Safety
How to Investigate a Workplace Incident: A Practical EU Guide for SMEs
A practical, step-by-step process for preserving evidence, finding underlying causes, assigning corrective actions, and preventing repeat incidents.
Published July 13, 2026 · Author Marian Stratulat · Reading time 12 min read · Last updated July 13, 2026
When something goes wrong at work, the first priority is always people: provide medical help, stop any continuing danger, call the emergency services if needed, and make the area safe. Once the immediate situation is under control, the investigation begins. Its purpose is not to find someone to blame — it is to understand what happened, why it happened, and what needs to change so that it does not happen again. For a small or medium-sized company, an investigation does not need to become a complicated legal exercise. It does need to be timely, factual and followed by action.
Our guides provide general educational information. Requirements vary by country, industry, and organization. Always verify applicable legislation, standards, and professional requirements.
Why this topic matters
- Any accident that causes injury, illness or damage deserves attention. Serious events will usually require a formal investigation, but smaller incidents and near misses can be just as useful to investigate.
- A box falling from a shelf without hitting anyone may look unimportant. In reality, it could reveal a storage problem that may cause a serious injury next time.
- Consider the actual and potential severity of the event.
- Consider whether a similar event has happened before.
- Consider whether national law requires reporting or investigation.
- Consider whether the incident exposed a wider problem in equipment, training, supervision or work planning.
- Consider whether specialist knowledge is needed.
- The depth of the investigation should match the risk and complexity of the event. A straightforward near miss may need a short review; a serious injury, equipment failure or chemical release may require technical experts and involvement from public authorities.
Step-by-step process
- 1. Respond to the emergency. Arrange first aid and medical care. Isolate dangerous equipment or substances, manage fire or evacuation risks, and prevent further harm. Do not let the investigation interfere with rescue or emergency work, but avoid moving or changing anything unnecessarily once the area is safe.
- 2. Check the legal requirements. Determine whether the incident must be reported to a labour inspectorate, insurer, police, prosecutor or another authority. Check the relevant national rules immediately because deadlines and reporting thresholds differ between EU Member States. Serious incidents may also be subject to sector-specific rules (construction, transport, chemicals, major hazards).
- 3. Secure the scene and preserve evidence. If it is safe and legally permitted, restrict access to the area and record its condition before anything is moved. Useful evidence includes photographs and video; the position and condition of equipment, tools and materials; measurements, samples and damaged components; CCTV, access-control records and system data; maintenance and inspection records; risk assessments, work instructions and permits to work; training records, shift plans and audit reports. Take privacy, data-protection and evidence-retention rules into account.
- 4. Appoint the investigation lead. Choose someone who understands the work but can examine the event objectively. Define who will collect evidence, conduct interviews, analyse causes and approve corrective actions. Include workers or their representatives where required or appropriate. Bring in external expertise for complex machinery, electricity, chemicals, occupational health or possible criminal liability. Using an outside specialist does not remove the employer's responsibility for workers' safety and health.
- 5. Speak to the people involved. Interview witnesses as soon as reasonably possible, while memories are fresh. Speak to people separately in a quiet place. Use open questions: What were you doing before the incident? What did you see and hear? What happened next? Was anything different from normal that day? Were there any problems with equipment, instructions, time pressure or staffing? What do you think could prevent this happening again? Explain that the aim is to learn, not to assign blame.
- 6. Build a factual timeline. Put the known events in order — before, during and immediately after the incident. Separate facts from assumptions. If two accounts conflict, record the difference and look for other evidence rather than choosing the version that sounds most convenient. A clear timeline often reveals missing information, unexpected changes or decisions that need closer examination.
- 7. Identify immediate and underlying causes. The immediate cause is what directly led to the event (missing guard, slippery floor, shifted load). Do not stop there — ask why that condition existed. Underlying factors may include inadequate maintenance or inspection; unclear or outdated procedures; unsuitable equipment; incomplete training; poor communication between shifts or contractors; weak supervision; unrealistic workloads or time pressure; changes that were not properly assessed; known problems that were not corrected. Ask: what would have had to be different for this incident not to occur?
- 8. Agree corrective and preventive actions. Each important cause should lead to a practical action. Avoid vague recommendations such as "be more careful" or "repeat the training." Where possible, remove the hazard or control it at source — engineering or organisational controls are generally more reliable than warnings or PPE alone. For every action, record what will be done, who is responsible, the deadline, any temporary measures needed until completion, and how effectiveness will be checked.
- 9. Write and communicate the findings. The report should be understandable to someone who was not present. Include the incident details, evidence considered, timeline, causes, corrective actions, owners and deadlines. Share relevant findings with management, affected workers and worker representatives. Communicate lessons without exposing unnecessary personal or medical information.
- 10. Follow up until the risk is controlled. An investigation is not finished when the report is signed. Track every action to completion and check whether it actually reduced the risk — through a workplace inspection, worker feedback, review of maintenance data or observation of the revised task. Update risk assessments, procedures and training where necessary. If the action did not work, revise it.
Roles and responsibilities
- Investigation lead — understands the work, examines the event objectively, and coordinates evidence, interviews, cause analysis and corrective actions.
- Workers and their representatives — participate where required or appropriate; their knowledge of daily work often reveals underlying conditions.
- External specialists — brought in for complex machinery, electricity, chemicals, occupational health or possible criminal liability.
- Employer — retains overall responsibility for workers' safety and health; using an outside specialist does not transfer this duty.
- Management — receives findings, allocates resources, and signs off corrective actions and deadlines.
Common mistakes
- Investigating only injuries and ignoring high-potential near misses.
- Looking for a person to blame instead of examining how the work was organised.
- Allowing the scene, data or witness evidence to be lost.
- Mixing facts, opinions and assumptions in the timeline.
- Stopping at the immediate cause.
- Recommending training when the real problem is unsafe equipment or poor work design.
- Assigning actions without an owner or deadline.
- Closing the case without checking whether the actions were effective.
Practical recommendations
- Where possible, remove the hazard or control it at source rather than relying on warnings or PPE alone.
- Prefer engineering or organisational controls over behavioural fixes — they are generally more reliable.
- For every corrective action, record what will be done, who is responsible, and the deadline.
- Define any temporary measures needed until the permanent action is complete.
- Plan in advance how the effectiveness of each action will be verified.
- Consult workers or their representatives when designing the controls — they see the work every day.
Documentation requirements
- A written report understandable to someone who was not present, covering incident details, evidence considered, timeline, causes, corrective actions, owners and deadlines.
- A factual timeline separating verified facts from assumptions.
- Preserved evidence: photos, video, measurements, samples, CCTV and system data, maintenance and inspection records, risk assessments, permits to work, training records.
- Witness statements captured shortly after the event.
- Updated risk assessments, procedures and training records reflecting the corrective actions.
- Confirmation that reporting duties to authorities, insurers or others were met within the applicable national deadlines.
- A short SME closing checklist: emergency handled; reporting duties checked; evidence preserved; people interviewed; factual timeline; technical, human and organisational causes considered; workers or reps consulted; clear actions with owners and deadlines; lessons communicated; actions completed and verified as effective.
Key takeaways
- The purpose of an investigation is to learn and prevent recurrence — not to assign blame.
- Match the depth of the investigation to the risk and complexity of the event; near misses often deserve serious attention.
- EU Directive 89/391/EEC sets general principles for worker safety and health, but exact definitions, notification thresholds, deadlines, forms and participation requirements depend on national law and may vary by sector across EU Member States.
- Get advice from a competent health and safety or legal professional when an incident is serious, reportable, technically complex or potentially subject to enforcement or criminal proceedings.
- An investigation is only finished when the corrective actions are complete and verified as effective.
Sources
- EU-OSHA: Directive 89/391/EEC — OSH Framework Directive — https://osha.europa.eu/en/legislation/directives/the-osh-framework-directive/1
- EUR-Lex: Council Directive 89/391/EEC — https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31989L0391
- ILO: Investigation of occupational accidents and diseases — https://www.ilo.org/publications/investigation-occupational-accidents-and-diseases
- EU-OSHA OSHwiki: Accident investigation and analysis — https://oshwiki.osha.europa.eu/en/themes/accident-investigation-and-analysis
- EU-OSHA OSHwiki: Accident investigation techniques — https://oshwiki.osha.europa.eu/en/themes/accident-investigation-techniques
FAQ
Marian Stratulat
Founder · sAuditor
Helping companies improve safety and quality processes through practical inspections and clear corrective-action management.