NEBOSH Incident Investigation cheat sheet

Incident: any unplanned event that caused or could have caused injury, ill health, damage, or loss; 'accident' is the subset that actually caused harm.

Investigation aims: establish causes and underlying deficiencies, prevent recurrence, meet legal duties, and feed lessons into risk assessment; blame allocation is not an objective.

Statutory basis in the UK: RIDDOR 2013 requires reporting deaths, specified injuries, over-7-day injuries, dangerous occurrences, and reportable occupational diseases to the enforcing authority.

Reportable over-7-day injury: incapacitation for more than seven consecutive days (excluding the day of the incident) from normal work duties; an over-3-day injury is recordable in the accident book but not RIDDOR-reportable.

Dangerous occurrence: a near-miss with high harm potential listed in RIDDOR (e.g., scaffold collapse, lifting equipment failure, electrical short-circuit causing fire) that must be reported even without injury.

Investigation levels: minimal (first-aid, minor damage), low (record and local review), medium (formal team investigation), high (full team plus specialist/legal input) - chosen by actual and potential consequence.

Immediate causes are the unsafe acts and unsafe conditions at the point of loss; root causes are the management-system failures (e.g., inadequate training, poor supervision, missing maintenance) that allowed them.

Human factors: errors (slips, lapses, mistakes) and violations (routine, situational, exceptional) are consequences of system design, not simply 'carelessness'.

Investigation must start promptly: preserve the scene, isolate the area, and record perishable evidence (positions, environmental conditions, witness memory) before clean-up begins.

Evidence types: people (witness statements, interviews), positions (scene layout, photographs, sketches), parts (failed components, equipment), and paper (procedures, permits, training records, maintenance logs).

Evidence hierarchy for physical items: preserve in situ, photograph and sketch before moving, label and bag, record chain of custody, and store securely for potential legal proceedings.

Witness interviews: conduct separately and as soon as practicable; use open questions first (what happened, what did you see), then probe; avoid leading questions and recording opinions as fact.

Interview structure: explain purpose and no-blame intent, establish the witness's role and vantage point, obtain free recall, clarify sequence and timings, confirm understanding, and record verbatim where possible.

Statements should record time, date, location, witnesses present, what was seen/heard, actions taken, and the witness's signature and date; distinguish observed fact from inference.

Scene reconstruction: use measurements, photographs from multiple angles, and scale drawings; note lighting, weather, floor condition, noise, and any obstructions at the time.

Documentary evidence to request: risk assessments, method statements, permits to work, training and competence records, maintenance/inspection records, and previous incident history.

Evidence must be reliable, sufficient, and relevant; triangulate across independent sources and record contradictions rather than resolving them by assumption.

Data protection and confidentiality: personal data in statements should be handled under GDPR principles; disclose only to those with a legitimate need (e.g., insurer, enforcing authority).

Five Whys: iteratively ask 'why' until the management-system cause is reached; typically 3-5 iterations; avoid stopping at 'operator error'.

Fishbone (Ishikawa) diagram: branches for Manpower, Method, Machine, Material, Measurement, and Environment (6M) to structure brainstorming of contributory factors.

Fault tree analysis: deductive, top-down; start from the top event and identify combinations of failures (AND/OR gates) that could produce it; useful for complex technical incidents.

Event tree analysis: inductive, forward from an initiating event through success/failure branches to outcomes; used for consequence modelling and barrier performance.

Bow-tie analysis: maps threats to a top event on the left and consequences on the right, with preventive and mitigating barriers; highlights barrier weaknesses.

Swiss-cheese model: incidents occur when holes in multiple defensive layers (organisational, supervisory, unsafe acts, technical) align; investigation should identify which barriers failed and why.

Task analysis / hierarchical task analysis: breaks the activity into steps and identifies where error or deviation was possible; supports design of controls.

Change analysis: compare the incident condition with a known safe baseline to reveal what changed (people, equipment, procedure, environment) before the event.

Barrier analysis (e.g., TRIPOD): identify failed, missing, or ineffective barriers and trace each to a pre-condition and underlying management factor.

Investigation report structure: executive summary, scope and terms of reference, methodology, sequence of events, findings (immediate and root causes), conclusions, recommendations with owners and timescales, and appendices.

Recommendations must be specific, achievable, and prioritised by risk (likelihood × severity); each should name an accountable person and a completion date.

SMART recommendations: Specific, Measurable, Achievable, Relevant, Time-bound; avoid vague actions such as 'retrain staff' without defined content or verification.

Hierarchy of control for corrective actions: eliminate, substitute, engineering controls, administrative controls, then PPE - prefer higher-order controls.

Action tracking: maintain a register with status, owner, due date, and evidence of completion; review at management meetings until closed and verified.

Effectiveness review: re-audit or re-inspect after implementation to confirm the control works; close the loop and communicate lessons learned to the workforce.

RIDDOR reporting: notify the enforcing authority without delay (e.g., by phone for deaths/specified injuries) and submit the written report within 10 days of the incident (15 days for over-7-day injuries).

Record-keeping: retain accident records (including over-3-day injuries) for at least three years; keep investigation files secure and available for inspection.

Legal privilege and disclosure: investigation reports may be disclosable in civil claims or criminal proceedings; separate factual findings from opinion and avoid speculative blame.