Incident Investigation and CAPA Across Many Sites

Why investigation needs group governance

Every site investigates incidents. The problem in a multinational or a large industrial group is that each site does it differently: one plant writes a one-line cause such as “worker not careful”, another runs a full team investigation for a minor cut, a third closes actions the day they are raised. Group leaders then see a list of closed actions and assume the risk is under control.

Group governance fixes three things that a single site cannot: consistency (the same event gets the same depth of investigation everywhere), follow-through (actions are owned, chased and checked for effect, not only closed) and learning (a lesson from one plant reaches every plant with the same hazard). This guide is written for group and regional HSE or EHS directors, plant heads and internal audit teams who need all three.

What the standards ask for

The main references agree on the shape of a good process. Use them as the backbone of your group standard so that sites in every country recognise it.

Reference	What it expects
ISO 45001:2018, clause 10.2 (Incident, nonconformity and corrective action)	A process to report, investigate and act. React in a timely manner to control, correct and deal with the consequences; evaluate, with the participation of workers, whether corrective action is needed; investigate and determine causes; check whether similar incidents have occurred or could occur; review existing risk assessments; take action following the hierarchy of controls and management of change; assess new or changed hazards before acting; review the effectiveness of actions; keep documented information and communicate it to relevant workers.
HSE GB, Investigating accidents and incidents (HSG245)	Four steps: gather the information, analyse it, identify risk control measures, and make and implement an action plan. Investigate as soon as possible, at a depth set by the potential risk, with management and workforce both involved.
OSHA, Incident [Accident] Investigations: A Guide for Employers (December 2015)	Four steps: preserve and document the scene, collect information, determine root causes, implement corrective actions. Investigate all incidents, including close calls. The investigation is not complete until corrective actions that address the root causes are in place.

For certified groups, clause 10.2 is audited at every sampled site, and the central function must show that it collects and analyses incident data from all of them. Our guide to ISO 45001 multi-site certification explains what auditors look for.

Set the depth by potential, not outcome

Not every event needs a team investigation, but the choice must not depend on luck. HSG245 sets the level of investigation from a simple risk rating: how likely the event is to happen again, and the worst consequence it could realistically have had. That means a near miss with a fatal potential can deserve more effort than an actual minor injury.

Level (HSG245)	Who investigates	A group rule could be
Minimal	The relevant supervisor looks into the circumstances and learns any lessons	Recorded at site; no group review
Low	A short investigation by the supervisor or line manager into immediate, underlying and root causes	Site HSE checks the cause and actions
Medium	A more detailed investigation by the supervisor or line manager, the health and safety adviser and employee representatives	Country or regional HSE reviews before closure
High	A team investigation under the supervision of senior management or directors, with supervisors, advisers and employee representatives	Group HSE reviews the report; lessons shared group-wide

The third column is an example of how a group can map HSG245 levels onto its own hierarchy; set your own thresholds. To judge potential severity the same way at every site, use one classification method across the group, as described in our guide to SIF and potential-severity reporting.

Find root causes, not someone to blame

HSG245 separates three layers of cause. The immediate cause is the most obvious reason the event happened. Underlying causes are the less obvious system or organisational reasons. The root cause is the initiating failing from which the others spring, and HSE notes that root causes are generally management, planning or organisational failings.

OSHA's guide makes the same point more sharply. It warns that an investigation focused on finding fault will stop short of the root causes, and that blame makes workers and managers reluctant to take part openly. It also rejects the idea that most incidents are simply “human error”, quoting Sidney Dekker: “Human error is not the conclusion of an investigation. It is the starting point.” Both guides recommend asking “why?” repeatedly until you reach a cause that management can actually change.

A practical group test: if the root cause field names a person or says “not following procedure”, the investigation is not finished. Ask why the procedure was not followed: was it unclear, impractical, untrained, unsupervised or in conflict with production pressure?

Corrective actions that actually work

Weak actions are the most common failure in CAPA registers. OSHA gives an example: telling workers to remember to wear PPE is unlikely to prevent a repeat. ISO 45001 requires actions to follow the hierarchy of controls, and HSG245 lists measures in priority order: eliminate the risk, combat it at source, and rely on human behaviour only last. The table compares weak and strong actions for the same findings.

Finding	Weak action	Stronger action
Hand caught in an unguarded roller	Retrain the operator; warning sign	Fixed or interlocked guard; check the same machine model at every site
Forklift and pedestrian near miss	Remind drivers to be careful	Separate walkways and traffic routes; barriers at crossing points
Fall from a ladder during maintenance	Toolbox talk on ladder use	Plan the work from a platform; review the permit and the task risk assessment
Contractor worked without a permit	Warning letter to the contractor	Permit check built into sign-in; review how the contractor was briefed and supervised

Every action also needs the basics HSG245 asks for in the action plan: a named owner, a timescale, and a senior person who oversees the plan as a whole. Its objectives should be SMART (specific, measurable, agreed, realistic and timescaled). Where a serious risk cannot be controlled at once, HSE is clear that you must reduce it to an acceptable level or stop the work.

Finally, close the loop that most registers skip. ISO 45001 asks you to review the effectiveness of actions taken. Separate “action done” from “action effective”: plan a check some weeks later (an inspection, an observation, a review of new reports from that area) and record the result.

Who owns what at site, country and group

Level	Owns	Typical evidence
Site	Immediate response, preserving the scene, investigation at minimal to medium level, local actions	Report with photos, witness statements, causes, actions with owners and dates
Country or region	Review of medium and high investigations, legal reporting in that country, support with resources	Review sign-off, regulator notifications, overdue action follow-up
Group	The standard (levels, method, cause categories), review of high-potential events, cross-site lessons, KPIs and management review	Group standard, lesson alerts, CAPA dashboard, management review minutes

Legal duties to notify regulators differ by country and are not covered here. This is general information, not legal advice. Keep each country's notification rules in your country procedures and make sure investigation timelines leave room for them.

Learning across sites

ISO 45001 asks whether similar incidents have occurred or could occur. In a group, that question is the most valuable part of the process, because the same machine, chemical, contractor or task often exists at many sites. A good practice is a short lesson alert for every high-potential event: what happened, the root cause, the control that failed and the action other sites must check, each with an owner at every relevant site and a date.

Sharing a report is not the same as learning from it. A research project at The Open University, funded by the Energy Institute and run with three multinational energy companies, looked at how incident information moves between teams and found both good practices and systematic barriers to learning. The practical lesson for a group: track whether each site has checked the alert and what it found, not only whether the alert was sent.

CAPA KPIs for the group dashboard

KPI	Why it helps	Watch out for
% of investigations completed within the group's target time, by level	Shows whether sites start while memories are fresh	Speed must not replace quality
% of root causes at system level (not “person” or “not following procedure”)	Tests the depth of analysis	Needs a fixed list of cause categories
% of actions above administrative controls and PPE	Tests whether actions follow the hierarchy of controls	Some actions rightly stay administrative
Overdue actions and average days to close, by site	Shows follow-through	Extensions without review hide delays
% of closed actions verified as effective	Separates done from working	Plan the check when the action is raised
Repeat events with the same root cause	The best test of whether CAPA works	Requires consistent cause coding across sites
% of sites that confirmed each lesson alert	Measures learning, not just sharing	Confirmation should include what was checked

For how these fit with injury rates and other indicators, see leading vs lagging safety KPIs for multi-site groups.

Checklist: investigation and CAPA across a group

#	Check	Done?
1	One written group standard for reporting, investigating and acting, mapped to ISO 45001 clause 10.2	☐
2	Investigation levels set by potential severity and likelihood, with a named reviewer per level	☐
3	Near misses and contractor events in the same process as employee injuries	☐
4	Workers and their representatives take part in investigations	☐
5	A fixed list of immediate, underlying and root cause categories used at every site	☐
6	Every action has an owner, a due date and a place in the hierarchy of controls	☐
7	Risk assessments reviewed after each medium or high investigation	☐
8	Effectiveness checks planned and recorded separately from closure	☐
9	Lesson alerts for high-potential events, with confirmation from each relevant site	☐
10	CAPA KPIs reviewed in management review at site, country and group level	☐

Making it work across every site

Investigation and CAPA break down when reports live in email and actions live in spreadsheets. AccelSafety, our enterprise HSE software, puts every site on one hierarchy from group to region, country, cluster and site, with access scoped to each person's part of it and enforced on the server. Incidents, hazards and near misses are reported from a phone with photos; the incidents module covers investigation with root cause and lessons learned; actions and CAPA are tracked to closure; approvals and reviews are limited to the roles you choose; work can be grouped by ISO 45001 clause; and every dashboard number drills back to the source record with its history. See how incident reporting works, or book a demo and we will set it up with a structure like yours.

General information, not legal advice. Check the original sources and the law in each country where you operate.

Incident investigation and CAPA across many sites: one standard for the whole group