Incident report template and how to investigate

An incident report is a plain, factual record of something that went wrong, or nearly did, written soon after it happened. A good one lets someone who was not there understand what happened, what you did right away, why it happened and what will change. This guide gives the structure and an investigation method a small company can use.

Use the incident report template for the form, the incident log to list every event in one place, and the post incident review for the learning meeting.

In the first hour

1. Make people safe. Treat injuries, stop the danger, call emergency services if needed.
2. Contain the event. Switch off the machine, isolate the account, secure the area.
3. Tell the right person. Your manager or the person responsible for safety or security.
4. Preserve the evidence. Take photos, keep logs, do not clean up or delete before you record.
5. Note who saw it. Names and contact details of witnesses.

What to write down

Facts first, opinions never in the same sentence. Record:

• Date, time and place.
• Who was involved and who saw it.
• What happened, in order, in plain words.
• Injuries, damage or data affected.
• What was done immediately, and by whom.
• Who was told and when.
• Photos, logs or documents attached.

Write "The forklift struck the shelf at about 10:40 and two boxes fell" rather than "The driver was careless". Leave out guesses about blame.

How to find the cause

The cause is rarely the person who happened to be there. Use the five whys:

1. A box fell on a worker. Why? The shelf was hit.
2. Why was the shelf hit? The aisle was too narrow for the turn.
3. Why was the aisle narrow? Pallets were stored in it.
4. Why were they stored there? The racks were full.
5. Why were they full? Stock levels grew and nobody reviewed the layout.

The fix now is a stock and layout review, not a warning to the driver. Stop when you reach something you can change. Talk to everyone involved, look at the place, read the procedure, and ask what would have stopped it.

Decide the actions

Sort actions into three kinds:

• Correction. Fix this event: clear the aisle, restore the data.
• Corrective action. Remove the cause so it does not return: review layout, add a rule, train.
• Preventive action. Check whether the same cause exists elsewhere.

Each action gets an owner and a date, tracked in tasks and projects. Later, check that it worked. See corrective actions that fix the cause.

Sample report in short

Security incidents

For a lost laptop, a wrong email or a suspected breach, add: what data was involved, whose data it is, whether it was encrypted, who has been told, and whether the rules in your country require telling the people or an authority. Time matters: some rules give 72 hours.

Keep a log and look for patterns

Every report goes into one log. Once a quarter, read the log: which place, which task, which time of day shows up again and again? Patterns point to the real fixes, and they are the evidence an auditor wants to see under ISO 9001 or 45001. Keep the log honest: a team that gets blamed stops reporting.

Who writes the report

The person who saw the event or the manager of the area writes the first version, ideally the same day, while memory is fresh. A second person, usually the manager or a safety or quality lead, reviews it and leads the investigation. Do not let the person involved investigate alone, and do not let the investigator be someone who might be blamed. For small companies one trusted person can review all reports, with the owner stepping in for serious events.

Types of incident to include

Define what is reportable so people know when to write one. A short list works:

• Injury or illness at work, however small.
• Near miss, where nobody was hurt but could have been.
• Property damage, including vehicles and equipment.
• Security or data event, such as a lost device, a wrong recipient or unauthorised access.
• Quality failure, where a product or service reached a customer wrong.
• Customer or visitor harm on your premises.
• Environmental event, such as a spill.

Anything that someone would want to know about next month belongs on the list.

Interviews that give you the truth

When you talk to people involved, the way you ask decides what you hear.

1. Choose a private, calm place and start by saying the aim is to learn, not to blame.
2. Ask open questions. "Tell me what happened from when you arrived" gives more than "Did you see the sign?".
3. Let them finish before asking follow ups.
4. Ask about the system. "What would have made this easier to avoid?"
5. Write notes and read the main points back to confirm them.
6. Thank them. People who feel safe tell you more next time.

Talk to witnesses separately so they do not influence each other.

Closing the report

A report is closed only when every action is done and checked. Set a date for the check, usually 30 to 90 days after the event, and ask a simple question: did the cause go away? If the same event happens again, the first fix did not work, so reopen the report and look deeper. Record the final result, the date, and who confirmed it. Share the lesson with the team in a short note, without names, so others can learn from it.

Retention and privacy

Incident reports can contain health and personal information. Keep them with restricted access, share only what each person needs, and keep them for the period your local rules require. Injury records often have a legal retention time, so ask your adviser before you delete anything.

The short version

Make people safe, contain the event, record facts and evidence, ask why until you reach a cause you can change, set owned and dated actions, check they worked and keep one log. Report to an authority first when the law says so.