# Incident Report Template and How to Investigate Source: https://nerix.ai/blog/incident-report-template-and-how-to-investigate How to write an incident report and investigate it: what to record in the first hour, how to find the cause, what to fix and when to tell an authority. The nerix team Published October 31, 2026 5 min read Quality and audits incidents In this guide ## Key takeaways - Facts first, opinions never in the same sentence. - The cause is rarely the person who happened to be there. - The person who saw the event or the manager of the area writes the first version, ideally the same day, while memory is fresh. - Define what is reportable so people know when to write one. An incident report is a plain, factual record of something that went wrong, or nearly did, written soon after it happened. A good one lets someone who was not there understand what happened, what you did right away, why it happened and what will change. This guide gives the structure and an investigation method a small company can use. Use the [incident report template](https://nerix.ai/templates/incident-report) for the form, the [incident log](https://nerix.ai/templates/incident-log) to list every event in one place, and the [post incident review](https://nerix.ai/templates/post-incident-review) for the learning meeting. Warning Serious injuries, deaths, dangerous events and some data breaches must be reported to an authority within a set time in many countries. Do that first if the law requires it. This guide is general information, not legal advice. ## In the first hour - **Make people safe.** Treat injuries, stop the danger, call emergency services if needed. - **Contain the event.** Switch off the machine, isolate the account, secure the area. - **Tell the right person.** Your manager or the person responsible for safety or security. - **Preserve the evidence.** Take photos, keep logs, do not clean up or delete before you record. - **Note who saw it.** Names and contact details of witnesses. ## What to write down Facts first, opinions never in the same sentence. Record: - Date, time and place. - Who was involved and who saw it. - What happened, in order, in plain words. - Injuries, damage or data affected. - What was done immediately, and by whom. - Who was told and when. - Photos, logs or documents attached. Write "The forklift struck the shelf at about 10:40 and two boxes fell" rather than "The driver was careless". Leave out guesses about blame. ## How to find the cause The cause is rarely the person who happened to be there. Use the five whys: - A box fell on a worker. Why? The shelf was hit. - Why was the shelf hit? The aisle was too narrow for the turn. - Why was the aisle narrow? Pallets were stored in it. - Why were they stored there? The racks were full. - Why were they full? Stock levels grew and nobody reviewed the layout. The fix now is a stock and layout review, not a warning to the driver. Stop when you reach something you can change. Talk to everyone involved, look at the place, read the procedure, and ask what would have stopped it. ## Decide the actions Sort actions into three kinds: - **Correction.** Fix this event: clear the aisle, restore the data. - **Corrective action.** Remove the cause so it does not return: review layout, add a rule, train. - **Preventive action.** Check whether the same cause exists elsewhere. Each action gets an owner and a date, tracked in [tasks and projects](https://nerix.ai/product/work). Later, check that it worked. See [corrective actions that fix the cause](https://nerix.ai/blog/corrective-actions-that-fix-the-cause). Try it on your own work. nerix writes the first draft, answers from your documents with the page each sentence came from, and keeps the team's work in one place. Start on the free plan. Start free ## Sample report in short | Field | Entry | | Date and place | 12 March, 10:40, warehouse aisle 3 | | People | Driver J. (injured: none), witness K. | | What happened | Forklift turning in the aisle hit the end of a shelf, two boxes fell, nobody was hit | | Immediate action | Aisle closed, boxes cleared, shelf checked | | Cause | Pallets stored in the aisle made the turn too tight | | Actions | Clear aisle (K, same day), review layout (manager, 31 March), floor marking (K, 15 April) | | Closed | After the 30 April check | ## Security incidents For a lost laptop, a wrong email or a suspected breach, add: what data was involved, whose data it is, whether it was encrypted, who has been told, and whether the rules in your country require telling the people or an authority. Time matters: some rules give 72 hours. ## Keep a log and look for patterns Every report goes into one log. Once a quarter, read the log: which place, which task, which time of day shows up again and again? Patterns point to the real fixes, and they are the evidence an auditor wants to see under ISO 9001 or 45001. Keep the log honest: a team that gets blamed stops reporting. Tip Thank the person who reports a near miss. How you react decides whether the next one is reported. ## Who writes the report The person who saw the event or the manager of the area writes the first version, ideally the same day, while memory is fresh. A second person, usually the manager or a safety or quality lead, reviews it and leads the investigation. Do not let the person involved investigate alone, and do not let the investigator be someone who might be blamed. For small companies one trusted person can review all reports, with the owner stepping in for serious events. ## Types of incident to include Define what is reportable so people know when to write one. A short list works: - **Injury or illness at work**, however small. - **Near miss**, where nobody was hurt but could have been. - **Property damage**, including vehicles and equipment. - **Security or data event**, such as a lost device, a wrong recipient or unauthorised access. - **Quality failure**, where a product or service reached a customer wrong. - **Customer or visitor harm** on your premises. - **Environmental event**, such as a spill. Anything that someone would want to know about next month belongs on the list. ## Interviews that give you the truth When you talk to people involved, the way you ask decides what you hear. - **Choose a private, calm place** and start by saying the aim is to learn, not to blame. - **Ask open questions.** "Tell me what happened from when you arrived" gives more than "Did you see the sign?". - **Let them finish** before asking follow ups. - **Ask about the system.** "What would have made this easier to avoid?" - **Write notes** and read the main points back to confirm them. - **Thank them.** People who feel safe tell you more next time. Talk to witnesses separately so they do not influence each other. ## Closing the report A report is closed only when every action is done and checked. Set a date for the check, usually 30 to 90 days after the event, and ask a simple question: did the cause go away? If the same event happens again, the first fix did not work, so reopen the report and look deeper. Record the final result, the date, and who confirmed it. Share the lesson with the team in a short note, without names, so others can learn from it. ## Retention and privacy Incident reports can contain health and personal information. Keep them with restricted access, share only what each person needs, and keep them for the period your local rules require. Injury records often have a legal retention time, so ask your adviser before you delete anything. ## The short version Make people safe, contain the event, record facts and evidence, ask why until you reach a cause you can change, set owned and dated actions, check they worked and keep one log. Report to an authority first when the law says so. ## Questions people ask What is an incident report? A written record of something that went wrong or nearly did: an accident, a near miss, a security event, a customer harm. It states the facts, the immediate action and the follow up. Should near misses be reported? Yes. A near miss is a free warning. Teams that record near misses find causes before someone is hurt or data is lost. Who must be told about a serious incident? In many countries serious injuries, deaths, dangerous events and some data breaches must be reported to an authority within a fixed time. Check the rule where you work and report first, then finish the paperwork. n/ About the author The nerix team The nerix team writes these guides in plain words for small teams, with templates you can fill in and use today. Share this guide - - [Email](mailto:?subject=Incident%20report%20template%20and%20how%20to%20investigate&body=https%3A%2F%2Fnerix.ai%2Fblog%2Fincident-report-template-and-how-to-investigate) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fnerix.ai%2Fblog%2Fincident-report-template-and-how-to-investigate) - [X](https://x.com/intent/post?url=https%3A%2F%2Fnerix.ai%2Fblog%2Fincident-report-template-and-how-to-investigate&text=Incident%20report%20template%20and%20how%20to%20investigate) One tap, no account. We keep a count and nothing else. ## Templates for this Fill one in online and download it as Word or PDF. Free, no account, and what you type stays in your browser. - ### [Incident report](https://nerix.ai/templates/incident-report) Record an accident, near miss or other incident clearly: facts first, then causes and actions. Fill it in - ### [Incident log](https://nerix.ai/templates/incident-log) Keep one running list of incidents, what was done about each, and which are still open. Fill it in - ### [Post-incident review](https://nerix.ai/templates/post-incident-review) Review a serious incident without blame: what happened, why, and what will stop it happening again. Fill it in ## In nerix - [Checks](https://nerix.ai/product/audits) - [Tasks and projects](https://nerix.ai/product/work) - [Templates](https://nerix.ai/templates) ## Try it on your own work. nerix writes the first draft, answers from your documents with the page each sentence came from, and keeps the team's work in one place. Start on the free plan. Start free See the plans ## Keep reading - Quality and audits iso [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) November 1, 2026 7 min read ### [ISO 9001 checklist for small businesses](https://nerix.ai/blog/iso-9001-checklist-for-small-businesses) An ISO 9001 checklist for small businesses, clause by clause, with the records the standard requires, what auditors sample and common delays. Read the guide - Quality and audits hkz [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) November 1, 2026 7 min read ### [HKZ certification guide for care organisations](https://nerix.ai/blog/hkz-certification-guide) HKZ certification for Dutch care and welfare providers. What the HKZ norms are, how they relate to ISO 9001, the audit cycle and a readiness checklist. Read the guide - Quality and audits risk [Quality and audits](https://nerix.ai/blog/category/quality-and-audits) October 31, 2026 7 min read ### [How to run a risk register in a small company](https://nerix.ai/blog/how-to-run-a-risk-register) A risk register in plain steps for a small company: what to list, how to score likelihood and impact, who owns each risk and how often to review it. Read the guide - [incidents](https://nerix.ai/blog/tag/incidents) - [safety](https://nerix.ai/blog/tag/safety) - [quality](https://nerix.ai/blog/tag/quality)