Accident investigation and root cause analysis

In short

Accident investigation is the structured, fact-finding process of establishing what happened in an incident, and root cause analysis (RCA) is the follow-on analysis that traces the event past the obvious unsafe act or condition to the management-system failures that allowed it. The purpose is prevention and learning, never blame or compensation-fixing. In India it is both a statutory duty — notice and inquiry of accidents and dangerous occurrences under the Occupational Safety, Health and Working Conditions Code, 2020 (in force 21 November 2025, replacing the former Factories Act, 1948, Mines Act, 1952 and Dock Workers Act) — and a certification duty under ISO 45001:2018 clause 10.2. It is examined in university papers on safety management, in AICTE fire-and-safety curricula, and asked in almost every EHS interview (Reliance, L&T, Tata Steel, ONGC, IOCL, BHEL, DRDO, Adani, pharma and construction majors) through the measurement formulas of IS 3786 and a live "walk me through an investigation" question.

Explained

Basic terms and the incident pyramid

• Hazard: a source with the potential to cause harm. Risk: likelihood × consequence of that harm being realised.
• Incident: any unplanned event; accident: an incident that results in injury, ill-health, damage or loss; near miss (close call): the same event sequence with no loss, by chance only.
• Dangerous occurrence: a notifiable event (vessel burst, fire or explosion, lift/crane collapse, gas release, structural collapse) reportable whether or not anyone was injured.
• Reportable injury: under the OSH&WC Code and its rules, death or bodily injury that prevents the person from working for 48 hours or more; the exact forms, timelines and the list of dangerous occurrences are set by the Central and State OSH rules, which differ, so quote your State's rule in an exam only if you know it.
• Lost-time injury (LTI): injury causing absence beyond the day of accident; first-aid case: treated on site, no lost time; restricted work case: worker redeployed to lighter duty.
• Heinrich's ratio (1931): 300 no-injury incidents : 29 minor injuries : 1 major injury. Bird's triangle (1969): 600 near misses : 30 property-damage events : 10 minor injuries : 1 serious injury. Meaning: the base of the pyramid is free information; investigating near misses prevents the apex.
• Heinrich's 88-10-2 claim (88% unsafe acts, 10% unsafe conditions, 2% unavoidable) is historically important but now treated as discredited in its blame-the-worker form — modern practice treats the "unsafe act" as a symptom, not a cause.

Causation models that justify RCA

• Domino theory (Heinrich): five dominoes — ancestry/social environment → fault of person → unsafe act or condition → accident → injury. Removing the middle domino stops the fall. Simple, linear, single-cause — its weakness.
• Loss causation model (Frank Bird / ILCI), the workhorse of industrial RCA: Lack of control (inadequate programme, standards or compliance) → Basic causes (personal factors: skill, knowledge, motivation, physical capability; job factors: design, tools, maintenance, procedures, wear) → Immediate causes (substandard acts and substandard conditions) → Incident (contact with energy or substance) → Loss (people, property, process, environment).
• Energy-transfer / energy-barrier model (Haddon): harm occurs when uncontrolled energy — kinetic, thermal, chemical, electrical, pressure, gravitational — reaches a target. Controls are barriers; investigate which barrier was missing, weak, bypassed or defeated.
• Swiss-cheese model (James Reason): defences in depth have holes — active failures (slips, lapses, mistakes, violations at the sharp end) line up with latent conditions (design, staffing, training, production pressure) to let the hazard through. Introduces organisational error and the distinction between human error and violation (routine, situational, exceptional).
• Multiple-causation theory: every accident has several contributing causes acting together; so an investigation that stops at one cause is incomplete.
• Systems/STAMP view: accidents arise from inadequate control and missing feedback in a socio-technical system, not from a chain of broken parts — useful language for interviews on process-safety incidents.

Step-by-step investigation procedure

1. Respond and make safe: rescue, first aid, isolate energy, extinguish, cordon. Life safety outranks evidence.
2. Notify: internal escalation plus statutory notice to the Inspector-cum-Facilitator / Chief Inspector (OSH&WC Code), police in case of death, and others as applicable — Factory/premises licensing authority, State Fire Service, PESO for explosives and pressure vessels, Chief Controller of Explosives for LPG/petroleum, the Electrical Inspector for electrical fatalities, and the authority under the Chemical Accidents (Emergency Planning, Preparedness and Response) Rules for MAH units.
3. Preserve the scene: photographs with scale, sketches, video, tagging of positions, retention of broken parts, PPE, permits, charts, DCS/SCADA logs, CCTV, PLC trends. Do not "clean up" before recording.
4. Collect facts: physical evidence, documents (work permit, JSA/HIRA, checklist, maintenance history, calibration, training records, shift handover, MSDS), and people.
5. Interview each witness separately, as soon as possible, in a neutral place, open questions first ("tell me what you saw"), no leading, no blame, let them draw the sketch; close with "what would have prevented this?" Record and read back.
6. Reconstruct the sequence on a time line — an Events and Causal Factors (ECF) chart of conditions and events in order, with gaps marked as questions still open.
7. Analyse causes: apply a technique (below) to move from immediate causes to basic causes to system/control failures. Test each candidate cause: *if it were removed or corrected, would the event have been prevented or mitigated?*
8. Identify corrective and preventive actions against the hierarchy of control — elimination, substitution, engineering control, administrative control/procedure, PPE — with owner and target date (SMART).
9. Report in a standard format; approve at the level that owns the risk.
10. Implement, verify effectiveness, and close; share the lessons across similar plants; feed back into HIRA, SOPs, training and design standards; track recurrence.

RCA techniques — how each works, with limits

• 5 Whys (why-why analysis): ask "why" repeatedly from the loss until an actionable system cause is reached. Cheap and fast; ends in a single chain, depends on the asker's knowledge, and can stop too early ("worker was careless") or run off into platitudes.
• Cause-and-effect / Ishikawa fishbone: the loss is the spine; bones group possible causes under 4M/6M — Man, Machine, Material, Method (plus Measurement, Milieu/Environment) or, for safety, People, Equipment, Procedure, Environment, Management. Excellent for brainstorming breadth; it organises hypotheses but does not prove them or show sequence.
• Fault tree analysis (FTA): top-down, deductive Boolean logic from the undesired top event through AND/OR gates to basic events; gives minimal cut sets and a quantified top-event probability. Strong for engineered systems and for GATE-type numericals; weak for human and organisational factors.
• Event tree analysis (ETA): forward, inductive — from the initiating event through success/failure of each barrier to the outcomes and their probabilities. FTA and ETA joined at the initiating event form the bow-tie diagram (threats — barriers — top event — barriers — consequences), the standard picture in process safety.
• Barrier/control analysis: list each barrier that should have worked (physical, functional, procedural, human) and classify it as absent, inadequate, failed, or defeated.
• Change analysis (Kepner-Tregoe style): compare the accident situation with the normal, trouble-free one and investigate every difference — ideal where a plant ran safely for years.
• ECF charting with cause coding, TapRooT, ICAM, MORT, 4M-5E, Tripod Beta, Apollo cause-mapping: structured commercial/industry methods used in oil and gas, aviation and mining; they force investigators past the first cause by means of a prebuilt taxonomy (dictionary) of root-cause categories.
• Failure mode and effects analysis (FMEA) and HAZOP are proactive hazard studies, not investigation tools — but an accident almost always reveals a gap in them, and the RCA report should require their revision. HAZOP guidance in India is in the IS code of practice on hazard identification and risk analysis (IS 15656).
• Pareto and trend analysis: for many small events, 80% of losses trace to a few causes; drives programme-level correction rather than event-level.
• Human-factor methods: HFACS and HTA break human error into decision, skill-based, perceptual error and violation, then to supervision and organisational influences.

Fire and explosion incident investigation (stream-specific)

• Objective: determine the point of origin, then the ignition sequence — fuel first ignited, ignition source, oxidiser, and the event that brought them together — and only then the responsibility and the system failures.
• Scientific method, as codified internationally (NFPA 921/1033 and used by Indian investigators and insurers): define the problem → collect data → analyse → form a hypothesis → test the hypothesis against all the data → revise. A hypothesis that is not tested is "expectation bias", the classic fire-investigation error.
• Reading the scene: V-shaped, hourglass and inverted-cone burn patterns, char depth and calcination survey, clean burn, spalling, heat shadows, direction of fall and distortion of steel, lowest point of burning, electrical arc mapping, and melting-point indicators (polyethylene ≈ 120 °C, aluminium ≈ 660 °C, copper ≈ 1,085 °C) to bracket temperatures.
• Cause classification: accidental, natural, incendiary (arson) and undetermined — "undetermined" is a legitimate, honest finding.
• Arson indicators: multiple unconnected origins, trailers and pour patterns, abnormally rapid growth, disabled detection or sprinkler valves closed, forced entry or removed valuables, inconsistent witness accounts — supported by laboratory analysis of debris for ignitable liquid residues (gas chromatography).
• System questions every fire RCA must answer: did detection and alarm operate and when; did sprinklers/hydrant/pump start and was water available in the static tank; were fire doors and dampers closed; was compartmentation breached by cable or duct penetrations; were exits usable, unlocked and unobstructed; was evacuation time adequate; was the hot-work permit system followed. Benchmarks come from the National Building Code of India 2016, Part 4 (Fire and Life Safety), the State Fire Prevention and Fire Safety Acts and rules, and the relevant Indian Standards for extinguishers, hydrants, sprinklers, detection and fire pumps.
• Indian landmark fires routinely used as case studies: Uphaar cinema (Delhi, 1997), AMRI Hospital (Kolkata, 2011), Kamala Mills (Mumbai, 2017), Surat coaching centre (2019), Vizag styrene release (2020), and repeated hospital ICU fires — in almost every one the RCA found blocked or locked exits, unauthorised change of use, combustible interior finishes and defeated or untested fire protection, not merely a short circuit.

Legal framework, reporting and records in India

• OSH&WC Code, 2020 (in force 21 November 2025) consolidates the earlier Factories, Mines, Dock Workers, Building and Other Construction Workers and Contract Labour legislation: the employer must notify specified accidents and dangerous occurrences to the authority notified by the appropriate Government, maintain registers and returns, run a safety committee in hazardous establishments, and appoint Safety Officers above the prescribed threshold; inspection is by an Inspector-cum-Facilitator. Numerical thresholds for safety officers/committees and the notice formats sit in the Central and State rules.
• Fatal-accident inquiry: the appropriate Government/competent authority may hold a formal inquiry into the causes; the employer's own report does not replace it. A death also brings in the police and a magisterial/coroner process.
• Compensation and benefits flow from the Code on Social Security, 2020 (which subsumed the former Employees' Compensation Act, 1923 and ESI Act, 1948) — a no-fault liability route independent of the RCA; so an investigation report must stay factual and avoid phrasing drafted for or against a claim.
• Environmental and chemical accidents: reporting under the Environment (Protection) Act, 1986 and the rules for manufacture, storage and import of hazardous chemicals; off-site/on-site emergency plans; the Public Liability Insurance Act, 1991 gives immediate relief; the principle of absolute liability for hazardous industry comes from *M.C. Mehta v. Union of India* (Oleum gas leak, 1986) and the Bhopal aftermath.
• ISO 45001:2018 clause 10.2 requires timely reporting, investigation of the root causes (not just correction), action per the hierarchy of controls, review of risk assessment, retention of documented information, and worker participation (clause 5.4) in the investigation. IS 14489 is the Indian code of practice for occupational safety and health audit; IS 3786 gives the computation of frequency and severity rates and the classification of industrial accidents. DGFASLI and the State Factory/Industrial Safety & Health Directorates publish the national statistics these rates feed into.
• Report structure (standard exam answer): identification details → description of the establishment and process → sequence of events with time line → injuries/loss and cost → evidence collected → immediate causes → basic causes → root/system causes → corrective and preventive actions with owners and dates → annexures (photos, sketch, permits, statements) → sign-off.

Key points

• Purpose of investigation - prevention and system learning; fault-finding destroys the flow of facts and the next report.
• Incident vs accident - the event sequence is identical; only the outcome differs, which is why near misses are investigated.
• Dangerous occurrence - notifiable even with zero injury (vessel burst, fire, explosion, crane or structural collapse, gas release).
• Immediate causes - the substandard acts and conditions you can see at the scene; never the stopping point.
• Basic causes - personal factors (knowledge, skill, motivation, capability) and job factors (design, maintenance, procedure, tools).
• Root cause - the management-system failure whose correction prevents recurrence of this and similar events.
• Loss causation model - lack of control → basic → immediate → incident → loss; the standard RCA ladder.
• Swiss cheese - active failures line up with latent organisational conditions; blame the holes, not the hand.
• Error vs violation - error is unintended, violation is a deliberate deviation; the remedies differ (design/training vs supervision, workload, culture).
• Bird's triangle - 1 : 10 : 30 : 600; the base is where cheap data lives.
• Hierarchy of control - eliminate, substitute, engineer, administrate, PPE; a report whose only action is "counselled the worker, issued PPE" is a failed RCA.
• 5 Whys - fast single-chain tool; fishbone - breadth of hypotheses; FTA - quantified Boolean logic; bow-tie - threats, barriers and consequences in one picture.
• Barrier analysis - classify every intended barrier as absent, inadequate, failed or defeated.
• Change analysis - find what differed from the day it worked safely.
• Frequency rate and severity rate - per million man-hours in Indian practice (IS 3786); OSHA-style TRIR/LTIFR uses 200,000 hours — always state the base.
• Fire origin and cause - establish origin first, then ignition sequence; test the hypothesis against all data; "undetermined" is a valid conclusion.
• Statutory position - notice, registers, safety committee and safety officer duties now sit in the OSH&WC Code, 2020 and its rules; compensation in the Code on Social Security, 2020.
• Closure - an action is closed only when implemented *and* verified effective; recurrence means the root cause was never found.

Formulas and examples

Example 1 — Statutory safety statistics for a factory. A unit employs 500 workers, works 300 days of 8 hours; actual man-hours worked in 2025-26 were 1,200,000. There were 9 lost-time injuries, including one permanent partial disablement, and 540 man-days were lost in total.

• FR = 9 × 1,000,000 / 1,200,000 = 7.5 injuries per million man-hours
• SR = 540 × 1,000,000 / 1,200,000 = 450 days per million man-hours
• Incidence rate = 9 × 1,000 / 500 = 18 per 1,000 workers
• Average days lost per injury = 540 / 9 = 60 days (= SR/FR = 450/7.5 ✔)
• LTIFR on the 200,000-hour base = 0.2 × 7.5 = 1.5
• FSI = √(7.5 × 450 / 1,000) = √3.375 = 1.84

Example 2 — Effect of the RCA programme (Safe-T-Score). Next year the plant works 1,000,000 man-hours with 4 LTIs → FR_present = 4 × 10⁶/10⁶ = 4.0.

• Safe-T-Score = (4.0 − 7.5) / √(7.5 / 1.0) = −3.5 / 2.739 = −1.28
• |−1.28| < 2 → the improvement is not yet statistically significant; a genuine claim of improvement needs more exposure hours or a bigger drop. (If the same FR of 4.0 were achieved over 3,000,000 man-hours: −3.5/√(7.5/3) = −3.5/1.581 = −2.21, i.e. significant.)
• If instead one of those 4 injuries had been a fatality, the scheduled charge of 6,000 days alone would give SR ≥ 6,000 × 10⁶/10⁶ = 6,000 — showing why FR and SR must always be read together.

Example 3 — Cost of a single accident (iceberg). A conveyor entanglement causes a crush injury. Direct/insured costs: medical ₹1,80,000, compensation ₹1,70,000 → ₹3,50,000. Using the classic 1 : 4 ratio, indirect costs ≈ 4 × 3,50,000 = ₹14,00,000 (lost production during the 2-day shutdown, overtime and replacement worker, supervisor and investigation time, damaged guard and belt, legal and inspection follow-up, retraining, morale and reputational effect).

• Total loss = 3,50,000 + 14,00,000 = ₹17,50,000
• At a net profit margin of 8%, sales needed to earn this back = 17,50,000 / 0.08 = ₹2,18,75,000 ≈ ₹2.19 crore
• A fixed interlocked guard for the tail pulley costs about ₹60,000 — payback is a single avoided accident. (The 1 : 4 ratio is an order-of-magnitude rule from Heinrich, not a measured constant; quote it as indicative.)

Example 4 — Fault tree for an uncontrolled warehouse fire (quantified).

TOP: Uncontrolled fire with major loss      = AND
 ├── Fire starts                            = OR
 │     ├── Electrical fault        P = 0.02
 │     └── Hot work / ignition src  P = 0.05
 └── Protection fails               = AND
       ├── Sprinkler system fails   P = 0.03
       └── Detection + alarm fails  P = 0.05

• Fire starts (OR) = 1 − (1 − 0.02)(1 − 0.05) = 1 − 0.98 × 0.95 = 1 − 0.9310 = 0.0690
• Protection fails (AND) = 0.03 × 0.05 = 0.0015
• Top event = 0.0690 × 0.0015 = 1.035 × 10⁻⁴ per year ≈ once in 9,662 years
• Minimal cut sets: {Electrical, Sprinkler, Detection} and {Hot work, Sprinkler, Detection} — every cut set contains both protection failures, so testing and maintaining sprinkler and detection is the highest-leverage action; if the sprinkler control valve is found shut (P = 1.0), the top event rises to 0.0690 × 0.05 = 3.45 × 10⁻³ per year, a 33-fold increase.

Example 5 — 5 Whys on a real-type case. A fitter suffers flash burns while opening a pump casing on a hydrocarbon line.

• Correct actions: engineering — install bleed/drain and locked-open/locked-closed valve scheme (elimination of stored energy); administrative — authorised-issuer list with competency matrix, mandatory re-training on every procedure revision, permit audit; PPE — flame-retardant coverall and face shield as the last layer. "Warned the fitter" would correct nothing.

Where it is used

• Refineries, petrochemicals and fertiliser plants (IOCL, BPCL, HPCL, RIL, GAIL, ONGC, Tata Chemicals): bow-tie and FTA-based process-safety incident investigation, PSM audits, OISD compliance and off-site emergency plans.
• Steel, cement, power and mining (Tata Steel, JSW, SAIL, NTPC, Coal India): fatality-prevention programmes, high-potential near-miss investigation, statutory FR/SR returns to the Directorate and DGMS/DGFASLI statistics.
• Construction and infrastructure (L&T, Afcons, Metro and expressway projects): fall-from-height and lifting-failure investigations, contractor incident reporting, client-mandated RCA within 48 hours.
• Pharma, FMCG and auto plants (Sun Pharma, Cipla, Maruti, Hyundai, Bosch): ISO 45001 clause 10.2 incident procedures, 5-Why/fishbone in the quality-safety QMS, horizontal deployment of lessons across sister plants.
• Fire services, insurance and forensics: State fire service fire-cause reports, insurance surveyors and loss adjusters determining origin and cause and whether warranties (sprinkler, hot-work permit) were breached, forensic science laboratories testing debris for ignitable liquids, court evidence in arson and negligence cases.
• Job roles: Safety Officer / Safety Supervisor, EHS Engineer, Fire & Safety Officer, Process Safety Engineer, Loss Prevention Officer, Incident Investigator, safety auditor, insurance risk surveyor; the OSH&WC Code route also supports Inspector-cum-Facilitator and State Fire Service posts.

Interview questions

• Q: What is the difference between an immediate cause and a root cause? A: The immediate cause is the substandard act or condition visible at the scene; the root cause is the management-system failure — in training, design, maintenance, procedure or supervision — that allowed it, and whose correction prevents recurrence.
• Q: Why investigate near misses when nobody was hurt? A: They have the same causes as injuries but cost nothing to learn from; the accident triangle shows hundreds of them for every serious injury, so they are the earliest and cheapest warning.
• Q: A worker ignored the SOP and was injured. Is the root cause "human error"? A: No — "human error" is a finding, not a cause. You must ask why the deviation was possible and rational to the worker: SOP unworkable, unavailable, untrained, production pressure, no supervision, or a missing engineering safeguard.
• Q: Your RCA ends with "worker was not wearing PPE". What is wrong? A: It stops at the last line of defence. The hierarchy of control requires first asking why the hazardous energy existed at all and why the PPE rule was not enforced or the PPE not suitable or available.
• Q: Which accidents must be reported to the authorities in India? A: Under the OSH&WC Code, 2020 and its rules, deaths, bodily injuries preventing work for 48 hours or more, and the prescribed dangerous occurrences — the last reportable even if nobody was injured; the forms and time limits are in the Central/State OSH rules.
• Q: Differentiate frequency rate and severity rate. A: FR counts lost-time injuries per million man-hours — how often; SR counts man-days lost per million man-hours — how bad. A low FR with a high SR signals rare but catastrophic events.
• Q: How many days are charged for a fatality in severity rate? A: A scheduled charge of 6,000 days for death or permanent total disablement, with scheduled charges for each permanent partial disablement, as per the computation convention in IS 3786.
• Q: When would you use FTA rather than 5 Whys? A: When the event involves engineered protection systems and you need quantified probabilities, minimal cut sets or a design decision; 5 Whys suits simple, single-chain, low-consequence events.
• Q: What is a bow-tie diagram? A: A fault tree of threats and preventive barriers on the left and an event tree of consequences and mitigating barriers on the right, joined at the top event — it shows at a glance which barriers were missing in the incident.
• Q: In a fire investigation, what do you establish first? A: The point of origin — from burn patterns, char and calcination depth, arc mapping and witness accounts — and only then the ignition sequence of first fuel, ignition source and the act or failure that brought them together.
• Q: What does ISO 45001 require after an incident? A: Timely reporting and investigation, determination of root causes, action per the hierarchy of controls, review of existing risk assessments and controls, worker participation, and retained documented information with verification of effectiveness.
• Q: How do you keep an investigation blame-free yet accountable? A: Separate the fact-finding RCA from any disciplinary process, use a just-culture test that distinguishes honest error from reckless violation, involve a worker representative, and report causes rather than culprits.

Common mistakes

• Stopping at the first plausible cause, so the report names a careless worker and the same accident recurs within months.
• Writing a "root cause" that is really a restatement of the loss ("because the scaffold collapsed") or an untestable generality ("poor safety culture") with no action attached.
• Mixing up frequency and severity formulas, or reporting a rate without stating its base — the 1,000,000-hour Indian/IS base versus the 200,000-hour OSHA base differ by a factor of 5.
• Forgetting the 6,000-day scheduled charge for a fatality, or computing man-hours from the payroll headcount instead of actual hours worked.
• Treating FMEA or HAZOP as investigation tools, or confusing the proactive risk assessment (before) with the reactive RCA (after).
• In fire cases, deciding the cause ("short circuit") first and then hunting for supporting evidence, instead of testing the hypothesis against all the data and accepting "undetermined" when warranted.
• Writing corrective actions that are all administrative or PPE-level, with no owner, no date and no verification of effectiveness — and quoting repealed law (the Factories Act, 1948 or the Mines Act, 1952) instead of the OSH&WC Code, 2020 now in force.

Related topics

Occupational health and industrial hygiene · Safety laws in India: the OSH&WC Code (replacing the former Factories Act) and fire service rules · Occupational health and safety management: ISO 45001 · Hazard identification and risk assessment: HAZOP, FMEA and QRA · Fire protection systems and the National Building Code · Emergency planning, on-site and off-site, and disaster management.