Not every incident deserves the same size of investigation, and knowing how to scale the response is as much a tested skill as knowing the investigation steps themselves.

Four levels, four different responses

Minimal-level investigation
A supervisor reviews what happened on their own and puts a fix in place. Appropriate for genuinely minor events with no real learning beyond "tidy this up."
Low-level investigation
The supervisor brings in the worker involved and a worker representative, looks at the circumstances together, and agrees preventative measures as a small group rather than alone.
Medium-level investigation
Supervisor, worker, worker representative and a safety adviser (sometimes a senior manager) identify all the causes and draw up a formal plan to prevent recurrence — a real, structured process, not just a chat.
High-level investigation
A thorough, formal inquiry involving everyone from the medium level, supervised by senior management, sometimes including an enforcement officer. This level agrees a timetable of immediate and longer-term actions and produces a formal record.

The scaling logic is simple: severity and potential consequence decide the level, not how much paperwork anyone feels like doing. A near miss with genuinely low potential doesn't need a senior-management inquiry — but a near miss that reveals a serious systemic gap absolutely might, regardless of the fact that, this time, no one was actually hurt.

The four basic steps, at any level

Whatever the scale, every investigation follows the same underlying sequence: gather information (from people, physical evidence, and documents like risk assessments and training records), analyse it, identify control measures, and implement an action plan with named owners and dates.

Immediate cause vs root cause

This is the pairing that gets tested constantly, and it's genuinely easy to get backwards under pressure.

The immediate cause is the unsafe act or condition right at the point of the accident — the unguarded blade, the missed step, the wet floor. It's what you'd point to if someone asked "what actually happened."

The root (or underlying) cause is the management failing sitting behind that immediate cause — the maintenance system that let the guard stay off for weeks, the training gap that meant no one flagged the missing signage. It's the answer to "why did the immediate cause exist at all."

Fixing only the immediate cause (put the guard back on) without touching the root cause (fix the maintenance system that let it come off) is how the same accident quietly recurs eighteen months later with a different name attached to it.

A useful interview habit worth borrowing

Whatever level you're investigating at, one simple technique consistently produces better information: interview people one at a time, in private, using open questions rather than yes/no ones, and open by making clear the goal is establishing facts — not finding someone to blame. People give noticeably more useful information once they believe that.

Key takeaway: in a scenario question, the level of investigation should follow from the severity and potential of the event described — and if you're asked for causes, give both the immediate cause and the management failing behind it. Answers that stop at the immediate cause leave marks on the table.

Practise on a real investigation scenario

Scenario-based questions marked against the real mark scheme, with detailed feedback on which causes and controls earned credit — and which ones you missed.

Attila Young, HSE consultant

Attila Young

Freelance HSE consultant who's been through the NEBOSH IGC himself. More about the creator →