Workplace Safety Incident Glossary and FAQ Hub
Plain-English definitions of the terms that show up in incident logging, alerting, investigation, and OSHA recordkeeping, followed by answers to the questions operations and EHS teams ask most.
- Acknowledgment time
- The elapsed time between an alert being sent and the intended recipient confirming they have seen it. It is a useful leading indicator of whether alert routing actually works, and a slow acknowledgment on a serious event is worth investigating on its own.
- Alert escalation
- A rule that moves an unacknowledged alert to the next person on a list after a set time. Escalation is what keeps a serious report from sitting with one unavailable person overnight.
- Audit trail
- A timestamped, unedited history of who created, changed, or closed a record and when. Inspectors, insurers, and attorneys rely on it to establish that a record is genuine and was not reconstructed after the fact.
- Corrective action
- A specific change made in response to an incident, near miss, hazard, or audit finding, intended to prevent recurrence. A complete corrective action has an owner, a due date, a definition of done, and a verification step.
- DART rate
- Days Away, Restricted, or Transferred rate. A lagging indicator calculated as the number of recordable cases involving days away from work, restricted work, or job transfer, multiplied by 200,000 and divided by total hours worked. The 200,000 figure represents 100 full-time workers for a year.
- First aid
- Under OSHA recordkeeping, a defined list of minor treatments such as cleaning a wound, applying a bandage, or using a non-prescription medication at non-prescription strength. An injury treated only with first aid is generally not recordable, though it still belongs in an internal log.
- Five Whys
- A simple root cause technique in which the investigator repeatedly asks why an event occurred, following each answer to the next contributing cause. It works well for straightforward events and is less reliable for complex ones with several interacting causes.
- Hazard
- A condition, practice, or source of energy with the potential to cause injury, illness, or damage. A hazard has not yet produced an event. Hazard reports let a workplace act before a near miss or injury occurs.
- Hierarchy of controls
- A ranking of ways to reduce risk from most to least reliable: elimination, substitution, engineering controls, administrative controls, and personal protective equipment. Corrective actions higher on the list depend less on individual behavior and tend to hold up longer.
- Incident
- An unplanned event that resulted in injury, illness, property damage, or environmental release. In many programs the word also covers near misses, so it is worth defining which meaning your forms use.
- Job hazard analysis
- A structured review of a specific task that breaks it into steps, identifies the hazards at each step, and defines the controls. Often abbreviated JHA or JSA (job safety analysis). Incident data is one of the best inputs for deciding which tasks need one.
- Just culture
- An approach to safety accountability that distinguishes between honest mistakes, at-risk behavior, and reckless conduct, and responds to each differently. It supports reporting by making clear that people will not be punished for raising a problem or admitting an error.
- Lagging indicator
- A measure of outcomes that have already occurred, such as recordable injury rate, DART rate, or lost workdays. Lagging indicators are useful for benchmarking but too slow and too sparse to manage a small site week to week.
- Leading indicator
- A measure of activity or conditions that precede outcomes, such as near-miss reports per hundred workers, corrective action closure rate, inspection completion, or alert acknowledgment time. Leading indicators move quickly and respond to management attention.
- Lockout/tagout
- Procedures for isolating hazardous energy sources and securing them with locks and tags before servicing or maintenance. Often abbreviated LOTO. Near misses involving unexpected machine startup usually point to a lockout/tagout gap.
- Near miss
- An unplanned event that did not cause injury, illness, or damage but had the potential to do so. Near misses are the cheapest lessons a workplace receives, and a program that captures them learns from far more events than one that logs only injuries.
- OSHA Form 300
- The Log of Work-Related Injuries and Illnesses, on which covered employers record each recordable case during the year. It is required by the federal recordkeeping rule at 29 CFR Part 1904 and must be kept for five years.
- OSHA Form 300A
- The annual Summary of Work-Related Injuries and Illnesses, which totals the year's recordable cases and must be posted in a visible workplace location from February 1 through April 30 of the following year. Some establishments must also submit it electronically.
- OSHA Form 301
- The Injury and Illness Incident Report, completed for each recordable case with details about the employee, the event, and the injury. Employers may use an equivalent form that captures the same information.
- Privacy case
- A recordable case for which OSHA allows the employee's name to be withheld from the Form 300, such as injuries to intimate body parts, sexual assaults, mental illness, and certain other categories. The name is kept on a separate confidential list.
- Recordable injury or illness
- A work-related case that must be entered on the OSHA Form 300 because it resulted in death, days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a licensed health care professional.
- Restricted work
- A situation in which an employee, because of a work-related injury or illness, is kept from performing one or more routine job functions or from working a full shift. Restricted work days count toward the DART rate.
- Risk matrix
- A grid that scores an event or hazard by the likelihood of harm and the severity of that harm, producing a rating used to prioritize investigation and corrective action. Keeping the scale simple, often three to five levels each, makes it usable on the floor.
- Root cause analysis
- A structured investigation that looks past the immediate trigger of an event to the underlying system failures that allowed it. If the analysis ends with a single person's mistake and no system finding, it has usually stopped too early.
- Safety observation
- A recorded note, usually from a supervisor or peer walkthrough, describing a safe or unsafe practice or condition. Observations provide behavioral and cultural signal that event-based reports do not.
- Severity rating
- A classification of how serious an incident or near miss was, or could have been. Severity should drive alert routing, investigation depth, and the urgency of corrective actions, and near misses should be rated on their potential, not their actual, outcome.
- State plan
- An OSHA-approved occupational safety and health program operated by a state rather than federal OSHA. State plans must be at least as effective as the federal program and may have stricter or additional requirements, so each site needs to know which applies.
- A formal policy giving any worker the right and the responsibility to halt a task they believe is unsafe, without fear of reprisal. Stop work events are worth logging even when nothing happened, because they identify controls that were about to fail.
- TRIR
- Total Recordable Incident Rate, a lagging indicator calculated as the number of OSHA recordable cases multiplied by 200,000 and divided by total hours worked. It allows comparison between organizations of different sizes but is a poor tool for managing a small site.
- Under OSHA recordkeeping, an injury or illness is presumed work-related if an event or exposure in the work environment caused or contributed to it, or significantly aggravated a pre-existing condition, subject to a list of specific exceptions.
Questions people ask
Why should a workplace log near misses when nobody was hurt?
Because a near miss reveals a weak or missing control at no cost. The same conditions that produced a near miss today can produce an injury tomorrow with a small change in timing. Logging near misses gives a site many more events to learn from than injuries alone, and it tends to surface problems in the areas where injuries eventually happen.
What should a basic incident report form ask for?
Keep required fields to what the reporter can actually know: what happened, where, when, and a photo if possible. For near misses, add what could have happened and what stopped it. Leave classification, root cause, and recordability to a supervisor or safety lead during follow-up. Short forms get used; long ones get skipped.
How do you get frontline workers to report hazards without fear?
Make the process fast, allow anonymous hazard reports, respond visibly to every report, and never let a report turn into discipline for the person who raised it. Managers should thank reporters publicly and share what was done. Reporting rises when people see that it leads to fixes rather than blame.
Who should be alerted when an incident is logged?
It depends on severity and location. A minor hazard can go to the area supervisor for review at the next huddle. A serious injury should reach the site lead, the EHS manager, and HR at once by text or phone, regardless of the hour. Write the routing rules down, include an on-call list for off hours, and add an escalation step for unacknowledged alerts.
What is the difference between a corrective action and a preventive action?
A corrective action responds to something that already happened and aims to stop it from recurring. A preventive action responds to a hazard, trend, or audit finding before an event occurs. In practice both need the same discipline: an owner, a due date, a clear definition of done, and independent verification.
Does incident logging software replace the OSHA 300 log?
No. Software can hold the information, flag likely recordable cases, and generate the Form 300, 301, and 300A, but the employer remains responsible for deciding recordability, keeping the records for five years, posting the annual summary, and reporting fatalities and severe injuries within the required time. Treat the internal log as broader than the legal log.
How long should incident records be kept?
OSHA requires covered employers to retain the Form 300, 300A, and 301 records for five years following the end of the calendar year they cover. Many organizations keep internal incident, near-miss, and corrective action records longer for trend analysis, insurance, and litigation purposes. Check state plan requirements, which can differ.
What safety metrics should a small site actually track?
Focus on leading indicators that move weekly: near-miss and hazard reports per hundred workers, alert acknowledgment time, corrective action closure rate, median time to verified closure, and inspection or training completion. Report lagging rates like TRIR for benchmarking, but do not try to manage a forty-person site by a number that changes once or twice a year.
How can an EHS manager spot a trend with only a handful of events?
Look for clusters rather than statistics. Group events by location, equipment, task, shift, and time of day, and review them monthly with the people who work in that area. Three similar hand injuries on one line or repeated slips at one dock door will not pass a significance test, but they are exactly the patterns worth acting on.
What does an inspector or auditor usually ask to see?
The injury and illness log, individual incident reports, evidence that events were investigated, evidence that corrective actions were completed and verified, training records, and evidence of proactive hazard identification such as inspections and near-miss reports. Being able to produce these quickly, with timestamps and photos, changes the tone of the visit.
How do you run a consistent safety program across several sites?
Standardize the categories, forms, severity scale, and escalation logic across all sites, and allow local flexibility only for alert recipients, language, and local regulations. Give the central EHS function visibility of every site's open incidents and overdue actions, and give each site ownership of its own follow-up. Share near misses across sites so one lesson becomes a control everywhere.
Is a rising near-miss count a sign the workplace is getting more dangerous?
Almost always the opposite. When near-miss reports rise and injuries stay flat, it means people trust the process and are reporting events that used to go unmentioned. A near-miss count near zero is the number to worry about, because events are still happening and are not being captured.
When should a small business move from a spreadsheet to dedicated software?
Typically when reports need to reach someone on another shift or at another site, when corrective actions are regularly being lost or missed, or when the person maintaining the spreadsheet is the only one who understands it. Each added shift, site, or layer of management multiplies the handoffs where a report can stall, and that is the problem dedicated tooling exists to solve.