Incident Investigation and Corrective Actions under ISO 45001 (Clause 10.2)

An operator slips on a patch of oil near a production line. This time he catches himself and nothing happens. The following week, another worker falls in the same spot and fractures his wrist. Between the two events, there was a signal, a chance to act, a cause waiting to be addressed. Clause 10.2 of ISO 45001:2018 exists precisely so that this first signal triggers a response, an investigation and the elimination of the cause, before a serious accident occurs. This is the heart of improvement in occupational health and safety: learning from what happens so it does not happen again.

Incident, near miss, nonconformity: distinguishing to treat properly

Vocabulary matters, because it determines the right response. The standard uses three complementary notions.

An incident is an occurrence arising out of, or in the course of, work that could or does result in injury and ill health. This definition is deliberately broad: it covers both an accident with injury and an event without physical consequence.

A near miss (or incident without harm) is an incident that caused no injury or ill health, but could have. The oil patch that no one has yet slipped on, the object that falls next to a worker, a machine starting unexpectedly with no operator nearby: all are rehearsals of a future accident. Treating near misses with the same seriousness as accidents is one of the reflexes that sets a mature organization apart.

A nonconformity is the non-fulfilment of a requirement: an internal rule, a legal requirement, a provision of the management system. An uninspected fire extinguisher, a lockout procedure not applied, a mandatory training not delivered are all nonconformities. Not every nonconformity causes an incident, but many incidents originate in a nonconformity left unaddressed. This link between requirement, hazard and event builds directly on the upstream work of hazard identification and risk assessment (HIRA).

What Clause 10.2 requires

Clause 10.2 requires the organization to establish, implement and maintain processes to respond to incidents and nonconformities. It sets out the logical sequence.

• React in a timely manner. Take action to control and correct the situation, and deal with the consequences, including those for health and safety.
• Evaluate the need for corrective action. Determine, with the participation of workers and other relevant interested parties, the causes of the incident or nonconformity so that it does not recur or occur elsewhere.
• Look for the existence of similar events or their potential occurrence elsewhere.
• Implement any action needed, in accordance with the hierarchy of controls and the management of change.
• Assess OH&S risks before taking action, where relevant.
• Review the effectiveness of any corrective action taken.
• Update, if necessary, the risks and opportunities determined during planning, and the management system itself.

The standard also requires the organization to retain documented information on the nature of incidents and nonconformities, the actions taken, and the results of any corrective action, including its effectiveness. This traceability is what the auditor will examine, and what feeds into management review. All of this makes full sense within a structured OH&S management system built to ISO 45001, where continual improvement is not a slogan but a documented mechanism.

Conducting an investigation: from the event to the root causes

The temptation, after an incident, is to stop at the immediate cause: the operator did not wear gloves, the part was positioned incorrectly. That is necessary but not sufficient. A quality investigation looks for root causes, that is, the organizational, technical and human failures that made the event possible.

A sound investigation is organized into clear steps.

• Secure and preserve. Provide first aid, control any residual hazard, then, as far as possible, preserve the scene and evidence (condition of the machine, PPE, statements taken while memories are fresh).
• Gather the facts. What happened, when, where, under what conditions. Facts are rigorously separated from interpretations and judgments.
• Analyze the causes. Proven methods help structure the analysis: the five whys to trace back the causal chain, the cause and effect diagram (Ishikawa) to explore families of causes (method, manpower, material, environment, management), or the fault tree favored in occupational accident prevention.
• Identify organizational factors. Workload, deferred maintenance, a procedure that is unworkable in practice, missing training, poor communication. This is often where the durable levers are hidden.

The standard insists on one non-negotiable point: worker participation. Workers are the ones who know the real work, the gap between the written procedure and daily practice. An investigation conducted without the operators concerned misses the most useful causes. In Morocco, this participation naturally connects with the health and safety committee provided for by the Labour Code (Law 65-99, provisions on hygiene and safety), a body where the analysis of accidents and risks is examined collectively, and with the occupational physician, whose insight into health impairments is valuable.

From correction to corrective action

These two notions are often confused, and this confusion is the leading cause of recurrence.

A correction addresses the effect, here and now: mopping up the oil, replacing the fire extinguisher, treating the injured worker, stopping the machine. It is essential and urgent, but it says nothing about the why.

A corrective action addresses the cause so that the event does not recur: identifying and repairing the oil leak, revising the machine's maintenance plan, changing the layout of the workstation, correcting the procedure, training the teams. This is the action that Clause 10.2 is concerned with, because it is the one that breaks the cycle of repetition.

A good corrective action respects the hierarchy of controls: eliminate the hazard, substitute it, put in place collective protection, organize the work, and use personal protective equipment only as a last resort. An action that amounts to reminding workers of the rule or handing out an extra piece of PPE, without touching the source, remains fragile. Every corrective action should have an owner, a deadline and a verification criterion, otherwise it remains an intention.

Once the action has been implemented, two requirements close the loop. First, update the risk assessment: the incident often reveals an underestimated risk, or even an unidentified hazard, which must be fed back into the HIRA. Second, verify effectiveness: did the action actually remove the cause? This is measured by the absence of recurrence, by a field check, by indicators. When an incident touches on the management of emergency situations, this review also feeds into emergency preparedness and response (Clause 8.2), updating scenarios, resources and drills.

Just culture and blame-free reporting

No Clause 10.2 process, however well written, works if incidents are not reported. What blocks reporting is almost always fear: fear of sanction, of blame, of being seen as the one responsible. An organization that looks for someone to blame after every event obtains a mechanical outcome: near misses disappear from the records, not because they stop happening, but because they are no longer reported. The system becomes blind at the very moment it believes it is improving.

A just culture reverses this logic. It clearly distinguishes an honest mistake, which calls for collective learning, from the deliberate and repeated violation of safety rules, which requires a different response. It holds that most incidents arise from organizational conditions, not from the fault of an isolated individual. It values the person who reports rather than stigmatizing them.

In practice, a healthy reporting culture rests on a few principles.

• Make reporting simple and fast. An accessible channel, a short form, the ability to report a near miss in a few moments.
• Guarantee feedback. Nothing is more discouraging than reporting into a void. Explaining what was done with a report maintains trust.
• Communicate on lessons learned, not on faults. Share the causes found and the actions taken, without naming anyone at fault.
• Involve management. A manager who thanks a worker for reporting a near miss sends a stronger message than any poster.

This requirement aligns with the spirit of the Moroccan framework, where the health and safety committee and occupational medicine exist precisely to organize a prevention dialogue rather than a search for individual blame. Reporting widely, investigating thoroughly, correcting at the root: this is the sign of an organization that is progressing, not one that is struggling.

To check that your investigation process, your corrective actions and your traceability hold up before a certification audit, HEMC provides its ISO 45001 audit readiness checklist, a free checklist to review your requirements clause by clause and identify your gaps before the auditor does.