Incident and Accident Investigation Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Health and Safety Advisers, HSE Managers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-OHS-050

Before you join: Participants should understand basic workplace hazards, risk assessments and their organisation’s reporting process.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Incidents, near misses and occupational accidents demand more than a quick explanation and a corrective action list. Weak investigations can lose physical evidence, overlook work-system conditions, assign blame prematurely and repeat the same event. Managers, safety professionals and investigators need a disciplined process that establishes facts, identifies causal factors, meets reporting duties and produces actions that prevent recurrence.

This course teaches participants to plan and conduct workplace incident and accident investigations from initial notification through to management review. Participants examine scene control, evidence preservation, witness interviewing, document review, event mapping, causal analysis and corrective-action planning. The course uses recognised methods including ISO 45001 incident investigation requirements, the 5 Whys, fault tree analysis, bow-tie analysis and ICAM-style causal factor analysis. Participants learn to distinguish immediate causes from underlying conditions, organisational influences and failed controls.

Instruction combines short technical briefings with realistic investigations drawn from construction, manufacturing, logistics, energy, healthcare and office-based operations. Participants work through evidence packs, photographs, statements, permits, risk assessments and maintenance records; conduct structured interviews; build timelines; and test competing causal explanations. They leave with an investigation plan, evidence log, interview guide, causal analysis model, corrective-action register and a completed investigation report suitable for adaptation at work.

The course suits personnel who investigate incidents as part of safety, operational, engineering, facilities, HR or management responsibilities. It is particularly useful for organisations seeking consistent investigation quality, clearer management reporting and corrective actions that address work conditions rather than individual error alone.

What you will be able to do

  • Plan an incident investigation using a defined scope, roles, evidence strategy and timeline
  • Secure an incident scene and preserve physical, digital and documentary evidence
  • Conduct structured witness interviews using open questions, probing and statement verification
  • Construct event timelines and causal factor charts from verified investigation evidence
  • Apply 5 Whys, fault tree analysis and bow-tie analysis to identify causal pathways
  • Distinguish immediate causes, underlying causes, organisational factors and control failures
  • Develop corrective actions using the hierarchy of controls and action-quality criteria
  • Produce and present a defensible incident investigation report for management review

Benefits of attending

For you

  • Greater confidence securing scenes and making early investigation decisions
  • A repeatable method for separating evidence from assumptions and opinions
  • Stronger interviewing skills for obtaining reliable witness accounts
  • Ability to explain causal findings clearly to managers and work teams
  • Practical report-writing evidence for safety and operational career progression

For your organisation

  • More consistent incident investigations across departments, sites and contractor interfaces
  • Earlier identification of failed controls before similar events recur
  • Better quality evidence for regulatory notifications, insurer discussions and internal reviews
  • Corrective actions focused on work-system causes rather than individual blame
  • Clearer management visibility of trends, overdue actions and residual risk

Course modules

20 modules over 10 days

Participants can define an investigation mandate, scope, governance structure and expected outputs.

  • Incident, accident, dangerous occurrence and near-miss definitions under organisational reporting systems
  • Investigation purposes: learning, prevention, legal compliance, insurance and operational assurance
  • ISO 45001 expectations for incident evaluation and corrective action processes
  • Selecting investigation level using actual severity and credible potential severity
  • Terms of reference defining scope, authority, exclusions, deliverables and deadlines
  • Investigation roles: lead investigator, technical adviser, recorder, sponsor and reviewer

Participants can organise initial response actions while protecting people, evidence and operational continuity.

  • Life-saving response priorities before evidence collection begins at an incident scene
  • Scene cordons, access logs and authority to preserve locations
  • Photographing transient conditions before equipment movement, cleanup or repair
  • Initial notifications to management, regulators, emergency services and insurers
  • Dynamic risk assessment for investigators entering damaged or hazardous areas
  • Scene release decisions documented with responsible manager approval

Participants can prepare an evidence-led investigation plan matched to event complexity and risk.

  • Investigation plan sequencing urgent evidence, interviews, records review and specialist input
  • Evidence matrix linking key questions, sources, owners and collection dates
  • Hypothesis control: testing explanations without reaching premature conclusions
  • Assigning investigators according to independence, competence and conflict considerations
  • Timebox milestones for preliminary findings, final report and action review
  • Stakeholder communication plan for workers, representatives, managers and families

Participants can identify, document, collect and protect physical evidence using sound chain-of-custody practice.

  • Evidence categories: physical items, photographs, measurements, samples and digital records
  • Systematic scene walk-through using observation routes and evidence markers
  • Photography protocol covering overview, mid-range, close-up and scale images
  • Measurements recorded with datum points, units, tolerances and equipment identification
  • Chain-of-custody records for removed items, samples and electronic media
  • Equipment condition checks covering guards, settings, alarms and isolation status

Participants can obtain and evaluate records that establish planned work, actual work and control status.

  • Retrieving risk assessments, method statements, permits and job safety analyses
  • Reviewing training records, competency evidence and authorisation registers
  • Maintenance histories, inspection certificates and defect reports as causal evidence
  • Digital evidence from access systems, CCTV, telemetry and electronic logs
  • Version control checks for procedures, drawings and manufacturer instructions
  • Document chronology revealing changes, deviations, approvals and unresolved issues

Participants can conduct respectful, structured interviews that obtain reliable factual accounts.

  • Interview planning based on witness proximity, role, memory and welfare
  • Rapport building without promises, coaching, intimidation or leading questions
  • PEACE interview structure: preparation, engage, account, closure and evaluation
  • Open questions before focused probes and evidence-based clarification questions
  • Active listening techniques: pauses, summaries, repetition and neutral prompts
  • Contemporaneous notes distinguishing quotations, observations and investigator interpretation

Participants can test witness accounts fairly and manage difficult interview circumstances.

  • Memory limitations, stress effects and post-event information contamination
  • Separating direct observation from inference, rumour and hindsight explanations
  • Chronological recall techniques using landmarks, tasks and environmental cues
  • Testing contradictions against records without accusing or blaming witnesses
  • Interpreter use, vulnerable witnesses and cultural communication considerations
  • Witness statement review, amendment, confirmation and secure storage requirements

Participants can convert verified evidence into a clear chronology of events and decisions.

  • Event timeline construction from planned work through post-incident response
  • Causal factor charting with events, conditions, decisions and evidence references
  • Mapping simultaneous work, handovers and contractor interface activities
  • Time-stamping evidence where clocks, logs and witness accounts differ
  • Identifying information gaps, disputed facts and necessary follow-up enquiries
  • Separating normal work variability from material deviations and violations

Participants can identify immediate causes and analyse the controls that should have prevented harm.

  • Immediate causes: unsafe conditions, unsafe acts, energy releases and exposures
  • Barrier analysis identifying preventive controls, mitigative controls and recovery measures
  • Swiss cheese model applied to aligned weaknesses across defence layers
  • Control effectiveness tested against design, availability, use and supervision
  • Bow-tie analysis connecting threats, top events, consequences and barriers
  • Human error classification without treating worker action as final cause

Participants can use 5 Whys to trace causal chains while avoiding unsupported conclusions.

  • 5 Whys applied to a defined problem statement and verified evidence
  • Writing causal statements with cause, effect and supporting evidence
  • Recognising circular reasoning, assumptions and single-cause explanations
  • Branching causal chains where several conditions contribute to an event
  • Stopping criteria when causes reach controllable management system conditions
  • Validating 5 Whys findings against timelines, records and witness accounts

Participants can build a fault tree that tests combinations of technical and human failures.

  • Top event definition for fault tree analysis construction
  • AND and OR gates representing necessary and alternative causal conditions
  • Basic events, undeveloped events and transfer symbols in fault trees
  • Decomposing equipment, procedural and human contributors without duplication
  • Minimal cut sets identifying critical combinations of control failure
  • Using fault trees to prioritise evidence gathering and corrective actions

Participants can classify causal factors across individual, task, equipment and organisational conditions.

  • ICAM causal categories: absent defences, individual actions and task conditions
  • Organisational factors shaping supervision, planning, resources and priorities
  • Latent conditions distinguished from active failures and immediate causes
  • Coding evidence statements into causal factor categories without speculation
  • Causal factor relationships displayed through an investigation logic model
  • Cross-checking ICAM findings against 5 Whys and barrier analysis

Participants can examine human performance within the work conditions that influenced decisions and actions.

  • Human factors: workload, fatigue, time pressure, communication and interface design
  • Situational awareness failures linked to information quality and task conditions
  • Procedure usability assessed for clarity, accessibility, sequence and practicality
  • Competence analysis covering knowledge, skill, supervision and task familiarity
  • Work-as-imagined compared with work-as-done through evidence and observation
  • Just culture principles separating error, at-risk behaviour and reckless conduct

Participants can investigate equipment and process failures with appropriate technical evidence and expertise.

  • Failure mode review for mechanical, electrical, process and control systems
  • Lockout-tagout verification following unexpected energisation or stored energy release
  • Maintenance-induced failures involving overdue work, incorrect parts and testing gaps
  • Process safety evidence: alarms, interlocks, relief systems and operating limits
  • Manufacturer instructions compared with installed configuration and operating practice
  • Specialist evidence requests framed with clear technical questions and constraints

Participants can recognise investigation obligations, confidentiality boundaries and fair treatment requirements.

  • Regulatory notification triggers for fatalities, serious injuries and dangerous occurrences
  • Preserving privileged advice boundaries while maintaining factual investigation records
  • Confidentiality, personal data and medical information handling during investigations
  • Worker representation rights, consultation duties and participation arrangements
  • Fair process requirements when investigation findings may prompt disciplinary action
  • Evidence disclosure considerations for regulators, insurers and legal proceedings

Participants can design corrective actions that address causal findings and reduce residual risk.

  • Hierarchy of controls applied to corrective-action option selection
  • SMART actions specifying owner, deadline, resources, evidence and acceptance criteria
  • Action quality tests: relevance, feasibility, effectiveness and unintended consequences
  • Interim controls protecting people while permanent actions are developed
  • Management of change requirements for redesigned equipment, procedures and staffing
  • Residual risk assessment after proposed controls and action completion

Participants can verify action effectiveness and convert investigation findings into organisational learning.

  • Action closure evidence demonstrating implementation rather than administrative completion
  • Effectiveness reviews using observation, testing, worker feedback and performance data
  • Leading and lagging indicators connected to recurring causal factors
  • Trend analysis across incident types, locations, tasks and control failures
  • Lessons learned communications tailored for leaders, supervisors and frontline teams
  • Knowledge retention through procedure updates, briefings and targeted assurance checks

Participants can write concise, evidence-based reports that support decisions and withstand scrutiny.

  • Report structure: mandate, facts, analysis, findings, actions and appendices
  • Executive summaries stating event significance, causal findings and key decisions
  • Fact, analysis and conclusion language separated throughout investigation reports
  • Evidence citations linking findings to photographs, records and interview statements
  • Visuals using timelines, causal charts, barrier maps and action tables
  • Quality assurance checks for accuracy, fairness, clarity and confidentiality

Participants can present investigation findings, manage challenge and support accountable action decisions.

  • Management review packs presenting evidence, risk, findings and action status
  • Presenting causal analysis without blame, defensiveness or unsupported certainty
  • Responding to challenge through evidence references and stated limitations
  • Escalation routes for overdue actions, disputed ownership and residual risk
  • Communicating findings to affected workers without disclosing sensitive information
  • Closing investigations only after approval, action ownership and learning arrangements

Participants can build, review and present a complete evidence-based incident investigation report and corrective-action plan.

  • Investigation mandate, scope, roles and evidence strategy for assigned incident
  • Scene evidence register incorporating photographs, records, statements and technical data
  • PEACE interview plan identifying witnesses, questions, welfare and verification needs
  • Event timeline and causal factor chart built from verified evidence
  • Combined 5 Whys, barrier analysis and ICAM causal findings
  • Corrective-action register prioritised through hierarchy of controls and residual risk
  • Final report presentation, peer review and management challenge response

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Incident investigation terms-of-reference template
  2. Scene preservation and evidence-log checklist
  3. PEACE witness interview guide
  4. Event timeline and causal factor chart
  5. Corrective-action quality review register
  6. Incident investigation report template

Who should attend

  • Health and Safety Advisers — investigate workplace events and recommend preventive actions
  • HSE Managers — establish consistent investigation standards and review significant cases
  • Operations Managers — address operational conditions contributing to incidents and near misses
  • Supervisors and Team Leaders — conduct initial inquiries and preserve critical evidence
  • Engineers and Maintenance Managers — investigate equipment failures, isolation breakdowns and maintenance causes
  • HR and Employee Relations Practitioners — support fair fact-finding where conduct issues arise

Skills and tools covered

Incident scene managementEvidence collectionWitness interviewingCausal analysisCorrective action planningInvestigation reporting

Tools and standards

ISO 45001, 5 Whys, Fault Tree Analysis, ICAM

How the course runs

Training methodology

The course uses short instructor briefings followed by guided analysis of realistic incident materials. Participants examine scene photographs, equipment records, permits, procedures, witness accounts and reporting forms; then apply investigation tools in pairs and groups. Simulated interviews develop questioning, listening and statement-testing skills. Facilitated reviews compare causal explanations and corrective actions against available evidence. Each participant builds an investigation pack through the course and prepares an application plan for their own reporting and escalation arrangements.

Requirements and prerequisites

Participants should understand basic workplace hazards, risk assessments and their organisation’s reporting process. Experience as a supervisor, safety representative, manager, engineer, facilities professional or safety practitioner is helpful because course discussions use realistic workplace events and operational records. Participants should be able to read procedures, complete structured forms and discuss incidents objectively. Previous formal investigation training is not required. Legal qualification, forensic science knowledge, auditing certification and prior experience leading major investigations are not required.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should understand basic workplace hazards, risk assessments and internal reporting arrangements. Previous formal investigation training is not necessary, and the course starts with investigation scope, roles and evidence planning.

Bring a laptop if possible, plus blank copies of your organisation's incident form, investigation procedure and action tracker if these can be shared. Do not bring confidential case files, personal medical information or identifiable witness material.

It is designed for safety advisers, supervisors, managers, engineers, facilities personnel, HR practitioners and others asked to investigate workplace events. It suits people who need a repeatable method rather than specialist forensic qualifications.

Risk assessment training focuses on identifying hazards before work begins, while auditing examines whether management system requirements are being met. This course focuses on establishing what happened after an event, why controls failed and what actions should prevent recurrence.

You can use the investigation plan, evidence log, interview guide, causal analysis models and report template for near misses, injuries, equipment failures and significant unsafe events. The action-quality checks also help when reviewing investigations led by others.

Training runs from 08:30 to 16:30, providing about 6.5 contact hours each day. The first week builds the investigation process and evidence skills; the second week develops causal analysis, action planning, reporting and the final capstone investigation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.