9.3 Four-Step Investigation Process

Key Takeaways

  • The four-step process is: (1) gather information, (2) analyse information, (3) identify suitable risk control measures, (4) plan and implement remedial action.
  • Gathering includes securing the scene, photos, equipment/documents/CCTV, and witness interviews — preserve facts before they disappear.
  • Analysis builds a timeline, cause tree (immediate/underlying/root), and human-factor understanding — not a blame story.
  • Control measures should follow ERICPD; remedial actions need owners, dates, and verification of effectiveness.
  • Interviews: put people at ease, use open questions, one at a time, facts not blame, separate witnesses; depth of investigation is proportional to potential severity.
Last updated: August 2026

9.3 Four-Step Investigation Process

Quick Answer: Investigate in four steps: (1) Gather information, (2) Analyse information, (3) Identify suitable risk controls (use ERICPD), (4) Plan and implement remedial action with owners, dates, and checks. Interview witnesses fairly (open questions, no blame theatre). Match investigation depth to potential severity, not only to luck this time.

Knowing definitions and cause levels is not enough. Managers need a repeatable process so investigations are thorough, fair, and productive. Managing Safely teaches a clear four-step sequence. Exam questions may ask for the order of steps, what belongs in each step, or good interview practice.

The four steps at a glance

StepNameCore purpose
1Gather informationCollect facts before they are lost or altered
2Analyse informationTurn facts into a coherent explanation of causes
3Identify suitable risk control measuresDecide what will prevent recurrence (ERICPD)
4Plan and implement remedial actionMake changes real with owners, deadlines, and verification

Do not jump to conclusions at step 1. Do not stop at a clever analysis with no actions. Do not issue actions nobody owns.

Step 1 — Gather information

The goal is a reliable evidence base. Poor gathering produces biased analysis and weak controls.

Secure the scene (when safe and appropriate)

  • Make the area safe first (isolate energy, prevent secondary injury, emergency care).
  • Then preserve the scene as far as practicable: stop unnecessary cleaning or plant moves until photos and measurements are taken (unless emergency or legal direction requires otherwise).
  • Restrict access to those who need to be there.

What to collect

SourceExamples
ScenePhotos, sketches, measurements, lighting, weather if outdoor, positions of people and plant
Equipment / materialsDamaged parts, settings, substances involved, PPE condition
DocumentsRisk assessments, SSoW, permits, training records, maintenance logs, method statements, induction records
ElectronicCCTV, telemetry, access logs, machine data where available
PeopleInjured person (when fit), witnesses, supervisors, contractors, first aiders
EnvironmentHousekeeping, noise, congestion, time of day, production pressure signals

Record times, names, and who said what. Separate facts from opinions in your notes.

Interview technique (high-yield exam content)

Good interviews produce usable facts; bad interviews produce fear and silence.

PracticeWhy it matters
Put people at easeStress blocks memory and honest detail
Explain the purposeLearning and prevention, not a public trial
Open questions“What did you see?” beats “You forgot the guard, didn’t you?”
One question at a timeAvoids confusion and leading bundles
Facts, not blameCapture sequence and conditions; reserve judgment for analysis
Separate witnessesPrevents stories merging and contamination
Allow timeDo not rush the only person who saw the critical five seconds
Note-taking / statementsAccurate record for step 2 and for any later legal process
Suitable locationPrivate enough to speak freely; respectful after trauma

Avoid leading questions (“You were rushing because of the bonus scheme, right?”). Avoid multi-part questions. Avoid interviewing a group as a panel for individual recollections.

Step 2 — Analyse information

Turn raw evidence into a timeline and cause structure.

Build a timeline

List events in order: what was normal, what changed, what failed, what injury/near miss occurred, what emergency response followed. Gaps in the timeline tell you where more gathering is needed.

Cause analysis

Use the three levels from the previous section:

  1. Immediate unsafe acts/conditions
  2. Underlying job/human factors
  3. Root management-system failures

Simple tools taught at overview level include:

  • Cause tree / fault tree style thinking — ask “why?” down through layers
  • Human factors review — competence, fatigue, design of controls, pressure, communication
  • Comparison to standards — what did the risk assessment and SSoW require vs what happened?

Analysis should answer: How did barriers fail? not only Who messed up?

Common analysis errors

ErrorBetter approach
Single cause obsessionMultiple causes usually combine
Hindsight biasJudge decisions by information available at the time and by whether systems supported safe choices
Stopping at PPE failureAsk why PPE was needed as last line and why higher controls failed
Ignoring near-identical previous reportsPattern = system signal

Step 3 — Identify suitable risk control measures

Once causes are clear, choose controls using ERICPD (from Controlling Risks):

Eliminate → Reduce → Isolate → Control → PPE → Discipline

Cause foundWeak responseStronger ERICPD-minded response
Recurring oil leaksMop more oftenFix/replace hoses (Reduce/Control), PM system (system Control), temporary isolation of route
Missing guard“Wear gloves”Refit interlocked guard (Control), eliminate need to reach into danger if redesign possible
Untrained temp on high-risk taskVerbal warningCompetence assurance, remove from task until trained (Control), supervision
Time pressure driving shortcutsPoster saying “don’t rush”Rebalance targets, plan work, adequate staffing (root/system Control)

Link each significant cause to at least one control. Prefer measures that protect everyone, not only the person blamed last week.

Step 4 — Plan and implement remedial action

A brilliant report that sits in a drawer prevents nothing.

Action plan quality checklist

ElementWhat good looks like
Specific actionClear task, not “improve safety”
OwnerNamed role/person with authority
DeadlineRealistic date
PriorityLinked to risk / potential severity
ResourcesBudget, downtime, contractor support agreed
VerificationHow you will check it worked (inspection, trial, audit, metric)
CommunicationWho needs to know the new method
ReviewDate to confirm sustained effectiveness

Implement, then verify. A guard ordered but not fitted is not control. A procedure rewritten but never trained is not control.

Proportionality — depth matches potential severity

Not every paper-cut needs a multi-week inquiry. Not every “lucky” near miss deserves a shrug.

Match effort to potential, including:

  • How bad could it have been (high potential near miss → deep investigation)
  • Actual severity of injury or ill health
  • Number of people exposed
  • Whether a legal reportable event is involved (RIDDOR next section)
  • Whether the event signals a systemic failure or a rare one-off with low potential
  • Learning value for other sites or shifts
Event typeTypical depth (manager overview)
Minor first-aid, low potential, clear one-offShort report; quick local fix; trend watch
Lost-time injury or recurring patternFormal investigation; full four steps
High-potential near miss (e.g. load nearly struck head)Treat like a serious accident investigation
Fatality / specified serious injury / major dangerous occurrenceFull investigation; specialist/legal involvement as required; preserve evidence carefully

Proportionality is not an excuse to skip learning. It is a way to spend investigation effort where it prevents the worst outcomes.

Putting the steps in sequence (exam order)

  1. Gather — scene, people, documents, media
  2. Analyse — timeline, immediate/underlying/root
  3. Identify controls — ERICPD-based measures for the causes found
  4. Plan and implement — owners, dates, verify effectiveness

If options scramble the order, pick the sequence above. Analysis before gathering is fantasy. Actions without analysis are guesswork. Controls without implementation are paper safety.

Manager checklist

  1. Was the scene made safe, then preserved enough for evidence?
  2. Were witnesses interviewed separately with open, non-blaming questions?
  3. Does the report show causes at three levels, not only immediate?
  4. Do recommended controls climb ERICPD rather than default to PPE and posters?
  5. Does every action have an owner, date, and verification method?
  6. Was depth proportional to potential severity?

Next, RIDDOR explains when UK law requires reporting certain outcomes to the enforcing authority — a duty that runs alongside this internal four-step process, not instead of it.

Test Your Knowledge

What is the correct order of the four-step investigation process taught in Managing Safely?

A
B
C
D
Test Your Knowledge

Which interview practice is recommended when gathering information?

A
B
C
D
Test Your Knowledge

A scaffold tube falls into an empty walkway with no injury. Potential severity was fatal head injury. How should proportionality guide the manager?

A
B
C
D
Test Your Knowledge

In step 3 of an investigation, why is ERICPD used when identifying risk control measures?

A
B
C
D