Incident Investigation in Canada — Steps, Reporting & the Law

When someone is hurt on a Canadian worksite — or very nearly is — what happens next is not optional. Every jurisdiction in Canada requires serious incidents to be reported to a regulator, protects the scene until it can be examined, and expects the employer to find out what actually went wrong so it cannot happen again.

This guide covers the incident investigation process, what must be reported and how quickly in each province and territory, the federal requirements, the current role of CSA standards, and the training that prepares people to conduct investigations properly.

What is an incident investigation?

An incident investigation is the systematic process of finding out what happened, and why, after a workplace accident, injury, illness or near miss. It means gathering evidence, interviewing witnesses, reconstructing the sequence of events, and identifying the causes underneath it. The purpose of an incident investigation is to find the causes of what happened and prevent similar incidents from happening again — not to assign blame. 9

A good investigation looks past the obvious "careless moment" to the conditions that set it up: the missing guard, the unclear procedure, the training gap, the time pressure. The same process applies to near misses and dangerous occurrences — investigating the incident that almost hurt someone is how the next one is prevented. Many workplaces, and several of the laws cited below, still call this work an accident investigation; the process is the same.

How do you conduct an incident investigation in 7 steps?

An investigation follows the same seven steps whether the incident put someone in hospital or simply came close: act quickly, make the scene safe, gather information, analyze the data, develop preventive measures, communicate findings, and follow up on corrective actions. Work through them in order.

1. Act quickly

Start as soon as the injured have been cared for and the area is safe to approach. Evidence disappears fast: equipment gets moved, conditions change and memories fade within hours. Acting quickly also protects your reporting deadline, because most statutory clocks start at the occurrence itself, not on the day the paperwork begins. Some jurisdictions put the investigation itself on a clock: British Columbia, for example, requires a preliminary investigation report within 48 hours and the full report within 30 days 14.

2. Make the scene safe

Before anyone investigates, the hazard has to be controlled so it cannot injure a second person: isolate the energy sources, shut down and lock out the equipment, and keep everyone out except the people who need to be there. Securing the scene is also a legal duty: every jurisdiction requires the scene of specified serious incidents to be left undisturbed, for a set period or until the regulator releases it, usually except to save a life, prevent further injury or protect endangered property.

3. Gather information

Photograph and measure the scene before anything is moved, and collect the physical evidence along with the maintenance records, training records, inspection logs and written procedures that apply to the task. Interview witnesses separately and as soon as possible, asking them to describe what they saw and did rather than what they think caused it. Several jurisdictions set out in law exactly what the written report must contain, so collect against that list from the start.

4. Analyze the data

Root cause analysis is the detailed procedure safety professionals use to determine the underlying source of an incident. In practice, though, incidents rarely have a single source. The Canadian Centre for Occupational Health and Safety puts it plainly: "even in the most seemingly straightforward incidents, seldom, if ever, is there only a single cause" 9.

Methods such as the "5 Whys" and fault-tree analysis are tools for that work rather than the definition of it. Keep going until you reach the factors the employer can actually change: a guard that was removed and never replaced, a procedure that does not match how the job is really done, a training gap, a production pressure. An investigation that stops at "the worker was not paying attention" has not found anything you can fix.

5. Develop preventive measures

Turn each cause into a specific corrective action with a named owner and a date. Prefer controls that remove or engineer out the hazard over controls that depend on someone remembering to behave differently. Several jurisdictions require the report to separate the immediate corrective action already taken from the long-term measures that will prevent a recurrence, so write both.

6. Write the report and communicate findings

The report goes to the people the law names: the joint health and safety committee or the worker representative, the regulator where a written report is required, and the managers who have to act on it. Share what was learned with the crew who do the job as well, because they are the people the findings are meant to protect.

7. Follow up on corrective actions

Check that each action was completed, then check that it worked. Confirm the control is in place and being used, update the procedure and the training that go with it, and close the item only when the hazard is genuinely gone.

What incidents must be reported — and how fast?

Every Canadian jurisdiction requires the most serious incidents to be reported to its OHS regulator. A workplace death or critical/serious injury must be reported immediately or as soon as possible — and where the law puts a number on it, within 24 hours. Most jurisdictions then require a written follow-up within a fixed period. Those periods vary considerably by jurisdiction and by incident type, from 24 hours to 30 days, so work from your own jurisdiction's clock rather than a rule of thumb.

Most jurisdictions also require reporting of defined dangerous occurrences even when nobody is hurt: structural collapses, uncontrolled explosions or fires, crane failures, major hazardous-substance releases. Some write near misses directly into law. In Newfoundland and Labrador, an accident with "the reasonable potential of causing serious injury" is reportable 24. Yukon requires a fire or explosion with the potential to cause serious injury to be reported 26. British Columbia requires a full investigation of incidents that had the potential for causing serious injury even where nobody was hurt 14.

Two rules travel with every report. First, preserve the scene. Every jurisdiction requires the scene of a specified reportable incident to be left undisturbed, usually except to save a life, prevent further injury, or protect endangered property. The trigger, the duration and the exceptions vary. Manitoba, for example, forbids altering or moving anything involved in a serious incident until at least 24 hours after notice is given, unless an officer directs otherwise 17. Saskatchewan, the Northwest Territories and Nunavut tie their rule to accidents causing a death.

Second, keep the paperwork. How long should incident reports be kept? There is no single national rule. Under federal rules, hazardous-occurrence reports and records must be kept for 10 years (s. 15.11) 8. Alberta, for example, requires the employer to retain the investigation report for at least two years 15. Treat your jurisdiction's requirement as the minimum. The exact thresholds, clocks and recipients for every jurisdiction are in the table below.

What does federal law require after a hazardous occurrence?

For federally regulated workplaces — banking, telecommunications, interprovincial transportation and the federal public sector — the Canada Labour Code, Part II sets the duty at the top. The employer must ensure the health and safety of every person it employs (s. 124) 1. It must also specifically "investigate, record and report," in accordance with the regulations, "all accidents, occurrences of harassment and violence, occupational illnesses and other hazardous occurrences known to the employer" (s. 125(1)(c)) 2.

The Code protects the scene as well. Where an employee is killed or seriously injured, nothing related to the incident may be disturbed without authorization. The exceptions are to save a life, prevent injury, maintain an essential public service or prevent unnecessary damage to property (s. 127(1)) 3.

The "how" lives in Part XV of the Canada Occupational Health and Safety Regulations — the Hazardous Occurrence Investigation, Recording and Reporting rules. It sets five duties, in this order:

• Investigate without delay. When an employer becomes aware of an accident, occupational illness or other hazardous occurrence, it must without delay appoint a qualified person to investigate. It must also notify the workplace health and safety committee or representative, and take measures to prevent a recurrence (s. 15.4) 4.
• Report the most serious results within 24 hours. Those results are: a death, a disabling injury to two or more employees, the loss of a body member, a permanent impairment, an explosion, or serious damage to a boiler or an elevating device. They must be reported to the Head of Compliance and Enforcement as soon as feasible, and within 24 hours of the employer becoming aware of them (s. 15.5) 5.
• Send a written report within 14 days. This applies where the investigation shows a disabling injury, a loss of consciousness from electric shock or a toxic or oxygen-deficient atmosphere, an emergency rescue, or a fire or explosion. The written report (form in Schedule I) goes to the committee without delay and to the Head of Compliance and Enforcement within 14 days (s. 15.8) 6.
• File the annual summary. Every employer files an annual summary of all hazardous occurrences by March 1 (s. 15.10) 7.
• Keep the records. These reports and records must be kept for 10 years (s. 15.11) 8.

What are the provincial and territorial incident investigation rules?

Outside federal jurisdiction, every province and territory runs the same basic architecture. Report serious incidents to the regulator, protect the scene, investigate, involve the workplace health and safety committee or representative, and fix what the investigation finds. What changes from one jurisdiction to the next is the detail — what exactly is reportable, how fast, who must carry out the investigation, and how long the scene stays untouched. The table below gives the working rules for each jurisdiction, from the primary legislation.

Committee or worker-representative involvement is common and frequently mandatory where one exists. Several jurisdictions make it conditional: in British Columbia the reports go to the joint committee or worker representative where applicable, and are otherwise posted at the workplace.

What is CSA Z1005, the standard for workplace incident investigation?

CSA Z1005:21, Workplace incident investigation, is the Canadian standard for this work: the second edition, published in 2021, supersedes the 2017 edition previously titled Incident Investigation (Z1005-17) 10. It is published alongside CSA Z1005.1:21, an implementation guideline for applying the standard 11. Z1005:21 itself sets out the requirements for an occupational health and safety incident investigation and prevention program, built on a Plan-Do-Check-Act cycle. It can be applied by organizations of any size in any type of industry. It is not written for criminal or regulatory enforcement investigations. It is a voluntary standard rather than law, so it sits on top of the statutory duties above rather than replacing them. With or without the standard, an incident investigation program should include what the law already names: who is notified and how fast, who investigates, how the scene is protected, what the written report must contain, how corrective actions are followed up, and how long the records are kept.

Two further CSA standards frame the surrounding system. CSA Z45001:19 (R2023) is Canada's adoption of ISO 45001 and now carries Amendment 1:2026. It sets the management-system requirements that investigations and corrective actions feed into 12. CSA Z1002:12 (R2022) is the hazard identification, risk assessment and control standard. Its front-end work — knowing your hazards before they become incidents — is what a good investigation checks against 13.

What skills does an incident investigation require?

Incident investigation training equips workers, supervisors and committee members to carry out an investigation properly: securing and documenting a scene, collecting evidence, interviewing witnesses, and working back from the visible event to the causal and contributing factors underneath it. It also covers what their jurisdiction requires them to report and what the written report must contain, so the investigation produces a document that stands up to a regulator's review.

Who is responsible for incident investigation?

The employer is responsible for ensuring an incident investigation is completed. That duty is explicit federally. The Canada Labour Code requires employers to investigate, record and report hazardous occurrences, and to provide employees with "the information, instruction, training and supervision necessary to ensure their health and safety at work" 2. The same duty runs through every provincial act's general duties.

Who actually conducts the investigation is often named in law too:

• Federally, it must be a qualified person.
• In Saskatchewan and Manitoba, it falls to the committee co-chairs or the employer with the representative.
• In the Northwest Territories and Nunavut, it falls to the committee or the representative together with the employer.
• In Ontario, the committee's designated worker members investigate fatalities and critical injuries.
• In British Columbia, it must be done by persons knowledgeable about the work, with employer and worker representatives participating.

Supervisors carry their piece as well: identifying and controlling hazards in their area and reporting what they cannot fix. Every worker's duty to report incidents promptly is what starts the process at all.

Who takes part in an incident investigation?

Anyone who may be handed a piece of the investigation when something goes wrong. In practice that means:

• Joint health and safety committee members and representatives — in several jurisdictions the law puts them directly on the investigation (Saskatchewan, Manitoba, the territories, Ontario's fatal and critical-injury cases). Where a committee or representative exists, the law has them notified or sent the report;
• Supervisors and managers — usually first on the scene, responsible for securing it and often for the first written account;
• Employers and owners in smaller workplaces — where there is no committee, the duty lands on them personally;
• Safety coordinators and designated investigators — the "qualified person" federal law demands.

The training matters most where the stakes are highest — construction, manufacturing, healthcare, transportation, oil and gas, mining — but the duty to investigate applies to every workplace, from an office to a drilling rig.

Can investigators be trained online?

Yes — incident investigation training can be completed fully online. The skills are procedural — what to report, how to secure a scene, how to gather evidence and reach root causes — which suits structured online learning well. Employers remain responsible for choosing training appropriate to their workplace, so confirm your employer accepts online delivery for this role.

What must investigators be taught to meet the law's requirements?

Incident investigation training has to cover six areas, and each one traces back to what the law asks an investigation and its written report to produce:

• Securing and managing an incident scene — every jurisdiction restricts disturbing the scene of a serious incident; investigators must know the exceptions (saving life, preventing further injury, protecting property);
• What must be reported, to whom, and how fast — the serious-injury lists, dangerous-occurrence categories and reporting clocks in your jurisdiction;
• Evidence gathering — photographs, video and graphics, witness management and interviews, documents and procedure records (the report contents Saskatchewan, Manitoba, the Northwest Territories and Nunavut spell out in law);
• Identifying unsafe conditions, acts and procedures that contributed to the incident — the analysis the British Columbia, Northwest Territories and Nunavut provisions name explicitly;
• Causal and contributing-factor analysis — explaining "the cause or causes," not just the last event, using methods like the 5 Whys and fault-tree analysis;
• Writing the report and closing the loop — immediate corrective action taken, long-term prevention measures (or the reasons for not acting), and who gets the report.

Does the law set an expiry date for the training?

No Canadian law sets an expiry date for incident investigation training, and no standard sets a refresher cycle: CSA Z1005:21 is a voluntary standard for an employer's investigation program, not a certification with a renewal cycle. The eSafetyFirst certificate carries a printed expiry of three years from completion; that is the program's practice, not a legal requirement. Earlier retraining is common practice, set by employers' training policies and their clients' requirements, usually when the job changes: joining an investigation team or a health and safety committee, new processes or equipment that change what could go wrong, or reporting rules changing in your jurisdiction.

Key takeaways

Incident investigation is where a workplace either learns or repeats. Canadian law makes the basics non-negotiable — report fast, protect the scene, investigate, fix the causes — and the difference between a paperwork exercise and a prevented recurrence is almost always the skill of the people doing the investigating. Train them before the incident, not after.