What should be included in an incident report?
A complete incident report should include seven key elements: the date, time, and location of the incident; the names and roles of all individuals involved; a factual, chronological description of what happened; the immediate actions taken in response; the injuries, damages, or consequences that resulted; any contributing factors or root causes identified; and the corrective actions recommended to prevent recurrence.
An incident report is one of the most important documents you may ever write at work. Whether you are documenting a workplace injury, a safety violation, an IT security breach, a customer complaint, or a near-miss event, the quality of your report can determine the outcome of investigations, insurance claims, legal proceedings, and organizational policy changes.
Despite its importance, most professionals receive little formal training in incident report writing. The result is reports filled with vague descriptions, missing details, subjective opinions, and unclear timelines -- documents that fail the very people who need them most. According to the National Safety Council, incomplete or inaccurate incident reporting is one of the leading barriers to effective workplace safety improvement [1].
This guide teaches you how to write incident reports that are factual, complete, well-organized, and useful. You will find a step-by-step process, a downloadable template structure, real-world examples, and guidance on the most common mistakes to avoid.
What Is an Incident Report?
An incident report is a formal, written document that records the facts of an unexpected event that caused or could have caused harm to people, property, processes, or the organization. It serves multiple purposes:
- Documentation: Creates an official record of what happened.
- Investigation: Provides the foundation for root cause analysis.
- Legal protection: Establishes a contemporaneous account that can be referenced in legal or regulatory proceedings.
- Prevention: Identifies patterns and informs corrective actions.
- Compliance: Satisfies regulatory requirements (OSHA, HIPAA, SOX, etc.).
"An incident report is not a place for opinions, theories, or blame. It is a factual record of what happened, when, where, how, and to whom. The analysis comes later." -- Occupational Safety and Health Administration (OSHA), Incident Investigation Guide [1]
The Seven Essential Elements
Every incident report, regardless of type, should include these seven elements:
| Element | What to Include |
|---|---|
| 1. Basic Information | Date, time, location, report author, report date |
| 2. People Involved | Names, roles, departments, contact information |
| 3. Description of the Incident | Chronological, factual account of what happened |
| 4. Immediate Response | Actions taken at the scene or immediately after |
| 5. Injuries/Damages/Consequences | Physical harm, property damage, data loss, operational impact |
| 6. Contributing Factors | Environmental conditions, equipment status, procedural gaps |
| 7. Corrective Actions | Recommended steps to prevent recurrence |
Step-by-Step Writing Process
Step 1: Gather Facts Immediately
As soon as it is safe to do so, collect information while memories are fresh:
- Interview witnesses and involved parties separately.
- Take photographs of the scene, equipment, and any damage.
- Preserve physical evidence (broken equipment, spilled materials).
- Note environmental conditions (lighting, weather, noise level).
- Record exact times using clocks, security cameras, or system logs.
Step 2: Write the Header Information
Start with the administrative details:
- Incident date and time: Be as precise as possible (e.g., "March 15, 2026, approximately 2:35 PM").
- Location: Specific location (e.g., "Building C, Loading Dock 3, Bay 7").
- Report author: Your name, title, and department.
- Report date: The date you are writing the report.
- Incident type: Injury, near-miss, property damage, security breach, etc.
Step 3: Identify All Involved Parties
List every person involved in or who witnessed the incident:
- Full name and job title
- Department or company
- Role in the incident (involved party, witness, first responder)
- Contact information
Step 4: Write the Description
This is the heart of the report. Describe what happened in chronological order, using objective language.
Guidelines for the description:
- Use past tense consistently.
- Be specific about times, measurements, and quantities.
- Describe observable facts, not interpretations.
- Use neutral language -- no blame, no emotion.
- Include what happened before, during, and after the incident.
- Note what conditions were normal and what was different.
Example of good description: "At approximately 2:35 PM on March 15, 2026, Employee A was operating Forklift #7 in Loading Dock 3, Bay 7. While reversing the forklift to position a pallet on Rack B-12, the rear of the forklift struck the support column between Bays 7 and 8. The impact dislodged three boxes from the second shelf of Rack B-11. One box, weighing approximately 25 pounds, fell and struck Employee B, who was standing in the adjacent aisle. Employee B reported pain in the left shoulder and upper arm."
Example of poor description: "The forklift driver was going too fast and carelessly backed into a column, causing boxes to fall on a coworker. He should have been paying more attention."
"Report what you observed, not what you concluded. 'The floor was wet' is a fact. 'The floor was dangerously slippery' is an opinion. 'Employee A slipped on the wet floor' is a fact." -- American Society of Safety Professionals, Best Practices for Incident Reporting [2]
Step 5: Document the Immediate Response
Record all actions taken immediately after the incident:
- First aid administered
- Emergency services called (time of call, arrival time)
- Area secured or evacuated
- Equipment shut down
- Supervisor notified (name, time)
Step 6: Record Injuries, Damages, and Consequences
Be precise and factual:
| Category | What to Document |
|---|---|
| Injuries | Body part affected, type of injury, severity, treatment provided |
| Property damage | Equipment or structure affected, extent of damage, estimated cost |
| Operational impact | Downtime, production loss, service interruption |
| Data/information loss | Systems affected, data compromised, recovery status |
| Environmental impact | Spills, emissions, contamination |
Step 7: Identify Contributing Factors
List the factors that may have contributed to the incident. Be factual, not speculative:
- Equipment condition (maintenance records, known issues)
- Environmental conditions (lighting, weather, temperature)
- Procedural factors (standard procedures followed or not)
- Training status (certifications, last training date)
- Staffing factors (overtime, shift length, workload)
Step 8: Recommend Corrective Actions
Propose specific, actionable steps to prevent recurrence:
- Immediate actions: What should be done right now (e.g., "Restrict access to Loading Dock 3 until the column is inspected").
- Short-term actions: What should be done within days or weeks (e.g., "Retrain all forklift operators on reversing procedures").
- Long-term actions: Systemic changes (e.g., "Install convex mirrors at all column intersections in the loading dock").
Incident Report Template
Use this structure for any type of incident:
INCIDENT REPORT
Report Number: [Auto-assigned or manual] Date of Incident: [MM/DD/YYYY] Time of Incident: [HH:MM AM/PM] Location: [Specific location] Report Prepared By: [Name, Title, Department] Date of Report: [MM/DD/YYYY] Incident Type: [Injury / Near-Miss / Property Damage / Security / Other]
Persons Involved: [Name, Title, Department, Role (involved/witness/responder), Contact]
Description of Incident: [Chronological, factual account]
Immediate Actions Taken: [First aid, emergency response, notifications]
Injuries / Damages / Consequences: [Specific details]
Contributing Factors: [Environmental, equipment, procedural, human factors]
Corrective Actions Recommended: [Immediate, short-term, long-term]
Attachments: [Photos, diagrams, witness statements, logs]
Signatures: [Report author, supervisor, safety officer]
Types of Incident Reports
Workplace Safety Incident
Covers injuries, near-misses, and safety violations. Must comply with OSHA reporting requirements in the United States (or equivalent regulations in other countries). Serious injuries must be reported to OSHA within 24 hours; fatalities within 8 hours.
IT Security Incident
Documents data breaches, unauthorized access, malware infections, or system compromises. Must include systems affected, data potentially compromised, timeline of detection and response, and notification requirements under regulations like GDPR, HIPAA, or state breach notification laws.
Customer Complaint Incident
Records serious customer issues that require formal documentation, particularly those involving potential liability, regulatory violations, or significant financial impact.
Vehicle/Transportation Incident
Documents accidents involving company vehicles or during work-related travel. Includes police report numbers, insurance information, and vehicle damage assessments.
Language Guide: Words to Use and Avoid
| Use (Objective) | Avoid (Subjective) |
|---|---|
| Employee A was not wearing safety goggles. | Employee A was careless/negligent. |
| The floor surface was wet. | The floor was dangerously slippery. |
| The equipment had not been inspected since [date]. | The equipment was neglected. |
| Employee B reported pain in the left shoulder. | Employee B was badly hurt. |
| The forklift struck the column. | The forklift crashed into the column. |
| The procedure was not followed. | The employee disregarded the rules. |
"Objectivity in incident reporting protects both the organization and the individuals involved. Subjective language can be used against you in legal proceedings, and it biases the investigation before it begins." -- National Safety Council, Injury Facts [3]
Writing the Chronological Narrative: Advanced Techniques
The description section is where most incident reports succeed or fail. Beyond the basic guidelines covered earlier, these advanced techniques will elevate the quality and usefulness of your narrative.
Use the Timeline Method
For complex incidents involving multiple parties or locations, a timeline format can be more effective than a prose narrative:
| Time | Event | Source |
|---|---|---|
| 2:15 PM | Employee A begins operating Forklift #7 in Bay 7 | Shift supervisor log |
| 2:30 PM | Employee B enters adjacent aisle to retrieve inventory | Security camera footage |
| 2:35 PM | Forklift #7 strikes support column between Bays 7 and 8 | Employee A statement, security camera |
| 2:35 PM | Three boxes dislodge from Rack B-11, second shelf | Security camera footage |
| 2:36 PM | One box strikes Employee B on left shoulder | Employee B statement, Employee C (witness) |
| 2:37 PM | Employee C calls for first aid; alerts Supervisor D | Employee C statement |
| 2:40 PM | First aid administered by certified responder E | First aid log |
| 2:45 PM | Supervisor D contacts safety office | Phone log |
This format allows investigators to see the sequence clearly, identify gaps, and cross-reference witness accounts with physical evidence.
Distinguish Observed Facts from Reported Information
When writing the narrative, clearly attribute information to its source. There is a critical difference between what the report author observed directly, what witnesses reported, and what was reconstructed from evidence:
- Directly observed: "At 2:45 PM, I arrived at the scene and observed a wet area on the floor extending approximately three feet from the base of the water fountain."
- Witness reported: "Employee C stated that she saw Employee B slip and fall at approximately 2:40 PM."
- Reconstructed from evidence: "Security camera footage from Camera 12 shows Employee B walking through the wet area at 2:39 PM."
"The best incident reports clearly distinguish between first-hand observation, witness testimony, and evidence-based reconstruction. This distinction is critical in legal proceedings and root cause analysis." -- James Roughton and Nathan Crutchfield, Safety Culture: An Innovative Leadership Approach, 2nd edition [4]
Quantify Whenever Possible
Vague descriptions undermine the utility of the report. Every measurement you can provide makes the report more useful for investigators, engineers, and legal teams:
| Vague Description | Quantified Description |
|---|---|
| The spill covered a large area. | The spill covered approximately 15 square feet. |
| The fall was from a significant height. | The fall was from a height of approximately 8 feet. |
| The chemical had a strong odor. | The chemical odor was detectable from approximately 20 feet. |
| The employee was exposed for a long time. | The employee was exposed for approximately 45 minutes. |
| The load was heavy. | The load weighed approximately 75 pounds per the shipping manifest. |
Incident Report Quality Checklist
Before submitting any incident report, verify that it meets these standards:
| Criterion | Check |
|---|---|
| Date, time, and location are precise | |
| All involved parties and witnesses are identified with full names and contact information | |
| The description is chronological and uses past tense consistently | |
| All statements are factual and objective -- no opinions, blame, or emotional language | |
| Immediate response actions are documented with times | |
| Injuries, damages, and consequences are described with specifics | |
| Contributing factors are listed based on evidence, not speculation | |
| Corrective actions include immediate, short-term, and long-term recommendations | |
| All photographs, diagrams, and supporting documents are referenced and attached | |
| The report has been reviewed for inconsistencies across witness statements | |
| Signatures are obtained from the report author and supervisor |
Common Mistakes to Avoid
- Waiting too long to write the report. Details fade from memory within hours. Write while the information is fresh.
- Using vague language. "The incident occurred in the afternoon" is useless. "The incident occurred at approximately 2:35 PM" is useful.
- Including opinions or blame. Save analysis for the investigation phase.
- Omitting the "near-miss." Many organizations only report incidents that result in actual harm, missing the opportunity to learn from close calls.
- Failing to include corrective actions. A report without recommendations is a record of failure with no path to improvement.
- Inconsistent details. Cross-check times, names, and facts across all witness statements.
- Mixing investigation conclusions with the factual report. The incident report records what happened. Root cause analysis, fault determination, and disciplinary recommendations belong in separate documents that reference the incident report.
- Failing to preserve evidence. The report should note what physical evidence was preserved and how. Photographs, damaged equipment, environmental samples, and system logs should all be referenced with their storage location.
Near-Miss Reporting: Why It Matters
Near-miss incidents -- events that could have caused harm but did not -- are among the most valuable incidents to document. According to safety research, for every serious injury there are approximately 300 near-miss events. Capturing these events provides organizations with data to prevent the serious incidents before they occur.
A near-miss report follows the same structure as a standard incident report but with one critical addition: the section on injuries and damages should describe what could have happened, not just what did happen.
Near-miss example: "At approximately 10:15 AM, a 30-pound box fell from the third shelf of Rack C-4 in Warehouse 2. No personnel were in the aisle at the time. Had an employee been present, the falling box could have caused a head or shoulder injury. The box fell because the shelf bracket had loosened due to repeated forklift contact with the rack's support column."
Organizations that actively report and investigate near-misses consistently achieve lower injury rates than those that report only after harm has occurred.
Related Business Writing Guides
- Business Report Template -- general report writing structure
- Executive Summary -- summarizing key findings for leadership
- How to Write Concisely -- eliminating wordiness for clarity
- Active vs Passive Voice -- when passive is appropriate in reports
- Tone in Professional Writing -- maintaining objectivity
Summary
A well-written incident report is factual, chronological, specific, and objective. It documents the who, what, when, where, and how of an incident without speculation or blame. It records the immediate response, the consequences, the contributing factors, and the corrective actions needed to prevent recurrence. Use the seven-element framework and template in this guide as your starting point for any incident type, and always write the report as soon as possible after the event while details are fresh. Good incident reports protect people, improve processes, and demonstrate organizational accountability.
How to Write a Chief Complaint Example?
In medical and incident-report contexts, a 'chief complaint' is the primary reason the patient or reporter sought help, stated in the person's own words or in a concise summary. Examples: 'Patient reports sharp lower back pain for three days.' 'Employee reports verbal harassment from a named supervisor on two dated occasions.' 'Customer reports charge of $X that does not match any authorized transaction.' The incident-report guide covers how to capture the chief complaint in the first line of the report: it should be a single factual sentence, use the reporter's language where possible, and avoid diagnostic or evaluative framing. Everything that follows in the report supports, documents, or responds to the chief complaint.
How to Write a Complaint About Bullying at Work?
Document workplace bullying in a formal written complaint with dated, specific incidents, witnesses, and direct impact. Use the incident-report structure from the guide: date, time, location, individuals involved, factual description in chronological order, supporting evidence (emails, messages, notes from witnesses), and a clear statement of what you are asking for -- investigation, transfer, or other remedy. Submit to HR in writing (email creates a timestamp) and keep personal copies of everything. Never speculate on motives or use evaluative language in the report; stick to what happened and what was said. The incident-report guide emphasizes that the strongest complaints read as factual, not emotional, even when the underlying experience is deeply emotional.
References
[1] Occupational Safety and Health Administration (OSHA). Incident Investigation Guide. United States Department of Labor.
[2] American Society of Safety Professionals. "Best Practices for Incident Reporting." Professional Safety Journal, 2021.
[3] National Safety Council. Injury Facts. NSC, 2023.
[4] Roughton, James, and Nathan Crutchfield. Safety Culture: An Innovative Leadership Approach. 2nd ed., Butterworth-Heinemann, 2019.
Frequently Asked Questions
What should be included in an incident report?
A complete incident report should include seven key elements: the date, time, and location of the incident; the names and roles of all individuals involved; a factual, chronological description of what happened; the immediate actions taken in response; the injuries, damages, or consequences that resulted; any contributing factors or root causes identified; and the corrective actions recommended to prevent recurrence. Stick to objective facts and avoid speculation, blame, or emotional language.
How soon after an incident should the report be written?
Write the incident report as soon as possible, ideally within 24 hours. The sooner you document the details, the more accurate your account will be. Memory fades quickly, and critical details -- exact times, sequences of events, specific words spoken -- become harder to recall with each passing day. Many organizations require reports within 24 to 48 hours. For serious incidents involving injury, property damage, or regulatory implications, some jurisdictions require reporting within specific timeframes (such as OSHA's 8-hour rule for fatalities in the US).
What is the most common mistake in incident reports?
The most common mistake is including opinions, assumptions, or blame instead of objective facts. An incident report should describe what happened, not why someone thinks it happened or whose fault it was. Statements like 'The employee was being careless' should be replaced with factual observations like 'The employee was not wearing the required safety goggles at the time of the incident.' Another frequent error is vague language -- 'the incident occurred around lunchtime' should be 'the incident occurred at approximately 12:15 PM.' Precision and objectivity are essential.