4.3 Incident Investigation and Compliance Audits
Key Takeaways
- OSHA 1910.119(m) requires investigation of each incident that resulted in, or could reasonably have resulted in, a catastrophic release, initiated as promptly as possible but not later than 48 hours after the incident.
- The investigation report must include the date of the incident, the date the investigation began, a description, contributing factors, and recommendations; the employer must address findings and document resolutions, and retain the report for five years.
- The team must include at least one person knowledgeable in the process, a contract employee if a contractor was involved, and others with knowledge and experience to investigate thoroughly.
- OSHA 1910.119(o) requires a compliance audit at least every three years, conducted with at least one person knowledgeable in the process, a report of findings, prompt documented responses, and retention of the two most recent audit reports.
Investigate the release that happened — and the one that almost did
29 CFR 1910.119(m) does not wait for a headline. The employer must investigate each incident that resulted in, or could reasonably have resulted in, a catastrophic release of a highly hazardous chemical in the workplace. A CIRO who only opens an investigation after product is on the parking lot has already missed the near-miss half of the rule.
In an ammonia plant, "could reasonably have resulted in" is the phrase that catches the almost-events: a recirculator that climbed to the high-level float and the float did not trip; a king valve that would not close during a drill; a dual-relief three-way left halfway so neither PRV had a full path; a contractor who opened a strainer on a live liquid line because the isolation valve was passing. None of those requires a body count to be an (m) incident. If the credible outcome is a catastrophic release, investigate it.
A packing drip that is found, isolated, and repaired under a work order, with no reasonable path to a catastrophic release, is still a maintenance event. Do not inflate every leak into 1910.119(m) just to look thorough, and do not hide a near-miss overfill because "nothing got out." The exam will give you facts that show catastrophic potential. Use those facts.
The 48-hour clock starts the investigation — it does not finish it
An incident investigation must be initiated as promptly as possible, but not later than 48 hours following the incident. Forty-eight hours is the latest start, not a two-day vacation before anyone looks at the scene. Preserve the equipment state, isolation status, control printouts, detector logs, and witness names immediately. Waiting until Monday because the release happened Friday night is a failed start if 48 hours has already passed.
The investigation must produce a report that includes, at a minimum:
- Date of the incident
- Date the investigation began
- Description of the incident
- Factors that contributed to the incident
- Recommendations resulting from the investigation
Those five fields are the OSHA floor. A competent ammonia investigation also traces why the safeguards that should have stopped the event did not: detection, ventilation, isolation, relief, procedures, training, and MOC. Contributing factors are not a hunt for a single guilty operator. If the night operator bypassed a high-level cutout, the report still has to ask why the bypass was available, whether MOC authorized it, and whether the procedure even mentioned the switch.
1910.119(m)(5) requires a system to promptly address and resolve the report findings and recommendations. Resolutions and corrective actions must be documented. A recommendation that dies in a shared drive is not resolved. 1910.119(m)(6) requires the report to be reviewed with all affected personnel whose job tasks are relevant to the findings, including contract employees where applicable. 1910.119(m)(7) requires incident investigation reports to be retained for five years.
Who sits on the team
The team must include:
- At least one person knowledgeable in the process involved
- A contract employee if the incident involved work of the contractor
- Other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident
A CIRO supervisor who knows the overfeed system but has never seen a hot-gas defrost valve train should not investigate a defrost-header rupture alone. If a contractor's millwright opened the wrong valve, a contractor employee belongs on the team. "We did not want the contractor in the room" is the opposite of the standard.
Compliance audits every three years — prove the program is real
29 CFR 1910.119(o) is how OSHA checks whether the other elements exist on paper and in the engine room. Employers must certify that they have evaluated compliance with 1910.119 at least every three years to verify that the procedures and practices developed under the standard are adequate and are being followed. Both halves matter. A beautiful MI procedure that nobody uses fails the audit. A plant that "does it from memory" with no written procedure also fails.
The compliance audit must be conducted by at least one person knowledgeable in the process. A visiting accountant who cannot find the king valve is not that person. Many plants use a mixed team — a knowledgeable operator or supervisor plus someone who is not auditing their own homework — but OSHA's floor is the knowledgeable-in-the-process requirement.
A report of the findings must be developed. The employer must promptly determine and document an appropriate response to each finding and document that deficiencies have been corrected. Employers must retain the two most recent compliance audit reports. That is two reports, not five years, not "all audits forever," and not the same retention as incident investigations. Mixing the two retention rules is a standard CIRO trap.
How a CIRO uses an audit without turning it into theater
Sample the elements this chapter already taught. Pull a PRV file and ask whether the five MI identifiers are there. Pull a hot-work permit and ask whether it names the object and was kept until completion. Pull an MOC for the last evaporator add-on and ask whether charge, PSI, training, and PSSR were closed before startup. Pull the last near-miss and ask whether the investigation started within 48 hours and whether recommendations were closed. If those samples fail, the three-year certificate is claiming a program that the engine room does not have.
Audits also catch stale PSI: a relief-valve summary that still shows a set pressure you changed last year, a P&ID that does not show the new circuit, or a procedure that still describes DX feed after the room was converted to overfeed. Those are not clerical nits. They are evidence that MOC and MI are not connected.
Do not treat the audit as a binder-refresh weekend. OSHA wants certification that procedures are adequate and being followed. The follow-up documentation is part of the element: a finding without a documented response is an open (o)(4) failure sitting on top of whatever (j), (k), (l), or (m) problem the auditors found.
A high-level float on a recirculator fails to trip during a near-miss that would have overfilled the vessel and lifted a relief valve into an occupied dock. When must the incident investigation be initiated under OSHA 1910.119(m)?
A contractor millwright is injured while opening a strainer on a covered ammonia process, and the event could reasonably have caused a catastrophic release. Who must be on the investigation team?
Which statement correctly describes OSHA 1910.119(o) compliance-audit frequency and recordkeeping?