What is the best way to run a root cause analysis after a workplace incident?

Start with a timeline, not a theory

The moment an incident happens, everyone forms a theory. The operator was rushing. The guard was missing. The new guy did not know. These early theories are often partly right and almost always incomplete, and if you begin the analysis by testing your favorite theory, you will find evidence for it and stop. The better starting point is a plain timeline: what happened, in what order, from the beginning of the shift or the beginning of the task until the moment of injury or damage.

Build the timeline from multiple sources. Talk to the person involved, but also talk to whoever was nearby, whoever set up the job, and whoever did the same task on the previous shift. Pull the maintenance record for the equipment. Look at the photos taken at the scene. Lay the events out on a whiteboard or a long sheet of paper with times attached. Gaps and contradictions in the timeline are not a problem; they are the first clue about where to dig. Related: How can a small operations team build a safety record that holds up during an inspection?

Keep reading: Why should a workplace log near-misses when nobody was actually hurt in the incident?, How can a workplace make incident reporting fast enough that frontline workers actually use it?, How do you make sure a workplace safety alert reaches the right person immediately?. See how SafetyPingr helps you workplace safety incident logging and alerts.

Ask why until you reach a system, not a person

The classic approach is to ask why repeatedly, and it works when you use it honestly. Why was the worker's hand in the machine? To clear a jam. Why was there a jam? The feed guide was bent. Why was it bent? It was hit by a forklift two weeks ago and never repaired. Why was it not repaired? The damage was never reported because the operator did not think it was worth the paperwork. Notice that the chain moved from a hand in a machine to a reporting culture and a maintenance process in four steps.

The rule that keeps this honest is simple: if your final answer is a person's name or a character trait, you are not done. 'He was careless' is not a root cause, it is a description of the outcome. Every experienced worker takes shortcuts under the right conditions, so the useful question is what conditions made this shortcut seem reasonable on this day. Keep asking until the answer is something a manager could actually change: a procedure, a design, a staffing level, a training gap, a tool that was missing, a schedule that left no margin. Related: How do you make sure a workplace safety alert reaches the right person immediately?

Look for the conditions that made the shortcut reasonable

Most incidents involve someone doing something that, in hindsight, was obviously risky. The temptation is to stop there. The more useful move is to ask how many other people would have done the same thing in the same situation. If the honest answer is 'most of them,' then the situation is the problem. Was the safe method slower and the shift running behind? Was the correct tool broken or far away? Had the workaround become normal because it had never gone wrong before? These are the questions that turn an investigation into a prevention plan.

Check your own records while you do this. Search the near-miss log for the same machine, the same task, or the same time of day. Very often the incident you are investigating had two or three rehearsals that were reported and closed without action, or noticed and never reported at all. If you find them, the root cause analysis has also just revealed a gap in how you respond to near misses, and that belongs in the findings too. Related: Why should a workplace log near-misses when nobody was actually hurt in the incident?

Turn findings into actions someone owns

A root cause analysis that ends with a report and no assigned actions has failed regardless of how insightful it was. Each contributing cause should map to at least one corrective action with a named owner and a due date. Prefer actions that change the environment over actions that ask people to be more careful. Repairing the feed guide and adding damage reporting to the forklift pre-shift check are actions. 'Remind operators to keep hands clear' is a hope.

Write the analysis so that someone reading it in a year understands what happened and why without having been there. Keep it factual, avoid blame language, and distinguish clearly between what you know and what you infer. Then track the actions to closure and revisit the incident type after a few months to see whether it recurred. That follow-up is the only real test of whether you found the root cause or just the most convenient one. Related: Why is tracking corrective actions to completion the most important part of incident management?