← Insights

Incidents

The incident log that closes the loop

July 2026 · 6 min read

An incident log takes two minutes to fill in. Date, time, location, what happened - most workplaces already have somewhere to put that, even if it is a lined notebook by the first aid box. Recording is the easy ten percent of the job. The value sits in what happens after the entry: who investigates, what they find, and what changes so the same event does not have a second outing next month, on a different shift, with a worse outcome. A register that stops at recording is an accident book. A register that drives an investigation through to a closed action is a safety tool, and nothing about the first line in either one tells you which you are running.

Most of the difference comes down to two things a plain log rarely does well: it treats near misses as seriously as it treats incidents, and it makes the investigation itself impossible to quietly forget.

The near misses you can actually afford to investigate

Every serious incident sits on top of a much larger pile of near misses and minor events that never made the news - the near-empty step ladder someone caught before it went, the pallet that clipped a rack and stayed upright, the near miss with the forklift that ended in a shout rather than a report. You cannot investigate the serious injuries you have not had. You can investigate every one of those near misses, for free, before any of them turns serious. That is the whole case for taking near-miss reporting seriously: it is the cheapest lesson a workplace can buy, and it is available in bulk, well before the expensive lesson arrives.

The trouble is that near misses are also the easiest thing to under-report, because reporting one takes effort and produces no visible consequence to fix. Which is why a near-miss ratio - the number of near misses reported for every recorded incident - is worth watching as a dashboard number in its own right, not just a count buried in a second tab.

A near-miss ratio sitting near zero does not mean a quiet site. Far more often it means a site where people have quietly stopped reporting - and a log with nothing minor in it has nothing to tell you about the serious event you have not had yet.

A status that cannot go quiet

Every incident that gets logged should get an owner and a due date for the investigation. What usually happens instead is that the owner is genuinely busy, the due date slips, and nobody notices until someone asks for the file. The fix is not a better intention - it is a status the register works out for itself, rather than one a person has to remember to update:

• Open. An owner and a due date are set, and the due date has not yet passed - the investigation is in hand.
• Overdue. The due date has passed and the investigation is not marked complete. This is the state that used to hide in a spreadsheet nobody re-opened; a computed status puts it in front of whoever looks at the register next, without anyone having to go looking for it.
• Closed. A completion date is recorded. The investigation happened, and there is a date to prove it.

Roll those three states up across a year and you get a number worth watching on its own: the on-time closure rate. It tells you something the incident count never will - whether the loop the register exists to close is actually closing, or whether investigations are happening late, or not at all, behind a status that used to say nothing more useful than "logged".

Two registers, one link

Incidents and near misses do not belong in the same rows, because they carry different information - a near miss has no injury, no lost-time count and no reportable flag, and forcing it into the incident register's columns either wastes most of them or tempts someone to leave the near miss out altogether. A second, linked register solves that: near misses get their own simple fields - what nearly happened, the category, the potential severity if it had gone the other way, whether it was fixed on the spot - and keep a reference field back to the incident register for the cases that do escalate.

That escalation link matters more than it looks. A near miss reported today that turns into a genuine incident next month, because the same hazard fired twice, should be traceable as one story rather than two disconnected entries in two different places. Without the link, that pattern is invisible; with it, it is one lookup away.

The name you don't need

Most incident logs default to recording the person's name, because that is what the paper accident book always did. It is worth resisting. What an investigation actually needs is the role involved - operator, driver, visitor, contractor - not the individual, and keeping the name out of the working register does two useful things at once. It keeps the register something you can put in front of a safety committee, a management review or a client audit without redacting it first. And it respects the person the incident happened to, who is usually already having a bad enough day without their name sitting in a spreadsheet column for years. Medical detail belongs in a separate confidential record for the same reason - not because the register should hide anything, but because it should hold only what the investigation and the trend actually need.

Leading numbers, not just the one everyone already watches

The raw incident count is a lagging indicator - it tells you what already happened, after the fact, and there is not much you can do to change last month's total. The numbers worth managing sit earlier in the chain:

• Near misses reported. A rising count is reporting culture working, not safety performance falling - the two get confused constantly, and a dashboard that only shows one number invites exactly that confusion.
• On-time investigation closure. A falling rate is a warning that shows up while there is still time to fix the process, weeks before it would otherwise surface as a repeat incident.

A single dashboard that puts the lagging count next to those two leading numbers - alongside something as simple as days since the last lost-time incident - turns a register from a historical record into something you can actually act on this month.

The form that captures it in the moment

None of the above works if the moment itself is badly captured. A printable one-page incident report form, filled in close to the event, keeps the initial capture to the minimum that matters - what happened, where, who was involved by role, immediate action taken - without inviting the kind of detail that belongs in a confidential record instead. Feed that form straight into the register and the rest of the system, the status, the ratio, the trend, has something reliable to work from.