Incident Investigation South Africa: OHS Act Reporting, Annexure 1, Root Cause Analysis & Free Investigation Pack
Updated: 2 days ago
QUICK ANSWER
Incident investigation South Africa starts with two separate questions: what must be reported or recorded under the Occupational Health and Safety Act framework, and what must the employer investigate to prevent the same event happening again?
Section 24 identifies specified serious incidents that must be reported, while regulation 9 of the General Administrative Regulations requires Annexure 1 records for section 24 incidents and for other incidents where a person needed medical treatment beyond first aid. Recordable incidents must be investigated within seven days from the date of the incident and finalised as soon as reasonably practicable.
A defensible investigation goes further than completing a form. It preserves evidence, establishes the event sequence, tests failed controls, distinguishes immediate causes from underlying causes, assigns corrective action and verifies that the action actually prevents recurrence.
Root-cause tools such as 5 Whys or a fishbone diagram can support that process, but the law does not prescribe one named root-cause method for every incident.
Incident Investigation South Africa at a Glance
Question | Employer answer |
Which serious incidents are reportable? | Section 24 covers specified deaths, serious injuries or illness, major incidents and defined dangerous occurrences involving substances or machinery. |
Which incidents require Annexure 1? | Section 24 reportable incidents and other incidents where the affected person had to receive medical treatment other than first aid. |
How soon must a recordable incident be investigated? | Within 7 days from the date of the incident; finalise as soon as reasonably practicable. |
How long must the Annexure 1 record be kept? | At least 3 years and available for inspection. |
What happens after the investigation? | Enter findings in Annexure 1, implement reasonably practicable preventive actions and have the health and safety committee examine the record at its next meeting where a committee exists. |
Is root cause analysis a separate statutory form? | No. Root-cause methods are investigation tools. They help the employer move beyond the first visible error and select stronger corrective action. |
What Is a Workplace Incident Investigation?
A workplace incident investigation is a structured examination of what happened, what conditions and decisions contributed, which safeguards failed or were absent, and what must change to reduce the chance of recurrence. The purpose is not simply to identify the person closest to the event. It is to understand the event well enough to control the underlying risk.
An incident form is not an incident investigation. A completed form can record an event; an investigation must explain the evidence, causes, failed controls and actions that follow from it.
This distinction matters because a shallow conclusion such as “employee was careless” can end the inquiry precisely where the useful questions should begin.
Why was the unsafe action possible?
Was the procedure practical?
Was the guard present and functional?
Was the task normally done differently from the written method?
Had a defect been reported before?
Was production pressure influencing the decision?
Was supervision effective?
Did the risk assessment reflect the work actually being performed?
Which Incidents Must Be Reported Under Section 24 of the OHS Act?
Section 24 of the Occupational Health and Safety Act 85 of 1993 identifies incidents occurring at work, arising out of work activities, or connected with the use of plant or machinery that must be reported when the statutory criteria are met.
Death, unconsciousness, loss of a limb and specified serious injury or illness
Section 24 includes an incident in which a person dies, becomes unconscious, loses a limb or part of a limb, or is injured or becomes ill to a degree that makes death or permanent physical defect likely, or makes the person likely to be unable for at least 14 days to work or continue the activity for which that person is normally employed.
Major incidents
A major incident is also within the section 24 reporting framework. The Act defines a major incident as an occurrence of catastrophic proportions resulting from the use of plant or machinery or from activities at a workplace. High-hazard operations may also have additional sector-specific or major-hazard duties that must be considered separately.
Dangerous events can be reportable even when nobody is injured
Do not use “nobody was injured” as the only test. Section 24 also covers specified events where health or safety was endangered: a dangerous substance spill, an uncontrolled release of a substance under pressure, machinery or a part of machinery fracturing or failing and producing flying, falling or uncontrolled moving objects, or machinery running out of control.
That is why the first legal classification after an event should examine both the consequence and the nature of the event itself.
When Must an Incident Be Reported?
Reporting and investigation are separate processes. An employer should not wait for the internal investigation to finish before making a notification that is already legally required.
The seven-day notice requirement
Regulation 8 of the General Administrative Regulations requires notice within seven days for incidents referred to in section 24(1)(a). The regulation refers to the prescribed WCL forms for this notice. Employers should verify the current Department and Compensation Fund submission process rather than relying on an old internal procedure or an outdated contact list.
Incidents that must also be reported forthwith
The same regulation requires specified severe incidents to be reported forthwith to the provincial director by telephone, facsimile or similar means of communication. This includes incidents where a person dies, becomes unconscious, loses a limb or part of a limb, or is injured or becomes ill to a degree likely to cause death or permanent physical defect. Major incidents and the dangerous events contemplated in section 24(1)(b) and (c) are included in this urgent reporting requirement.
If the injured person later dies
If a person dies after the initial incident notice was given, regulation 8 requires the employer or user to notify the provincial director forthwith of the death. The incident classification is therefore not a once-off decision that can never change as medical consequences develop.
Incidents affecting people who are not employees
Regulation 8 also contains a specific notification requirement for incidents arising out of or in connection with work activities that occur to persons other than employees. The required information includes the injured person, employer or user details, what happened, where and when it happened, how and why it happened, and witness names.
When Must the Incident Scene Be Preserved?
For an incident in which a person died, is likely to die, or suffered the loss of a limb or part of a limb, section 24 restricts disturbance of the incident site or removal of an article or substance involved without an inspector's consent.
The Act allows necessary action to prevent a further incident, remove the injured or deceased, or rescue people from danger. The practical rule is simple: protect life and prevent further harm first, but do not clean, reset, repair, move or discard evidence merely to restore production before the scene-preservation requirement has been considered.
What Is Annexure 1 and When Is It Required?
Annexure 1 is the prescribed regulation 9 workplace record for recording and investigating applicable incidents. It is not the same document as a Compensation Fund W.Cl.2 employer accident report.
Which incidents go into the Annexure 1 record?
Regulation 9 requires an employer or user to keep an Annexure 1 record of incidents that must be reported under section 24 and of other incidents where the affected person had to receive medical treatment other than first aid. The record must be kept for at least three years and be open for inspection by an inspector.
This creates an important distinction: an event can be recordable and investigable under regulation 9 even if it does not meet a section 24 inspector-reporting threshold. Conversely, a first-aid-only event is not automatically brought into regulation 9 merely because it happened at work, although a separate section 24 dangerous-event trigger may still make an event reportable even without injury.
Who may investigate?
Regulation 9 allows the investigation to be conducted by the employer, a person appointed by the employer, a health and safety representative, or a member of a health and safety committee. The choice should also make operational sense: the investigator needs enough competence, authority and access to evidence to test the event properly.
What is the seven-day investigation rule?
Every incident that must be recorded under regulation 9 must be investigated within seven days from the date of the incident and finalised as soon as reasonably practicable. The findings must be entered in Annexure 1 immediately after the investigation is completed.
The seven-day rule should never become an excuse for a rushed one-line cause. Immediate evidence preservation and early interviews should happen quickly, while complex technical analysis can continue so that the final investigation is factually defensible.
What must the health and safety committee do?
Where a health and safety committee exists, regulation 9 requires the incident record to be examined at the committee's next meeting. The employer must ensure that necessary reasonably practicable actions are implemented and followed up to prevent recurrence.
What Does Annexure 1 Actually Ask the Employer to Record?
The official Annexure 1 form is short, but the information it asks for reveals the control logic behind the regulation. The record includes the employer and affected person, incident date and time, body part and effect, expected disablement, the machine, process, work or exposure involved, reporting status, investigation details, suspected cause, recommended recurrence-prevention steps, employer action and health and safety committee remarks.
The form asks for a suspected cause and prevention steps. That is a starting point for disciplined analysis, not permission to stop at the first visible mistake.
How to Conduct a Defensible Incident Investigation South Africa Employers Can Use
Step 1 — Care for people and control immediate danger
Emergency response comes first. Arrange first aid, medical treatment, rescue, isolation or evacuation as required. At the same time, prevent a second event. If a serious section 24 incident may require scene preservation, control access without unnecessarily altering the scene.
Step 2 — Classify the legal reporting and recording duties
Ask whether section 24 reporting is triggered, whether urgent notification is required, whether Annexure 1 recording is required and whether a separate Compensation Fund accident-reporting process applies. Do not collapse these into one checkbox called “reported”.
Step 3 — Preserve evidence before it changes
Secure photographs, equipment positions, control settings, guarding condition, isolation status, damaged parts, substances, labels, permits, checklists, access-control records, CCTV where lawfully available, environmental conditions and other perishable evidence. Record what was moved for rescue or danger-control purposes and why.
Step 4 — Build the event timeline
Construct a factual sequence from before the task started through the event and the response. Include shift handover, instructions, changes in conditions, equipment state, abnormal alarms, maintenance activity, deviations from the normal method and actions immediately after the event. A timeline helps expose gaps that are hidden by a single narrative paragraph.
Step 5 — Interview witnesses separately and early
Interview people who performed the task, saw the event, supervised the work, maintained the equipment or responded afterwards. Use open questions first. Separate observation from assumption. Record where accounts agree and where they differ. Avoid leading questions designed to confirm a conclusion management has already chosen.
Step 6 — Compare work-as-written with work-as-done
Review the risk assessment, safe work procedure, permit, manufacturer information, training records, maintenance history and inspection records. Then compare those documents with what people actually do. A beautifully written procedure that is impossible to follow in the real workspace is a control weakness, not proof that the system worked.
Step 7 — Identify immediate, contributing and underlying causes
An immediate cause is close to the event: contact with moving machinery, a fall from an edge, exposure to a substance, loss of control or unexpected energy release. Contributing factors may include layout, lighting, housekeeping, fatigue, workload, communication, maintenance, supervision, access, equipment condition or contractor interfaces. Underlying causes sit deeper in the management system: poor design, weak change control, inadequate procurement specification, ineffective training, missing maintenance strategy, unrealistic procedures or failure to act on previous warnings.
Step 8 — Test the barriers that should have stopped the event
Ask which preventive and mitigative controls should have existed, whether they existed, whether they were available, whether they were used, whether they were effective and why the system allowed a critical barrier to fail. This turns the investigation from storytelling into control verification.
Step 9 — Select corrective actions that match the cause
Corrective action should address the failure found. If the problem is a machine design defect, retraining the operator alone is weak. If the issue is missing competence, replacing a guard alone may not address the competence gap. Strong closeout normally uses the hierarchy of controls and assigns a named owner, deadline and evidence requirement for each action.
Step 10 — Verify effectiveness before closing the investigation
Do not close an action because an email says “done”. Verify the new guard, procedure, permit, inspection, maintenance change, engineering modification, competence evidence or supervision arrangement in the workplace. Where appropriate, observe the task again and confirm that the new control is practical and sustained.
Root Cause Analysis: How Far Should the Investigation Go?
Root cause analysis is the disciplined search for the deeper conditions that allowed an event to occur or allowed safeguards to fail. South African regulation 9 requires an investigation, findings and recurrence-prevention action, but it does not prescribe one universal named root-cause technique. The method should therefore be proportionate to the incident, the complexity of the system and the quality of evidence available.
Immediate cause vs root cause
“Hand contacted blade” describes an event mechanism. It does not explain why contact was possible. “Guard was removed” goes deeper, but may still not be the root. Why was it removed? Why did the machine remain operable? Why did maintenance or production allow the condition? Why was the defect not identified before use? A useful investigation keeps asking until the corrective action can change the system that produced the risk.
Using the 5 Whys
The 5 Whys is useful for a relatively linear problem when each answer can be supported by evidence. The number five is not a legal rule and not a magic stopping point. Stop when the investigation reaches a controllable underlying cause that is supported by facts; continue when the answer is still superficial.
Using a fishbone or cause-and-effect analysis
A fishbone approach can help when several causal branches may have interacted. Typical headings can include people, plant, method, materials, environment, supervision, maintenance and management systems. The diagram is only useful if each proposed cause is tested against evidence rather than accepted because it sounds plausible.
Why “human error” is not enough
People make decisions inside systems. If an investigation identifies an unsafe action, ask what made that action possible, normal, rewarded, tolerated or difficult to avoid. Was the correct tool available? Was the procedure workable? Was the person authorised and competent? Was supervision present? Was the task changed without risk review? Had the same shortcut become normal practice?
This does not mean individual conduct can never matter. It means the investigation should not use individual conduct as a shortcut that prevents examination of the work system.
Annexure 1 vs Internal Investigation Report vs W.Cl.2
These records can overlap around the same event, but they serve different functions. Treating them as interchangeable is a common source of incomplete incident files.
Document / process | Primary purpose | What it does not replace |
Annexure 1 | Regulation 9 workplace record and investigation entry for applicable incidents, including suspected cause, prevention recommendations and employer action. | It does not replace a deeper technical investigation where the event needs more evidence and analysis. |
Internal investigation report | Expands the evidence, timeline, witness accounts, causal analysis, failed barriers, corrective actions and verification needed to understand a complex event. | It does not remove the duty to complete Annexure 1 where regulation 9 applies. |
W.Cl.2 / Compensation Fund process | Employer accident reporting for Compensation Fund purposes where the applicable occupational accident criteria are met. | It is not the Annexure 1 OHS incident investigation record and does not replace OHS Act reporting duties. |
What Evidence Should an Incident Investigation Collect?
The evidence set should be driven by the event, but a serious investigation normally looks across people, equipment, documents and the physical workplace. Collect what can prove or disprove a causal theory.
Scene photographs, sketches, measurements and equipment positions before conditions change.
Names and accounts of the affected person, witnesses, supervisor, maintenance personnel and responders.
Risk assessments, safe work procedures, permits, isolation documents and pre-task records relevant to the work.
Training, competence, authorisation, appointment and supervision evidence relevant to the people involved.
Inspection, maintenance, defect, breakdown, calibration and statutory examination records for relevant plant or equipment.
Manufacturer instructions, design information, guarding specifications or safety-device information where relevant.
PPE issue records and the actual condition and suitability of PPE when it is relevant to the event.
Environmental information such as lighting, noise, temperature, weather, housekeeping or contamination where relevant.
Previous incidents, near misses, hazard reports, complaints and corrective actions involving the same task, area or equipment.
Change-management evidence where equipment, process, people, materials, production targets or work methods changed before the event.
How Should Corrective Actions Be Prioritised?
The best corrective action is not automatically “retrain everyone”. Training is appropriate when knowledge or competence is part of the cause, but it cannot substitute for stronger engineering, isolation, guarding, maintenance or process controls where those are reasonably practicable and relevant.
For each finding, define the risk being controlled, the action, the responsible owner, the due date, required evidence and the person who will verify effectiveness. High-risk temporary controls should be explicit while permanent action is being completed.
Corrective action is not closed when the task is assigned. It is closed when implementation is evidenced and effectiveness has been verified.
Ten Incident Investigation Failures That Weaken Employer Evidence
Waiting for the investigation to finish before making a legally required urgent report.
Cleaning, repairing or restarting the scene before considering section 24 scene-preservation requirements.
Treating Annexure 1 and W.Cl.2 as the same document or process.
Beginning with a preferred conclusion and collecting only evidence that supports it.
Interviewing a group together so individual recollections influence each other.
Writing “employee negligence” or “human error” as the entire causal analysis.
Ignoring maintenance history, previous defects, near misses or earlier corrective actions.
Making training the default action even when the failure is physical, technical or managerial.
Closing corrective actions without workplace verification.
Filing the investigation without feeding lessons back into risk assessments, procedures, inspections and management review.
The 15-Minute Incident File Readiness Test
A useful incident file should allow a competent manager or inspector to understand the event without reconstructing the entire story from scattered emails. Test whether the file can answer the following questions quickly:
What happened, where and when?
Who was affected and who witnessed the event?
Was section 24 reporting considered and completed where applicable?
Was scene preservation considered where applicable?
Is Annexure 1 present where regulation 9 applies?
Was the investigation performed within the required timeframe?
What evidence supports the event sequence?
What immediate, contributing and underlying causes were identified?
Which controls failed, were absent or were ineffective?
What corrective actions were assigned, to whom and by when?
What evidence proves each action was completed?
Who verified effectiveness and what did that verification show?
Was the health and safety committee review completed where required?
Were HIRA, procedures, maintenance, training or other controls updated when the findings required it?
Free South African Workplace Incident Investigation & Root Cause Action Pack
The free employer pack that accompanies this guide is designed to turn the investigation into a controlled workflow rather than a loose collection of forms. It should be used alongside the official statutory forms and current Department processes, not as a replacement for them.
The pack is designed around the full sequence:
RESPOND → PRESERVE → CLASSIFY → REPORT → RECORD → INVESTIGATE → FIND ROOT CAUSE → CORRECT → VERIFY → LEARN.
Immediate response and scene-control checklist.
Section 24 reportability decision screen.
Annexure 1 completion support worksheet.
Witness interview and statement tools.
Scene, photo and evidence registers.
Event-sequence and timeline worksheet.
5 Whys and cause-and-effect analysis tools.
Failed-barrier and control verification worksheet.
Corrective-action register with owner, due date and evidence fields.
Closeout effectiveness verification and management review tools.
Lessons-learned briefing and repeat-incident tracking.
Frequently Asked Questions
What incidents must be investigated in South Africa under the General Administrative Regulations?
Regulation 9 requires investigation of every incident that must be recorded under that regulation. The record covers incidents reportable under section 24 and other incidents where the affected person had to receive medical treatment other than first aid.
How soon must a recordable workplace incident be investigated?
Regulation 9 states that a recordable incident must be investigated within seven days from the date of the incident and finalised as soon as reasonably practicable. Required external reporting should not be delayed while the investigation continues.
Does every near miss have to be reported to the Department of Employment and Labour?
No. Not every near miss is automatically a section 24 reportable incident. However, section 24 includes specified dangerous occurrences where health or safety was endangered even if no injury resulted, such as certain dangerous-substance spills, uncontrolled pressure releases and machinery failures. Employers may also choose to investigate non-reportable near misses as part of good risk management.
Is Annexure 1 required for a first-aid-only injury?
Not merely because first aid was provided. Regulation 9 expressly adds incidents where the affected person required medical treatment other than first aid, as well as all section 24 reportable incidents. A first-aid-only event can still require attention if a separate section 24 dangerous-event trigger applies.
Is W.Cl.2 the same as Annexure 1?
No. W.Cl.2 is an employer accident-reporting form used for Compensation Fund purposes. Annexure 1 is the regulation 9 OHS incident recording and investigation record. Depending on the facts, both processes may be relevant to the same incident.
Can an employer disturb the incident scene to restart production?
For an incident involving death, likely death or loss of a limb or part of a limb, section 24 restricts scene disturbance without inspector consent. The Act allows necessary action to prevent another incident, remove the injured or deceased, or rescue persons from danger. Restarting production is not itself one of those stated exceptions.
Does the OHS Act require a 5 Whys investigation?
No. The General Administrative Regulations require the applicable incident to be investigated and findings entered in Annexure 1, but they do not prescribe 5 Whys as the universal method. 5 Whys is one practical tool that can help identify underlying causes when used with evidence.
Can “employee negligence” be the root cause?
An individual's action may be relevant, but a strong investigation tests why the action occurred and why the system did not prevent or detect it. Procedure design, supervision, competence, equipment, maintenance, workload, change control and prior warnings may all need to be examined before the investigation is closed.
How long must Annexure 1 records be kept?
Regulation 9 requires the applicable Annexure 1 record to be kept for at least three years and to be available for inspection by an inspector.
What should happen after corrective actions are completed?
Verify effectiveness. Check that the action exists in the real workplace, works as intended and has not created another hazard. Where the finding affects HIRA, procedures, maintenance, competence, inspections or other controls, update those systems and retain evidence of the change.
Authoritative Sources & Regulatory References
Authoritative Source | What It Supports |
Section 24 reportable-incident criteria, serious-incident scene preservation and the statutory OHS framework. | |
Official government record for the General Administrative Regulations containing incident reporting, recording and investigation requirements. | |
Regulations 8 and 9, Annexure 1 fields, seven-day investigation requirement, three-year retention and committee review. | |
Official Compensation Fund employer accident-report form and instructions; distinct from Annexure 1. | |
Primary statutory framework for occupational injury and disease compensation, separate from OHSA incident-investigation records. |
Read More
Read More | Why Read It |
Use this companion guide for the reporting decision: section 24 thresholds, W.Cl.2, Annexure 1 and the employer reporting workflow. | |
Use HIRA to feed investigation lessons back into hazard identification, risk assessment and control review. | |
Understand what an OHS inspector may check and how incident evidence fits into broader inspection readiness. |
Final Word
A strong workplace incident investigation does more than satisfy a recordkeeping requirement. It creates a traceable chain from the event to the evidence, from the evidence to the causes, from the causes to corrective action, and from corrective action to verified prevention.
The legal framework sets important reporting, recording, investigation and follow-up duties. The employer's management system determines whether those duties become real learning or simply another completed form.
RESPOND → PRESERVE → CLASSIFY → REPORT → RECORD → INVESTIGATE → FIND ROOT CAUSE → CORRECT → VERIFY → LEARN.
