Incident investigation
Incident investigation questions test whether you can preserve evidence, separate causal layers, and produce corrective actions that change the system. The exam rewards fact-finding, not fault-finding.
Core rules and concepts
- Secure the scene and isolate hazards first; then collect physical evidence, documents, and witness accounts before memories fade.
- Distinguish immediate cause (the event or condition) from contributing causes and root causes.
- Use structured methods such as 5 Whys, fishbone diagrams, or fault trees; test each cause against evidence.
- Corrective actions should follow the hierarchy of controls and have an owner, due date, and verification step.
- Investigate near misses with the same rigor, because they reveal failures before harm occurs.
Worked example
A worker slips on oil near a conveyor. The immediate cause is oil on the floor. Interviews and maintenance records show a leaking seal was reported twice but not scheduled for repair. The root cause is the preventive-maintenance backlog and lack of a tracking system. A suitable action is a maintenance work-order system with priority rules and weekly review; 'retrain the worker to watch for spills' does not address the leak. The investigation report links evidence to each cause and closes only after the repair and tracking are verified.
Traps that cost marks
Stopping at 'employee carelessness.' Writing recommendations without owners or dates. Blaming a witness and losing cooperation. Confusing a corrective action with a lesson learned.