View current

Incident Investigation Guideline

This is the current version of the approved document. You can provide feedback on this document to the Enquiries Contact - refer to the Status and Details tab from the menu bar above.

Section 1 - Purpose and Scope

(1) The purpose of an incident investigation is not to assign blame - incidents occur for a variety of reasons and the main aim is to establish what the contributing factors were and to put measures in place to prevent a recurrence. This Guideline supports the Incident Investigation Procedure and provides practice guidance on how to conduct an effective investigation.

(2) Whenever a worker or other person is involved in a UQ related incident, it must be reported, investigated and corrective actions taken to prevent recurrence. Investigations should commence early and be given appropriate priority and resources by UQ management. This Guideline is intended to provide those in an investigation team with guidance to be able to conduct a thorough and fair investigation.

Top of Page

Section 2 - Process and Key Controls

(3) The objective of an incident investigation is to determine the contributing factors and identify appropriate controls to prevent a recurrence. This Guideline should be read in conjunction with the Incident Investigation Procedure and Health and Safety Incident and Hazard Reporting Procedure.

(4) The objectives of this Guideline are to:

  1. Ensure all incidents reported that resulted in or had the potential to cause injury or illness investigated in a consistent and proportionate manner.
  2. Provide practical instruction on how to determine the level of investigation required – the type of investigation conducted depends on the seriousness or complexity of the incident.
  3. Support an investigation process that determines the cause of incidents and identifies opportunities for improvement to health and safety systems to prevent a recurrence.
  4. Ensure investigation findings and conclusions are evidence based.
Top of Page

Section 3 - Key Requirements

Part A - Immediate Action Following an Incident

(5) Immediate actions following the incident can mitigate further risk to persons or property and support effective incident investigation:

  1. For serious incidents, suspend work in the affected area. It may also be necessary to suspend similar work if there is a risk of a similar incident occurring.
  2. Restrict access to the site/area so that it is preserved and only allow authorised persons into the site/area, e.g., emergency personnel, manager, etc.
  3. Secure the scene to preserve evidence, and if appropriate and safe to do so, collect evidence for investigation, e.g., photos, statements, damaged equipment. UQ is legally obliged under the Work Health and Safety Act 2011 to notify the regulator of particular incidents, and also to preserve the incident site. If the incident is notifiable to the regulator, the Director, Health Safety and Wellness (Director, HSW) (or a senior member of the HSW Division) will facilitate this process.
  4. Report the incident in accordance with Health and Safety Incident and Hazard Reporting Procedure.
  5. Consult with your Work Health and Safety Coordinator (WHSC), Health, Safety and Wellness Manager (HSW Manager) and/or the HSW Division to verify investigation and notification requirements.

Part B - Scoping the Investigation

(6) The severity or potential severity of the incident may drive the objectives of the investigation. Consideration should be given to the legal, insurance, human resource, enterprise compliance and third-party aspects and will also determine whether one or multiple investigation as are required.

(7) Once the objectives of the investigation have been determined, establish the legislation that may apply including, codes of practices and understanding other requirements that may apply; for example, Australian/New Zealand Standards, International Standards (ISO), and Building Codes.

(8) In addition, UQ policies and procedures and local standard operating procedures that outline required practices and processes should be considered.

(9) Clarity about what is included and exclude from the investigation scope will drive the objectives and provide clarity to the investigation team. The content of a formal report must be considered as these may be provide to external parties (e.g., Regulators).

The Level of Investigation

(10) A Level 1 Investigation is required for ‘low’ or medium risk incidents. These incidents are to be investigated by the supervisor of the person reporting or involved in the incident, with support from the local WHSC. Level 1 investigations are documented through the creation of an Action Plan in UQSafe.

(11) A Level 2 Investigation is required for an incident that is rated as having a ‘high’ risk. These incidents are to be investigated by the local WHSC or HSW Manager and findings recorded in UQSafe. Level 2 investigations can be documented using the Basic Incident Investigation tool in UQSafe.

(12) A Level 3 Investigation is required when an incident is notifiable to a Regulator (or had a high likelihood of being notifiable) or the risk level is determined as ‘Extreme’. In addition to reporting the incident and corrective actions in UQSafe, a formal investigation is to be conducted by the local HSW Manager with support, if required, from the HSW Division. A separate report is required, and may on occasions be provided to a Regulator or inspector either voluntarily or if compelled by a Regulator.

Part C - Preparing For the Investigation

Establishing the Investigation Team

(13) While it is appropriate to have a number of people involved in investigations, Level 1 investigations only need to be completed by Supervisors. WHSCs and HSW Managers could be included if required.

(14) Level 2 investigations must be completed by WHSCs and /or HSW Managers.

(15) Level 3 investigations are more complex and require a suitably competent and skilled investigation team. The investigation team must be carefully selected to ensure the following principles:

  1. Diverse team with appropriate expertise, e.g., lead investigator, subject matter experts, worker experienced in the task, etc.
  2. Team members are to declare conflicts of interest, these should be considered, documented and addressed as required.

(16) If there is a Health and Safety Representative (HSR) that represents the workgroup involved, they should be offered the opportunity to be included in all investigations, with permission from injured if applicable.

Report Requirements

(17) Determine who the audience of the investigation report will be, considering confidentiality and sensitivity. The expectations of the reporting deadlines must be considered in conjunction with the scheduling of evidence gathering.

  1. Level 1 – UQSafe action plan.
  2. Level 2 – UQSafe action plan and UQSafe Basic investigation.
  3. Level 3 – UQSafe action plan and a formal investigation report.

Part D - Data Collection

(18) Data collection can be divided into five main areas (PEEPO):

  1. People;
  2. Environment;
  3. Equipment;
  4. Procedures;
  5. Organisation.

(19) Mapping out PEEPO assists the investigation team in keeping on track and focussed on the evidence collection.

  Data Category Collection Method
P People:
- Witnesses
- Other associated with the incident		 Interviews
Written statements
Observations
E Environment:
- Weather
- Workplace
- Incident scene		 Observation / Review
Inspection / Photography
Event reconstruction
E Equipment:
- Vehicles, plants, tools, infrastructure, etc.		 Inspection
Testing
Operation
P Procedures:
- Existing maps, charts, documents, reports, photographs, etc.		 Review / Comparison
O Organisation:
- Culture to safety
- Previous incidents		 Review / Comparison

Part E - Evidence Collection and Recording

Recording of Evidence

(20) One person should be nominated to handle the evidence which includes storage of documentation and data, and storage of physical evidence. Catalogue what the evidence is, the date obtained, where the evidence was obtained and from who. Most of the items in this section are applicable for Level 3 investigations and in most cases do not apply to Levels 1 or 2.

Principals of Evidence Collection

(21) Evidence used to support an incident investigation must be based in fact as factual evidence is crucial to the outcome of the investigation. If assumptions are made, it is important to explain what they are based on, if there is any supporting evidence for the assumption and whether there are any alternatives that should be considered. Opinions, hypotheses, hearsay and conjecture are not considered as evidence and should not be used except where further inquiries lead to actual evidence supporting them. Interpretation of data may be considered to be evidentiary, if the person conducting the interpretation is qualified to do so, such as an engineer interpreting data relating to load bearing issues.

(22) When scheduling evidence collection, consideration must be given to the two main types of evidence, perishable and non-perishable. Perishable evidence is that which post incident can change swiftly, e.g., memory, incident site, real-time recordings and should be collected first. Non-perishable evidence such as documentation and training records can be collected after perishable evidence has been secured.

Site Inspection

(23) The site should have, in some instances, been preserved immediately after the incident. As soon as the site has been released by the authorities, a walk through the site and surroundings will be possible to take photographs (all items in situ) and measurements. Ensure any items that can be recovered are, and those that cannot be removed (due to size, etc.) are protected from the elements.

Photographs and Video

(24) Any photographic or video footage taken must be date and time stamped. If there is Closed Circuit TV (CCTV) footage, obtain this through the appropriate channels.

Interviews

(25) Interviews form part of the key evidence in investigations and should be conducted as soon as possible after the incident as memory declines rapidly. Interviews should be scheduled with:

  1. Principal witnesses – those directly involved in the incident.
  2. Eyewitnesses – those that directly observed the incident, or the conditions immediately preceding or following the incident.
  3. General witnesses – those with knowledge about the activities.
  4. Subject matter experts (SME) – those with specific process or technical expertise.

(26) It is vital to create the right environment for the interview. Keep the tone conversational and allow rapport to develop across the interview. Inviting questions around how the interview will work, describing procedural aspects like recording and note taking can assist in reducing anxiety. It is important to explain that the process is not about blame and the expected outcome of the investigation is to improve safety and prevent reoccurrences of the incident. Key principles for conducting effective interviews:

  1. prepare for the interview developing a list of questions, keeping an open mind, approach the interview without bias;
  2. establish trust through setting the expectations and providing clarity on the interviewee’s role in the investigation and how their interview statement will be used;
  3. agree on recording method with interviewee, e.g., hand written notes, typed, or audio recording. If using audio recording obtain permission;
  4. advise the interviewee to clearly articulate if the information experienced was firsthand or otherwise;
  5. allow the interviewee to elaborate, as the interviewer do not ask leading questions or provide the answer;
  6. listen actively and allow the interviewee to do the majority of the talking;
  7. group interviews may be appropriate in some circumstances; however, it is important to be mindful that ‘group think’ may occur, some people may dominate the conversation and there is no independence of witness statements; and
  8. exchange contact details so that the witness statement can be forwarded to the interviewee for verification.

(27) If a witness refuses to provide an interview, reiterate that the purpose is not to find fault but to find the weakness in the process or system. Ask if the witness is willing to explain their reason for not wanting to participate, offer contact details if they decide to change their mind. There is an interview plan template that can assist with this process.

Interview Questions

(28) Interview questions should be developed ahead of the interview and primarily be open ended, e.g., “Can you provide as much information about what happened leading up to and during the incident?”. Ask questions that explore what has already been stated by others in addition to probing for missing information. Actively listen and give the witness feedback.

(29) Interview questioning tips:

  1. refrain from interrupting;
  2. ask the same question of several witnesses to corroborate the facts;
  3. aid the interviewee with reference points, e.g., “How did the lighting compare to the lighting in this room?”;
  4. keep an open mind; and
  5. don’t assume; if unclear, ask further questions to clarify your understanding, paraphrase, e.g., “What I heard you say was…, did I understand that correctly?”.

Support Person

(30) When conducting interviews, the interviewee may want to have a support person with them. The role of the support person is to be present but not take part in any of the interview, e.g., no answering or asking of questions, no interpretation of questions. The support person is present to provide moral support, not as an advocate, and are expected to remain silent throughout the interview.

Documentation and Records

(31) Documents and records are non-perishable and can be collected after the non-perishable evidence. Documents that may be considered, depending on the incident could include:

  1. maintenance logs;
  2. training records;
  3. timesheets;
  4. risk assessments;
  5. safe operating procedures;
  6. local operating procedures;
  7. policies/procedures/guidelines;
  8. induction records and processes;
  9. audit reports;
  10. maps and diagrams;
  11. communication emails;
  12. change papers/communication; and
  13. engineering/plant/equipment reports.

Chain of Evidence

(32) The evidence collected must be catalogued with a date and time when collected or obtained. This includes the following:

  1. label all evidence including the description and identification details;
  2. date, time and location the evidence was found;
  3. how it was obtained and from who (if applicable); and
  4. name of the person who handed the evidence over.

Part F - Conducting an Investigation

Level 1

(33) The supervisor develops the action plan in UQSafe which outlines the actions using the hierarchy of control, this is verified by the WHSC or HSW Manager.

Level 2

(34) Level 2 incidents require a basic investigation and information can be collected in UQSafe. This is reviewed by the HSW Manager or the HSW Division (as appropriate), to:

  1. ensure the risk rating level is appropriate;
  2. assess the quality of the investigation;
  3. follow up with management to ensure that consultation has occurred with relevant persons, and actions and timing for implementation has been agreed; and
  4. enable legal implications to be considered.

(35) For guidance on conducting a basic investigation in UQSafe refer to the Systems Training Hub.

Level 3

(36) Incidents requiring Level 3 investigations are notifiable to a Regulator (or had a high likelihood of being notifiable) or, have an ‘extreme’ risk. These investigations require a formal report and a planned and methodical investigation process conducted by an investigation team. The report must be uploaded to UQSafe at the conclusGion of the investigation and marked ‘confidential’. Marking the report confidential only allows the WHSC, HSW Manager and selected people in the HSW Division to view the report. Refer to the Appendix – ‘Conducting the Interview – Areas to Explore’.

Part G - Analysis of Evidence - ICAM

(37) Analysis is a methodical and logical link between the fact-finding process and the development of conclusions therefore the basis for corrective actions and preventative measures. There is usually never one single ‘cause’ of an incident – usually there are several event or conditions that together increase the likelihood of an incident – these are called indirect or contributing factors.

(38) When analysing the evidence, there usually is several techniques that can be used depending on the severity and complexity of the incident. UQ uses ICAM (Incident Cause Analysis Method) which is based on the work conducted by Professor James Reason (also developed the Swiss Cheese Model of system accidents). 

(39) This method allows investigators to extend beyond the intentional (human violation - deliberate deviation from a rule or procedure) or unintentional (human error) acts of the person (active failures) and identify the underlying factors that contributed to those actions and context (latent conditions) – indirect or contributing factors.

(40) The system approach has the basic premise that humans are fallible, and error are to be expected. Errors are seen as consequences rather than causes, having their origins in systemic failures. The assumption being that we cannot change the human condition, but we can change the conditions under which humans work. ICAM focuses not on who to blame, but how and why the defences in place failed.

(41) A further assumption, and the purpose of an ICAM investigation, is that consideration of sound organisational factors produces safe workplaces which reduces errors and violations. A range of questions that could be used is found in the Appendix to keep the investigators open to other considerations.

Incident Timeline

(42) The benefits of establishing an incident timeline forms the basis for further analysis, it is systematic, graphically can display a flowchart plotted on a timeline, it shows actions, decisions and context of decisions and it establishes the chain of events. It can illustrate and validate the sequence of events leading to the incident and the conditions affecting these events. It helps to link facts and causal factors to organisational issues and management systems.

Event and Conditions Charting

(43) Using the timeline as a starting point, build outward from the validated sequence of events, add in the conditions affecting the events. Set out the conditions in visual form, include assumed conditions and conditions, visually represented by the linked image:

See: Incident timeline – Event, Condition and Assumed Condition icons

(44) An example of an event and conditioning chart is linked below of a car and train incident at a level crossing:

See: Example event and conditions chart - car and train incident at a level crossing

Indirect or Contributing Factors to Consider

Organisational Factors

(45) Consider the following at the organisational level the following:

  1. leadership;
  2. safety culture;
  3. safe systems of work;
  4. staff selection for the role;
  5. training;
  6. operation vs safety goals;
  7. risk management processes;
  8. contractor management processes;
  9. management of change; and
  10. communication and consultation.

Task/Environmental Conditions

(46) Consider the following at the workplace level:

  1. working conditions;
  2. time pressures applied;
  3. resources available to complete the task;
  4. support;
  5. task complexity;
  6. fitness for work;
  7. workload;
  8. task planning; and
  9. environment (outdoor/indoor/weather, etc.).

Individual/Team Actions

  1. Errors and violations.

Absent/Failed Defences

  1. Interlocks;
  2. isolation;
  3. guarding;
  4. barriers;
  5. risk assessment;
  6. safe operating procedures;
  7. job safety analysis;
  8. awareness;
  9. supervision;
  10. emergency response; and
  11. personal protective equipment (PPE).

Determination of Causes

(47) Based on the analysis of the evidence and the event and conditions charting – determine the most likely reasons of the incident.

Part H - Key Findings and Conclusions

(48) The conclusions will be based on facts and the analysis of the facts, and these will be substantiated by the physical evidence, interviews, ICAM and event and conditions charting analysis. The conclusions will state:

  1. actual, validated, causes and contributing factors that led to the incident;
  2. highlighted weaknesses and any areas that are still unsubstantiated; and
  3. highlight strengths.

Part I - Recommendations

(49) Where system deficiencies have been identified through the investigation process, recommendations for corrective action must be made to reduce future risk and improve health and safety performance. The Appendix has some questions to consider when thinking about recommendations.

(50) The recommendations will:

  1. flow from the causal factors and will directly tie back to the evidence collected;
  2. be such that a corrective action plan can be developed with the rectification of the cause in mind to minimise or prevent a similar event in the future; and
  3. be able to be achieved, realistic and effective.

Part J - Action Plan

(51) Action plans must be created as soon as practicable following an incident. Level 1 and 2 investigations require an action plan to be created in UQSafe within three (3) weeks of the incident occurring in and allocated to a person responsible for actioning. Level 3 investigations should also aim to have action plans in place within three (3) weeks, however due to the complexity of the investigation this timeframe may be extended.

(52) Each corrective action must have a deadline for implementation, and a monitoring processes established to ensure actions are addressed satisfactorily. Follow up to evaluate the effectiveness of the corrective actions is required, and adjustments made as needed to continue to improve. These can be discussed at HSW Committee meetings.

(53) The following considerations should be taken into account when developing action plans:

  1. corrective actions are specific, constructive and address the contributing factors – they must tie back to the evidence gathered.
  2. the hierarchy of controls and risk management procedure has been considered when developing the risk treatment.
  3. existing knowledge and impact on the business.
  4. the person responsible for the action agrees with the action being allocated to them and the target completion date for implementation.

(54) If a formal investigation is undertaken – the formal investigation template can be used. ‘Determining Recommendations and Conclusions’ in the Appendix may be used to assist investigators when determining recommendations.

Part K - Close-out Meeting

(55) Once the report has been completed, a meeting with senior management should be organised to review the report and discuss the findings. This meeting should be run by the Lead Investigator. The outcomes of this meeting should be agreement of the action plan, ensuring there is the correct person allocated against each corrective action along with an agreed timeframe for implementation.

Top of Page

Section 4 - Monitoring, Review and Assurance

Level 1

(56) The supervisor develops the action plan in UQSafe which outlines the actions using the hierarchy of control, which is verified by the WHSC or HSW Manager.

Level 2

(57) Level 2 incidents require a basic investigation and information can be collected in UQSafe. This level of investigation can also be conducted for HiPo incidents. This is reviewed by the HSW Manager or the HSW Division (as appropriate), to:

  1. Ensure the risk rating level is appropriate.
  2. Assess the quality of the investigation.
  3. Follow up with management to ensure that consultation has occurred with relevant persons, and actions and timing for implementation has been agreed.
  4. Enable legal implications to be considered.

(58) If a report is required, the ‘Report Template’ in the Appendix has an outline of what should be included in the final report. 

Level 3

(59) Incidents requiring level 3 investigations are notifiable to a Regulator (or had a high likelihood of being notifiable) or have an ‘extreme’ risk. These investigations require a formal report and a planned and methodical investigation process conducted by an investigation team, using ICAM.

(60) A formal report should be produced for the senior management that summarises all the elements of the investigation. The report should be reviewed by the HSW Director (or senior member of the HSW Division) prior to it being released. Using the formal investigation template can be used as the final report.

Top of Page

Section 5 - Appendix

Conducting the Interview – Areas to Explore

People

(61) Review personnel records (work history, training, time sheets, induction, etc.) as required. Identify all the people who might have information about the incident/event and obtain statements from parties as soon as possible. Explore the following:

  1. Experience of those involved in task/activity;
  2. Training requirements and evidence;
  3. Appropriate and adequate supervision;
  4. Fatigue;
  5. Work stress or time pressures;
  6. Safety procedures;
  7. Appropriate emergency response.

Environment

(62) Examine the scene of the incident for information and to help understand the nature of the task being conducted and the local environmental conditions.

(63) The physical environment, especially sudden changes to that environment, are factors that need to be identified. The situation at the time of the incident/event is important, not what the “usual” conditions were. Explore:

  1. Weather conditions;
  2. Appropriate housekeeping;
  3. Thermal comfort;
  4. Noise;
  5. Lighting;
  6. Visibility; and
  7. Toxic or hazardous gases, dusts, or fumes.

Equipment

(64) Examine any equipment involved in the incident/event looking at the condition of equipment. Identify any design flaws, mismatched components or confusing labelling or marking. Explore:

  1. Equipment used in the way it was designed to be used;
  2. Equipment fit for purpose;
  3. Equipment failure;
  4. Equipment modifications post purchase;
  5. Equipment design;
  6. Safety devices fitted to plant and equipment;
  7. Maintenance; and
  8. Hazardous substances.

Procedures

(65) Review the task/activity that was being conducted. Examine the work procedures and the scheduling of the work to ascertain whether they contributed to the incident/event. Examine the availability, suitability, and supervisory requirements. Explore:

  1. Work schedules;
  2. Equipment instruction manuals;
  3. Local safe operating procedures for the task;
  4. Communication of procedures to workers;
  5. Risk Assessment for the task/activity;
  6. Risk Assessments approved;
  7. Workers aware of risk assessments;
  8. Changed conditions / processes;
  9. Appropriate tools and materials available; and
  10. Tag-out lockout procedures used.

Organisation

(66) The role of supervisors and management must always be considered in an incident/event investigation. Explore:

  1. Workers understood safety requirements;
  2. Safety requirements enforced;
  3. Adequate supervision for the skill level of the workers;
  4. Training provided to workers;
  5. Regular safety inspections;
  6. System for reporting hazards;
  7. Corrective action plans in place;
  8. Unsafe conditions corrected;
  9. Changes to equipment, environment, people or procedures; and
  10. Worker consultation.

Determining Recommendations

(67) The linked checklist may help the investigators when determining the recommendations.

See: Recommendations checklist

Report Template

(68) If conducting an investigation, the following format may be used. If conducting a formal incident investigation, use the formal investigation template.

  1. Title of the report
  2. Date of the report
  3. Table of contents
  4. Executive Summary (one page)
    1. Brief summary of the event (one paragraph)
    2. List of causes
    3. Conclusion
    4. Recommendations
  5. Introduction
    1. Background of the incident
    2. Full description of where and when the event took place
    3. Scope and purpose of the investigation
    4. Description of how the investigation was undertaken
  6. Factual information (known)
    1. Facts collected and type, e.g., reports, photographs, interviews, etc.
    2. Sequence of events
    3. Photographs
    4. Including any missing evidence (unable to obtain)
  7. Analysis
    1. Description and analysis of the facts
    2. ICAM tools
    3. Indirect or contributing factors
    4. Incident timeline
    5. Analysis of the facts impact on the incident and its causes
  8. Conclusions
  9. Recommendations and action plans
    1. Include which area the recommendation applies, who may be responsible for the implementation and a realistic timeframe
  10. Appendices
    1. Definitions and abbreviations or specific terminology
    2. Photos
    3. Site Map
    4. Maintenance reports
    5. Procedures, policies, etc.
    6. Risk assessments and safe operating procedures.