Investigate an incident

Reporting an incident is the easy bit. Investigating it — actually finding out why it happened and stopping it from happening again — is where the real work is.

Lifecycle

Reported  →  Under investigation  →  Closed

The status names match the default lookups. Your org might have renamed them — see Customise lookup values.

Steps

Open the incident from the Incidents list.
Click Edit (kebab menu, ⋯).
Change Status to Under investigation.
Set or update the Investigation due date.
Save.

Now do the actual investigation in the Description field, the People tab, and the Attachments tab:

People involved / witnesses — who was there. Add free-text contact notes if useful for follow-up.
Description — root cause analysis. Use whatever method your org prefers (5 Whys, fishbone, immediate / underlying / root).
Attachments — photos of the scene, the equipment, any documents (training records, SDS extracts, witness statements).

Link the incident to its hazard

If the incident relates to a known hazard, link them via the Related tab. This is what builds your evidence trail across modules — “we knew about this hazard and this is what happened”.

Open the Related tab.
Click + Add related.
Pick Hazard as the type.
Search and select.

If the hazard doesn’t exist yet, the investigation has just discovered an unmanaged hazard. Click Create new in the same dialog to add it to the register.

Raise corrective actions

A closed investigation should produce at least one action — fix the control gap, retrain the people, replace the equipment. Use the same Related tab to add Action rows. They appear in the Actions module and stay linked to this incident.

See Raise an action from a finding.

Close the incident

When the investigation is complete:

Edit the incident.
Set Status to Closed.
Save.

The incident’s BRAG turns blue. Linked actions are still on their own clocks until they’re verified.