Learn from Incidents: Capture the Scene & Root Cause

Last updated: March 2026

A workplace incident investigation is a structured process for determining why an incident happened and what changes will prevent it from happening again. The goal is never to assign blame. It is to find the root cause, fix it, and protect every worker who walks onto that site tomorrow.

Here is what most contractors get wrong: they treat the investigation as a formality. A worker slips off a ladder, the foreman writes "be more careful" on the report, and everyone moves on. Three months later, someone else falls from the same type of ladder in the same conditions. The investigation that could have caught the real problem, a worn rung, a wet surface, a missing tie-off point, never happened.

A proper investigation works backward from the incident to its causes. It looks beyond the obvious. It asks "why?" until the answers stop changing. This guide walks you through the full process, from the moment the incident happens to the corrective actions that prevent the next one.

When Is an Investigation Required in Canada?

Every Canadian province requires employers to investigate certain incidents. The threshold varies, but the principle is the same: if someone was hurt, or could have been, you need to find out why.

• British Columbia: Employers must investigate all incidents that required immediate notification to WorkSafeBC, including fatalities, serious injuries, structural failures, and hazardous substance releases. The investigation must identify the cause and recommend corrective actions. See our BC incident report guide for the full WorkSafeBC investigation requirements.
• Alberta: Employers (or the prime contractor) must investigate incidents that caused or could have caused serious injury. The investigation must produce a written report with circumstances, causes, and corrective measures. Scene preservation rules are strict: do not disturb the scene of a fatality or serious injury until an OHS officer gives permission. See our Alberta incident report guide for details.
• Ontario: The employer must investigate all incidents that result in critical injury or death, and provide a written report to the Ministry of Labour within 48 hours. The joint health and safety committee (JHSC) or health and safety representative must be involved. See our Ontario incident report guide for WSIB and Ministry requirements.

Beyond legal obligations, smart contractors investigate every incident and near miss. Near misses are free warnings. A load that swings wide today is a worker struck by a load tomorrow. For more on why near misses deserve the same investigation rigor, see our guide to near-miss reporting.

📹 Watch: How to Write an Incident Report — 7 Essential Elements

Step 1: Respond and Secure the Scene

The first minutes after an incident are about people, not paperwork. Ensure injured workers receive first aid or medical attention. Account for everyone on site. Eliminate any ongoing hazard: shut down equipment, isolate the area, stop work in the affected zone if needed.

Once the immediate emergency is handled, your next job is to freeze the scene.

Step 2: Freeze the Scene

Preserving the scene is the single most important step in the investigation, and the one most often skipped. Once workers start cleaning up, moving equipment, or resuming work, critical evidence disappears.

What "freezing" means in practice:

• Tape off or barricade the area. Start with a larger perimeter than you think you need. You can always reduce it later; you cannot recover evidence that was walked through.
• Do not move anything. Fallen tools, displaced equipment, loose materials: leave them exactly where they are. In many provinces (BC, Alberta, Ontario), disturbing the scene of a fatality or serious injury before a regulatory officer gives permission is a legal violation.
• Document weather conditions immediately. Wind, rain, temperature, and lighting change. If weather could compromise evidence (rain washing away a spill, wind shifting debris), cover or protect the relevant areas with tarps.
• Control traffic. Can vehicles be rerouted? If not, protect evidence from being driven over. If there is pedestrian traffic, consider screening the scene to prevent interference and to protect workers' privacy from bystanders and social media.
• Note the time. Record exactly when the scene was frozen, who authorized it, and when it was released.

Take your time. The pressure to "get the site moving again" is real, but rushing past this step undermines everything that follows.

Step 3: Document Everything

You are building a record that investigators, regulators, and possibly courts will rely on. Thoroughness now saves enormous problems later. For the full breakdown of what belongs in a written incident report, see our guide to the 7 essential elements of an incident report.

Photos

You cannot take too many photos. Start on the perimeter and work inward. Photograph from every angle. Capture:

• The point of injury or damage (close-up and wide-angle)
• Equipment involved, including condition, model/serial numbers, and any visible defects
• The surrounding environment: ground conditions, weather, lighting, signage
• Safety equipment that was or was not in use (harnesses, hard hats, guardrails)
• Any documentation visible at the scene (permits posted, hazard signs, inspection tags)

Photos preserve the two things that disappear fastest after an incident: evidence and memory. Use them when gathering witness statements — they are powerful memory joggers.

Witness Statements

Interview witnesses individually, as soon as possible after the incident. Memory degrades quickly, and group discussions can contaminate individual recollections.

• Reassure witnesses that the investigation is about prevention, not blame. A witness who fears punishment will not give you the full picture.
• Ask open-ended questions: "Tell me what you saw," "What were you doing just before it happened?" "Did anything seem unusual?"
• Use photos to prompt recall: "Do you see anything in this photo that was different at the time of the incident?"
• Include bystanders. Visitors, delivery drivers, or members of the public may have seen something workers missed.
• Not everyone can put their recollections into writing. For some workers, you may need to record their verbal account and transcribe it for their review and signature.

Supporting Paperwork

Tired of incident reports that sit in a filing cabinet? SE-AI early access analyzes your incident data to spot patterns before they become your next recordable.

Collect all documentation connected to the incident scene and the workers involved:

• Field Level Hazard Assessment (FLHA): Was the hazard identified during the pre-shift assessment? Were workers aware of it?
• Toolbox talk or safety meeting records: Were the workers present at the most recent meeting? Was the topic relevant to the incident?
• Inspection records: Site inspections, equipment inspections, and any corrective actions that came out of them.
• Permits: Work permits, hot work permits, confined space permits, anything applicable to the incident area.
• Training and orientation records: When were the workers trained? Are they new or young workers? When did they complete orientation? Who was their mentor?
• Safe work procedures: Is there a documented procedure for the task being performed? Was it current?

Step 4: Analyze Root Causes with the 5-Category Framework

This is where most investigations fail. They stop at the obvious: "the worker slipped." But a worker slipping is a symptom, not a cause. A proper investigation asks why the worker slipped, and then asks why again, and again, until the answers reach something the organization can fix.

The 5-category framework ensures you examine every dimension of the incident. For each category, ask questions and look for evidence. Keep detailed notes as you go.

1. Task

Examine the work procedure being used at the time of the incident.

• Was the procedure safe? Had conditions changed to make the usual process unsafe?
• Were appropriate tools and materials available and being used correctly?
• Were safety guards and devices used properly?
• Was a lockout procedure required? Was it followed?

For every "no," follow up with: "Why not?"

2. Material

Examine equipment and materials involved.

• Was there an equipment failure? What caused it?
• Were materials or equipment substandard or past their service life?
• Were hazardous products used? Were they identified clearly with proper labels and SDS?
• Could a less hazardous alternative have been used?
• Was appropriate PPE available, in good condition, and used correctly? Were workers trained on it?

Follow up: "Why were these conditions allowed to exist?"

3. Work Environment

Examine all environmental factors, especially sudden changes that may have compromised an initially safe setup.

• Weather: unusual conditions, heat stress, cold exposure, wind, rain, ice
• Housekeeping: debris, clutter, tripping hazards, spills
• Noise levels: could workers hear warnings or equipment signals?
• Lighting: adequate visibility for the task?
• Airborne hazards: toxic gases, dust, fumes present or possible?

4. Personnel

Explore the physical and mental state of the workers involved. Remember to consider the psychological environment as well, as these factors change from day to day and are often influenced by external sources.

• Were the workers fatigued? How many hours had they been working?
• Did they have sufficient training and experience for the task?
• Was shift work an issue? Were they at the end of a long rotation?
• Was there stress, whether at work or personal, that may have affected focus?
• Was there pressure, explicit or implied, to complete the task quickly or to bypass safety procedures?

5. Management

Management system failures can be direct or indirect causes. As the party with legal obligation for workplace safety, management's role must always be examined.

• Were safety rules and procedures clearly communicated to workers?
• Did workers have access to safe work procedures? Were these procedures being enforced?
• Was training consistent and adequate?
• Were safety inspections conducted regularly? Were unsafe conditions corrected when found?
• Had previous concerns been raised about the condition that led to this incident? Were they addressed?

The management category often reveals the root cause. A worker might slip on ice (environment), but the root cause may be that no one was assigned to inspect and treat walkways (management), or that the de-icing budget was cut (management), or that workers were not trained to report icy conditions (management + training).

For a deeper dive into structured root cause methods like the 5 Whys and Fishbone diagram, see our root cause analysis template guide.

Step 5: Write the Investigation Report

The investigation report is a separate document from the initial incident report. The incident report captures what happened. The investigation report explains why it happened and what you are going to do about it.

A complete investigation report should include:

1. Incident summary: What happened, when, where, who was involved, what injuries or damage resulted
2. Investigation team: Who conducted the investigation and their qualifications
3. Evidence collected: Photos, witness statements, documents reviewed, physical evidence examined
4. Root cause analysis: The causal chain from immediate cause to root cause, using the 5-category framework or another structured method
5. Corrective actions: Specific actions to prevent recurrence, each with an assigned owner and completion deadline
6. Follow-up plan: How and when corrective actions will be verified as effective

Be specific. "Improve training" is not a corrective action. "Conduct fall protection refresher training for all framing crew workers by April 15, delivered by the site safety coordinator, with attendance documented" is a corrective action. For guidance on the legal aspects of investigation documentation, see our legal guide to incident report confidentiality and retention.

Step 6: Implement Corrective Actions and Follow Up

An investigation without follow-through is worse than no investigation at all. It creates a paper trail showing you knew about the problem and did nothing.

• Assign every corrective action to a specific person with a specific deadline. "The team will address this" means nobody will address it.
• Track completion. Use a corrective action log or safety management software that sends reminders and requires sign-off.
• Verify effectiveness. After the corrective action is implemented, check that it actually works. Did the new procedure stick? Is the repaired equipment holding up? Are workers following the updated process?
• Share findings. Review investigation results with workers in toolbox talks or safety meetings. Explain what happened, why it happened, and what changed. Worker participation is vital for any safety program to thrive, and sharing results encourages future reporting.

It is rare that an incident has never happened before in some form. The causes and corrections from prior incidents can shed new light on the current one. Keep investigation records accessible so they can inform future investigations.

Who Should Conduct the Investigation?

The severity of the incident determines the resources involved, but certain principles apply to every investigation:

• The investigator should not be the person responsible for the area where the incident occurred. This is not about blame, but about objectivity. A supervisor investigating their own crew's incident may unconsciously overlook systemic issues.
• Include diverse perspectives. The best investigations combine: someone experienced in incident causation models and investigative techniques, someone knowledgeable about the specific work process, and a worker representative (JHSC member, safety representative, or union representative where applicable).
• Frontline workers are essential. The "boots on the ground" supervisors and workers who do the job daily offer a perspective that safety managers and executives often lack. Encouraging their input also increases buy-in to the corrective actions that follow.

For serious incidents (fatalities, critical injuries, major structural failures), you may need external investigators or may be required to coordinate with provincial regulators, WCB, or police. Have a plan in place for this before it happens.

How Safety Software Improves the Investigation Process

Paper-based investigations work, but they create friction at every step. Documents get lost. Photos are on someone's phone. Witness statements are in a folder that nobody can find six months later.

Digital safety management software like Safety Evolution streamlines the entire investigation workflow:

• The initial incident report is formatted to capture scene details, witness statements, and photos. Workers submit from any device in the field.
• When an investigation is triggered, the software pulls in all relevant documentation: the initial report, linked inspections, training records, and permits.
• The investigator can map causal factors, document the root cause analysis, and create corrective actions, all within the same system.
• Corrective actions are assigned, tracked, and followed up with automatic reminders. No more spreadsheets and sticky notes.
• Management is notified immediately when an incident occurs and can monitor investigation progress in real time.