ISO 45001 Incident Investigation Template: From Near Miss to Corrective Action
An ISO 45001 incident investigation template should do more than describe what happened. Its real value lies in showing why the event was possible, what the organisation learned and whether the response made work safer.
That applies even when nobody was injured. A near miss can expose the same weaknesses in equipment, supervision, planning or working conditions as an accident. The difference may simply be timing or luck.
An effective ISO 45001 incident investigation template therefore needs to create a clear evidence trail. It should connect the event to its immediate and underlying causes, involve the people who understand the work, generate proportionate corrective action and prompt a check that the action was effective.
This is what turns an incident record from a completed form into useful evidence of learning and continual improvement.
The investigation trail at a glance
Each stage should lead naturally to the next. Skipping from the event straight to an action makes it easy to treat a symptom while leaving the real cause untouched.
Make it safe
Deal with injuries, isolate danger and preserve anything that may help establish the facts.
Gather evidence
Record the sequence, people involved and relevant photographs, documents and workplace conditions.
Find the causes
Look beyond the final act or failed component to the conditions and decisions behind it.
Take action
Choose controls that address the findings, with clear owners, priorities and completion dates.
Verify the change
Close the investigation only when there is evidence that the actions worked in practice.
What an effective ISO 45001 incident investigation template records
A usable form should be detailed enough to support learning without becoming so cumbersome that people avoid it. It will normally capture:
- The incident or near-miss category, date, time and location
- People affected, witnesses and the investigator
- A factual account and the sequence leading to the event
- Injuries, damage or credible potential consequences
- Immediate action taken to make the situation safe
- Relevant photographs, documents and other evidence
- Immediate, underlying and root causes
- Worker or representative involvement
- Actions, owners, priorities and completion dates
- Changes to risk assessments, controls or training
- Any reporting decision, including RIDDOR consideration
- Approval, close-out and an effectiveness-review date
Reporting is not the same as investigating. The first report should make it easy for a worker to raise an event promptly. The investigation record can develop as evidence is gathered and causes are tested.
The two records can sit within the same workflow, provided their purpose and status are clear. A reference number should connect the notification, investigation, actions and final review.
The form should separate facts from assumptions. A witness account can be recorded as evidence, for example, but it should not automatically become the final explanation. The investigation level should also be proportionate: a low-potential event may need a short local review, while a serious or high-potential incident may require a competent team and more detailed analysis.
A forklift near miss
Imagine a forklift reversing from a loading bay as a warehouse employee steps into the same route. The driver brakes and no contact occurs. A useful investigation follows the evidence rather than reaching for a quick explanation.
The weak conclusion
“Pedestrian failed to use the marked walkway. Reminded staff to take care.” It closes the form quickly, but explains very little and is unlikely to prevent recurrence.
What the evidence shows
The walkway was partly blocked by returned stock, the reversing alarm was hard to hear, a temporary worker had not received a site walk-through and the loading schedule created congestion.
The stronger response
Clear and protect the route, improve separation, review traffic flow and induction, change the busy-period loading arrangement and then verify the revised controls in use.
Those findings point to workplace and system causes, not one careless person. The workplace-transport risk assessment should also be reviewed. The investigation is not complete merely because actions appear on a list; somebody should confirm that they were implemented and effective.
Find causes, not culprits
People still need to follow agreed controls, but stopping at “operator error” rarely prevents recurrence. It can also discourage workers from reporting near misses or speaking openly.
The Health and Safety Executive's HSG245 investigation workbook separates immediate, underlying and root causes. That distinction moves the investigation from the visible event to work design, maintenance, competence, supervision and management decisions.
Worker consultation matters. The people doing the job often know about workarounds, intermittent faults and differences between the written method and the work as it is really done.
Where RIDDOR fits
An internal investigation and a legal report are related but different. Not every accident is reportable, and many near misses do not meet the definition of a reportable dangerous occurrence.
The template should prompt a RIDDOR decision, identify who made it and retain any report reference. It should not replace the current HSE guidance on reportable incidents.
An event can still deserve investigation even when it is not reportable. The question is what can be learned and whether further harm can be prevented.
The audit trail should continue beyond the form
An auditor should be able to follow the response from the event to the completed and verified change. That trail may include worker input, an updated ISO 45001 risk assessment, revised controls or training and a later effectiveness check.
Trends matter as well. Several individually minor events involving the same activity, location or control may show a wider issue. Incident data should feed into performance evaluation, internal audit and management review rather than remaining in separate files.
This connected trail is stronger than a polished form on its own. It demonstrates that the organisation noticed the warning, understood it and changed the way risk was controlled.
Build a working ISO 45001 system, not an incident folder
Incident investigation connects with hazard identification, risk assessment, worker consultation, competence, operational control and continual improvement. Managing each element separately makes actions easier to lose and evidence harder to retrieve.
The Compliance Companion's ISO 45001 workspace brings editable documentation, implementation guidance, evidence and progress tracking into one structured system. It helps you adapt the records around the way your organisation works while keeping the links between an event, the response and the wider management system visible.
