An incident investigation is the work of finding out why something happened so that it doesn’t happen again. Canada’s Centre for Occupational Health and Safety (CCOHS) puts the emphasis on “finding the root cause so that the event can be prevented from happening again.”
Most investigations start from a first account, often written at the end of a shift by someone who wanted to go home, and how much of the investigator’s time goes on reconstructing events depends on how good that account is.
What are the steps of an incident investigation?
CCOHS sets out the stages in its incident investigation guidance: secure and assess the scene, manage the witnesses, collect the evidence, analyse it to find the root causes, then report the findings with recommendations and follow them up. The right-hand column below is ours.
| Stage | What happens | What it needs from the first account |
|---|---|---|
| Scene | Make the area safe and preserve it for the investigation | Exactly where it happened, and what was moved or done straight away |
| Witnesses | Identify the people involved and interview them separately, as soon as possible | Who was there and who saw what |
| Evidence | Gather physical, documentary and witness evidence | The equipment, substance or vehicle involved, and its condition |
| Analysis | Establish the causes and check each conclusion against the evidence | The order of events, and what is still unknown |
| Recommendations and follow-up | Agree actions, owners and checks | What was done at the time, and what was only requested |
On the day, the person who was there can answer every row in the right-hand column first-hand.
Why does the first account matter?
Because everything after it builds on it. In The Frontline Reporting Index 2027 we wrote: “A first account is the beginning of an investigation, not its conclusion.”
On witnesses, CCOHS makes the timing point: “Witnesses should be kept apart and interviewed as soon as possible after the incident.” It gives one purpose of the interview as “to obtain his or her own words describing the event.”
A first account given at the time, in the person’s own words and checked by them, is the closest the record gets to that. A summary written up the next morning by someone else is a step further away.
How do you keep facts, accounts and assumptions apart?
By labelling each one in the record. CCOHS advises investigators to check every conclusion before finalising it: whether it rests on direct physical or documentary evidence, on an eyewitness account, or on an assumption.
The first account can make that easier or harder. A reporter who writes “the hose failed because it was old” has turned a guess into a cause; the investigator needs the observation and the gap kept separate, as in “the hose looks like the original fit and I don’t know when it was last inspected”.
In the report’s worked example, a worker reports fluid under a parked delivery vehicle. The confirmed record includes “Fluid type unknown. Maintenance attendance not confirmed.” Those gaps are information. We wrote in the same chapter that “The system must not fill an empty field by inventing a reassuring answer.”
What should a first account contain to help an investigation?
The answers to the questions an investigator will ask later. CCOHS’s witness questions start with “Where were you at the time of the incident?”, “What were you doing at the time?” and “What did you see or hear?”, and go on to the conditions at the time and what the injured person was doing.
Asked at the job, while the person is still there, those questions cost a minute. Asked a week later, they cost a meeting, and the answers have had a week to change. The sections in our incident report template follow the same questions, with a line of guidance under each.
How many handoffs sit between the worker and the record?
Count them. One of the eight measures in the report, Reporting Distance, is defined as “People, systems and handoffs between worker and committed record. Median handoffs and systems.”
One common path for a night-shift report: the worker tells the supervisor over the radio, the supervisor writes notes on paper, and the next morning an administrator enters them into the safety system. That is two handoffs and three formats before the record exists. Each handoff is a chance for the account to be summarised or translated, and the investigator reads the last version.
How do you know if your investigations start from a good account?
Measure the rework. In the report we suggest you “Record how often reviewers need to return to the reporter, how long it takes to assemble the agreed evidence and which required elements are missing.” Then “Review a comparable sample before and after a pilot.”
A second measure helps here: the First-Pass Acceptance Rate, the share of submitted records “accepted without clarification, correction or re-entry.” If most first accounts at a site need a follow-up call before anyone can use them, investigators are spending time collecting detail that should have been captured in the first report.
Where does Tandm fit?
At the start. In the report we put it this way: “Tandm belongs at the start of this evidence chain: helping the organisation capture a useful account before someone has to seek the missing details later.”
The worker explains what happened by speaking or typing, in their own language, at the job. Tandm asks the follow-up questions the record needs, shows the completed account back, and records it only once the worker confirms it, in the safety system you already run.
It doesn’t investigate. Finding causes and following actions through stay with your team and your process. In the report: “Better initial information can support that process; the organisation must still carry it through.”
Download The Frontline Reporting Index 2027, or book a demo and bring the first account from a recent investigation.
Sources
- Canadian Centre for Occupational Health and Safety, Incident Investigation, fact sheet revised 23 June 2025. ccohs.ca
- Tandm, The Frontline Reporting Index 2027: The work-to-record gap, framework edition, October 2026: the chapters on useful detail and on audit and follow-through, and the measurement framework. tandm.io