What this is
What is incident investigation training, as distinct from an incident report?
What is incident investigation training, as distinct from an incident report?
An incident report captures what happened at the time. This training builds the separate skill of investigating afterwards — reconstructing a timeline, preserving evidence before it degrades, conducting interviews, and reaching a finding that identifies a failed or absent control rather than stopping at who was involved. It's a competency record for the investigator, not a record of any single incident.
What is ICAM, and what does it actually ask an investigator to do?
ICAM — Incident Cause Analysis Method — is an investigation method that separates absent or failed defences, individual actions, task or environmental conditions, and organisational factors. Rather than asking who did something wrong, it asks which control should have stopped this and why that control wasn't there or didn't work.
What counts as evidence being "correctly preserved" in this template?
It means physical evidence, system states and witness accounts were secured before they degraded or were disturbed — within hours in most cases, not days. An investigator who arrives at a scene and lets it be cleaned up, or waits days to interview a witness, has lost evidence that can't be recovered by good analysis afterwards.
Scope
When is an incident investigation training required?
This is investigator competency training, not the investigation record itself and not the root cause analysis that follows it. It records that one named person can run an investigation to the standard the programme expects.
Use this template when
- Someone is being assigned or nominated to lead incident investigations and needs to be trained and assessed first
- An existing investigator's competency is due for its scheduled refresher
- A completed investigation review has exposed a specific skill gap that needs retraining before the next case
- A new site or team is standing up an investigation capability and needs a documented, assessed baseline
- The competency matrix shows an investigator's record has lapsed ahead of the next expected case load
Do not use it for
- The incident report itself, which captures what happened at the time rather than testing whether the investigator can analyse it afterwards
- Root cause analysis records, which are the output of an investigation, not the training that qualifies someone to produce one
- Witness statements, which are evidence gathered during a real investigation rather than a training artefact
- Root cause analysis training, which teaches the causal-analysis technique itself and sits alongside this rather than inside it
- Post incident retraining records, which document retraining given to someone involved in an incident, not to the investigator who examined it
Compliance mapping
Which ICAM requirements does this satisfy?
ISO 45001:2018 clause 10.2 sets the investigation obligation this training exists to satisfy; ICAM is the method used to meet it. The clauses below are what the form's fields demonstrate.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001:2018 cl.10.2(b) | Investigate the incident, with worker participation, to determine its causes. | Investigation exercise |
| ISO 45001:2018 cl.10.2(a) | React in a timely manner to control the situation and deal with its consequences. | Theory content |
| ICAM — absent or failed controls | Map the incident against the controls that should have prevented it, and establish why each one was absent or didn't work. | Knowledge check |
| ISO 45001:2018 cl.10.2(b) | Determine whether similar incidents have occurred or could occur again. | Theory content |
| ISO 45001:2018 cl.10.2(d) | Determine and implement any action needed, including corrective action, based on the investigation. | Practical assessment |
| ISO 45001:2018 cl.10.2(f) | Review the effectiveness of any corrective action taken. | Outcome |
| ISO 45001:2018 cl.10.2 | Retain documented information as evidence of the investigation and its results. | Header |
What it does not cover
- An investigator who can recite ICAM's categories but has never built a timeline against a real case, which leaves the method untested until an actual incident lands on their desk.
- A timeline constructed after cause has already been assigned, which inverts the order ICAM depends on and locks in whatever assumption came first.
- A finding that names the person involved rather than the control that was absent or failed, which stops at blame instead of reaching the organisational factor clause 10.2 asks for.
- A practical exercise run on a simulated case with no real case ID recorded anywhere, which does not confirm the investigator can work with real, degrading evidence under time pressure.
- A finding that describes what happened without pointing to a specific, verifiable corrective action, which clause 10.2(d) does not treat as a complete investigation.
Global
Incident Investigation Training requirements by country
ICAM's reach and clause 10.2's legal weight land differently by jurisdiction, even though the skills trained here are close to universal.
ISO 45001:2018, clause 10.2
Organisations must investigate incidents to determine causes, evaluate the need for corrective action, and review the effectiveness of any action taken.
Where a site holds ISO 45001 certification, an auditor will expect to see investigator competency evidence, not just a completed investigation report, sitting behind clause 10.2.
ICAM, embedded in resources, rail and Model WHS Regulations practice
ICAM originated in Australian aviation and rail investigation practice and is now the de facto method across the country's resources and transport sectors.
On Australian sites, ICAM competency is often the specific method a regulator or client audit expects, not just a generic root-cause approach.
OSHA 29 CFR 1904.39 and general duty clause practice
Recordable incidents generate an expectation of internal investigation to prevent recurrence, even though OSHA does not mandate ICAM or any single method by name.
US sites usually adopt ICAM voluntarily, most often because a parent company or ISO 45001 certification requires a documented, repeatable method.
How to complete it
How to complete an incident investigation training, step by step
Filling in every field is mechanical. The judgement calls below are what decide whether a completed investigation would actually survive scrutiny.
Timeline Constructed Correctly only means something if the sequence of events was established first. An investigator who has already decided what happened and then arranges the evidence to match it has skipped the step ICAM exists to enforce.
Evidence Correctly Preserved and Worked A Real Or Simulated Case together decide how much the assessment actually proves. A simulated case with no time pressure and no degraded evidence tests a different, easier skill.
Findings Reached Beyond Individual Blame is the field that separates an investigation from an incident report with extra pages. A finding that names an action but not the control gap behind it hasn't finished the job.
Report Quality should fall if the finding is blame-stopping, however well the report reads. Scoring these independently only works if a weak finding is allowed to cap a well-written report.
What auditors find
Most common incident investigation training findings
These are the specific combinations worth checking on a completed record, not generic advice about investigation quality.
| Finding | Clause | What fixes it |
|---|---|---|
| Worked A Real Or Simulated Case is marked "No" but Practical Result is still recorded as a clean "Pass". | ISO 45001:2018 cl.10.2(b) | Require at least one real, closed case reference before a clean pass is accepted; simulated-only assessments should cap at "Pass with development points". |
| Interviews Conducted Appropriately is scored "Partly" with no note captured anywhere on the record. | ICAM — task conditions and individual actions | Use the Areas For Improvement field to capture what fell short, so the gap is traceable at the next assessment. |
| Findings Reached Beyond Individual Blame is scored "Partly" alongside a Report Quality of "Strong". | ISO 45001:2018 cl.10.2(b) | Cap Report Quality at "Adequate" whenever the finding stops at individual blame, regardless of how well the report is written. |
| Case ID Used is left blank on records where Worked A Real Or Simulated Case is Yes. | ISO 45001:2018 cl.10.2 | Make Case ID Used a required field whenever a real case is claimed, so the assessment is traceable to an actual investigation. |
| Overall Result is recorded as "Fail" while Retraining Required is left at "No". | ISO 45001:2018 cl.10.2(f) | Force Retraining Required to Yes whenever Overall Result is Fail — a failed assessment with no follow-up skips the effectiveness review this clause asks for. |
| Certificate Issued is Yes with a Valid Until date set, on a record where Assessor Qualified is marked "No". | ISO 45001:2018 cl.10.2(d) | Block certificate issue until assessor qualification is confirmed; an unqualified sign-off doesn't establish the competency the certificate claims. |
Case in point
Case in point: the timeline that was built backwards
An investigator's knowledge check came back clean — all four questions correct, including the one on why a timeline comes before cause. The practical exercise used a real closed case, a minor equipment failure with no injury. The assessor noticed the investigator had already written "operator error" in their notes before the timeline was even sketched out, then built the sequence of events to support that conclusion rather than the other way round.
Timeline Constructed Correctly was scored "Partly", Findings Reached Beyond Individual Blame was scored "No", and Practical Result was recorded as "Fail" with Retraining Required set to Yes. Retraining focused on sequencing — building the timeline from evidence before any cause discussion starts — and the investigator was reassessed on a second case within a fortnight before being cleared to lead one unsupervised.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
6 sections
- Reference
- TRN-042
- Archetype
- Training
- Record ID
- TRN-2026-000
- Scoring
- Percent with pass mark
- Direction
- High is good
- Singleton
- No
- Basis
- ICAM, ISO 45001 cl.10.2
- Links
- Links Worker
- Tags
- Training, Investigation
- Sections
- 6
- Fields
- 53
- Follow up fields
- 5
- Repeating sections
- 0
- Links out
- 5
Header
13 fieldsTraining ID*
Auto sequence. Format TRN-2026-00000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Delivered By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Course
Course ID
Format CRS-000.
Links to FDN-007 Course ID
Delivery Method*
Duration Minutes*
Trainer Qualified*
- Yes3 pts
- Subject expert, not trainer trained1 pt
- No0 pts
Worker*
Person ID*
Format PER-0000.
Links to FDN-003 Person ID
Theory content
4 fieldsEvidence Degrades Fast
Physical evidence, memories and system states all change within hours. The first response shapes what can still be learned.
Build The Timeline First
Before assigning cause, establish the sequence — what happened, in what order, and who did what when.
ICAM: Absent Or Failed Controls
Map the incident against the controls that should have prevented it, and ask why each one didn't work — not who failed to follow it.
A Finding Must Change Something
A finding that only describes what happened is incomplete. It must point to a specific, verifiable action.
Knowledge check
7 fieldsWhat is the first priority when arriving at an incident scene*
- Correct3 pts
- Partly correct1 pt
- Incorrect0 pts
Why build a timeline before assigning cause*
- Correct3 pts
- Partly correct1 pt
- Incorrect0 pts
What does ICAM ask about the controls that were in place*
- Correct3 pts
- Partly correct1 pt
- Incorrect0 pts
What makes a finding actionable rather than just descriptive*
- Correct3 pts
- Partly correct1 pt
- Incorrect0 pts
Score Percent*
Pass Mark Percent*
Passed*
- Yes3 pts
- No0 pts
Investigation exercise
6 fieldsWorked A Real Or Simulated Case*
- Yes3 pts
- No0 pts
Case ID Used
Timeline Constructed Correctly*
- Yes3 pts
- Partly1 pt
- No0 pts
Evidence Correctly Preserved*
- Yes3 pts
- Partly1 pt
- No0 pts
Interviews Conducted Appropriately*
- Yes3 pts
- Partly1 pt
- No0 pts
Findings Reached Beyond Individual Blame*
- Yes3 pts
- Partly1 pt
- No0 pts
Practical assessment
6 fieldsAssessor*
Assessor Qualified*
- Yes3 pts
- No0 pts
Assessed On Real Equipment*
- Yes3 pts
- Simulated scenario1 pt
- No0 pts
Report Quality*
- Strong3 pts
- Adequate1 pt
- Weak0 pts
Practical Result*
- Pass3 pts
- Pass with development points2 pts
- Fail0 pts
Areas For Improvement
Outcome
17 fieldsOverall Result*
- Pass3 pts
- Pass with note2 pts
- Fail0 pts
Retraining Required*
- No3 pts
- Yes1 pt
Retraining Detail
Authorisation Issued*
- Yes3 pts
- Not applicable3 pts
- No0 pts
Authorisation ID
Links to TRN-024 Authorisation ID
Restrictions Applied
Matrix Updated*
- Yes3 pts
- No0 pts
Certificate Issued
- Yes3 pts
- Not applicable3 pts
- No0 pts
Valid Until*
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Trainer*
Signature*
Worker*
Second Signature*
TRN-042 · record IDs look like TRN-2026-000 · Links Worker
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The form captures one investigator's competency. Making sure that competency is current before the next case, and that a failed practical assessment actually triggers retraining, is the part that slips.
Holds the investigator training record against the competency matrix, flags lapsed refreshers, and keeps the link to real case assessments current.
Connects this training to the incident and investigation records it feeds, so a failed practical assessment is visible where the next case is about to be assigned, not buried in a training file.
Tracks the ISO 45001 clause 10.2 evidence trail — training, investigation, corrective action, effectiveness review — as one connected thread rather than four separate filings.
Watches for the specific combinations that undermine a record — a simulated case scored as a clean pass, a strong report sitting on a blame-stopping finding — and holds every write for approval before it touches the record.
This template lives in KnowTrain — training and credentials. Induction, competency, toolbox talks, refreshers and expiry tracking.
Meet KnowTrain→Glossary
Incident Investigation Training definitions and key terms
- ICAM
- Incident Cause Analysis Method — an investigation method separating absent or failed controls, individual actions, task or environmental conditions, and organisational factors.
- Timeline
- The reconstructed sequence of events — what happened, in what order, and who did what when — established before cause is assigned.
- Finding
- A conclusion from an investigation that identifies a specific, verifiable gap and points to an action that would close it, rather than only describing what occurred.
- Absent or failed control
- A safeguard that either wasn't in place or was in place but didn't work as intended — the thing ICAM asks investigators to identify instead of stopping at individual blame.
- Evidence preservation
- Securing physical evidence, system states and witness accounts before they degrade, are disturbed, or are lost — a window that is often measured in hours, not days.
FAQ
Frequently asked questions about incident investigation training
Does an investigator need to pass both the knowledge check and the practical assessment?+
Yes. The knowledge check confirms they understand ICAM's structure — timeline first, absent or failed controls, findings that go beyond blame. The practical assessment confirms they can apply that under the pressure and ambiguity of a real or realistic case. A pass on one without the other leaves a real gap.
What happens if the practical exercise uses a simulated rather than a real case?+
It's allowed, and it's recorded explicitly via Worked A Real Or Simulated Case, but a simulated case tests a narrower skill — it removes the time pressure and degrading evidence that a real case brings. Most programmes expect a real case at least once before an investigator is cleared to lead unsupervised.
Why does the form score Report Quality separately from the finding itself?+
Because a well-written report can still stop at individual blame, and a rougher one can still reach the organisational factor. Scoring them separately stops writing quality from masking an incomplete finding.
How often does this training need to be refreshed?+
On a scheduled cycle as a baseline, and immediately if a completed investigation review shows a specific gap — a timeline built out of order, an interview that stopped too early, a finding that named a person instead of a control.
Does ISO 45001 certification require ICAM specifically?+
No. Clause 10.2 requires investigation to determine causes and corrective action; it doesn't mandate a named method. ICAM is one of the more widely used ways of meeting that requirement, particularly where the site or parent company has adopted it as standard.
Can this template be adjusted for a different investigation method?+
Yes. The fields, options, scoring and conditional logic are all editable, and the links to the worker record travel with the template. Most teams install it as-is against ICAM, run a full cycle, then adjust based on what the practical assessments actually reveal.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Incident and Investigation
Root Cause Analysis
Finds out why something happened rather than who was involved
Corrective and Preventive Action
The single action record used everywhere
Finding
Records a single deficiency picked up during an audit, inspection or check
Effectiveness Verification
Checks whether an action actually worked, some time after it was put in place
Just Culture Determination
Separates a system problem from a genuine choice to take a risk, using a consistent set of questions
Extent of Condition Review
Asks two questions after an investigation: where else does this same condition exist, and where else could this same cause bite us
More in Safety Training
Hazard Communication Training
Covers chemical labels, safety data sheets and what the hazard symbols mean
Lockout Tagout Training
Covers energy isolation, lock application, verification and group lockout
Confined Space Training
Covers hazards, testing, entry procedures, attendant duties and rescue
Fall Protection Training
Covers fall hazards, equipment selection, anchor points, inspection and rescue
Fire Safety and Extinguisher Training
Covers fire prevention, alarm response, evacuation and safe extinguisher use
First Aid Training
Covers basic first aid, CPR and the use of a defibrillator
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 45001:2018, clause 10.2 — Incident, nonconformity and corrective action
- ICAM — Incident Cause Analysis Method
- OSHA 29 CFR 1904.39 — Reporting fatalities, hospitalizations, amputations and losses of an eye
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.