How to Investigate a Workplace Incident: A Root Cause Analysis Guide That Goes Beyond "Worker Error"

Pull up the last ten incident reports at your facility and look at the "root cause" field. If your program is like most, you'll see a lot of the same phrases: "employee not paying attention," "failed to follow procedure," "worker error." And in the corrective action field: "employee retrained," "reminded crew to be careful."

Those reports close the paperwork, but they almost never prevent the next incident. If a hazard was serious enough to hurt someone, telling people to be more careful around it leaves the hazard exactly where it was. OSHA makes the same point in its incident investigation guidance: the goal of an investigation is to find the system failures that allowed the incident to happen, not to assign blame.

Here's a practical process for investigations that actually change something.

Why "worker error" is where an investigation starts, not where it ends

People make mistakes. That's not a root cause; it's a condition you have to design around. When someone does something unsafe, the useful question is why it made sense to them at the time.

Did they skip the lockout step because the procedure takes 20 minutes and the line is under production pressure?
Did they reach past the guard because the guard makes it impossible to clear a jam any other way?
Did they miss the warning because it's posted in English and their first language is Spanish?

Each of those answers points to something you can fix: the schedule, the equipment design, the communication. "Worker error" points to nothing except the worker. It also teaches your crew that reporting an incident gets someone in trouble, which is the fastest way to make your near-miss reports disappear.

Step 1: Secure the scene and take care of people

Before any investigating happens:

Get the injured person care.
Make the area safe so nobody else gets hurt. Stop the equipment, barricade the spill, lock out the energy source.
Preserve the scene as much as you safely can. Don't let anyone reset the machine, clean up, or move things until you've documented them.

Also check your reporting clock. Under 29 CFR 1904.39, you must report a work-related fatality to OSHA within 8 hours, and an inpatient hospitalization, amputation, or loss of an eye within 24 hours. That clock starts when you learn about the event, not when your investigation finishes.

Step 2: Gather the facts while they're fresh

Evidence degrades fast. Within a day, the scene gets cleaned up and people's memories start to merge with what they've heard from coworkers. Aim to collect the following within the first shift if you can:

Photos and video of the scene from several angles, including wide shots that show the surroundings. Take more than you think you need.
Physical evidence such as the broken tool, the frayed sling, or the worn ladder foot. Tag it and set it aside.
Documents including the relevant procedure, the JSA for the task, training records, maintenance logs, and the shift schedule.
Conditions at the time: lighting, weather, noise, staffing levels, whether it was the end of a long shift.

Step 3: Interview the people involved

Talk to the injured worker (when they're able), witnesses, the supervisor, and anyone who regularly does the same task. A few things make interviews far more useful:

Interview people separately, and as soon as possible.
Go to the location if you can. People remember more when they can point to things.
Explain the purpose up front. You're trying to understand what happened so it doesn't happen again, not to decide who gets disciplined.
Ask open questions. "Walk me through what you were doing" gets you more than "Did you have your gloves on?"
Ask the experts. The question "Is this the way the job usually gets done?" often reveals the real answer. If the official procedure and actual practice have drifted apart, that gap is a finding in itself.

Step 4: Find the root causes

This is the step most investigations rush. There are formal methods (fishbone diagrams, fault trees, causal factor charts), but for most incidents the 5 Whys is enough, as long as you use it honestly.

Start with what happened and keep asking why until you reach something management controls. Here's an example:

Incident: A worker's hand was cut while clearing a jam on a packaging line.

Why was their hand cut? They reached into the machine while it was still moving.

Why was the machine still moving? They didn't lock it out before clearing the jam.

Why didn't they lock it out? Jams happen 15 to 20 times a shift, and full lockout takes about 10 minutes each time. Nobody on that line locks out for jams.

Why are there so many jams? The line was switched to a thinner film last spring, and the feed rollers were never adjusted for it.

Why weren't they adjusted? The material change didn't go through a change review, so maintenance and safety never heard about it.

Stop at question 2 and the corrective action is "retrain on lockout." It will be ignored within a week, because the real pressure that caused the shortcut is still there. Follow it to question 5 and you get three fixes that matter: adjust the rollers to cut the jam rate, install a guarded jam-clearing access point so clearing doesn't require reaching into a moving machine, and add material changes to your change management process.

A few tips for getting the 5 Whys right:

There's usually more than one root cause. Branch the chain when an answer has several parts.
"Five" isn't a rule. Stop when you reach a cause you can actually fix at the system level, whether that takes three whys or seven.
If an answer names a person, ask why again. "Because Mike didn't check it" becomes "Why wasn't checking it part of the process?"
Check for patterns. Search your past incidents and near-misses for the same equipment, location, or task. If this has happened before, the investigation should explain why the last fix didn't work.

Step 5: Write corrective actions that match the root cause

Every root cause needs at least one corrective action, and each action should be ranked against the hierarchy of controls:

Elimination: remove the hazard entirely.
Substitution: replace it with something less hazardous.
Engineering controls: guards, interlocks, ventilation, barriers.
Administrative controls: procedures, training, signs, scheduling.
PPE: the last line of defense.

If every corrective action from your investigations lands in the bottom two levels, that's a pattern worth noticing. Training and PPE have their place, but they depend on people doing the right thing every single time, which is exactly what failed in the first place.

Then make each action specific enough to verify:

Weak corrective action	Strong corrective action
Retrain employees on lockout	Install interlocked jam-clearing door on Line 3 by Nov 15 (owner: maintenance lead)
Remind crew to watch for forklifts	Paint pedestrian lane and install convex mirror at Dock Door 7 intersection by Nov 1
Be more careful on ladders	Replace two ladders with worn feet; add ladder inspection to the monthly checklist

Every action needs an owner, a due date, and a way for someone other than the owner to confirm it was done.

Step 6: Verify the fix, and check that it held

Closing an action isn't the same as fixing the problem. Have someone independent confirm the fix is in place, then check again 30 to 90 days later. Is the guard still installed, or has it been propped open? Did jams actually drop after the roller adjustment? Is the new procedure being followed on night shift too?

Effectiveness reviews are where many programs quietly fail. They're also one of the best leading indicators you can track: if your overdue and unverified action counts are climbing, your next incident is probably already in the queue.

Step 7: Share what you learned

An investigation only one person reads has limited value. Turn the findings into a short toolbox talk for the affected crews and any other site with similar equipment. Explain what happened, what's changing, and why. When workers see that a report led to a real fix, not a write-up, they report more, and you get to fix the next hazard before it hurts anyone.

Don't skip the near-misses

Everything above applies to near-misses too, and they're the cheapest investigations you'll ever run. Nobody's hurt, nobody's defensive, and the hazard is identical to the one that will eventually cause an injury. A quick 5 Whys on a serious near-miss can prevent the recordable that would have cost you tens of thousands of dollars.

When an incident does involve an injury, run the case through the free OSHA Recordability Checker as part of your investigation so the recordkeeping decision gets made correctly while the facts are fresh.

How Infranoto helps

Infranoto is built to carry an incident from the first report all the way through to a verified fix:

Root cause detail on every incident, from first aid cases to lost-time injuries, with photos and severity, linked directly to OSHA recordability and corrective actions.
Corrective actions that get verified. Owners, due dates, reminders, independent sign-off, and automatic effectiveness reviews are built in.
Hierarchy of controls visibility. Your dashboard shows where your controls actually fall on the hierarchy, so you can see if you're leaning too heavily on training and PPE.
Pattern detection across sites. AI surfaces recurring hazards across incidents, near-misses, and observations, so the investigation into this week's cut can tell you about the three similar near-misses from last quarter.

See the full feature set on the platform page, or request a demo and we'll walk through an investigation using an incident like the ones your team handles.

The takeaway

"Worker error" is a starting point. Keep asking why until you reach something the system controls.
Move fast on evidence. Photos, documents, and interviews are most reliable in the first shift.
Use the 5 Whys honestly. Branch for multiple causes, and ask again whenever an answer names a person.
Aim corrective actions up the hierarchy of controls, and make each one specific, owned, and dated.
Verify the fix and check that it held. A closed action isn't a fixed hazard.
Share the lessons so one incident improves every site.