ISO 45001 Clause 10.2: Investigate Incidents and Test Actions
ISO 45001:2018 clause 10.2 requires processes for reporting, investigating and acting on incidents and nonconformities. The organisation responds to the immediate situation, evaluates causes with worker participation and checks whether action is effective. The purpose is to prevent recurrence or similar events elsewhere through changes supported by evidence.
What clause 10.2 requires in practice
Clause 10.2 requires a process covering reporting, investigating and taking action on incidents and nonconformities. When one occurs the organisation reacts in good time, controlling and correcting it and dealing with consequences. It then evaluates, with worker participation and the involvement of other relevant parties, whether corrective action is needed to remove the root causes, by investigating or reviewing the event, determining causes and checking whether similar events have happened or could happen.
Existing risk assessments are reviewed. Actions needed, including corrective action, follow the hierarchy of controls and management of change, and risks from new or changed hazards are assessed before action is taken. The organisation reviews effectiveness and changes the system if necessary. Actions are appropriate to the effects. Retained information covers the event, actions and their effectiveness, and is communicated to relevant parties.
Why clause 10.2 matters to the business
How an organisation responds to an incident reveals how seriously it takes prevention. A prompt, fair investigation protects the people affected, preserves facts and limits further harm. Finding genuine causes instead of stopping at the nearest person prevents repeats, which are the costliest events of all. Worker participation improves accuracy and encourages future reporting, including near misses that give cheap warnings. Regulators, insurers and clients often judge a business by how it handled its last serious event, and a documented, reasoned response supports its position. Checking that corrective action works, and does not create new hazards, also protects the investment made in the fix and avoids a cycle of repeated, ineffective actions.
How to implement clause 10.2
Design the process so that the first response, the investigation and the follow-up are separate, clear steps. One approach follows. Where the event involves serious harm, medical needs or mandatory notification, those obligations take priority and come from the applicable requirements; the process described here concerns the management system response that follows.
- Make reporting simple, accessible on every shift and free of reprisal, and define what counts as an incident, a near miss and a nonconformity.
- Set out the immediate response duties: control the situation, look after people, preserve evidence and meet any mandatory notification.
- Scale the investigation to actual and potential consequences, and involve workers and competent technical people.
- Test causal explanations against records and observation, and record why conclusions were reached.
- Check other shifts and sites for the same weakness, and note why it does or does not apply.
- Assess risks from the proposed action, apply the hierarchy and change process, then implement it.
- Review effectiveness after enough operation to judge, keep the records and share relevant learning with workers.
Recognise incidents, near misses and nonconformities
An incident is a work-related occurrence that caused or could have caused injury or ill health. A near miss therefore falls within the concept even when no harm occurred. A nonconformity is a failure to meet a requirement. An event can involve both, but an incident does not automatically establish that a rule was breached.
Make the reporting route understandable and usable. Workers should know where concerns go and how relevant information is handled. The investigation process needs to preserve useful facts without treating the first account as the final causal conclusion. Protection against reprisals and meaningful participation support reliable learning.
Respond promptly and evaluate the need for corrective action
Take appropriate action to control and correct the situation and deal with consequences. Then evaluate corrective-action needs with workers and relevant interested parties. The review determines causes and examines whether similar events or weaknesses exist or could occur elsewhere. Consider potential consequences as well as the outcome that happened on this occasion.
Separate immediate correction from action addressing causes. Restoring an arrangement may be necessary, but does not explain why it failed. The depth of investigation should suit the situation. Neither a routine “retrain staff” response nor a large investigation with no decision is automatically proportionate.
Illustrative manufacturing example: a repeated control bypass
A fictional manufacturer discovers that an established operational check is being bypassed during a recurring production condition. After the authorised immediate response, the investigation involves workers who understand the condition and competent technical personnel. It examines why the process makes the bypass likely, rather than stopping at the name of the last worker involved.
Suppose the evidence identifies incompatible scheduling expectations and an unclear escalation route when the check cannot be completed. Management addresses those conditions and evaluates the relevant control with appropriate expertise. Later sampling examines whether workers can follow the authorised arrangement under the same production condition. The example does not instruct anyone to bypass or modify equipment protection.
Use evidence to test the causal explanation
Compare accounts with relevant records and observations. Distinguish established facts from assumptions, and consider more than one contributing factor where the evidence supports it. A named technique can organise thinking, but does not prove the conclusion. “Human error” often describes the final action without explaining the conditions that shaped it.
Investigate wider exposure carefully. Other shifts or sites may share the same process weakness, while different conditions may require a different response. Record why the finding is considered applicable or inapplicable elsewhere. This avoids both overlooking a shared problem and copying a solution without checking its fit.
Illustrative construction example: an instruction lost between employers
A hypothetical project experiences a near miss after one contractor changes an activity without the revised information reaching another affected team. The investigation includes workers from the relevant interfaces and examines how programme changes are authorised and communicated.
The agreed action clarifies the coordination decision and the evidence needed before affected work proceeds. The project checks subsequent changes through to actual use of the information. A distribution email alone is not treated as proof that the interface is controlled. Relevant technical safety decisions remain with competent parties working from the actual project conditions.
Check risk and change before introducing action
Review existing OH&S and other risk assessments as appropriate. Actions need to follow the hierarchy of controls and management-of-change arrangements. Assess risks from new or changed hazards before implementing the response. A corrective action can introduce new exposure if it changes equipment, staffing or work organisation without suitable review.
After implementation, evaluate effectiveness against the intended result. Establish what evidence and period of operation can support that judgement. The absence of a repeat report may be insufficient where exposure has not recurred or reporting is unreliable. Revise the action or the system when the result is not adequate.
Preserve and communicate the learning
Retain information on the nature of incidents or nonconformities, subsequent actions and results, including effectiveness. Communicate it to relevant workers, representatives where they exist and other relevant parties. Appropriate protection of personal or sensitive information should be considered alongside the need to share useful learning.
An auditor may compare the event, causal reasoning, action and effectiveness evidence. Common gaps include unsupported conclusions, closure before evaluation, failure to involve workers and no consideration of similar conditions elsewhere. A record should make the reasoning understandable without becoming a substitute for carrying out the work.
Frequently asked questions
Is every incident evidence of a nonconformity?
No. An incident can occur without an identified failure to meet a requirement. The event still needs an appropriate response and evaluation through the incident process.
Does ISO 45001 prescribe one root-cause tool?
No. Select a method suitable for the event and evidence. What matters is a supported understanding of causes and an effective response.
Can effectiveness be confirmed by signing the action form?
A signature records a decision, but the decision needs suitable evidence. Explain what was checked and why it supports the conclusion that the action works. Where an external audit has raised a finding, the ISO 45001 audit nonconformities guide explains the separate classification and closure context.
Develop investigation capability across your sites
Discuss incident-process and certification-preparation support with Sterling, including employee learning and agreed Effivity ISO & GRC automation software. Independent bodies decide certification; the organisation retains workplace and legal duties. Enrol in Root Cause Analysis & CAPA to strengthen related investigation skills.
Return to clause 10 improvement or the requirements overview; use findings to revisit hazards, risks and opportunities.