OSHA Incident Investigation: A Step-by-Step Guide for EHS Managers

An employee is taken to the hospital at 11:00 AM on a Tuesday. By 11:00 AM on Wednesday, OSHA expects a phone call. Most EHS managers know that deadline exists. Far fewer know what happens in the hours between the incident and that call — and what documentation needs to survive the months after it.

A workplace incident report is not a formality you fill out once the dust settles. Under 29 CFR 1904 and 1910.119, it is the foundation of a regulatory record that OSHA can request at any time. Getting the investigation right the first time is the difference between a compliant record and a citation that compounds with each day it goes unfixed.

This guide walks through every stage of an OSHA-compliant incident investigation — from the moment the scene is secured to the point where corrective actions are verified and records are filed for the five-year retention window.

---

Why Incident Investigation Is a Regulatory Requirement, Not a Best Practice

OSHA does not simply encourage investigations — it mandates them through overlapping standards.

29 CFR Part 1904 (Recording and Reporting Occupational Injuries and Illnesses) requires covered employers to document work-related injuries and illnesses on OSHA Forms 300, 300A, and 301. The investigation that feeds those forms must be accurate and complete. Falsified or incomplete records are themselves a citable offense.

29 CFR 1910.119 (Process Safety Management of Highly Hazardous Chemicals) goes further. Section 1910.119(m) specifically requires employers covered by PSM to investigate every incident that resulted in — or could reasonably have resulted in — a catastrophic release of a covered chemical. This includes near-misses. The investigation report must be completed within 48 hours of the incident, retained for five years, and reviewed with all employees whose job tasks are relevant to the findings.

For facilities outside PSM scope, the general duty clause still applies. OSHA expects any serious incident to be investigated with enough rigor to identify root causes and prevent recurrence. An investigation that stops at "employee wasn't paying attention" will not satisfy an OSHA compliance officer reviewing your records.

---

Reporting Timelines: The Deadlines That Cannot Slip

Before the investigation is even underway, two hard deadlines govern your reporting obligation to OSHA directly.

Event	Reporting Window	Trigger Condition
Work-related fatality	8 hours	Death occurs within 30 days of the work-related incident
In-patient hospitalization	24 hours	Hospitalization occurs within 24 hours of the work-related incident
Amputation	24 hours	Amputation occurs within 24 hours of the work-related incident
Loss of an eye	24 hours	Loss of eye occurs within 24 hours of the work-related incident

Reports can be made by calling OSHA's 24-hour hotline (1-800-321-OSHA), contacting the nearest area office, or using OSHA's online reporting portal. You must provide the employer's name and address, the location and time of the incident, the type of incident, the number of employees affected, the name of the injured employee, a brief description of what happened, and a contact name and phone number.

Missing the 8-hour or 24-hour window is itself a citable violation. OSHA does not accept "we were still gathering facts" as a defense. Report what you know, then continue your investigation.

---

Step-by-Step OSHA Incident Investigation Process

Step 1: Secure and Preserve the Scene

The first task following an incident — after ensuring emergency medical response is activated — is preventing the scene from being disturbed. Equipment should not be restarted, materials should not be moved, and the work area should be restricted to the investigation team until documentation is complete.

Photograph and video the scene from multiple angles before anything is touched. Capture the position of equipment, any guarding that is in place or missing, spilled materials, tool placement, and any physical evidence that may speak to what happened. If the incident involved machinery, photograph the control panel settings and any relevant safety interlocks.

Assign one person to manage scene integrity. Document the time the scene was secured and who was present.

Step 2: Assemble the Investigation Team

An effective investigation team is cross-functional. It should include:

• The direct supervisor of the injured employee or affected area
• At least one frontline employee who works in the process area (not the injured person, but someone who understands the work)
• Maintenance or engineering, when equipment is involved
• The EHS manager or safety director
• For PSM-covered facilities: a technically qualified person with knowledge of the process

Under 1910.119(m), OSHA explicitly expects employee consultation in PSM investigations. The regulation states that employees in the process area "should be consulted, interviewed or made a member of the team." Their firsthand knowledge of work conditions and informal practices is often the most valuable input the investigation team has.

Assign a team lead, establish a timeline, and document who is participating before interviews begin.

Step 3: Gather Evidence and Conduct Interviews

Evidence collection falls into three categories:

Physical evidence — damaged equipment, PPE worn at the time of the incident, materials involved, environmental conditions (lighting, noise, temperature), and the configuration of the work area.

Documentary evidence — maintenance logs, training records, work orders, standard operating procedures, prior near-miss reports, equipment inspection records, and shift handoff notes.

Testimonial evidence — interviews with the injured employee (when possible), coworkers who witnessed the event, the supervisor, and anyone else with relevant knowledge.

Conduct interviews as soon as possible after the incident, while memories are fresh. Interview witnesses separately to avoid anchoring their recollections to someone else's account. Ask open-ended questions: "Walk me through what you were doing just before the incident" rather than "You were using the machine without the guard in place, weren't you?"

Document every interview with the date, time, interviewee name and role, and a verbatim or close-paraphrase record of the key statements. These notes become part of the investigation file.

Step 4: Determine Root Causes

Surface-level cause attribution — "the employee slipped" or "the guard was removed" — is not sufficient. OSHA's incident investigation guidance and the PSM standard both expect employers to identify underlying contributing factors: why the guard could be removed, why the hazard wasn't identified in a prior inspection, why no procedure addressed the specific task being performed.

Two methods work well for most workplace incidents:

5 Whys — Start with the immediate cause and ask "why" iteratively until you reach a systemic or organizational factor. A laceration from an unguarded blade may trace back through five steps to a preventive maintenance backlog caused by inadequate staffing. That last answer is the actionable root cause.

Fishbone (Ishikawa) diagram — Useful when multiple contributing factors exist across different categories (People, Equipment, Environment, Process, Management). The diagram forces a structured review of all potential causes before conclusions are drawn.

Document the full causal chain, not just the endpoint. An OSHA compliance officer reviewing your investigation report will look for evidence that the investigation was thorough, not that it confirmed a predetermined conclusion.

Avoid listing "human error" or "inattention" as a root cause. These describe what happened, not why. If a worker made a critical error, the root cause is the condition that made that error possible — inadequate training, unclear procedures, excessive time pressure, poor equipment design.

Step 5: Develop and Assign Corrective Actions

Corrective actions must be matched to root causes, not symptoms. A corrective action that only addresses the surface condition (reinstalling the guard) without addressing the system failure (why the guard could be removed during normal production) will produce the same incident again.

For each identified root cause, document:

• The specific corrective action required
• The person responsible (by name and title, not department)
• The target completion date
• The verification method (who will confirm completion, and how)

Prioritize by risk level. Immediate hazards require immediate interim controls — physical barriers, task suspension, or administrative controls — until permanent fixes are in place. Document interim controls separately and track them to closure.

For PSM-covered facilities, corrective action recommendations from the investigation report must be resolved and the resolution documented. This is a hard regulatory requirement, not optional follow-up.

Step 6: Write the Formal Investigation Report

The investigation report is the document that survives OSHA audits and litigation. It must be factual, specific, and free of hedging language that obscures findings.

A compliant investigation report includes:

• Date and time of the incident
• Date the investigation began and the names of all team members
• Description of the incident (what happened, where, who was involved)
• Evidence collected (photographs, documents, interview summaries)
• Timeline of events leading to the incident
• Root causes identified, with supporting evidence for each
• Corrective actions, responsible parties, and target dates
• Review of prior similar incidents or near-misses

For PSM-covered incidents, the 1910.119(m) report must also specify the factors that contributed to the incident and any recommendations resulting from the investigation.

Under PSM, this report must be completed within 48 hours. For other incident types, best practice is to complete the full report within five business days, while evidence is still intact and memories are still reliable.

Step 7: File Records and Track Corrective Actions to Closure

OSHA Form 301 (Injury and Illness Incident Report) must be completed within seven calendar days of learning of the recordable incident. This form captures the detailed facts of the incident and feeds into the 300 Log.

OSHA Form 300 (Log of Work-Related Injuries and Illnesses) must be updated with the incident. Each entry requires a unique case number, accurate day-count data, and the correct outcome classification.

OSHA Form 300A (Annual Summary) must be completed, certified by a company executive, and posted from February 1 through April 30 of the following year. Establishments meeting certain size and industry thresholds must submit data electronically through OSHA's Injury Tracking Application by March 2.

All records — Forms 300, 300A, 301, and the full investigation file — must be retained for five years from the end of the calendar year they cover.

Track every corrective action in a formal corrective action register. Close no item without documented verification. Unclosed corrective actions that remain open at the time of an OSHA inspection are evidence of a systemic failure — and they compound any underlying citation.

---

Generate Countermeasures with AI

Based on what you've learned, try our AI-powered countermeasure generator. Enter an incident and the AI will suggest both immediate and permanent countermeasures.

OSHA Penalty Structure: What Is at Stake

Understanding the financial exposure tied to investigation failures is part of making the business case for a rigorous process. The following table reflects current maximum penalty amounts, effective January 15, 2025.

Violation Type	Maximum Penalty	Notes
Other-than-Serious	$16,550 per violation	Minor hazards with low injury probability
Serious	$16,550 per violation	Hazards with substantial probability of serious injury or death
Repeat	$165,514 per violation	Same or substantially similar violation within five years
Willful	$165,514 per violation	Minimum $11,823 per violation
Failure to Abate	$16,550 per day	Per day past the abatement deadline
Failure to Report (fatality, hospitalization, amputation, eye loss)	Up to $16,550 per violation	Also eliminates eligibility for standard penalty reductions

A single workplace fatality that triggers an OSHA investigation can produce multiple citations across several standards. A willful violation — where OSHA determines the employer knew about a hazard and chose not to correct it — carries a minimum penalty and is not eligible for the standard reductions available to employers with clean inspection histories.

Employers with no prior serious violations in the past five years can qualify for a 20% reduction on serious violations. That reduction disappears the moment there is a failure-to-report violation on the record.

---

Audit Preparation Checklist

Use this checklist before an OSHA inspection or internal compliance audit. Each item maps directly to a citable standard.

Reporting Obligations

• Fatality reporting procedure is documented and EHS staff know the 8-hour window
• Hospitalization, amputation, and eye loss reporting procedure covers the 24-hour window
• OSHA hotline number and area office contact are posted and accessible to all supervisors
• A log of all reports made to OSHA in the past five years is maintained

Recordkeeping Forms

• OSHA Form 300 Log is current, with all recordable incidents entered within seven calendar days
• OSHA Form 301 is completed for each recordable incident within seven calendar days
• OSHA Form 300A is signed by a company executive and posted February 1 through April 30 annually
• Electronic submission to OSHA ITA has been completed for applicable establishments
• All records are retained and retrievable for a rolling five-year window
• Privacy case procedures are followed for applicable injuries and illnesses

Investigation Process

• Written incident investigation procedure exists and is current
• All supervisors have been trained on investigation initiation steps
• Scene preservation steps are documented in the procedure
• Investigation team composition requirements are defined
• Root cause analysis method is specified (5 Whys, fishbone, or equivalent)
• Corrective action tracking system is in place with owner, date, and verification fields
• Investigation reports are completed within required timeframes (48 hours for PSM, 5 business days for general industry best practice)

PSM-Specific (29 CFR 1910.119) — if applicable

• Near-miss investigation procedure covers incidents that could have caused a catastrophic release
• PSM investigation reports specify contributing factors and recommendations
• Recommendations from prior PSM investigations are resolved and documented
• PSM investigation findings have been shared with employees in affected process areas
• PSM investigation records are retained for five years

General Compliance

• Prior OSHA inspection citations have been abated and abatement documented
• No open corrective actions are past their target completion dates
• Prior investigation findings have been reviewed for recurrence

---

Common Investigation Failures That Create Regulatory Exposure

Stopping the causal chain too early. The most common investigation failure is accepting a proximate cause as a root cause. If the investigation report says "employee failed to follow lockout/tagout procedure," OSHA will ask why — and if the answer is "we didn't check," the investigation itself becomes evidence of a systemic failure.

Delayed or incomplete Form 301 completion. The seven-day completion requirement runs from the day the employer learns of the recordable incident, not from the date of the incident. Supervisors who fail to report injuries internally create a gap that appears on the 300 Log as a late entry — which draws scrutiny during audits.

No verification of corrective action closure. An investigation report with corrective actions that have never been signed off is worse than no report at all during an OSHA inspection. It documents that the employer knew about the hazard and did not confirm it was fixed.

Missing near-miss investigations. OSHA's PSM standard explicitly requires near-miss investigation when the event could have resulted in a catastrophic release. For general industry, near-miss investigation is a best practice that OSHA inspectors look for as evidence of a proactive safety culture — and its absence can influence how citations are classified.

---

If your current investigation workflow leaves corrective action tracking and root cause documentation in shared drives and email threads, the risk is not just regulatory exposure — it is the next preventable incident. WhyTrace Plus structures the full investigation process from root cause analysis through corrective action closure, with the documentation trail that compliance audits require.

Learn how WhyTrace Plus supports OSHA-compliant incident investigations

---

Related Resources

Resource	Description	Best For
5 Whys Analysis: Complete Guide	How to apply the 5 Whys technique with documented examples	Teams building investigation skills
How to Do a 5 Whys Analysis	Step-by-step walkthrough for conducting a structured 5 Whys session	New EHS investigators
RCA Software Comparison	Side-by-side review of root cause analysis tools for EHS teams	Evaluating digital investigation platforms
AI-Assisted Root Cause Analysis	How AI tools support faster and more consistent RCA	Teams with high incident volume
Free Investigation Template	AI-guided analysis with automatic documentation	Running your first structured investigation