Skip to content
SentinelHSE
Incident investigation

The second time it happens, someone will ask what you did the first time.

Structured cause analysis bound to the incident, a named investigator, a signed sign-off, and a report you can hand over without rebuilding it.

See it on your own dataBook a 20-minute walkthrough

An investigation that stops at the immediate cause guarantees the repeat.

“The operator reached into the machine” is not a root cause. It is a description. It produces a corrective action — re-brief the operator — the action closes, and the same event happens on another shift to another person.

The root cause is why reaching in was the fastest way to do the job that day. Finding it is uncomfortable, slow, and the only part that pays. What most sites lack is not the will to do it — it is a structure that makes a thin investigation visibly thin.

A repeat incident means the first investigation found a cause nobody fixed.
The file

Two causes, six sections, one owner

What an investigation record holds, and what it refuses to let you skip. Every field below exists because a report without it is one somebody has to reconstruct later.

An open file and the form that starts one, every control on both. Hover a card to light that control on the screen, or hover the screenshots themselves to magnify them and click to open one full size.

An investigation record on a phone: the incident title, an Open status, the linked incident, the date opened, the named investigator, lost days, the immediate cause in plain words, and a cause analysis with two contributing causes selected

An open file

The new investigation form on a phone: a lost-days field, the cause analysis checklist with six collapsed sections, an open or closed status toggle, camera and gallery buttons, and a create button

Opening one

Screenshots from a working build. Illustrative records — not a customer.

Two causes, kept apart

Immediate cause is what happened, in the words of the people who were there. Root cause is what the organisation had in place that allowed it. One field each — collapsing them is the clearest tell of a product nobody in HSE reviewed.

Six sections, not a text box

A record of what was considered and what was ruled out. Free text tells you what somebody concluded; a section left blank tells you what nobody looked at.

A named investigator

Not a department. “HSE will look into it” is how a file goes quiet for a month, and a name with a due date is the cheapest fix available.

Scheduled without scheduling

The file inherits half the parent incident’s SLA as its planned duration and lands on the investigator’s planboard lane the moment it opens.

The board

Twelve investigations, one month, one board

A live board from a working month, filterable by status, category and investigator — with counters that follow the filter rather than the whole site.

Investigation board

One working month, every file with a named owner and a cause analysis

Illustrative data — not a customer
Total
12
Open
6
Closed
6
Lost days
31
Status
  • 1
    MediumOpen

    Laceration on burr during deburring

    Category
    Machine Guarding / Pinch Point
    Opened
    Closed
    —
    Lost days
    0
    Contributing causes
    5
    Investigator
    Tanya Brooks
  • 2
    HighClosed

    Forklift struck racking upright

    Category
    Vehicle & Mobile Equipment
    Opened
    Closed
    Lost days
    0
    Contributing causes
    3
    Investigator
    Derek Coleman
  • 3
    HighOpen

    Caustic splash during drum decanting

    Category
    Chemical Exposure
    Opened
    Closed
    —
    Lost days
    3
    Contributing causes
    4
    Investigator
    Angela Reyes
  • 4
    CriticalOpen

    Fall from mobile scaffold

    Category
    Fall from Height
    Opened
    Closed
    —
    Lost days
    21
    Contributing causes
    5
    Investigator
    Sarah Whitfield
  • 5
    CriticalClosed

    Arc flash during panel inspection

    Category
    Electrical / Arc Flash
    Opened
    Closed
    Lost days
    0
    Contributing causes
    5
    Investigator
    Angela Reyes
  • 6
    HighApproved

    Hydraulic oil to storm drain

    Category
    Environmental Release
    Opened
    Closed
    Lost days
    0
    Contributing causes
    5
    Investigator
    Emily Carver
  • 7
    MediumOpen

    Back strain lifting a drum

    Category
    Ergonomic / Overexertion
    Opened
    Closed
    —
    Lost days
    5
    Contributing causes
    5
    Investigator
    Tanya Brooks
  • 8
    MediumClosed

    Weld spatter ignited waste rags

    Category
    Hot Work / Burn
    Opened
    Closed
    Lost days
    0
    Contributing causes
    5
    Investigator
    Derek Coleman
  • 9
    MediumApproved

    Pinch injury closing a die

    Category
    Machine Guarding / Pinch Point
    Opened
    Closed
    Lost days
    2
    Contributing causes
    5
    Investigator
    Tanya Brooks
  • 10
    HighOpen

    Trailer moved during loading

    Category
    Struck-By / Caught-Between
    Opened
    Closed
    —
    Lost days
    0
    Contributing causes
    4
    Investigator
    Derek Coleman
  • 11
    HighApproved

    Atmosphere alarm during sump entry

    Category
    Confined Space
    Opened
    Closed
    Lost days
    0
    Contributing causes
    5
    Investigator
    Angela Reyes
  • 12
    MediumOpen

    Load shifted on delivery trailer

    Category
    Struck-By / Caught-Between
    Opened
    Closed
    —
    Lost days
    0
    Contributing causes
    2
    Investigator
    James Okonkwo

Twelve investigations against 14 incidents — the two low-severity events closed on a corrective action, which is the right answer. Six open, three closed, three signed off, and 31 lost days totalled across the board.

The same board, in the hand

Grouped by state, so the six still open are the first thing anyone sees. An investigator standing in the bay can open a file, add what they just found and close it without going back to a desk.

The phone counts six open and six closed against 12 total, while the web board splits that second number into closed and approved. Both are true — the field app can close a file, but it cannot sign one off.

The investigation list on a phone: twelve records with a counter strip showing six open and six closed, grouped by state
Worked example

Nobody was hurt. It was the most valuable file of the month.

An event with no injury and no cost is the cheapest lesson a site will ever be offered. It is also the one most likely to be closed with a paragraph, because nothing forces it open.

Investigation 5

Arc flash during panel inspection

Ridgeline Houston, Jul 09

A thermographic survey was run with a 480 V panel door open; a meter lead contacted the adjacent phase bar. Nobody was hurt.

Immediate cause — what happened
The meter lead contacted a live bar during an open-door thermographic survey.
Root cause — what the organisation allowed
The site treats thermography as a non-contact inspection and issues no energized-work permit for it, so the approach boundary and the PPE category were never assessed for the task. The panel’s arc-flash label was last updated in 2019 and understated the incident energy for the current transformer configuration.
Contributing causes recorded
Electrical hazardStopping the job / performing lockoutHead and eye protectionUsing tools incorrectlyInadequate procedures
5 causes across 5 of 6 sections.
Classified: potential SIFSigned off by HSE Manager, then VP HSE

A structured analysis is what makes the zero-injury file as rigorous as the fractured-wrist one. Classifying by potential rather than outcome is what puts it in front of a board that would otherwise never hear about it.

Cause analysis

Six sections. What you considered, not just what you concluded.

The value is not the taxonomy. It is that an empty section is visible — an investigation that ticks two boxes in one section is a thin investigation, and now it looks like one from across a room.

Investigation 5

Arc flash during panel inspection

Closed

5 contributing causes across 5 of 6 sections

  • Hazard to be reported1
    • Electrical hazard
  • Reaction of people1
    • Stopping the job / performing lockout
  • Personal protective equipment1
    • Head and eye protection
  • Tools and equipment1
    • Using tools incorrectly
  • Procedures / Training1
    • Inadequate procedures
  • Substandard conditionnothing recorded

Five sections considered, one ruled out. This is what a worked analysis looks like.

Investigation 12

Load shifted on delivery trailer

Open

2 contributing causes across 1 of 6 sections

  • Hazard to be reported2
    • Risk of staying under load
    • Risk of being struck by / caught in, between objects
  • Reaction of peoplenothing recorded
  • Personal protective equipmentnothing recorded
  • Tools and equipmentnothing recorded
  • Procedures / Trainingnothing recorded
  • Substandard conditionnothing recorded

One section, two boxes, five blanks. Still in progress — and impossible to mistake for finished.

Only the sections relevant to the incident's category open by default, with the rest one click away behind “Show all”. Both the checklist and the relevance map are edited by an administrator under System Settings → Cause Analysis. The product ships around forty items across these six sections; the ones above are the causes these two files actually recorded.

Capture

A confined space entry is not a forklift strike

The investigation form grows extra fields driven by the parent incident's category. Asking every event the same twenty questions is how you get twenty blank answers.

Confined Space

  • Space ID
  • Entry permit valid?
  • Atmosphere tested continuously, or pre-entry only?
  • Which gas alarmed
  • Attendant posted?

Electrical / Arc Flash

  • System voltage
  • Energized work, with or without a permit
  • Arc-rated PPE category
  • Potential SIF

Ergonomic / Overexertion

  • Task type
  • Load weight
  • Mechanical aid available, and was it used
  • Injury classification

These templates are built by administrators per category in the incident Category Manager. A site that investigates something the platform has never heard of writes its own template in minutes — no ticket, no release.

Sign-off

Approved is something two people did, not a field someone typed

A reusable template, a named signer per step, a typed signature and a comment. The status is produced by the workflow — the API refuses an attempt to set it directly on the record.

  1. Step 1

    HSE Manager review

    A named signer, not a role anybody can fill. A typed signature and a comment are both required before the step completes.

  2. Step 2

    VP HSE sign-off

    Notified the moment the step before completes. Nobody else can sign it — including an administrator, who cannot sign on their behalf.

Fixed at signing

What was signed is hashed the moment the signature lands, so the file cannot quietly change underneath an approval.

One signature, not two

Signing is row-locked. A double-tapped Approve on a slow connection produces one signature.

Reopenable, and noisy about it

A closed file can be reopened, and managers are notified both when it closes and when it comes back.

Approved

is the output of the two steps above. There is no back door on the record itself.

The chain

From reported to signed off

The chain an auditor asks for, built as the work happens rather than reconstructed the week they arrive.

  1. 1

    The incident is reported

    From the floor, on a phone, in under a minute. Everything below hangs off that record and carries its number.

  2. 2

    An investigation is opened against it

    One file per incident, bound to it, with a named investigator rather than a department. Not every incident gets one.

  3. 3

    A planned duration is inherited

    Half the parent incident’s SLA for that category and severity. The file lands on the investigator’s planboard lane without anyone scheduling it.

  4. 4

    Evidence and interviews

    The immediate cause is written first, in the words of the people who were standing there. What happened, before why.

  5. 5

    Cause analysis

    Six sections, with the ones relevant to that incident’s category surfaced first and the rest one click away.

  6. 6

    Category detail captured

    The questions that matter for that kind of event — a confined space entry is not asked what the forklift was carrying.

  7. 7

    The root cause is written

    Organisational, not personal. What the site had in place that let the immediate cause be the fastest way to do the job.

  8. 8

    Corrective actions raised

    Each with an owner and a date, chased automatically when they run late — against the hierarchy of controls.

  9. 9

    Closed, with managers notified

    And reopenable. If something surfaces later the file goes back to Open, and managers are told that too.

  10. 10

    Signed off

    HSE Manager, then VP HSE. What was signed is fixed at the moment of signing.

  11. 11

    Retained and exportable

    A numbered report carrying the details, the analysis, the contributing causes by section, and the sign-off block.

Oversight

Lost days are a number. The cause behind them is a decision.

Three things a VP HSE can read off this board that a folder of Word documents will never give them.

31

Lost days, totalled

Per file and across the board, filter-aware. This is the input to the rates below — captured on the investigation that determines the classification, not reconciled from a roster afterwards.

LTIFR
lost-time injuries × 1,000,000 / hours worked
DART
per 200,000 hours worked
Severity
lost days × 1,000,000 / hours worked

Always quoted with its multiplier. A rate without one is not a rate.

OpenClosedApproved

Open, closed, approved — live

Six open and three signed off in the month above. The counters on the cards are the same numbers as the rows in the list, because they are counted from them.

The board updates when a colleague opens or closes a file — with a toast, rather than a silent redraw that moves the row you were reading.

Repeat causes, findable

Search runs across the root cause, the immediate cause and the parent incident's title and description, as well as by file number.

The reason it works is that everyone is picking from the same six sections instead of writing free text. The same root cause cannot appear at four sites under four different names.

Evidence

What an auditor actually asks for

Buyers respond to clause numbers rather than feature lists, because the clause is the artefact they have to produce on the day.

  • ISO 45001:201810.2

    Incident, nonconformity & corrective action

    Where the evidence comes from

    Incident → investigation → cause → corrective action → verified closure, end to end

  • ISO 45001:20186.1.2

    Hazard identification & risk assessment

    Where the evidence comes from

    The “Hazard to be reported” section feeds findings back into the hazard register

  • ISO 45001:20185.4

    Consultation & participation of workers

    Where the evidence comes from

    The people who were there are the source of the immediate cause

  • ISO 45001:20188.1.3

    Management of change

    Where the evidence comes from

    Approval sign-off on the investigation and on its actions

  • ISO 45001:20187.5

    Documented information

    Where the evidence comes from

    Every file retained, numbered and retrievable

  • ISO 45001:20189.1

    Monitoring, measurement & analysis

    Where the evidence comes from

    Lost days, closure rates and recurring causes, per site

  • OSHA1904.7

    General recording criteria

    Where the evidence comes from

    Injury classification — first aid, medical treatment, restricted work, days away — captured on the file that determines it

  • OSHA1904.29

    Recordkeeping forms

    Where the evidence comes from

    The data behind the 300 log, retained with the investigation that produced it

SentinelHSE supports evidencing these requirements. Certification is an audit of your organisation, not of software — any vendor who tells you their product makes you compliant is selling you a problem.

See all twelve ISO clauses in the full map
Objections

The seven things you are already thinking

Answered the way we would answer them in the room, starting with the one that matters most.

No. People do. The platform makes a thin analysis visible, gives the file a named owner and a date, keeps the immediate cause and the root cause in separate fields so neither can quietly become the other, and stores what was concluded next to who signed it. That is a structure, not an answer — anyone selling you the answer has not sat in a post-incident review.

Most sites do. The question is retrieval and consistency, not effort. How long would it take you to produce every investigation from the last two years with “inadequate procedures” as a contributing cause, across all five sites? If the honest answer is “a week and a spreadsheet”, that is the gap — and it is why the same root cause can appear four times under four different names without anyone noticing.

Keep using them. The 6-section checklist records what the analysis considered and what it ruled out; it does not replace the method that got you there. If your team runs a fishbone on a whiteboard, the sections are where the outcome lands so it is still findable in eighteen months.

Yes — the sections, the items inside them, and which sections surface by default for which incident category. All under System Settings, changed by an administrator, no development work and no release. The same is true of the per-category capture templates.

Whoever the template names. A step assigned to a person can only be signed by that person — an administrator cannot sign it on their behalf, and the API refuses an attempt to set Approved directly on the record. Signing is row-locked, so a double-tapped Approve produces one signature rather than two.

Yes, and managers are notified both when it closes and when it reopens. Findings surface late — a second interview, a maintenance record nobody had — and a file that cannot reopen just teaches people to delay closing.

No, and a platform that forces one is training your team to write filler. In the illustrative month on this page, twelve of fourteen incidents got a formal file; the rest closed on a corrective action. Ceremony where none is warranted is how the ones that matter stop being read.

Not every incident gets a file. Twelve of the 14 incidents in the month above did; the other two closed on a corrective action. Forcing ceremony where none is warranted is how the files that matter stop being read.

See it on your own data

Send us your last three investigation reports — redacted is fine. We'll load them, run the cause analysis over them, and show you what a fourth would look like.

Book a walkthroughIncident management

45 minutes. Or bring a month of incidents and we will show you which of them would have earned a file.