Is Your Incident Management System Working as Intended?

Originally published by Jessica Urquhart.

You’ve updated your controls, you’ve done the toolbox talks, you’ve updated training packages and changed procedures. And yet – the same types of incidents keep happening.

It’s easy to assume the problem is the worksite, the workers, or the hazard itself. But what if the real issue is your investigation process? What if your system isn’t learning – it’s just logging?

Recurring incidents are rarely just bad luck. They’re often the result of missed insights, rushed investigations, superficial root causes, and ineffective follow-through. If your incident reports are stacking up but your risk profile isn’t changing, it might be time to ask:

Is our incident management system actually working?

What Should an Incident Management System Look Like?

Most incident management systems were developed many years ago. A well-meaning response to an injury, a compliance requirement, or a recommendation after an audit. A policy was written, a reporting form created, and a basic investigation template dropped into the safety folder.

Since then? Maybe there’s been a tweak or two – a new drop-down field, an extra signature box – but rarely a full review of how the system actually performs end-to-end.

An effective incident management system isn’t just a form and a filing cabinet. It’s a collection of integrated components that need to work in sync:

• Policy and procedures – outlining roles, responsibilities and escalation
• Reporting tools – designed for ease of use, timely reporting and capturing near misses
• Investigation methodology – consistent, repeatable, and grounded in risk-based thinking
• Templates and checklists – tailored to the level of severity and complexity
• Corrective actions and learnings – tracked, reviewed, and embedded
• Data analysis and insights – identifying trends, control failures and high-risk work

Without a structured review, these systems can quickly become reactive, inconsistent or redundant – leaving the business exposed.

Why Now Is the Right Time for an Incident Management Audit

When was the last time you looked at your entire system, not just after something went wrong?

A formal review gives you visibility of:

• Gaps in compliance with legislation or industry standards
• Missed opportunities to learn from near misses and low-level events
• Investigation fatigue, delays, or blame-driven outcomes
• Repeated corrective actions that don’t actually fix the problem
• Whether your system is enabling learning or just creating paperwork

Reviewing a full 12 months of incident data – the minor, the major, and the near misses – helps draw out meaningful patterns. Reported hazards are worth examining too, to ensure they haven't been downplayed or dismissed, along with how information flows, who's accountable, and what gets escalated (or buried).

If you have a risk management process in place, particularly one that includes critical control verification, that should be integrated into the review too. Understanding how well your critical controls are performing – especially those tied to high-consequence scenarios – is a key part of identifying gaps and strengthening your system.

What Does a Good Audit Include?

A thorough Incident Management System Audit typically includes:

• Review of your incident policies, procedures, and responsibilities
• Analysis of your reporting tools, templates and escalation pathways
• Detailed review of up to 12 months of incident data and investigations
• Insights into systemic issues, repeated failures, and missed trends
• Assessment of corrective action implementation and follow-through
• Evaluation of the effectiveness of incident actions
• Alignment check with legislative requirements and best practice
• Tailored recommendations and improvement priorities

Audits like this are best conducted in line with ISO 19011:2018 – Guidelines for Auditing Management Systems, aligned to the principles of ISO 45001 (Occupational Health and Safety Management Systems) and ISO 31000 (Risk Management Guidelines), so the process is structured, professional, and based on internationally recognised standards.

Why It Matters

• Because safety culture is shaped by how you respond to failure
• Because regulators expect systems to be living, breathing, and reviewed
• Because repeating the same mistakes is costly, frustrating, and avoidable
• Because you deserve to know if your system is doing its job

Before You Have Another Incident…

Have you ever looked at an investigation and thought, “We didn’t learn anything from this”? That’s a system problem, not a people problem.