Incident Investigation

What incident investigation is

Incident investigation (التحقيق في الحوادث) is a structured examination carried out after an incident at work, such as an injury, damage to equipment or a sudden stoppage. It establishes what happened and why, and it identifies what can be changed so that the incident does not happen again. Its purpose is prevention and not the identification of whom to blame. It asks about the conditions that made the incident possible before it asks about the person who was at the scene.

Incident investigation is a practice in occupational safety and health that an establishment adopts. What follows is an explanation of the management concept, and it is not presented as a procedure fixed by a particular text. It does not establish anyone’s responsibility for a particular incident.

How incident investigation differs from neighbouring concepts

• Near miss is an event that came close to causing harm and did not. Incident investigation concerns an event in which harm or a stoppage occurred, and the same method may be used to examine a near miss that merits attention.
• Work injury is the injury to which the Labor Law attaches obligations. Incident investigation is an internal examination of causes and not of entitlements.
• Internal investigation is the procedure in which an establishment establishes the facts of an allegation against a worker before any decision about that worker. Its subject is a person and an allegation, while the subject of incident investigation is an event and its causes. If individual conduct that contributed to the incident appears in an incident investigation, disciplinary action follows a separate track.
• Occupational risk assessment looks forward and anticipates hazards before they occur. Incident investigation looks back, and what it finds returns to the assessment and adjusts it.

The stages of an investigation

These stages are our proposal. Their detail varies with the type of incident and the size of the establishment, and they are not an approved model:

1. Securing the scene. The establishment cares for the injured, informs those responsible and isolates the place of the incident in a way that does not destroy its evidence.
2. Preserving evidence. The investigators keep photographs, measurements, maintenance and operating records, the affected equipment and a record of the arrangement of work at that moment, before the place is rearranged.
3. Collecting statements. The investigators speak to those who witnessed the incident and those who took part in the work, one at a time, with open questions that ask for a description of what happened and not a judgement on it.
4. Building the timeline. The investigators set out what happened before, during and after the incident, with dates and times, and they note the points on which accounts conflict.
5. Analysing causes. The investigators distinguish the direct cause, the conditions that contributed and the deeper cause whose removal would prevent a repeat. Asking “why” repeatedly may be enough, continuing until the answer is a decision or an arrangement that can be changed.
6. Setting corrective actions. Each action is given an owner and a date.
7. Verifying and monitoring. The establishment checks that each action was carried out and that it removed the cause and not its appearance.
8. Sharing the lesson. The establishment communicates what it learned to those who work in similar places.

Who takes part in an investigation

The establishment decides who carries out the investigation. We suggest that the person under whose supervision the incident occurred should not conduct it alone, because that person may lean toward an explanation that keeps responsibility away from that person’s work. Those who take part are people who know the nature of the work and people who do not report to the manager in whose area the incident happened.

The health and safety officer may take part if the establishment has one, and the findings are put to the safety committee if the establishment has one. Workers on site are heard, because they know what may not appear in any record.

When an incident merits a wider investigation

Not every event needs an investigation of the same depth. An establishment may set criteria that decide the level of examination. Entry points include the severity of what actually happened, the severity of what could have happened with different timing, the repetition of a similar event at the same site, and the involvement of equipment or processes that a large number of workers use.

We propose no numerical threshold for these criteria. Each establishment sets them according to the nature of its work and announces them before incidents occur and not after, so that the depth of an investigation is not decided by who happened to be affected.

What an investigation report contains

The report is written so that someone who was not present at the incident can understand it and follow up on its actions. Proposed fields include:

• A short description of the incident, its date, its location and the activity under way when it occurred.
• The people who were affected and the people who witnessed it, within the limits that the confidentiality of their data requires.
• The timeline and the evidence relied on.
• The direct cause, the contributing conditions and the deeper cause, kept separate from one another.
• The corrective actions, each with an owner, a date and a status.
• Whatever concerns other sites and should be shared.

The report contains no judgement on a particular person. If individual conduct has to be addressed, that is done on a separate track.

A hypothetical example: a slipping incident

Suppose a worker at a hypothetical establishment slips on a floor covered in oil near the filling line and twists an ankle. The investigation finds that the oil leaks from a gearbox on the conveyor and that a repair request was opened five days earlier and was not closed. It also finds that cleaning was postponed to the end of the shift, that the spot had no warning sign, and that the lighting on the night shift is weak at the filling line.

The direct cause is the slip on the oil. The contributing conditions are an unrepaired leak, postponed cleaning, the absence of a warning and weak lighting. The deeper cause, in the investigators’ judgement, is that maintenance requests carry no priority that distinguishes those that affect safety, so this request stayed in the queue with the others.

The investigation ends with five actions:

1. Repair the gearbox.
2. Fit a tray to catch the leak.
3. Adopt a rule that gives priority to any maintenance request that leads to a slippery floor.
4. Clean immediately and put up a sign.
5. Improve the lighting on the night shift.

Actions 1, 2 and 5 are engineering actions, which is 3 ÷ 5 = 60%, and actions 3 and 4 are administrative, which is 2 ÷ 5 = 40%. The total is 100%. The split into engineering and administrative actions is our own practical grouping. It matches the preference for engineering controls over administrative ones that is described under occupational risk assessment.

After the period that the establishment set, three of the five actions were completed, which is 3 ÷ 5 = 60%. Actions 1, 2 and 4 were done. Actions 3 and 5 remained: the priority rule, which addresses the deeper cause, and the lighting improvement. At monitoring, the establishment asks why the rule is still outstanding.

The details are hypothetical and set to illustrate. They do not represent an establishment or an incident, and the percentages do not measure the quality of an investigation.

How incident investigation relates to the design of work

The deeper cause that an investigation reaches may lie in the arrangement of work and not in a particular piece of equipment. That arrangement includes the distribution of shifts, rest breaks, the allocation of tasks to individuals and the method of supervision. Workplace ergonomics deals with how well this arrangement suits what people can do. If an investigation shows that an incident occurred at the end of a crowded shift, the question may be about the work schedule and not about the worker who was injured in it.

How incident investigation goes wrong

• Stopping at human error. The file records that the worker was careless and is then closed, without asking why carelessness was possible and what arrangement made it possible.
• Turning into a search for someone to blame. Workers may learn to hide what they know, so honest statements become fewer in later incidents.
• Starting late. The features of the site change and the memory of witnesses weakens.
• Dealing only with the symptom. An example is adding a sign after an incident caused by a leak that was not repaired.
• Closing without verification. Actions are recorded that nobody checks were carried out.
• Not going back to the person who reported. Someone who saw what happened and is not told what followed from the statement may stay silent next time.

Incident investigation and the Labor Law

Article 122 of the Saudi Labor Law (نظام العمل) obliges the employer to take the necessary precautions to protect workers from the hazards and diseases arising from work and from the machinery used. Article 123 of the Labor Law requires the employer to inform the worker, before starting work, of the hazards of the occupation. These are duties of prevention that apply whether or not an incident occurs, and occupational health and safety sets them out in detail.

Article 132 of the Labor Law opens the chapter on work injuries by stating that its provisions do not apply to establishments subject to the occupational hazards branch of the social insurance law. Whether that chapter applies to an establishment depends on whether the establishment is subject to that branch.

Article 141 of the Labor Law refers the procedures for reporting work injuries to a decision of the Minister. In implementation of Article 141 of the Labor Law, Article 28 of the Implementing Regulation (اللائحة التنفيذية) provides, for an establishment that is not subject to the occupational hazards branch, that the employer reports an injury to a worker to the competent labour office within a week of learning of it. The office then considers whether it is a work injury and what follows, in accordance with that article of the Implementing Regulation. The week applies only to such an establishment.

For an establishment that is subject to the occupational hazards branch, the reporting route is the one in the social insurance rules. We state no reporting period for it and no ruling on that procedure. The establishment’s investigation of an incident is separate from this reporting. It does not replace the report.

In the Labor Law and in the Implementing Regulation we found no text prescribing a detailed procedure for an establishment’s internal investigation of incidents, and no model for its report. The stages and the report fields in this term are our own proposal, and they are not wording taken from either text. We propose no period for completing an investigation and no committee to conduct it. What goes into the report and how it is kept is a decision that the establishment makes according to the nature of its work.

What incident investigation is for

Incident investigation is a means by which an establishment learns from an incident that actually occurred. It points to what can be changed, and what is decided afterwards rests on what the workers at the site say and on the nature of the work. Its success depends on workers feeling that saying what happened will not be held against them, a point that psychological safety examines.

This is an explanation of the concept and of the statutory provisions cited, not legal advice.