How to Run an Incident Investigation: The 5 Whys, Done Right

What does a proper incident investigation actually find?

A proper incident investigation finds the system failure that let an incident happen, not just the mistake a worker made in the moment. In Victoria, that matters because the OHS Act 2004 (Vic) puts an ongoing duty on employers to eliminate or reduce risks so far as is reasonably practicable, and that duty doesn't switch off once the injured person has been treated (WorkSafe Victoria, reviewed 13 March 2025).

I've sat through enough "toolbox talk" debriefs that ended with "just be more careful" to know that's not an investigation, it's a shrug. If the fix you land on is retraining or a warning, you haven't found the root cause yet. You've found where the chain broke, not why it was there to break.

What does the OHS Act actually require when something goes wrong?

Two duties run at the same time after an incident, and they're not the same thing.

The general duty (sections 20-21). As an employer, you must eliminate or reduce risks to health and safety so far as is reasonably practicable. WorkSafe assesses "reasonably practicable" against five factors: the likelihood of the hazard occurring, the possible seriousness of harm, what you knew or should have known about it, the availability of ways to fix it, and the cost of doing so (WorkSafe Victoria, reviewed 13 March 2025). An incident is direct evidence that a risk existed. Once you know about it, doing nothing is no longer "reasonably practicable" — it's a breach waiting to be found.

The notification duty, if the incident qualifies. If the incident involved a death, an injury needing immediate medical treatment, or exposed someone to a serious risk (a near miss counts), you must phone WorkSafe on 13 23 60 immediately, preserve the incident site until an inspector arrives or directs otherwise, submit written notification within 48 hours, and keep that record for at least 5 years (WorkSafe Victoria, reviewed 1 December 2025). An incident site can only be disturbed to protect someone's health and safety, to aid an injured person, or to make the site safe.

Not every incident is notifiable. But the general duty applies to all of them, including the near miss nobody reported because "nothing happened." That's exactly the incident a 5 Whys investigation is built for.

What is the 5 Whys technique, and how does it actually work?

The 5 Whys is a simple method: state the problem as a factual sentence, then ask "why" against the answer, repeatedly, until you stop finding a person and start finding a system. Five is a rule of thumb, not a rule — some chains resolve in three, others need seven.

Here's what that looks like on a factory floor:

1. Why did the operator's hand contact the roller? The guard was open while the machine was running.
2. Why was the guard open? The interlock had been bypassed.
3. Why was the interlock bypassed? Clearing a jam with the guard closed took too long and the line was behind schedule.
4. Why did clearing a jam take so long? There was no quick-clear procedure, so operators improvised.
5. Why was there no quick-clear procedure? The machine's risk assessment hadn't been reviewed since it was installed.

The root cause isn't "operator bypassed a guard." It's a machine risk assessment that was never updated once real production pressure showed up. Fix the guard interlock and you've patched one symptom. Fix the review cycle and you've removed the reason someone reaches for a bypass in the first place.

How do you run a 5 Whys investigation, step by step?

1. Make the area safe and treat anyone injured first. No investigation step outranks first aid.
2. If it's notifiable, call WorkSafe on 13 23 60 immediately and preserve the site before you do anything else (WorkSafe Victoria, reviewed 1 December 2025).
3. Gather facts while they're fresh — who, what, where, when, in plain language, before memory smooths the edges.
4. Write the problem as one factual sentence. Not "operator was careless," but "operator's hand contacted the roller while the guard interlock was bypassed."
5. Ask why, and verify each answer against evidence — logs, photos, plant history, a second witness — not the first plausible guess.
6. Keep asking why until the chain lands on a system, not a person: a missing procedure, a review that never happened, a design that assumed conditions that don't hold on your floor.
7. Fix the root cause, not just the last link. A control at the system level (a revised procedure, an engineering change, a review schedule) beats a reminder or a retraining session almost every time.
8. Document the investigation and the controls, and communicate them to the people doing the work. This record is what shows a reasonably practicable response if WorkSafe ever asks.
9. Check back in a few weeks. A control that looked right on paper sometimes gets quietly worked around under production pressure — that's worth knowing before it causes the next incident.

Where does 5 Whys fall short, and what should you pair it with?

Three traps catch most first-time investigators.

Single-cause bias. Real incidents usually have more than one contributing factor running in parallel, not a single straight line. If your "whys" keep branching, stop forcing them into one chain — switch to a fishbone diagram or a simple cause map that can hold more than one root cause at once.

Stopping at a person. If a "why" answer is "the employee didn't follow the procedure," that's not the end of the chain, it's a prompt for one more why: was the procedure known, current, realistic and enforced? People are usually the last domino, not the first.

Hindsight bias. It's easy to ask "why" through the lens of what you know now. The honest version asks what was reasonably foreseeable to the people on the floor at the time, with the information and training they actually had that day.

Situation	Better fit
Single clear chain of events, one likely cause	5 Whys
Multiple contributing factors, unclear order	Fishbone / cause-and-effect map
Death, serious injury, or a pattern of repeat incidents	5 Whys plus a documented, ideally independent, formal investigation

FAQ

Do I have to investigate an incident that isn't notifiable? There's no separate notification duty for it, but the general duty under the OHS Act to eliminate or reduce risks so far as is reasonably practicable doesn't stop at notifiable incidents (WorkSafe Victoria, reviewed 13 March 2025). A near miss is free information about a hazard that hasn't hurt anyone yet — investigating it is how it stays that way.

How fast do I need to notify WorkSafe if the incident is serious? Phone WorkSafe on 13 23 60 immediately on becoming aware of a notifiable incident, preserve the site until an inspector arrives or directs otherwise, then submit written notification within 48 hours (WorkSafe Victoria, reviewed 1 December 2025).

Is 5 Whys enough for a serious incident? For a death, a serious injury, or a repeat problem, treat 5 Whys as a starting point, not the whole investigation. Pair it with a fuller, documented review, and bring in someone with investigation experience who wasn't on shift that day.

If you'd rather have a safety manager on call to run this properly when it matters — securing the scene, working the 5 Whys, writing it up in a form that holds up if WorkSafe asks — that's exactly what Ardmor's managed service is for. Book a site assessment and we'll walk your current investigation process before you need it under pressure.

This article is general information for Victorian manufacturers, not legal advice. Last updated: 5 August 2026.