Quick answer: A workplace incident investigation should identify what happened, why it happened, what controls failed, and what must change. The goal is not blame - it is preventing the same event from happening again.
Last reviewed: March 2026 by the BlueSafe Technical Team. Reflects current Australian WHS laws and regulations.
An incident investigation is one of the fastest ways to find system failures before they become repeat harm. It also gives officers and managers evidence that they took the incident seriously and acted on the risk.
Why does incident investigation matter?
Investigation matters for three reasons. First, it helps the business protect people. Second, it shows the PCBU is taking reasonably practicable steps to manage risk. Third, it creates the record needed to prove what changed after the event.
When should you investigate?
| Incident type | Investigation depth | Typical outcome |
|---|---|---|
| Fatality or serious injury | Full investigation | Immediate controls, regulator involvement, management review |
| Notifiable incident | Full investigation | Preserve the scene and document all evidence |
| Near miss | Root cause review | Correct the hazard before harm occurs |
| Minor injury | Brief investigation | Simple corrective action and record keeping |
What is the incident investigation process?
- Make the area safe and provide first aid.
- Preserve the scene if the event is notifiable.
- Collect physical evidence, photos, documents, and witness statements.
- Build a timeline of events.
- Ask why each event happened, not just what happened.
- Identify immediate causes, contributing factors, and root causes.
- Record corrective actions and assign owners.
- Review whether the change was effective.
The best investigations avoid the trap of stopping at "worker did the wrong thing". If the answer is only "retrain the worker", the business has probably missed the real problem. Look for supervision gaps, poor planning, missing guards, unclear procedures, fatigue, or maintenance failures.
What evidence should you gather?
- photos of the scene and equipment
- SWMS, safe work procedures, permits, or checklists
- maintenance and inspection records
- training and induction records
- witness statements and supervisor notes
- site diaries, emails, and communications
How do you identify root causes?
Root cause analysis is usually a combination of the 5-Why method and a contributing factors review. Start with the event and keep asking why until you reach the underlying system issue. If a worker slipped, for example, the root cause may be an uncleaned spill, missing housekeeping checks, or a lack of task supervision, not simply the slip itself.
| Level | Example question | Example answer |
|---|---|---|
| Immediate cause | What directly happened? | The worker slipped on a wet floor |
| Contributing factor | What made it more likely? | No spill warning and poor cleaning frequency |
| System issue | Why did that happen? | Housekeeping checks were not assigned |
| Root cause | What failed in the system? | The housekeeping procedure was not implemented or monitored |
What should the report contain?
The report should be plain, factual, and complete. Include the event description, the people involved, the time and place, the evidence, the causes, the corrective actions, the person responsible, and the target date. Keep opinions separate from evidence.
What should happen after the investigation?
The business should update the relevant documents. That might include a SWMS, permit system, housekeeping procedure, maintenance schedule, induction, or training register. If the event exposed a broader issue, the business may also need a system review through a WHS management system.
How do you share the findings?
Share the findings with the workers who do the job. That is how the business closes the consultation loop and shows the investigation was used to improve the workplace. If the corrective action changes work methods, brief the team before they resume the task.
State and territory variations
Incident investigation overlaps with WHS and workers compensation processes, and regulators in every jurisdiction expect records to be kept.
| Jurisdiction | Regulator | Key notes |
|---|---|---|
| NSW | SafeWork NSW | Notifiable incidents must be preserved and reported |
| VIC | WorkSafe Victoria | OHS and workers compensation systems both matter |
| QLD | Workplace Health and Safety Queensland | Keep investigation records and evidence together |
| SA | SafeWork SA | Inspectors may request the report and follow-up actions |
| WA | WorkSafe Western Australia | Scene preservation is critical for serious events |
| TAS | WorkSafe Tasmania | Keep witness statements and corrective action records |
| ACT | WorkSafe ACT | Review whether the event exposed a broader system issue |
| NT | NT WorkSafe | Retain records for later audit or prosecution use |
Always verify current requirements with your state or territory regulator.
Related guides
- Reporting Notifiable Incidents Under WHS Law
- WHS Record Keeping Requirements
- The Right to Cease Unsafe Work
Frequently asked questions
Is workplace incident investigation a legal obligation?
Yes, as part of the duty to manage risks and prevent recurrence. Serious incidents and notifiable incidents require particularly careful investigation and record keeping.
What is root cause analysis in a workplace investigation?
It is a method for finding the underlying system failure, not just the immediate mistake. The goal is to identify what must change so the incident does not happen again.
Who should conduct a workplace incident investigation?
A competent person who understands the work should lead it, with support from supervisors, witnesses, and HSRs where appropriate. More serious events may need external support.
What must the investigation report include?
It should include the facts, evidence, causes, corrective actions, and review date. It should also be linked to the documents that were changed after the investigation.
Get the right documents for your business
Investigation findings usually lead to system updates, new controls, and better record keeping. BlueSafe templates can help turn the findings into a documented improvement plan.