You investigate an accident or near miss so that the company learns when the guiding question is: why did the action make sense at that moment? It leads to system causes such as time pressure, material, information and coordination instead of a culprit. The investigation runs in four steps and ends with measures whose effect you check.
What is an incident investigation and when is it worth it?
An incident investigation is the structured examination of an accident, near miss or operational disruption with the aim of finding conditions that can be changed. It is worth doing after every event with an injury and after near misses with high damage potential, for example lifting operations, work at height or work on electrical installations. Learning from near misses is the cheapest, because nobody was harmed. We describe the approach on our page Incident Investigation.
Why does asking who is to blame lead to weaker measures?
The question “Who did it?” ends with a person. The measure is then usually to repeat the instruction or to reprimand, and the conditions under which the action arose remain. The next person in the same situation acts the same way. Sidney Dekker describes the principle behind this: people act in the way that seems reasonable to them in the situation (local rationality). The HOP movement around Todd Conklin states it as a principle: blame fixes nothing, context drives behaviour. (Dekker 2014; DOE-HDBK-1028-2009; Safety Differently)
The question “Why did it make sense at that moment?” directs attention to time pressure, material, information and coordination. The answers show levers in planning, contracting and interfaces. This is not exoneration at any price: rules stay valid, and the question only sets the order, first understand, then assess.
Example for illustration: During a crane lift the load swings, and shortly before, someone entered the exclusion zone. With the question “Who did it?” the result is: repeat the instruction. With the question “Why did it make sense?” it turns out that the walking route to the delivery point ran through the exclusion zone and the delivery window coincided with the lift. The measure then concerns routing and scheduling and works for every person. The example is constructed and has no project reference.
How do you ask “Why did it make sense?” in an interview?
You ask those involved what they saw, knew and intended at that moment, and which requirements, time windows and aids applied. Avoid questions of the pattern “Why did you not …?”, because they trigger justification. The aim is a sequence of events that those involved recognise as their own.
How does an investigation work in four steps?
- Secure: traces, data and conversations with those involved. Care and safety come first.
- Understand: reconstruct the sequence from the point of view of the people on site as a timeline.
- System causes: keep asking back to planning, contracting and interfaces.
- Measures and learning: measures with priority, responsibility, deadline and effectiveness check, plus a one-page learning letter for teams and other sites.
The result is an investigation report with system causes, an action plan and the learning letter, one page that can be used in the next toolbox talk.
How quickly should an investigation start?
As early as possible, once care for the injured and safety of the location are ensured. Traces change, memories fade and operations continue. A prompt first securing of traces, data and first conversations creates the basis, and the deeper analysis follows afterwards.
Which methods suit which event?
| Event | Method | Guiding question |
|---|
| Smaller event, clear sequence | 5-Why | What happened right before, and why? |
| Recurring deviation, near miss | Learning Team (HOP) | How is the work actually done, and what makes it harder? |
| Understanding everyday work | Safety-II, Work-as-Done | Why does the same work succeed on other days? |
| Serious event with several parties | ICAM, AcciMap | Which factors at which level worked together? |
A Learning Team is a moderated conversation between those who do the work and those who plan it. The distinction between Safety-I and Safety-II goes back to Erik Hollnagel, more in the glossary. AcciMap comes from Jens Rasmussen (1997) and arranges decisions from execution to management in levels. 5-Why is fast, but with complex events it can stop at one cause too early. That is our assessment from project practice.
What must be reported, and how does the investigation run alongside the official procedure?
Employers report accidents of insured persons to the accident insurance institution when insured persons are killed or injured so that they are unable to work for more than three days (§ 193 (1) SGB VII). The report is due within three days after the employer becomes aware of it (§ 193 (4) SGB VII). Liability and responsibility are clarified by authorities, courts and legal counsel. The internal investigation asks about the conditions of the event. Both procedures run in parallel; individual questions, for example on handling statements, you clarify with your legal counsel.
Do near misses have to be reported?
§ 193 SGB VII ties the report to insured persons who are killed or unable to work for more than three days. Near misses without such consequences are not mentioned in the provision. Whether they are reported internally or to clients is governed by your reporting system and your contracts. We still recommend an investigation where damage potential is high.
How does SAFETEE support you?
In Safety Consulting we investigate events, moderate Learning Teams, train your team in the course “Investigating events” and review existing reports. Your contact is Björn Andresen, Chief Strategy Officer (CSO). Get in touch if you would like to discuss a case.
As of: 20.10.2026
Is “Why did it make sense?” an excuse?
No. The question sets the order: first understand, then assess. Rules stay valid, and deliberate violations have consequences. The investigation first clarifies which conditions made the action seem reasonable, because only those conditions can be changed, and the measure then works for every person.
How does the investigation differ from establishing liability?
Authorities, courts and legal counsel clarify responsibility and liability. The internal investigation asks about the conditions of the event and derives measures. Both procedures run in parallel. How you handle statements and documents you discuss case by case with your legal counsel.
What role does a Learning Team play after an event?
A Learning Team is a moderated conversation between those who do the work and those who plan it. It shows how the work actually went and collects improvement ideas for planning, material and sequence. It complements the cause analysis and does not replace it. Neutral moderation and a binding answer on what happens with the suggestions matter.
Is it worth investigating a near miss?
Yes, especially where damage potential is high, for example lifting operations or work at height. Nobody was harmed, and the conditions that made the event possible are still the same. Selection follows the possible damage, not the actual damage, and it reveals weak points before anyone is hurt.
Can we run investigations ourselves in future?
Yes. In the course “Investigating events” your managers and HSE leads learn the methods and interview technique. On request we accompany the first investigations until your team masters the process. We can also review existing reports together with you, so that you can check measures and system causes.
Leistung
