Incident Investigation: How to Find the Root Cause and Stop It Happening Again

A conveyor bearing seizes at two in the morning. The crew replaces it, restarts the line, and goes home. Three weeks later, the new bearing seizes too. Nobody is surprised, because nobody ever asked why the first one failed. That’s the difference between fixing a problem and doing an incident investigation. One gets you running again. The other keeps you from having the same bad night twice.

The same logic applies when a person gets hurt, when a lift goes wrong, or when a near miss makes everyone’s stomach drop. This guide covers what incident investigation really is, how to dig past the obvious answer, and what separates a report that changes something from one that sits in a folder.

What Is Incident Investigation?

Incident investigation is the structured process of working out what happened, why it happened, and what needs to change so it doesn’t happen again. It applies to injuries, equipment failures, property damage, and close calls that could have turned into any of those.

The Canadian Centre for Occupational Health and Safety is clear on the purpose: the goal is to find the root cause so the event can be prevented, not to point a finger. That one idea shapes everything else. An investigation that hunts for someone to blame will get silence and half-truths. One that hunts for causes will get the real story, because people are willing to tell it.

Why Incident Investigation Matters on an Industrial Site

On an industrial site, most serious events don’t come out of nowhere. Usually the warning signs were there: a procedure that was quietly skipped, a guard that kept coming off, equipment that kept acting up. Incident investigation is how you look back while it still helps.

It also protects the next crew. The person at that conveyor next month never saw the failure, but they work under the fix.

Provincial occupational health and safety rules in Saskatchewan, Alberta, and Manitoba set their own expectations for investigating and reporting incidents, and serious events may need to be reported to the provincial authority. Check the rules where the work is happening.

Direct Cause vs. Root Cause: Where Most Incident Investigation Stops Too Early

This is the part most investigations get wrong. The direct cause is the thing that immediately produced the event: the bearing seized, the sling slipped, the guard was missing. The root cause is the reason that condition existed in the first place.

Stopping at the direct cause is tempting because it feels like an answer. “The bearing failed” is true, and it points to a replacement part. But it doesn’t tell you why the bearing failed, so the fix won’t last.

Between the two sit contributing factors: conditions that didn’t cause the event alone but made it more likely. Poor lighting, a rushed schedule, a missing procedure, or a worker new to the task can each play a part. A good investigation looks at all three levels, not just the one closest to the injury. And “the worker made a mistake” is almost never a root cause. It usually points to a procedure, design, or schedule that set the worker up.

The Incident Investigation Process, Step by Step

The details vary by site, but a sound incident investigation follows the same basic path:

Secure the scene. Make the area safe, treat any injured person first, and preserve evidence. Don’t clean up before anyone has looked.
Start quickly. Memories fade fast. Start early.
Gather information. Photograph the scene, check equipment, and review procedures and records. Interview witnesses separately with open questions.
Build the timeline. Lay out what happened in order, including what led up to it, not just the moment of the event.
Analyze the causes. Identify the direct cause, the contributing factors, and the root causes behind them.
Decide corrective actions. For every root cause, choose a specific fix, an owner, and a date.
Report and share. Write it up, communicate the findings, and make sure the lessons reach other crews.
Follow up. Confirm the corrective actions actually happened and actually worked.

The CCOHS guidance also recommends investigating as a team and including a worker representative, which adds the view of someone who actually does the job.

Root Cause Analysis in Practice: The 5 Whys

Root cause analysis has plenty of methods, but the simplest to use on a busy site is the 5 Whys. You state the problem, ask “why did that happen,” then ask why again about each answer until you reach something you can actually fix. Five is a rule of thumb, not a requirement.

Here’s an illustrative example using that conveyor bearing:

Why did the conveyor stop? The drive bearing seized.
Why did the bearing seize? It ran without enough grease.
Why was there not enough grease? The greasing point was missed on the last round.
Why was it missed? The route sheet didn’t include that point after the drive was modified.
Why wasn’t the sheet updated? There’s no step that updates maintenance routes when equipment changes.

The direct cause was a dry bearing. The root cause is a missing step in how changes are handled. Replacing the bearing again fixes none of that. Adding the update step does. This kind of reasoning also connects to your condition monitoring program, since a failure investigation often shows which early warning signs were available and ignored.

What a Good Incident Investigation Report Contains

An incident investigation report is only useful if someone could read it six months later and understand what happened and what changed. A solid one includes:

A clear description of the event, with date, location, and who was involved
A timeline of the events leading up to it
The direct cause, contributing factors, and root causes, stated plainly
The evidence behind each conclusion
Corrective actions, each with an owner and a due date

The corrective actions matter most. Great analysis with no tracked actions is just a story. An owner and a date for every fix makes it a plan.

How Incident Investigation Fits Into a Safety Program

Incident investigation is the learning half of a safety program. A job safety analysis plans the work, and toolbox talks carry that plan to the crew. Near miss reporting captures the close calls, and incident investigation turns the serious ones into lasting changes. Procedures like lockout tagout often get tightened as a direct result.

This is also what a COR-certified program is meant to show: not that nothing ever goes wrong, but that when something does, the system finds the cause and fixes it.

What to Ask a Contractor About Their Incident Investigation Process

How a contractor investigates is a fast read on how they work. A few direct questions help:

Who investigates an incident, and who else is involved?
How do you separate the direct cause from the root cause?
How are corrective actions tracked until they’re closed?
How do lessons reach crews on other jobs?

Specific answers suggest a real process. A vague answer about “having a procedure” usually means the process exists mostly on paper.

Frequently Asked Questions About Incident Investigation

What is the purpose of an incident investigation?

The purpose is to find the root causes of an incident so corrective actions can prevent it from happening again. It is not meant to assign blame to individuals.

What is the difference between root cause and direct cause?

The direct cause is what immediately produced the incident, such as a seized bearing. The root cause is the underlying reason that condition existed, such as a missing maintenance step.

What are the 5 Whys?

The 5 Whys is a simple root cause analysis method. You ask “why” repeatedly, using each answer as the basis for the next question, until you reach a cause you can fix.

What should happen after an incident investigation report is completed?

Each corrective action should be assigned, scheduled, completed, and checked to confirm it worked. The findings should also be shared with other crews so the lesson spreads beyond one site.

Fix the Cause, Not Just the Day

An incident will always have a story. The question is whether anyone reads it closely enough to change the ending. Good incident investigation digs past the obvious, treats people as sources instead of suspects, and doesn’t call the job done until the fixes are done.

Credence Construction investigates incidents to find causes, not to assign fault, across the mining, agricultural, and industrial sites we work on in Saskatchewan, Alberta, Manitoba, and Western Ontario. Our repair and maintenance crews apply the same thinking to equipment failures. If you want a contractor who fixes what caused the problem, call us at 306-786-7000.