investigating an incident on their own crew is being asked to examine their own decisions. For serious incidents, most organisations use a small team rather than an individual.
How soon after the incident should this be done?
Start within 24 to 48 hours. Physical evidence degrades, CCTV overwrites, and people reconstruct rather than recall after about a day. It is normal for the report itself to take longer to finish — the urgency is in the collection, not the writing.
Do I need to investigate a near miss?
Yes, and they are often the best investigations you will do. A near miss and a serious injury usually share a cause and differ only in luck, and the near miss comes without an injured person, a regulator, or anybody's defensiveness.
What if the root cause cannot be identified?
Record that it could not, and record why. There is a question for exactly that, plus one asking how likely the incident is to recur — which is the thing that actually matters if you cannot explain it. An unexplained incident with a high likelihood of recurrence is an open risk, and naming it as one is the useful outcome.
Should the investigation assign blame?
No. Disciplinary matters are a separate process with different rules, and mixing them into an investigation reliably destroys the quality of the evidence — people stop telling you things. Record what people did and why it made sense to them at the time.