Management system guidance
10.0 Improvement
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
10.2 Incident, nonconformity and corrective action
ISO 45001 clause 10.2 requires your organization to set up and maintain a process (or processes) for reporting and investigating incidents and nonconformities, and for taking action to determine and manage them. Incidents include injuries, ill health and near misses (e.g. a same-level fall with or without injury, a broken leg, hearing loss, or damage to buildings or vehicles that could lead to OH&S risks). Nonconformities include, for example, protective equipment not working properly, failure to fulfil legal requirements and other requirements, or prescribed procedures not being followed.
Put simply, this clause addresses the need to manage things that either could have gone wrong or actually have gone wrong. Separate processes may exist for incident investigation and for reviewing nonconformities, or they may be combined into one process – ISO 45001 leaves this to your organization. Whichever approach you choose, your procedures need to ensure proper control over reporting and investigation, that immediate actions are taken, and that longer-term corrective actions are initiated and completed. Responsibilities should be defined for everyone involved at each stage.
What the standard requires
When an incident or nonconformity occurs, your organization must:
- React in a timely manner and, as applicable, take action to control and correct it and deal with the consequences;
- Evaluate whether corrective action is needed to eliminate the root cause(s) so that it does not recur or occur elsewhere, with workers participating (see 5.4) and other relevant interested parties involved – by investigating the incident or reviewing the nonconformity, determining its cause(s), and determining whether similar incidents have occurred, whether similar nonconformities exist, or whether they could potentially occur;
- Review, where appropriate, the existing risk assessments for OH&S risks and other risks (see 6.1.2);
- Determine and implement any action needed, including corrective action, in line with the hierarchy of controls (8.1.2) and management of change (8.1.3);
- Assess the OH&S risks relating to any new or changed hazards before taking action;
- Review the effectiveness of any action taken, including corrective action;
- Make changes to the OH&S management system, if necessary.
Corrective actions must be proportionate to the actual or potential effects of the incident or nonconformity concerned. Documented information must be retained to show what each incident or nonconformity involved and what was done about it, and the results of any action and corrective action, including their effectiveness. This documented information must be communicated to relevant workers, workers' representatives where they exist, and other relevant interested parties.
First response
When an incident occurs, immediate action is taken to make the situation safe, prevent further injury, and help, treat and if necessary rescue injured persons. The first person aware of an incident should act, where safe to do so, to prevent further harm to people and property, and complete the following actions:
- Assess the situation and provide assistance and resources where necessary;
- Confirm that appropriate action has been taken, as far as practicable, to prevent further harm;
- Determine the actual and potential severity of the incident and notify the relevant managers and other relevant interested parties;
- Follow the relevant emergency response plan when it is an emergency situation (see 8.2);
- Where a reportable or high-potential incident has occurred, preserve the incident scene to obtain relevant evidence;
- Record any initial response taken to control the incident.
When summoning emergency assistance by telephone, the caller should keep calm and clearly state:
- The location of the incident;
- The nature of the incident, how many people are injured, and whether there is any fire or hazardous chemical spillage;
- The seriousness of the injuries, e.g. bleeding or bone fracture;
- The caller's name, department and telephone number.
An injured person should not be moved unless their location exposes them to further risk of injury. The general approach to a seriously injured person is to provide comfort, and only the treatment necessary to preserve life, until trained medical help arrives. Afterwards, details should be given to the attending emergency services to help with their follow-up.
Preserve the incident scene
Preserving the incident scene enables evidence to be collected so that the outcomes of the investigation are factual and the causes can be identified. In the case of a reportable or high-potential incident, the equipment, plant, machinery or process involved should not be disturbed until the investigation team has released the scene, unless this is needed to make the area safe.
Inspect the incident scene
Data needs to be gathered and records kept of all stages of the investigation. Unsafe situations must be made safe as soon as practicable, which means corrective action may take place in phases – immediate action to prevent further harm, followed by medium- or longer-term action to prevent recurrence. Any proposed action should be risk assessed before it is implemented; the intention is not to make an unsafe situation worse.
Collate clear and accurate information to begin the investigation. It is important not to allocate blame when investigating incidents. If attempts are made to apportion blame, people who might otherwise provide useful information will become defensive, which can lead to:
- Witnesses not revealing all of the circumstances and events surrounding the incident;
- Deliberate obstruction or the provision of false information;
- The removal of relevant information, documents or evidence.
The investigation must remain impartial and objective if all of the causes are to be established. It will be necessary to establish the events and circumstances leading up to the incident, which may include:
- The system of work in place;
- The instructions given for the work;
- Variations from instructions or safe systems of work;
- Workplace conditions such as lighting, floor surfaces, stair treads and handrails, warning signs, temperature and weather, recorded in enough detail for someone else reading the report to identify the area readily.
Find the root cause
Root cause analysis means examining every factor that may have contributed to an incident or nonconformity – what happened, how, and why – so that action can be taken to prevent it happening again. Investigations can be triggered by injuries, ill health, near misses, damage to buildings or vehicles, worker reports and complaints, internal or external audits, inspections and management reviews.
Immediate causes are usually obvious and easy to find – they are the unsafe acts and conditions, or active failures, present at the time. Behind them lie the root causes, or latent failures, arising from weaknesses in the organization and its OH&S management system. Use methods appropriate to the nature of the incident or nonconformity – for example the “5 Whys”, fishbone diagrams or event-and-causal-factor charts. Analysis frequently identifies several contributory failures, including factors related to communication, competence, fatigue, equipment, procedures, planning and maintenance.
Once the causes have been identified, review the incident step by step from the moment of occurrence and make sure that each conclusion is supported by direct evidence (physical or documented) or eyewitness accounts, and note where it is based on assumptions. Remember to check whether similar incidents have happened before, or could happen elsewhere in the organization.
Implement corrective action
Corrective actions to address the root cause(s) should be selected using the hierarchy of controls (8.1.2) and may include removing the hazard altogether; switching to a less hazardous material; redesigning or modifying tools and equipment; introducing or revising procedures; training the affected workers to improve their competence; reducing how often the task or substance is used; and, as a last resort, providing personal protective equipment. Before implementing an action, review the relevant risk assessments and assess any new or changed hazards it introduces, and manage the change through 8.1.3.
The timing and priority of any corrective action should reflect the OH&S risk involved. Clause 5.4 requires your organization to emphasize the participation of non-managerial workers in investigating incidents and nonconformities and in determining corrective actions (see 5.4).
Review effectiveness
Reviewing the effectiveness of corrective action means checking how well the actions taken actually control the root cause(s). This might involve follow-up inspections, observation of the revised work method, exposure monitoring or checking for any recurrence over a set period. Actions that have not worked should be re-opened and the investigation revisited.
Monitor and review trends
Incidents should be reviewed at health and safety meetings to identify trends that might reveal areas for improvement. Use incident statistics to measure trends over time so that the organization knows whether its OH&S performance is improving, stable or deteriorating (see 9.1.1); trends in incidents, nonconformities and corrective actions are a required input to management review.
The investigation process itself should be examined from time to time to check that it consistently delivers good-quality information. This can be done by checking a sample of investigation reports to verify the standard of investigation and the judgements made about causes and the prioritization of corrective actions.
Regulatory reporting
Your organization must comply with any statutory requirements to report certain incidents to the relevant enforcing authority; these will be identified as legal requirements under 6.1.3. In the UK, for example, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR) require work-related deaths, specified injuries, certain occupational diseases and dangerous occurrences to be reported to the enforcing authority, and injuries that incapacitate a worker for more than seven consecutive days to be reported within 15 days of the incident. See the Health and Safety Executive's website for current guidance.
Insurance and claims reporting
Your organization's insurer should also be notified of any reportable or significant incident that could give rise to a claim, and any subsequent investigation report and relevant documentation provided on request.
You should seek and record evidence that your organization has a process for reporting, investigating and taking action on incidents and nonconformities; that it reacts in a timely manner; that workers participate in evaluating the need for corrective action and in investigations; that root causes are determined and similar occurrences considered; that risk assessments are reviewed and new hazards assessed before action; that actions follow the hierarchy of controls and management of change; that effectiveness is reviewed; and that documented information is retained and communicated to relevant workers, their representatives and other relevant interested parties.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.