Incident reporting: a complete guide

Incident reporting is how an organisation turns what went wrong, and what nearly went wrong, into something it can learn from. A good report captures the facts of an event quickly and clearly, routes it to the right person, and feeds a record that can be trended over time and stood behind in an audit. Done well, it is the single cheapest source of safety insight you have.

What is incident reporting and why does it matter?

Incident reporting is the structured process of recording any unplanned event that caused harm, or could have caused harm, and then doing something useful with that record. The event might be an injury, an environmental spill, a security breach, a quality failure or a close call that hurt no one. Reporting it matters for three plain reasons.

First, you cannot fix what you cannot see. An event that is never written down is an event the organisation never gets to learn from. Second, many incidents are legally reportable, and a clear internal record is what makes external reporting accurate and defensible. Third, patterns only appear in aggregate. One trip on the same stair is bad luck. Forty trips on the same stair is a fact that pays for a handrail. Incident reporting is what makes the fortieth report visible alongside the first.

Logincident exists to make this easy on any channel, so that the person closest to the event can capture it in the moment rather than from memory days later. The faster and simpler the capture, the more honest and complete the record. You can read more about that in our guide to digital reporting.

Incidents, near misses and hazards: what is the difference?

These three words are often used loosely, but keeping them apart makes your data far more useful. The short version is that a hazard is a source of potential harm, a near miss is an event where harm almost happened, and an incident is an event where harm, loss or damage actually occurred.

The important insight is that all three describe the same underlying risk at different stages. The hazard is the cable, the near miss is the warning, and the incident is the bill. Capturing the first two is how you avoid paying the third. For a deeper look at why the warnings matter most, see what is a near miss.

What does a good incident report contain?

A good incident report answers the basic questions a stranger would ask: who, what, where, when, and what happened next. It records facts rather than blame, and it captures enough detail to be useful weeks later without being so heavy that nobody fills it in. At a minimum it should contain:

• What happened: a plain, factual description of the event in the order it occurred.
• When and where: the date, time and exact location.
• Who was involved: people affected, witnesses and the reporter, with the option to report anonymously where that encourages honesty.
• The outcome: any injury, ill health, damage or loss, and the immediate action taken.
• Type and severity: a consistent category and a sense of how bad it was, or how bad it could have been.
• Evidence: photos, readings or documents attached at the point of capture.

The single most useful field is also the one people skip: what could have made this worse. A trip that grazed a knee and a trip that nearly fell down a stairwell look identical in a basic log. The potential-severity field is what separates them. For a full walk-through and a template you can copy, see how to write an incident report.

The reporting-to-resolution flow

An incident report is not the end of anything. It is the start of a short journey from a raw observation to a closed action. Most organisations follow some version of these steps:

1. Capture. The person closest to the event records it, ideally in the moment and on whatever device is to hand.
2. Triage. The report is categorised and its severity assessed, so the urgent rises above the routine.
3. Notify. The right people are told. Some events also trigger a legal reporting duty, which we cover below.
4. Investigate. For anything significant, you look past the immediate cause to the conditions that allowed it. See incident investigation basics.
5. Act. Corrective actions are assigned to named owners with due dates.
6. Close and verify. Actions are completed, checked, and the record is locked as evidence.
7. Learn. The finding is shared so the rest of the organisation benefits, not just the team where it happened.

The flow breaks most often at two points: capture, because reporting is too slow or feels risky, and the gap between investigate and act, because actions are agreed but never tracked to completion. A clear workflow with owners and due dates is what keeps reports from dying in an inbox. This is exactly the path our health and safety solution is built around.

Leading and lagging indicators

Incident data comes in two flavours, and confusing them is one of the most common mistakes in safety. Lagging indicators count harm that has already happened: injuries, days lost, claims paid. Leading indicators try to point forwards: near misses reported, hazards logged, inspections completed, corrective actions closed on time.

Lagging indicators are accurate and they matter, but they are entirely in the rear-view mirror. A year with no injuries can mean you are genuinely safe, or it can mean you were lucky and were not looking. From the injury count alone, you cannot tell which. Leading indicators are messier, but they are the only numbers you can still change. A rising number of near-miss reports is usually a good sign: it means people can finally see the risk that was always there. The UK Health and Safety Executive encourages organisations to watch leading indicators for precisely this reason. Turning both kinds of number into something a manager can read at a glance is the job of data visualisation.

The safety triangle, handled with care

You will often see incident reporting justified with a pyramid: many minor events and near misses sit beneath every serious one, so reducing the small stuff reduces the big stuff. The idea traces back to Herbert William Heinrich, whose 1931 book Industrial Accident Prevention proposed a ratio of roughly 300 no-injury accidents to 29 minor injuries to one major injury. Frank Bird offered a revised triangle in 1969.

The triangle is a useful picture, but it should be handled with care. The exact ratios were drawn from a particular dataset of the time and have been widely criticised, and the relationship between minor and serious events is not as fixed as a neat pyramid suggests. The defensible takeaway is the qualitative one: serious harm rarely comes from nowhere, and the near misses and minor events underneath it are warnings worth collecting. Use the triangle as a reason to capture small events, not as a formula that predicts how many big ones you will have.

What stops people reporting, and how to lower the barrier

The biggest threat to incident reporting is not bad software. It is silence. People do not report when reporting is slow, when they fear blame, when they doubt anything will happen, or when they are not sure an event even counts. Each of those has a practical fix.

• Make it fast. If a report takes ten minutes and a manager’s signature, it will not be filed at the end of a long shift. Capture on a phone, with a QR code at the point of work, removes most of the friction.
• Make it safe. A blame-free, just-culture approach, with the option of anonymous reporting, is what turns “I am not getting anyone in trouble” into a filed report.
• Close the loop. People stop reporting when nothing visibly changes. Telling reporters what happened next is the strongest encouragement there is.
• Lower the bar for what counts. Make it clear that hazards and near misses are wanted, not just injuries. The aim is more reports, not fewer.

Counterintuitively, a rising report count is usually a sign of a healthy culture, not a deteriorating site. Leaning too hard on a falling injury figure can simply teach people to stop reporting, which leaves you with less harm on paper and the same risk in the building.

What to do with the data

Reports are only worth collecting if they change a decision. Once you have a steady stream of clean, categorised records, the value comes from three things. Trends show you where harm clusters, by location, by task, by time of day, so you can fix conditions rather than chase individual events. Open actions show you what you have promised to do and have not yet done. And a complete, time-stamped, locked record gives you something to stand behind when a regulator, an insurer or an auditor asks what you knew and when.

This is the difference between a logbook and an early-warning system. A logbook tells you what happened. A connected reporting and visualisation system tells you what is about to happen if nothing changes. Keeping records audit-ready, rather than scrambling to assemble them after the fact, is one of the quiet benefits of reporting digitally from the start.

Is incident reporting a legal requirement?

Some of it is. In Great Britain, the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, known as RIDDOR, place a legal duty on employers and others in control of work premises to report certain serious events to the Health and Safety Executive. These include work-related deaths, specified injuries, injuries that keep a worker off their normal duties for more than seven consecutive days, certain occupational diseases and a defined list of dangerous occurrences. Internationally, the management-system standard ISO 45001:2018 requires organisations to investigate incidents and act on what they find. Good internal reporting is what makes both of these straightforward rather than stressful, because the facts are already captured and organised.

By Shannon Hamming, Communications and Community