Incident Investigation

What is incident investigation?

In the Australian Work Health and Safety landscape, incident investigation has evolved from a reactive, compliance-driven obligation into a sophisticated strategic function critical to organisational resilience. It's the primary mechanism by which your organisation learns from its failures, capturing lessons learned and transitioning from vulnerability to proactive risk management.

Under the Model Work Health and Safety Act 2011 and state-based derivatives, investigating incidents isn't merely a statutory requirement—it's a fundamental expression of your PCBU's primary duty of care. If an incident occurs and you fail to investigate and rectify the cause, you may be deemed to have failed in your primary duty, exposing you to prosecution.

Modern investigative practice requires a shift in focus from the "sharp end" of human error—the immediate actions of workers—to the "blunt end" of systemic organisational factors. Australian best practice now views incidents not as isolated aberrations caused by "bad apples," but as systemic outputs of complex organisational environments.

What must be investigated?

The scope of what requires investigation is dictated by both legal statutes and your internal risk appetite. Understanding these categories helps you allocate investigative resources appropriately.

Following the 2025 legislative amendments, the definition of workplace incidents now includes work-related suicide, extended absences due to psychological injury, and sexual assault. This necessitates a fundamental shift in your investigative techniques to handle trauma-informed processes.

Australian legal framework

Your statutory duties as a PCBU

You hold the primary duty of care under Section 19 of the WHS Act. This duty requires you to provide and maintain safe systems of work. Incident investigation is the feedback mechanism that validates whether your systems are actually safe.

Section 38 of the WHS Act mandates that you must notify the regulator immediately after becoming aware of a notifiable incident. The term "immediately" is interpreted strictly by courts—it means "without delay" once the immediate emergency has been managed.

Notification requirements (Section 38)

You must notify the regulator for:

• Death of a person arising out of the conduct of your business
• Serious injury or illness requiring immediate hospital inpatient treatment, amputation, serious head/eye/spinal injury, serious burns, degloving, loss of bodily function, or serious lacerations
• Dangerous incidents including uncontrolled substance escape, explosion, electric shock, fall of plant/objects from height, excavation collapse, or mobile plant overturning
• Violent incidents (2025) including work-related suicide, sexual assault, credible threats, or 15+ day absence due to psychological injury

Delaying notification to conduct an internal investigation first is a breach of the Act. Maximum penalties can reach $80,000 for corporations and $16,000 for individual officers.

Duty to preserve the incident site (Section 39)

You must ensure the incident site is not disturbed until an inspector arrives or directs otherwise. The site may only be disturbed to assist an injured person, remove a deceased person, make the site safe to prevent further incidents, or facilitate a police investigation.

This creates critical operational tension. You want to access the scene immediately to gather perishable evidence, but you must respect the statutory freeze. Unauthorized disturbance is a strict liability offence with significant penalties.

Industrial manslaughter and officer liability

The proliferation of Industrial Manslaughter laws across Australian jurisdictions has raised the stakes for incident investigation. Under Section 27 of the WHS Act, Officers (Directors, CEOs) must exercise due diligence to ensure you comply with your duties.

An investigation that reveals a history of ignored incidents or under-resourced safety departments can provide the evidence necessary to prosecute Officers for reckless conduct or manslaughter. Your investigations must be unflinching in examining executive decision-making—if you stop at the supervisor level, you may fail to identify the very governance failures that create legal liability.

Modern investigation methodology: from blame to systems thinking

Historically, safety investigations followed a "Bad Apple" theory, seeking to identify the individual whose error caused the accident. Modern Australian practice, guided by the Swiss Cheese Model (James Reason), rejects this approach entirely.

The model posits that an accident results from multiple layers of defense failing simultaneously. Your investigation should identify all these failed layers, not just the final human action.

The ICAM methodology

The Incident Cause Analysis Method (ICAM) has become the industry standard for high-level investigations in Australia, particularly in mining, resources, and construction. ICAM categorizes contributing factors into four distinct levels, analyzed in reverse order from the incident.

The "Gold Standard" of an ICAM investigation is identifying the Organizational Factors. Correcting these provides the highest return on investment for safety, as it fixes the system rather than just the symptom. This systematic approach aligns with Root Cause Analysis (RCA) methodologies that probe beyond surface-level causes.

Safety-II and local rationality

Safety scientist Sidney Dekker argues that traditional investigations suffer from hindsight bias—the tendency to view the outcome as inevitable and judge actions based on knowledge the actors didn't have at the time.

Instead of asking "Why didn't they do X?", effective investigators ask "Why did doing Y make sense to them at the time?" This principle of "local rationality" means you must reconstruct the goals, knowledge, and focus of attention that people had in that moment, rather than judging from the outside.

The investigation lifecycle: a practical workflow

Phase 1: Immediate response & triage

The "Golden Hour" following an incident is critical. Data is perishable—memories fade, physical scenes are disturbed, and evidence disappears.

Secure the scene: Implement Section 39 preservation using physical barriers, tape, bollards, and security guards if required.

Triage the severity: Determine investigation level—Level 1 (Minor) uses 5 Whys by supervisor, Level 2 (Moderate) uses mini-ICAM by safety advisor, Level 3 (Major/HiPo) requires full ICAM by lead investigator with legal privilege considerations.

Notification check: Your Senior Safety Manager must assess against Section 38 triggers. If in doubt, the default position in Australia is to notify to avoid the criminal offense of non-notification.

Phase 2: Data collection using PEEPO

To ensure holistic investigation, Australian safety professionals use the PEEPO framework to structure evidence gathering. This prevents "tunnel vision" where you focus only on one aspect.

Best practice uses PEEPO at the start of your investigation as a brainstorming tool to direct the search for evidence, ensuring no category is overlooked.

Phase 3: Investigative interviewing (PEACE model)

Interviewing is the most delicate phase. Poor interviewing can contaminate memory and shut down information flow. Australian regulators and police use the PEACE model, which you should emulate:

• Planning and Preparation: Define objectives and needed information
• Engage and Explain: Build rapport, explain the safety-focused purpose (not blame), describe the process
• Account: Use open-ended questions ("Tell me what happened..."), avoid leading questions, let the witness tell their story uninterrupted
• Closure: Summarize the account to ensure accuracy, maintain relationship for future follow-up
• Evaluation: Review information against physical evidence

With the 2025 focus on psychosocial incidents, your interviewers must be trained to recognize trauma. Retelling an event can be re-traumatizing. Offer support persons, and ensure the environment is private and safe.

Phase 4: Analysis and sense-making

Using your chosen methodology (ICAM, Fishbone, Bowtie), organize the data you've collected. Building a precise, second-by-second chronology is often the most revealing step—it highlights gaps in knowledge.

Map the timeline against your "Work-as-Imagined" procedures to see where they diverged from "Work-as-Done." This reveals systemic design flaws rather than individual failures.

Phase 5: Recommendations and corrective actions

Your Corrective Action Plan (CAP) must prioritize controls using the hierarchy of controls—Elimination and Engineering controls over Administrative or PPE controls. An action plan relying solely on "Toolbox Talks" is weak and likely to fail.

Make actions SMART: Specific, Measurable, Achievable, Relevant, Time-bound. Instead of "Improve safety culture," write "Implement biometric fatigue monitoring system on all haul trucks by Q3 2025."

Root Cause Analysis Tools

The 5 Whys

For lower-consequence incidents, the 5 Whys technique is widely used due to its simplicity. You ask "Why?" iteratively until you reach a systemic cause.

Example: Vehicle won't start → Battery dead → Alternator broken → Belt snapped → Belt beyond service life → Maintenance schedule not followed (Root Cause)

The 5 Whys can be linear and simplistic, often leading to a single root cause when reality involves multiple converging factors. It relies heavily on your investigator's knowledge—if they don't know the answer to a "Why," the analysis stops. It's best used for simple mechanical failures rather than complex organizational accidents.

Fishbone (Ishikawa) diagram

The Fishbone diagram is a visual tool for categorizing causes into "ribs" (typically People, Methods, Machines, Materials, Environment) leading to the "head" (the incident). It's particularly effective for brainstorming sessions with your team, visualizing complex interactions between different categories of failure.

Bowtie analysis

While often used for risk assessment, Bowtie analysis is also a powerful investigation tool. It maps Threats on the left, Consequences on the right, and the Top Event (loss of control) in the center.

Your investigation then checks the status of every Preventative Control (left side) and Recovery Control (right side). This clearly identifies which barriers failed and is excellent for visualizing High Potential incidents where the consequence didn't happen, but controls failed.

Critical challenges: legal privilege and self-incrimination

Legal professional privilege (LPP)

LPP protects confidential communications between a lawyer and their client from disclosure to regulators and courts. For LPP to apply, your investigation report must be created for the dominant purpose of providing legal advice or for use in existing or anticipated litigation.

Here's the conflict: safety legislation requires you to investigate incidents to prevent recurrence. If you conduct an investigation to satisfy this statutory duty, it cannot be privileged. Courts have ruled that "dual-purpose" documents generally fail the dominant purpose test and are discoverable.

The "two-track" investigation strategy

Sophisticated organisations often employ a two-track strategy following serious incidents:

Privileged Track: Commissioned directly by external legal counsel. The investigator reports to the lawyer. This investigation focuses on liability, potential prosecution, and legal defense. It's protected by LPP.

Non-Privileged Track: Commissioned by your Safety Department. This focuses on fact-finding and immediate safety improvements to meet statutory obligations. This report is discoverable by the regulator.

Using in-house counsel to commission the investigation is riskier than using external counsel, as in-house lawyers often have commercial/operational roles, making the "dominant purpose" harder to prove.

Coercive powers and self-incrimination

Inspectors have broad powers under Section 171 of the WHS Act to require document production and answers to questions. Individuals must answer the inspector's questions, but the answer given under compulsion cannot be used against that individual in civil or criminal proceedings (except for perjury).

Your internal company investigators do not have these statutory powers. Employees may refuse to answer questions unless their employment contract mandates cooperation. If they do answer, those answers are generally not protected by statutory immunity and could be subpoenaed by the regulator.

Just culture and cognitive biases

The just culture framework

If your workers fear that reporting a mistake will lead to discipline, they'll hide evidence, leading to a "secret" organization where risks go unmanaged. A Just Culture creates an atmosphere of trust where people are encouraged to provide safety-related information, while still maintaining accountability for reckless behavior.

To determine culpability, use the "Substitution Test": Could a peer with similar qualifications and experience, put in the same situation, have made the same error?

• If Yes: The issue is likely systemic (training, design, environment). Discipline is inappropriate.
• If No: The individual may be accountable.

Just Culture distinguishes between three types of behavior:

• Human Error: Inadvertent slips, lapses, or mistakes. Response: Console the worker and fix the system.
• At-Risk Behavior: Drifting into unsafe habits because they're rewarded (e.g., saving time). Response: Coach the worker and remove the incentive.
• Reckless Conduct: Conscious disregard for substantial and unjustifiable risk. Response: Discipline/Punish.

Cognitive biases in investigation

Your investigators are human and subject to cognitive biases that can derail analysis:

Hindsight Bias: Seeing the event as having been predictable, leading to harsh judgments ("They should have known").

Confirmation Bias: Seeking evidence that confirms a pre-existing theory and ignoring contradictory evidence.

Outcome Bias: Judging decisions based on severity of outcome rather than quality of the decision at the time. A shortcut praised 99 times is condemned the one time it causes an injury.

Psychosocial hazards: the 2025 paradigm shift

The 2025 amendments to the WHS Act place psychosocial hazards on equal footing with physical hazards. This requires a new set of investigative skills.

Investigating psychosocial incidents

Investigations into bullying, harassment, sexual assault, and suicide differ fundamentally from physical investigations.

Evidence is subjective: Unlike a broken machine, the "damage" in a bullying case is often based on perception and pattern. Evidence includes emails, witness observations of interactions, and culture surveys.

Systemic causation: You must look at organizational design—workloads, role clarity, leadership styles, and change management processes—as root causes of stress and conflict.

Confidentiality: Privacy is paramount. You often need to redact identities to protect victims and witnesses from retaliation, which is common in toxic cultures.

Trauma-informed approach

When investigating sexual assault or workplace violence (now notifiable), your investigation process itself must not cause harm:

• Allow the victim to control the pace of the interview
• Provide access to psychological support (EAP) during the process
• Focus on the system (security, lighting, lone worker procedures) rather than questioning victim credibility

Measuring effectiveness and common failures

Why investigations fail

Coronial inquests in Australia frequently highlight inadequacy in workplace investigations. Common themes include:

Superficiality: Stopping at "worker error" or "failure to follow procedure" without asking why the procedure wasn't followed—was it outdated? Impossible to follow?

Siloed data: Failing to connect the fatal incident with previous minor near misses that shared the same root cause.

Failure to implement: The most damning finding is often that your organization knew of the risk from a previous investigation but failed to implement the recommendations.

Effectiveness of interventions

Academic reviews of WHS interventions in Australia suggest that "Administrative" controls (training, procedures) are the most commonly recommended actions but have the lowest effectiveness. Effective investigations result in "Structural" or "Engineering" changes—automating hazardous tasks, installing physical barriers.

Closing the loop

Your investigation is only as good as its closed actions. Best practice requires:

Tracking: Use software to track Corrective Action Plans to closure.

Verification: Implement a "Safety Action Verification" step where a manager checks 3 months later if the action was actually done and if it actually reduced the risk.

Feedback: Inform the person who reported the incident of the outcome. This builds trust and encourages future reporting.