A practical walk-through of what a compliant incident investigation looks like in Canada, from securing the scene and running a 5 Whys root cause analysis to tracking corrective actions and building the documentation file an OHS officer or COR auditor expects to see.
A near miss report that goes nowhere and a fatality investigation are built from the same bones. Both start with an immediate response, both depend on a scene that has not been disturbed, both need a root cause method that goes past the obvious answer, and both end with a corrective action that someone actually closes out. The difference is only in scale. Get the process right on the small stuff and you will not be improvising it the day something serious happens.
This post walks through what a compliant incident investigation actually looks like in a Western Canadian workplace, from the moment something goes wrong to the paperwork an OHS officer or a COR auditor will ask to see afterward. It is not a theory piece. It is the sequence.
The first response, before the investigation starts
Before anyone asks why something happened, deal with what is happening right now. Get first aid or medical attention to anyone hurt, and make the area safe by stopping the equipment or process involved, applying lockout if needed, and keeping other workers away. Only once the immediate hazard is controlled does the investigation begin.
- Secure the injured worker's care and confirm they are stable before anything else happens.
- Notify the supervisor and, where one exists, a joint health and safety committee member or worker health and safety representative.
- Isolate the area so equipment, materials, and conditions stay exactly as they were.
- Determine whether the incident meets your provincial regulator's threshold for a reportable serious incident, and if so, report it through the proper channel without delay.
- Assign someone to lead the investigation, ideally someone with no direct role in the task that led to the incident.
That last point matters more than it sounds. A supervisor investigating their own crew's incident is not automatically biased, but an investigation that is led or reviewed by someone one step removed produces findings that hold up better under scrutiny, including a COR or SECOR audit.
Preserving the scene
Once people are safe, resist the urge to clean up. A scene that has been tidied before it is documented is evidence that is gone. Photograph everything from multiple angles before anything is moved, including the general area, the specific point of the incident, any equipment or tools involved, and the condition of PPE worn at the time.
- Photograph first, move second, and only move what is unsafe to leave in place.
- Identify every witness on site at the time, not just the ones who saw the moment of impact, and record their contact information immediately.
- Note environmental conditions that will not still be there tomorrow: weather, lighting, noise, housekeeping state, and anyone else working nearby.
- Tag and retain any damaged equipment, materials, or PPE rather than sending it back into service or the bin.
- Get written or recorded statements from witnesses separately, as soon as practical, before accounts start to blend together.
Interview witnesses one at a time and separately. A group conversation about what happened produces one shared story, not several independent accounts, and it is the differences between accounts that usually point to the real cause.
Finding the root cause, not just the immediate cause
Every incident has an immediate cause, the unsafe act or unsafe condition that sat right next to the injury. A worker's hand slipped, a guard was off, a load shifted. Stopping there produces a corrective action aimed at that one moment, and the same failure mode shows up again in six months wearing a different hazard's clothes.
The 5 Whys method is the simplest tool for pushing past the immediate cause to the root cause, and it needs no special software or training to use correctly. Start with the immediate cause and ask why it happened. Take that answer and ask why again. Keep going, typically around five times, until the answers stop being about the individual and start being about the system: the training that was skipped, the maintenance schedule that slipped, the procedure that was never updated after the equipment changed.</p>
- Why did the worker's hand get caught? The guard was removed from the machine.
- Why was the guard removed? It was in the way of a jam-clearing task performed several times a shift.
- Why did jam-clearing require removing the guard? The guard design does not allow clearing jams without full removal.
- Why was that never addressed? No one had raised it as a hazard through the reporting system.
- Why not? Workers were not confident that reporting a recurring nuisance would lead to any change.
That fifth answer is the one worth fixing. A root cause analysis that stops at "worker removed the guard" produces a corrective action of "retrain the worker on guard use," which does nothing about a guard design that makes the job harder to do safely. For incidents with more than one contributing factor, a fishbone or cause-and-effect diagram works alongside the 5 Whys to map causes across categories such as equipment, people, environment, and procedures rather than following a single thread.
Corrective actions that actually get tracked
A root cause analysis that ends in a paragraph nobody owns is not a corrective action, it is a summary. Every corrective action needs a specific fix, a named owner, and a due date, and it should be evaluated against the hierarchy of controls before anyone defaults to a toolbox talk.
- Elimination or substitution: can the hazard be removed entirely, such as redesigning the jam-clearing task so the guard never needs to come off.
- Engineering controls: can a physical barrier, interlock, or redesign reduce exposure regardless of behaviour.
- Administrative controls: procedures, scheduling, and job rotation, useful but dependent on consistent follow-through.
- PPE: the last line of defence, appropriate as a layer but rarely sufficient as the only corrective action for a systemic cause.
Log every corrective action in a tracker with status, owner, and target date, and revisit it until it is verified closed, not just marked complete. Verification means someone checked that the fix was actually implemented and that it is working as intended, whether that is a redesigned guard installed and tested or an updated procedure that workers have actually been trained on.
What an OHS officer or COR auditor expects to find afterward
When a provincial OHS officer or a COR or SECOR auditor asks to see your incident investigation records, they are looking for a complete file, not just a filled-in form. The paper trail should let someone who was not there reconstruct what happened, why it happened, and what changed as a result.
- A completed incident report with date, time, location, persons involved, and a factual description of events.
- Witness statements collected individually.
- Scene photographs taken before anything was disturbed.
- The root cause analysis itself, whether that is a documented 5 Whys chain or a fishbone diagram, not just a conclusion.
- A corrective action plan naming a specific fix, an owner, and a due date for each item.
- Evidence the corrective action was completed and verified, such as updated procedures, training sign-off sheets, or photos of the physical change.
- Sign-off from a supervisor or manager confirming the file is closed.
That last piece, a closed and signed file with verified corrective actions, is what separates an investigation that satisfies an auditor from one that raises a follow-up question. If your current process stalls somewhere between the root cause worksheet and an actual tracked fix, that is usually a documentation gap rather than an investigation gap, and it is worth reviewing your incident reporting forms and corrective action tracker before your next COR or SECOR audit cycle.