Incident Investigation Checklist: 25 Steps from Scene to Report
The hours right after a serious incident decide whether your investigation finds a usable cause or just produces paperwork. Evidence disappears, scenes get cleaned up, witnesses go home and start rationalizing what they saw, and the regulatory clock starts ticking the moment the injury happens. If you are working from memory and a half-remembered process, you will miss things you cannot recover later.
This checklist gives you 25 concrete steps grouped into four phases — scene preservation, witness interviews, evidence collection, and the report — so the next time you respond to an incident, you work from a sequence rather than from adrenaline.
Want to run this without losing the thread? WhyTrace Plus walks an investigation from scene to root cause to corrective action in one record. Free to start.
Phase 1: Scene Preservation Checklist (Steps 1-6)
Scene preservation means securing the incident location in its post-incident state so physical evidence, positions, and conditions can be examined before they are disturbed. The window is short. Once normal operations resume, you cannot recreate where a guard was, how a load was stacked, or which valve was open.
Your first responsibility is people, not evidence. Care for the injured and remove anyone from ongoing danger before you think about photographs. After that, the priority shifts to capturing the scene exactly as the incident left it.
OSHA's own accident investigation guidance is direct on this point: evidence at the scene should be left untouched until it has been examined, except to the extent necessary to protect employees and the public. Where serious personal injury is involved and litigation is reasonably anticipated, the employer has a legal duty to preserve evidence from the scene.
| Step | Action | Why it matters |
|---|---|---|
| 1 | Render aid and remove people from ongoing hazards | Life safety comes before any evidence |
| 2 | Stop the process / lock out affected equipment | Prevents a second incident and freezes machine state |
| 3 | Cordon off the scene with barrier tape or barriers | Stops well-meaning cleanup that destroys evidence |
| 4 | Photograph and video the scene before anything moves | The scene is unrepeatable once operations resume |
| 5 | Note transient conditions (lighting, noise, weather, temperature) | These vanish within minutes and rarely make it into reports |
| 6 | Log who was present and who entered the scene after | Establishes the witness pool and chain of access |
A practical note on step 4: take wide context shots first, then mid-range, then close-ups, and include a scale reference (a ruler or a known object) in detail photos. Capture the obvious and the seemingly irrelevant. You will not know which detail mattered until the analysis is further along, and by then the scene is gone.
Know your reporting clock
Scene work and regulatory reporting run in parallel, not in sequence. Under OSHA 29 CFR 1904.39, you must report a work-related fatality within 8 hours, and an in-patient hospitalization, amputation, or loss of an eye within 24 hours. As of 2026 these timelines are in effect and apply regardless of how your internal investigation is progressing. Assign the reporting task to a named person immediately so it does not get lost while the team focuses on the scene.
Phase 2: Witness Interview Checklist (Steps 7-13)
A witness interview is a structured conversation to capture what a person saw, heard, and did — before memory decays and before social pressure reshapes the account. Memory degrades fast, and it does not degrade randomly: people unconsciously fill gaps with what they expect should have happened.
Interview witnesses as soon as practical, individually, and away from the group. Group debriefs feel efficient and quietly corrupt every account in the room, because the loudest or most senior voice anchors what everyone else "remembers."
The single most important framing move you can make is to separate fact-finding from blame. If a witness believes the interview is hunting for someone to punish, you get defensiveness and a narrowed story. If they believe it is hunting for the conditions that allowed the incident, you get detail. (See Human Error and Systems Thinking for why the blame frame quietly destroys investigation quality.)
| Step | Action | Watch out for |
|---|---|---|
| 7 | Interview each witness individually, as soon as practical | Group sessions contaminate memory |
| 8 | Open by stating the purpose: fact-finding, not blame | Defensiveness narrows the account |
| 9 | Let the witness narrate freely before you ask questions | Early interruptions reshape the story |
| 10 | Use open questions ("What did you see next?") | Leading questions plant answers |
| 11 | Ask about conditions, not just actions | Conditions are the root-cause material |
| 12 | Read back your notes and confirm accuracy | Catches misunderstandings while fixable |
| 13 | Record contact details for follow-up questions | Analysis raises questions you cannot foresee now |
Keep your questions open. "What were you doing when you heard the noise?" pulls a real account. "You weren't wearing your gloves, were you?" tells the witness the answer you expect and ends the useful part of the conversation. Capture quotes in the witness's own words rather than paraphrasing into procedure language — "the line was running faster than normal" carries more signal than "production rate exceeded standard."
Phase 3: Evidence Collection Checklist (Steps 14-19)
Evidence collection is the systematic gathering, labeling, and securing of the physical, documentary, and digital records that explain what happened. Witness accounts tell you what people perceived. Evidence tells you what the conditions actually were — and the two often disagree.
Think in three categories: physical (the broken part, the failed PPE, the spilled material), documentary (training records, maintenance logs, the relevant procedure, the JSA), and electronic (machine data, access logs, CCTV, alarm histories). The documentary and electronic categories are the ones investigators most often skip, and they are frequently where the real story lives.
| Step | Action | Why it matters |
|---|---|---|
| 14 | Collect physical evidence and label each item | Unlabeled evidence is unusable in analysis or court |
| 15 | Maintain a chain of custody for transferred items | Establishes that evidence was not altered |
| 16 | Pull documentary records (procedures, training, maintenance, JSA) | Reveals whether the system was followed or failed |
| 17 | Secure electronic data (machine logs, CCTV, access, alarms) | These overwrite themselves on a fixed cycle |
| 18 | Create a scene sketch or diagram with measurements | Positions and distances are otherwise lost |
| 19 | Back up all digital evidence to access-controlled storage | One lost file can break the whole investigation |
Step 17 carries a hidden deadline. CCTV systems, machine controllers, and alarm historians overwrite on a fixed cycle — sometimes days, sometimes hours. If you do not export that data deliberately and early, it is gone, and no amount of investigation effort recovers it. Add "export and preserve electronic logs" to your day-one task list, not your week-one task list.
For physical evidence, follow OSHA's guidance: label and package items appropriately, follow chain-of-custody procedures when transferring them, and store physical evidence under secure conditions with digital copies preserved to avoid loss.
Try AI-Powered Root Cause Analysis
You have the scene secured, the interviews captured, and the evidence preserved. The next step is turning that material into an actual cause — not "operator error," but the chain of conditions behind it. Enter what happened and let AI drive a structured 5 Whys analysis to the root cause.
Try WhyTrace Plus Free
Investigations stall when evidence, interviews, and analysis live in separate files that no one reconciles. WhyTrace Plus keeps the scene record, witness statements, root cause analysis, and corrective actions in one connected case from the first hour.
Phase 4: Root Cause and Report Checklist (Steps 20-25)
The report phase converts evidence and interviews into an analyzed cause, a set of corrective actions, and a documented record that withstands review. This is where investigations most often fail — not for lack of data, but because the team stops at the first plausible cause and writes "retraining" as the fix.
A defensible report does three things: it traces the incident to root causes rather than blaming the nearest person, it proposes corrective actions tied to those causes, and it builds in verification that the actions worked. (For the structure of a report that holds up to an auditor, see RCA Report Writing.)
| Step | Action | Why it matters |
|---|---|---|
| 20 | Build a timeline / sequence of events from the evidence | A clear sequence exposes gaps and contradictions |
| 21 | Run a structured root cause method (5 Whys, fishbone, fault tree) | Stops the analysis from halting at the symptom |
| 22 | Reach systemic causes, not just "operator error" | Symptom-level fixes guarantee recurrence |
| 23 | Assign corrective actions with named owners and due dates | An action without an owner is not an action |
| 24 | Schedule an effectiveness review before closing the action | Confirms the fix actually held |
| 25 | Write the report and route it for review and sign-off | Closes the loop and creates the audit record |
Steps 22 and 24 are the ones auditors probe hardest. A root cause logged as "failure to follow procedure" almost always produces a corrective action of "retrain the employee" — which addresses nothing about why the procedure was skippable in the first place. Push past the first answer. And under both ISO 45001 and OSHA-aligned management systems, closing a corrective action on the day it is assigned rather than the day it is verified effective is one of the most common findings against incident programs.
If your incident triggered a regulatory report under 1904.39, keep your internal investigation record consistent with what you reported. Discrepancies between the two are exactly what a compliance officer looks for. The companion guide OSHA Incident Investigation Requirements covers what regulators expect from the documented record.
Frequently Asked Questions
Q. How quickly should an incident investigation start?
Scene preservation begins immediately — secure people, stop the process, and cordon the area within minutes. Formal investigation steps (interviews, evidence collection) should start the same day while memories are fresh and electronic logs still exist. Separately, OSHA 29 CFR 1904.39 requires reporting a fatality within 8 hours and a hospitalization, amputation, or eye loss within 24 hours, so the reporting clock runs in parallel with your investigation.
Q. Should witnesses be interviewed together or separately?
Separately, and as soon as practical. Group interviews feel efficient but contaminate accounts — the most senior or confident voice anchors what everyone else recalls, and you lose the independent detail that makes multiple accounts useful. Interview each person individually, let them narrate before you ask questions, and frame it as fact-finding rather than blame.
Q. What electronic evidence is most often lost in investigations?
CCTV footage, machine controller data, alarm histories, and access logs. These systems overwrite on a fixed cycle — sometimes within hours — so they must be exported and preserved on day one. Teams that treat digital evidence as a week-one task routinely find it gone by the time they get to it.
Q. What makes an incident report defensible in an audit?
A defensible report traces the incident to systemic root causes rather than blaming the nearest worker, ties each corrective action to a specific cause with a named owner and due date, and documents an effectiveness review before the action is closed. Auditors look hardest at whether causes stopped at "operator error" and whether actions were closed without verification.
Q. Do I need a formal investigation for a near miss?
Yes, for any near miss with serious potential. Near misses share the same causal conditions as injuries — they just had a better outcome. Investigating them lets you fix conditions before someone gets hurt. Scale the depth to the potential severity rather than the actual outcome. See Near-Miss Reporting for building a program that surfaces them.
Key Takeaways
- An effective incident investigation runs in four phases — scene preservation, witness interviews, evidence collection, and root cause/report — and works best as a fixed 25-step sequence rather than improvised response.
- Scene preservation is time-critical: secure people first, then freeze the scene with photos, barriers, and notes on transient conditions before normal operations destroy the evidence.
- Interview witnesses individually and quickly, framed as fact-finding not blame, using open questions to capture conditions in the witness's own words.
- Electronic evidence (CCTV, machine logs, alarm histories) overwrites on a fixed cycle and must be exported on day one — it is the most commonly lost evidence category.
- The report phase fails when it stops at "operator error" or closes corrective actions without an effectiveness review; trace to systemic causes, assign named owners, and verify before closing.
- OSHA 29 CFR 1904.39 reporting deadlines (8 hours for a fatality, 24 hours for hospitalization/amputation/eye loss) run in parallel with your investigation and are in effect as of 2026.
Related Resources
| Resource | Description | Best For |
|---|---|---|
| Run a guided investigation in WhyTrace Plus | Scene record, interviews, root cause, and corrective actions in one connected case | Replacing scattered files and spreadsheets |
| OSHA Incident Investigation Requirements | What regulators expect from the documented investigation record | US regulatory compliance |
| RCA Report Writing | How to structure a report that holds up to audit review | Turning evidence into a defensible report |
For frontline safety reporting and JSA-driven hazard work that feeds your investigations, see AI-assisted job safety analysis and incident reporting (AnzenAI). To capture the equipment-condition signals that often precede mechanical incidents, see predictive equipment monitoring and abnormal-sound detection (PlantEar). For preserving the tacit investigation know-how of experienced safety staff, see knowledge capture for hard-to-document expertise (know-howAI).
From the first hour to the closed report
WhyTrace Plus connects scene documentation, witness statements, AI-assisted root cause analysis, and corrective action tracking in a single incident record — so nothing gets lost between phases and every action carries an owner, a due date, and a verification step.