This guide is for quality, EHS, safety, operations, and compliance teams working in manufacturing, aerospace, defense, and aviation, where an incident, nonconformity, or near miss can affect people, product, delivery schedules, and regulatory standing all at once.
OSHA's investigation guide makes a point that gets lost in practice: the investigation isn't finished when the report gets filed. It's finished when root-cause corrective actions are actually in place. We'll cover the full sequence here — scene response, team planning, fact collection, root cause analysis methods, corrective action, and the effectiveness checks that prove a fix actually held.
Key Takeaways
- Look at system conditions and contributing factors, not just the worker closest to the event
- Follow a repeatable path: response, planning, fact collection, root cause analysis, corrective action, communication
- Compare multiple evidence sources to separate direct causes from root causes
- Give every corrective action an owner, a deadline, a risk-based priority, and proof it worked
What Is Incident Investigation and Why Is It Used?
Incident investigation is a formal, evidence-based review of an accident, near miss, injury, property event, quality failure, process deviation, or security incident.
The goal is straightforward: understand the causal chain, control immediate risk, fix the underlying weakness, and leave behind objective evidence that your organization actually learned something.
That goal gets muddled because four related activities get treated as interchangeable. They're not.
| Activity | What it actually does |
|---|---|
| Reporting | Records that the event happened: OSHA 300/301 logs, complaint files |
| Investigation | Establishes the facts: what, when, who, under what conditions |
| Root cause analysis | Explains the causal relationships behind those facts |
| Corrective action | Eliminates the cause and prevents recurrence |
When the Law Requires It, and When It's Just Good Practice
Legal reporting triggers and investigation obligations aren't the same thing, and conflating them is how gaps happen.
- OSHA recordkeeping: Covered employers log work-related deaths, lost-time cases, and significant injuries within 7 calendar days of learning about them
- OSHA severe-event reporting: Fatalities must be reported within 8 hours; hospitalizations, amputations, and eye losses within 24 hours, under OSHA's reporting rule
- Process Safety Management: Facilities covered under 29 CFR 1910.119 must initiate an investigation of a catastrophic chemical release within 48 hours and keep records for five years
- FDA device reporting: Manufacturers generally report device-related deaths or serious injuries within 30 calendar days of becoming aware
None of these deadlines are root cause analysis. They're notification clocks.
OSHA's own guidance goes further than these minimums, recommending that employers investigate every incident, including near misses. The organizational value (fewer repeat events, better process control, more employee trust) extends well past what the regulation technically demands.
How the Incident Investigation Process Works
A reliable investigation follows the same sequence regardless of industry: respond, plan, collect, analyze, correct, and close the loop.
Step 1: Respond Immediately and Preserve the Scene
Medical care and hazard containment come first, always. Isolate energy sources, restrict access, and stabilize the area before anyone starts investigating. Once it's safe, preserve what you can without creating new risk:
- Photograph equipment positions and conditions before anything moves
- Secure perishable evidence: spilled material, machine settings, digital logs that auto-overwrite
- Restrict the area to essential personnel only
Step 2: Plan the Investigation and Select the Team
Define scope before you start collecting facts. Assign a qualified lead and pull in the right representation: safety, quality, operations, engineering, or maintenance, depending on what failed. A supplier nonconformity needs different expertise than an injury on the line.
Decide upfront what records, equipment, and time the investigation will need. Underestimating this step is how investigations stall halfway through.
Step 3: Collect and Corroborate Facts
This is where most investigations either hold up or fall apart. Gather physical evidence, photos, measurements, maintenance and training records, production data, and environmental conditions, then interview everyone involved.
Interview technique matters more than most teams realize:
- Separate witnesses before interviewing them
- Ask open-ended, non-leading questions
- Document statements in the person's own words
- Interview promptly, since memories fade within days
Fact-finding, not fault-finding. People give better information when they're not worried about getting blamed for it.
Step 4: Analyze the Causal Chain and Identify Root Causes
An event has a direct cause, contributing factors, and a root cause. They are not the same thing. "Operator error" or "failed to follow procedure" isn't a root cause. It's a description. The real question is why the error was likely, or why the control that should have caught it didn't.
Different methods suit different situations:
| Method | Best for |
|---|---|
| 5 Whys | Single-path causes with a clear linear chain |
| Fishbone diagram | Brainstorming multiple possible contributing categories |
| Fault tree analysis | Complex failures with multiple independent paths |
| FMEA / CAPA | Prioritizing risk and tracking the corrective response |
FMEA deserves its own callout: it's a prospective risk tool for anticipating potential failures, not a method for establishing what actually caused one that already happened. Mixing the two up is a common and costly mistake.
Step 5: Implement Corrective Actions and Verify Effectiveness
Separate containment (the immediate fix that stops the bleeding) from the systemic corrective action that addresses the actual cause. Every corrective action needs:
- A confirmed cause it's tied to, not a guess
- An owner and a due date
- A risk-based priority
- An effectiveness criterion defining what gets measured, over what period, and under what conditions
Producing a few good parts right after an adjustment doesn't prove the fix worked. ISO/IAF guidance is explicit that closure requires objective evidence of correction, cause analysis, implementation, and prevention of recurrence, not just completion of the action item.
Step 6: Document, Communicate, and Close the Loop
A complete investigation record includes the event description, timeline, evidence, interviews, causal analysis, risk evaluation, corrective actions, approvals, and effectiveness results. Share findings with affected workers, process owners, and leadership, without blame-based language and while protecting confidential details.
This is where a lot of teams get stuck picking the right method under time pressure, then building the documentation from scratch.
QMS Learning's AI Workbench was built around that exact gap by Will Trikha, a 20-year quality practitioner who's written over 1,000 audit findings. It diagnoses the problem, recommends the appropriate method, and generates an audit-ready artifact instead of a blank template.
Where Incident Investigation Is Applied and What Affects Results
Investigation shows up anywhere something can go wrong: workplace safety and EHS events, manufacturing quality escapes, supplier nonconformities, aerospace and defense compliance findings, equipment failures, environmental releases, cybersecurity incidents, and near misses with serious potential even when nothing was actually harmed.
Common triggers include:
- Injury, illness, or a recordable incident
- Repeated defects or customer complaints
- Audit findings — internal or from a customer
- Unexpected downtime or equipment damage
- Supplier failures or hazardous releases
One aerospace supplier learned this the hard way: a Tier 1 customer's audit team found the shop-floor process didn't match the written SOP, and the contract went on hold until it got sorted out. The same nonconformity resurfaced the following year, because the original CAPA had closed without anyone verifying it actually worked.
Investigation quality depends on:
- Evidence availability and record quality
- Investigator competence and independence from the event
- Interview conditions — rushed or adversarial interviews produce bad data
- Organizational culture and time pressure
- Process and equipment complexity
Severity and recurrence potential should drive how deep you go. The NTSB's 2025 findings on the Boeing door-plug incident identified inadequate training, guidance, and oversight as the probable cause — a system-level failure, not a single worker's mistake.
OSHA violation penalties for documentation and investigation gaps run from roughly $15,000 to $165,000 per violation, with repeat or willful classifications pushing toward the higher end.
Common Issues, Misconceptions, and When Investigation Methods Are Not Appropriate
Most failed investigations fail for the same handful of reasons:
- Starting with a preferred explanation and collecting evidence to confirm it
- Blaming the individual closest to the event instead of the conditions around them
- Relying on a single witness or one piece of physical evidence
- Disturbing the scene before documenting it
- Treating "didn't follow procedure" as a complete answer
- Closing corrective actions without checking whether they actually worked
Picking the wrong method creates its own problems. 5 Whys isn't automatically the right tool. It works well for linear, single-path problems.
A recurring defect across multiple jobs from one supplier is a different case. When tool wear, material variation, and measurement system questions all factor in at once, you usually need 5 Whys paired with a supplier CAPA process, not a fishbone diagram or full fault tree analysis. Matching the method to the complexity of the failure matters more than picking a "favorite" tool.
Not every event warrants a full investigation. A low-risk event with no credible path to recurrence might only need a supervisor review. The key is having documented triage criteria and applying them consistently, so a near miss with serious potential severity doesn't get waved through just because nobody got hurt this time.
Conclusion
Effective incident investigation connects immediate risk control, objective evidence, root cause analysis, corrective action, and verification into one continuous thread. Skip any link, and the event comes back.
The goal was never to prove who's at fault. It's to understand why the organization's controls, processes, equipment, or decisions allowed the event to happen in the first place.
Match your investigation depth and method to the risk in front of you, communicate what you learned, and keep the evidence that proves the fix actually held. That evidence is what an auditor, a regulator, or your own team will ask for next time something goes wrong.
Frequently Asked Questions
What is a root cause analysis in an incident investigation?
Root cause analysis is the structured step that identifies the underlying conditions and system weaknesses behind an incident. It goes beyond the immediate cause and stops short of assigning blame to any one person.
Is RCA part of Six Sigma?
RCA sits inside the Analyze phase of Six Sigma's DMAIC framework, but it isn't exclusive to it. Quality teams use RCA across many improvement approaches, including standalone investigations outside any formal Six Sigma program.
What are the 5 steps of RCA?
A practical sequence is: define the problem, collect evidence, identify causal relationships, select corrective actions, and verify effectiveness. Frameworks vary: DMAIC uses five phases, while OSHA's model uses four steps.
What are the root causes of an incident?
Root causes often include equipment or design flaws, unclear procedures, training gaps, weak supervision, maintenance shortfalls, environmental conditions, and management-system decisions. The actual cause depends on the evidence.