OSHA Incident Investigation Requirements: What's Mandatory vs. Best Practice

OSHA Incident Investigation Requirements: What's Mandatory vs. Best Practice

If you run a small business: The most important things to know are the hard deadlines — a workplace fatality must be reported to OSHA within 8 hours. A hospitalization, amputation, or eye loss within 24 hours. Missing these deadlines is itself a violation. This article explains what else OSHA requires and recommends — and what "best practice" looks like beyond the minimum.

When a workplace incident occurs, most people responsible for safety know they need to investigate. But there is often genuine uncertainty about what OSHA incident investigation requirements actually mandate — as distinct from what constitutes thorough professional practice. The gap between those two things is significant, and understanding it has practical consequences: organizations that treat the regulatory minimum as the ceiling of their investigation program consistently produce lower-quality findings, miss systemic causes, and remain exposed to recurrence. This article clarifies what OSHA requires, what it recommends, and what best practice looks like beyond both.

What OSHA actually mandates

There is no single OSHA standard that universally requires employers to conduct incident investigations. Instead, investigation requirements appear across several standards and apply differently depending on industry, incident type, and employer size.

The most broadly applicable requirement flows from the General Duty Clause of the Occupational Safety and Health Act of 1970, which requires employers to provide a workplace free from recognized hazards. While this does not explicitly mandate investigation, OSHA consistently treats failure to investigate serious incidents as evidence that an employer has not taken reasonable steps to identify and control hazards — making investigation an implied obligation for any employer seeking to demonstrate due diligence.

Explicit investigation requirements exist in several industry-specific standards:

• Process Safety Management (29 CFR 1910.119) — Requires formal incident investigation for any incident that resulted in, or could reasonably have resulted in, a catastrophic release of a highly hazardous chemical. Investigations must begin within 48 hours, use a defined methodology, produce a written report, and be retained for five years.
• Construction (29 CFR 1926) — Does not contain a general investigation requirement, but several subparts require investigation of specific incident types including crane and derrick incidents.
• Mine Safety and Health Administration (MSHA) — Separate from OSHA, MSHA has its own mandatory investigation requirements for mining incidents.

For most general industry employers outside of PSM-covered processes, OSHA's investigation mandate is implicit rather than explicit — but no less real for that.

Recordkeeping and reporting: the mandatory floor

The area where OSHA's requirements are most concrete and universally applicable is recordkeeping and reporting under 29 CFR Part 1904. These requirements apply to most employers with 11 or more employees in industries not specifically exempted.

The key obligations are:

• OSHA 300 Log — Record all work-related injuries and illnesses that result in days away from work, restricted work, job transfer, medical treatment beyond first aid, loss of consciousness, or diagnosis of a significant injury or illness by a healthcare professional.
• OSHA 301 Incident Report — Complete a separate incident report for each recordable injury or illness within seven calendar days.
• OSHA 300A Summary — Post annually from February 1 to April 30.
• Severe injury reporting — Report any work-related fatality within 8 hours and any work-related inpatient hospitalization, amputation, or loss of an eye within 24 hours, by calling 1-800-321-OSHA or reporting online.

It is important to understand what these recordkeeping requirements do not mandate: they do not require employers to conduct a formal root cause analysis, identify contributing factors, or implement corrective actions. An employer can be technically compliant with Part 1904 while conducting no meaningful investigation at all. The recordkeeping system is a surveillance tool for OSHA — it is not an investigation standard.

What OSHA recommends beyond the mandate

OSHA's incident investigation guidance goes considerably further than its mandatory standards. OSHA recommends that employers investigate all incidents — including near misses with high injury potential — regardless of whether they resulted in a recordable injury. The guidance recommends:

• Preserving the incident scene and collecting physical evidence immediately
• Interviewing witnesses promptly, separately, and without leading questions
• Identifying both immediate and root causes — not stopping at the surface
• Implementing corrective actions that address root causes, not just symptoms
• Tracking corrective action completion and verifying effectiveness
• Sharing findings with the workforce to prevent recurrence

None of these steps is mandatory for most employers. All of them represent the standard of care that OSHA will look for when evaluating whether an employer took reasonable action to prevent a hazard — and that courts and insurers will examine in civil litigation following a serious injury.

The difference between what OSHA requires and what OSHA recommends is the difference between staying out of trouble after an incident and actually preventing the next one.

Near misses: the most underinvestigated category

OSHA's guidance is explicit that near-miss events — incidents that could have resulted in serious injury but did not — should be investigated with the same rigor as recordable injuries. The causal chain producing a near miss is structurally identical to the one that produces an injury: the outcome differs by circumstance, not by the severity of the underlying failure.

In practice, near-miss investigation is the area where most organizations fall furthest short. Near misses are frequently underreported due to concerns about blame, paperwork burden, or the perception that "nothing happened." The business case for near-miss investigation is straightforward: the cost of investigating a near miss is a fraction of the cost of investigating the serious injury that the same causal chain will eventually produce.

State plan OSHA requirements

Twenty-two states and two territories operate their own OSHA-approved state plans, which must be at least as effective as federal OSHA but may impose additional or more stringent requirements. California's Cal/OSHA, for example, requires employers to investigate occupational injuries and illnesses under the Injury and Illness Prevention Program (IIPP) standard. Employers operating in state-plan states should verify the specific investigation obligations that apply to their jurisdiction — federal OSHA compliance is not sufficient in these states.

What best practice looks like beyond OSHA

The most mature investigation programs treat OSHA's requirements as a starting point rather than a destination. Beyond regulatory compliance, best practice investigation programs share several characteristics:

• Consistent methodology — A defined root cause analysis framework applied to all investigations above a specified severity threshold.
• Proportionate depth — Investigation depth matched to actual or potential severity.
• Corrective actions tied to root causes — Every corrective action traceable to a specific identified root cause, prioritized using the Hierarchy of Controls.
• Workforce involvement — Workers involved in investigations as subject matter experts, not just as witnesses.
• Learning systems — Investigation findings shared across the organization in a format that drives learning, not just compliance.

For a detailed treatment of the root cause analysis methodologies that underpin best practice investigation, see our article on root cause analysis methods for workplace incidents. For guidance on structuring corrective actions using the Hierarchy of Controls, see our article on hierarchy of controls in practice.

Documentation: what you need to be able to show

Regardless of whether an investigation was triggered by a mandatory requirement or a voluntary best practice commitment, the documentation produced needs to withstand scrutiny. The practical documentation standard is: could a person with no prior knowledge of the incident read this record and understand what happened, why it happened, and what has been done to prevent recurrence? Investigation records that answer those three questions clearly — with findings traceable to evidence and corrective actions traceable to root causes — are defensible. Those that don't are a liability.