Academy › Practical guides › Management systems
An ISO 45001 incident investigation is not an accident report
Clause 10.2 asks for a chain: respond, investigate, find the system-level cause, re-run the risk assessment, act, verify, communicate. Most organisations stop at step two.
Updated 13 November 2026 · 8 min read · Written for working labs and quality teams
Short answer
Clause 10.2 is titled incident, nonconformity and corrective action — the word incident is in the clause title, so this is not a paperwork exercise bolted onto the quality system. It requires a process that reports and investigates, responds promptly and provides first aid, evaluates the need for corrective action through root cause analysis, reviews the existing risk assessment, implements the actions, evaluates their effectiveness, and communicates the results to workers and interested parties. A report that ends with worker did not follow the procedure, filed and forgotten, fails at least three of those links.
On this page
What clause 10.2 asks for, link by link
| Link in the chain | Evidence an auditor expects | Where it usually breaks |
|---|---|---|
| Report the incident or near miss | A reporting channel open to all workers including contractors, with evidence it is safe to use — near misses actually reported | Zero near misses on a busy site: a sign the channel is feared, not that nothing happened |
| Respond and provide first aid | Timely response, first aid, scene control and any statutory notification with a defined owner and deadline | The report is written days later with no contemporaneous timeline |
| Investigate and analyse root cause | A timeline, the direct cause, and a system-level root cause distinct from individual behaviour | Operator error recorded as the root cause and nothing upstream is examined |
| Review the existing risk assessment | The hazard register and risk evaluation for that area re-run and re-issued after the event | The report is archived and the risk assessment is never touched |
| Implement and verify | Actions with owners and dates, then an effectiveness check dated after implementation | Effectiveness signed off on the same day the action was installed |
| Communicate and feed the system | Results shared with workers, plus incident trends entering the 9.3 management review | Findings stay in the safety office and never reach the people exposed to the hazard |
Practical note. A correction and a corrective action are not the same thing. Isolating the machine, treating the injured person and cordoning the aisle are corrections — they deal with the immediate situation. Corrective action removes the system-level cause so the same event cannot recur. Most reports contain only the first half.
Why worker did not follow the procedure is not a root cause
Take a forklift striking a pedestrian in a shared aisle. The direct cause is that the pedestrian crossed outside the marked walkway. If the investigation stops there, the only available action is to retrain the pedestrian — and the aisle, the routing, the shift pattern and the delivery schedule are unchanged, so the same event is still designed into the workplace.
A system-level root cause analysis asks why the design allowed it: did the 6.1.2 hazard identification cover non-routine activity such as an unscheduled delivery or a maintenance bypass? Did it cover all shifts, contractors and visitors? Did 8.1.2 apply the hierarchy of controls, so that physical segregation was considered before signage and training? Did 8.1.3 management of change pick up the new delivery route? The answers produce actions that change the workplace, plus an updated hazard register and risk evaluation — which is exactly the 10.2 requirement to review the existing risk assessment.
No method is mandated. Five Whys, fishbone, fault-tree or a structured D0 to D8 report are all acceptable. What matters is that the method is applied consistently, that the conclusion is traceable to evidence on the timeline, and that at least one action addresses the system rather than the individual. Write your own investigation time limits into the procedure and then obey them: an auditor will compare your records with your own rules, not with an invented statutory clock.
Close the loop back into 6.1.2, 7.3 and 9.3
Under the current 2018 edition this is the whole loop. The revision is at DIS 40.60, expected in the first half of 2027, and its transition arrangements have not been published. Keep the chain above working against the 2018 edition and your own body's current written rules; do not rewrite procedures against text that has not been issued.
- 6.1.2 hazard identification: past incidents and near misses are explicit inputs. Put a dated reference to the investigation in the hazard register and show the revised risk evaluation for the affected area, including non-routine activities, contractors and visitors.
- 7.3 awareness: workers must know how to report an incident or near miss and know they will not be punished for doing so. The number of near misses reported is a leading indicator of whether that channel works; a permanently empty near-miss log is a finding, not a success story.
- 9.3 management review: incident trends and monitoring results are review inputs, alongside worker consultation. Bring the trend, not just a list of closed actions, and carry decisions out with an owner and a date.
- 8.2 emergency preparedness: if the event was one of the scenarios identified in 6.1.2, the drill or real event must trigger a documented review and revision of the response plan.
Where this goes wrong in practice
Concluding that the worker did not follow the procedure and filing the report without ever asking what in the hazard identification, control hierarchy or change management allowed it.
Never re-running the 6.1.2 risk assessment for the affected area after the event — the most commonly cited gap in clause 10.2 audits.
Dating the effectiveness verification on the same day the corrective action was implemented, which makes the verification impossible and the record obviously back-filled.
Keeping the findings inside the safety department, or running a reporting channel that produces no near misses because workers expect blame.
Frequently asked
Does ISO 45001 require every near miss to be fully investigated?
Clause 10.2 requires a process for reporting, investigating and acting on incidents and nonconformities; it does not prescribe that every near miss gets the same depth of investigation. Define grading criteria in your own procedure — a high-potential near miss gets the full root cause chain, a low-potential one still gets logged and trended. Near misses are also an explicit input to 6.1.2 hazard identification.
Is a specific root cause analysis method mandatory?
No. The clause asks for the need for corrective action to be evaluated through root cause analysis; it names no method. Five Whys, fishbone, fault tree or a D0 to D8 report are all fine. Apply one consistently, keep the conclusion traceable to the timeline, and make sure at least one action fixes the system rather than the person.
What is the difference between correction and corrective action?
A correction deals with the immediate situation — first aid, isolating equipment, cordoning the area, containing a spill. A corrective action removes the underlying cause so recurrence is prevented, and its effectiveness is checked later. Under 10.2 you need both, plus a review of the existing risk assessment.
Will the expected 2027 revision change any of this?
The revision is at DIS 40.60, expected in the first half of 2027, and transition arrangements have not been published. Treat anything about the new edition as expected rather than fixed. Until it is issued, work to ISO 45001:2018 and your own certification or accreditation body's current written rules.
Structure the investigation
Build the D0 to D8 investigation and corrective-action trail
Keep the timeline, the direct cause, the system-level root cause, containment, corrective actions and the prevention-of-recurrence step in one report — then hand the updated hazard register back to your risk assessment.
Open the free 8D tool →Runs in your browser. Export the report free. No sign-up needed.
LabKitPro guides are written from published standards and accreditation-body documents — references, clause numbers and paraphrased intent only, never verbatim standard text. They are for preparation and study, not a certification or accreditation decision, and not legal advice. ISO standards are trademarks of ISO; IATF 16949 is published by the International Automotive Task Force and is not an ISO standard. The current laboratory standard is ISO/IEC 17025:2017; there is no 2025 edition. Global ACI replaced IAF and ILAC on 1 January 2026.
Academy by standard · All practical guides · Free browser tools