Incident Investigation Reports Using the 5 Whys

The worst incident report in a small shop is the one that ends with "worker should have been more careful."

That sentence feels complete when everyone is busy. The helper slipped because he rushed. The electrician got shocked because she assumed the circuit was dead. The painter's ladder kicked out because the feet were set on bad ground. The HVAC tech cut a hand because the panel edge was sharp. The cleaning crew left a wet entrance because the floor sign was in the van. The plumber nearly hit an unmarked private line because the work area changed after the locate ticket.

But "be more careful" does not fix the next job.

An incident report should capture the facts while they are fresh, then push the shop past the first answer. The 5 Whys method is useful because it is simple enough to use on a clipboard, but disciplined enough to expose weak handoffs, missing tools, rushed schedules, bad assumptions, incomplete work orders, thin job hazard analyses, and safety notes that never reached the crew.

Use the same habit for a near-miss report. A near miss is the cheapest investigation you will ever get. Nobody is hurt, but the job just showed you where the next injury, property damage claim, utility strike, fire, flood, or callback could come from.

National numbers do not tell you what happened on your job, but they explain why the habit matters. The Bureau of Labor Statistics recorded 5,070 fatal work injuries in the United States in 2024, including 1,032 among workers in construction and extraction occupations. Your report is local and practical: it is how your shop learns before the next job repeats the same pattern.

This is not a replacement for emergency response, medical care, OSHA reporting, state-plan rules, workers' comp reporting, insurer notice, attorney guidance, or customer-site requirements. If the event is serious, those duties come first. The report workflow below is for the practical question every small owner has after the immediate response is under control:

What do we write down so the same thing does not happen again?

Start with the facts, not the theory

OSHA's incident investigation guidance is clear on the purpose: find the underlying or root causes so the employer can prevent recurrence. OSHA's safety-management guidance also says investigations should cover injuries, illnesses, close calls, near misses, and other concerns, and that the purpose is to identify root causes, often more than one.

That means the first page of the report should not be a verdict.

It should be a field record.

Use the first section of the incident report to capture:

Do not start with:

Tech was careless.

Start with:

Technician was removing the old condenser fan motor on RTU-3. Unit disconnect was off, but stored energy had not been verified at the capacitor. Technician received a shock while reaching into the control compartment. Work stopped at 9:18 a.m. Crew lead secured the unit, provided first aid, notified the owner, and photographed the disconnect, capacitor, panel, tool, and work area.

That is a report you can investigate.

If the job already had a work-order safety briefing, attach or reference it. If the incident involved elevated work, connect the report to the JHA for work at 6 feet or more. If the event happened during excavation, attach the utility locate photo log. The incident report should not sit alone when the real story lives in the job file.

Do not let the 5 Whys start too soon

The 5 Whys method works only after the immediate response is handled.

Use this order:

1. Stop the work and make the area safe.
2. Provide first aid or medical care.
3. Call emergency services when needed.
4. Notify the supervisor, owner, customer, GC, property manager, or site contact required by the job.
5. Preserve the scene when safe and appropriate.
6. Check OSHA, state-plan, workers' comp, insurer, and customer-site reporting duties.
7. Capture facts, photos, statements, and document references.
8. Then run the 5 Whys analysis.

OSHA's severe injury reporting page says all employers under OSHA jurisdiction must notify OSHA when an employee is killed on the job or suffers a work-related hospitalization, amputation, or loss of an eye. A fatality is reported within 8 hours; an in-patient hospitalization, amputation, or eye loss is reported within 24 hours. State-plan states may have their own procedures, and customer sites may require separate notice.

Do not let an internal root-cause meeting delay a required report.

Also do not treat every hospital visit the same way. OSHA defines an in-patient hospitalization as a formal admission for care or treatment; emergency-room treatment by itself is not the same severe-event reporting trigger. It still may create OSHA recordkeeping, workers' comp, insurance, or customer-site duties, so do not dismiss it as "internal only" without checking the right rule.

A required report still should not replace the investigation. OSHA Form 301 or an insurer form may capture the injury details. Your internal investigation should explain what changed in the work system so the next crew sees a safer plan.

Use the 5 Whys as a cause chain, not a script

The name is misleading.

You do not win by asking exactly five questions.

The Canadian Centre for Occupational Health and Safety lists the 5 Whys as one possible root-cause analysis tool and says there is no single definitive way to conduct root-cause analysis. The useful part is the discipline: keep asking why the previous answer was possible until you reach a cause the shop can actually control.

Bad chain:

That is not an investigation. It is a scolding with a form attached.

Better chain:

That chain gives you something to change.

The better question is not "who messed up?"

The better question is:

Why did our normal job setup allow this to happen?

Run separate chains for separate causes

One incident can have more than one cause.

OSHA's hazard-identification guidance says there is often more than one root cause. CCOHS makes the same practical point: even straightforward incidents are seldom caused by one thing.

So do not force everything into one neat chain.

Use separate 5 Whys branches when the event has multiple paths:

Example: a plumber damages a private irrigation line while exposing a sewer lateral.

One branch may show that the public 811 ticket was complete, but the site assessment checklist did not ask about private landscape systems. Another branch may show that the customer moved the repair area after the ticket was submitted. A third branch may show that the work order did not require morning-of-dig photos or a stop if marks did not match the excavation area.

Those are different fixes:

• update intake to ask about private utilities;
• require updated locate scope when the work area changes;
• add photo requirements and stop-work triggers to excavation work orders.

If the report says only "crew hit line," the lesson is gone.

What belongs in the report packet

A small shop does not need a 40-page investigation binder for every scrape.

It does need a repeatable packet.

Use this structure:

If you already run a general service work order for mixed service calls, add the incident report number to that job file. If the issue came from a field condition that changed scope, connect it to When the Plans Don't Match the Field and Hidden Conditions and Scope Gaps. Safety and scope often move together.

The point is not to make the file heavy.

The point is to make it readable three months later.

Write corrective actions that change the next job

Most weak incident reports fail in the corrective-action box.

They say:

• retrain employee;
• remind crew;
• discuss at meeting;
• be more careful;
• follow policy.

Sometimes training is the right fix. But if the same hazard appears in the next work order, the report did not change the work.

Use corrective actions that are specific, assigned, dated, and verifiable:

Tie each action to a person:

• owner updates the template;
• crew lead reviews the next briefing;
• dispatcher adds the stop-work field;
• estimator adds an exclusion or access assumption;
• shop manager removes damaged equipment;
• payroll or office manager files required records;
• safety lead verifies the fix after two weeks.

Then close the loop. A corrective action is not complete because it was typed. It is complete when the changed process is visible on the next job.

Use the report to update the form

The best incident investigations improve tomorrow's paperwork.

If the root cause was missing access information, update the work request intake and site assessment checklist.

If the root cause was unclear day-of instructions, update the work order.

If the root cause was a hazard that should have been planned, update the job hazard analysis or safety inspection checklist.

If the root cause was a field change, update the change order workflow so the crew knows when price, scope, and safety changed together.

If the root cause was a recurring job pattern, update the trade-specific work order:

• electrical work order: test-before-touch, panel labeling, lockout, energized-work stop point;
• roofing work order: access method, pitch, edge exposure, weather hold, material staging;
• plumbing work order: shutoff status, hot-water hazard, drain machine setup, excavation notes;
• HVAC work order: roof access, disconnect, refrigerant handling, lifting, sharp edges, startup verification;
• cleaning work order: wet floor controls, chemical labels, public access, key control, after-hours sign-off.

This is why a near miss deserves a real near-miss report. It gives the shop permission to change the form before an actual injury forces the same lesson at a higher cost.

Keep blame, admissions, and medical guesses out of the report

An incident report should be factual and useful.

It should not be a confession, argument, medical diagnosis, or courtroom speech.

Avoid:

• "employee was negligent";
• "our company failed";
• "customer caused the injury";
• "defective ladder" before the ladder is inspected;
• "minor injury" before medical information is known;
• "OSHA violation" unless a qualified person has actually made that determination;
• jokes, frustration, profanity, or private opinions;
• full medical details beyond what is needed for the report;
• unrelated personnel history.

Write what the report can support:

Crew lead observed the ladder foot on wet mulch after the slip. Ladder was removed from service pending inspection. Photos 4-8 show footing, ladder label, work area, and weather condition. Helper reported left ankle pain and was transported to urgent care by supervisor.

That is enough for the investigation to continue.

OSHA recordkeeping rules also have privacy details. For privacy-concern cases, OSHA's 1904.29 rule says the employer does not enter the employee's name on the OSHA 300 Log and keeps a separate confidential list. Even when your internal report is not the OSHA log, use the same instinct: keep personal and medical details tighter than the job facts require.

Know when OSHA recordkeeping is separate from your internal report

Do not mix up three different records:

OSHA's recordkeeping overview says many employers with more than 10 employees must keep injury and illness records unless exempted by industry. It also says covered employers must save the OSHA 300 Log, privacy case list if any, 300A summary, and 301 Incident Reports for five years.

OSHA 1904.29 says covered employers must complete an OSHA 301 Incident Report, or equivalent form, for each recordable injury or illness entered on the OSHA 300 Log, and must record each recordable injury or illness within seven calendar days of receiving information that it occurred.

That does not mean your small internal investigation form automatically satisfies every OSHA, state, insurance, customer, or workers' comp duty. Treat it as the field-quality record that helps you complete the other required records correctly.

Trade examples: what 5 Whys should find

Roofer near miss at a skylight

Event:

Crew member stepped backward near an unguarded skylight during roof repair. No fall occurred.

Weak answer:

Crew member was not watching.

Better 5 Whys path:

Update the next roofing packet and point the crew to the elevated-work JHA habit in Job Hazard Analysis Forms for Work at 6 Feet or More.

Electrical shock during troubleshooting

Event:

Technician received a shock while diagnosing a mislabeled circuit.

Weak answer:

Verify power next time.

Better 5 Whys path:

This is the difference between a safety reminder and a changed field document.

Cleaning slip in an open lobby

Event:

Customer employee slipped in the lobby after floor cleaning.

Weak answer:

Crew forgot sign.

Better 5 Whys path:

The corrective action belongs in the work order, not only the report.

Investigation mistakes that keep repeating

Small shops usually do not fail because the owner does not care.

They fail because the report gets squeezed between dispatch, customers, payroll, and the next job.

Watch for these mistakes:

The report should end with proof that the fix happened:

• updated work order language;
• revised checklist;
• equipment removed or replaced;
• toolbox talk date;
• photo requirement added;
• crew lead sign-off added;
• new stop-work trigger;
• customer access rule changed;
• material staging rule changed;
• follow-up inspection completed.

If the fix cannot be shown on the next job, it is probably not a fix yet.

A one-page format that works in the field

Use this as the working order for a small-shop incident report:

Then add one final question before closing the report:

What should the next crew see before starting this same type of job?

If the answer is not visible in the work order, job hazard analysis, safety inspection checklist, service report, or daily report log, the investigation is not finished.

Sources

• OSHA, Incident Investigation overview, including OSHA incident investigation resources and root-cause guidance for preventing recurrence
• OSHA, Recommended Practices for Safety and Health Programs: Hazard Identification and Assessment, especially the action item on investigating injuries, illnesses, close calls, near misses, and root causes
• OSHA, Incident [Accident] Investigations: A Guide for Employers, December 2015 systems-approach guide to incident investigation, root causes, corrective actions, witness interviews, and sample questions
• OSHA, Report a Fatality or Severe Injury, for federal OSHA fatality, in-patient hospitalization, amputation, and eye-loss reporting timelines and options
• OSHA, 29 CFR 1904.39, Reporting fatalities, hospitalizations, amputations, and losses of an eye, for the underlying federal reporting rule, timing, methods, and delayed-knowledge provisions
• OSHA, 29 CFR 1904.29, Forms, including OSHA 300, 300A, and 301 form requirements, equivalent forms, seven-day recording timing, and privacy-case handling
• OSHA, Recordkeeping overview, including covered-employer recordkeeping responsibilities, record retention, and recordability overview
• CCOHS, Incident Investigation, including root-cause analysis methods, 5 Whys, investigation steps, and the warning against stopping at worker carelessness
• NIOSH, FACE Reports, for fatal occupational injury investigations and prevention recommendations by industry and incident type
• NIOSH, Fatality Assessment & Control Evaluation Program, DHHS (NIOSH) Publication No. 2017-145, describing FACE investigation methods, contributed factors, and prevention recommendations
• Bureau of Labor Statistics, National Census of Fatal Occupational Injuries in 2024, February 19, 2026 release with current fatal-work-injury counts, events, occupations, and CFOI data notes

---

This article is for general information and is not legal, safety, insurance, medical, tax, or compliance advice. Verify all rules with OSHA, your state plan, workers' compensation administrator, insurer, customer-site requirements, attorney, or qualified safety professional before acting.