Format of an incident report: what to include and how to structure it

Last updated 2026-07-09

What is an incident report and why does the format matter?

An incident report is a written record of any workplace event that caused injury, illness, property damage, or a near miss. Format matters because a report full of gaps comes back to haunt you, whether that's during an OSHA inspection, a workers' comp fight, or a lawsuit.

Format also decides whether you actually learn anything. A report that says "employee slipped and fell" tells you nothing. A report that names the wet floor, the missing wet-floor sign, the short-staffed shift, and the fact that the same corner flooded twice before gives you something to fix.

OSHA doesn't require a single universal incident report form for most employers. What the agency does require, under 29 CFR 1904, is that employers with 11 or more employees keep records of work-related injuries and illnesses on specific OSHA forms ^[1]. Those forms (OSHA 300, 300A, and 301) are not the incident report itself. They're the recordkeeping output that a good incident report feeds.

The distinction matters. Your internal incident report is your investigation document. The OSHA 301 Injury and Illness Incident Report is a government recordkeeping form. You need both, and the internal one should be the richer of the two.

What are the required fields in a standard incident report format?

No federal law dictates the exact fields on an internal incident report. But years of OSHA enforcement, workers' comp litigation, and industrial hygiene practice have settled on a consistent list. If your form is missing any of these, fix it before you need it.

Identification and basic facts

• Report number (for tracking)
• Date and time of incident
• Date and time the report was completed
• Location (building, floor, area, exact spot)
• Department or work area

People involved

• Name, job title, and tenure of the injured or affected employee
• Supervisor's name
• Names and contact info of witnesses
• Person completing the report and their title

What happened

• Narrative description of the event, written in plain past tense
• Sequence of events leading up to the incident
• What the employee was doing at the time
• What equipment, materials, or substances were involved
• Environmental conditions (lighting, temperature, wet floors, noise level)

Injury or illness details

• Nature of injury (laceration, strain, burn, etc.)
• Body part affected
• Severity at time of report (first aid only, medical treatment, hospitalization)
• Whether the employee continued working, went to a clinic, or went to the ER

Cause analysis

• Immediate cause (the direct action or condition that caused the event)
• Root cause (the underlying system failure that allowed the condition to exist)
• Contributing factors

Corrective actions

• Interim controls put in place immediately
• Long-term corrective actions planned
• Person responsible and target completion date

Signatures

• Injured employee (if able)
• Supervisor
• Safety officer or HR (depending on your structure)

OSHA's own 301 form covers roughly the first three categories above ^[2]. Your internal form should go deeper, especially on root cause and corrective action, which the 301 doesn't ask about at all.

What does a good incident report narrative look like?

The narrative section is where most reports fall apart. People write vague passive sentences: "An injury occurred when a box fell." That's almost useless.

A good narrative reads like a tight factual account written by someone who was standing there. Active voice. Real names. Specific times. Exact measurements where they apply. Here's the contrast:

Weak: "Employee was injured in the warehouse. A box fell and hit them."

Strong: "On June 12 at approximately 2:15 PM, Maria Santos (warehouse associate, 8 months tenure) was retrieving a 40-pound box of motor parts from the top shelf in Aisle 7 of Building B using a rolling step ladder. The box shifted as she lifted it, slid off the shelf edge, and struck her on the left forearm and shoulder before hitting the floor. No other employees were within 10 feet at the time. The shelf had no lip guard. The box was not shrink-wrapped to a pallet and had been stored loosely since the prior shift."

That second version gives you the who, what, when, where, and the two conditions that let it happen. A root cause investigator can work with that.

Write the narrative the same day. Memory degrades fast, and so does physical evidence. The Bureau of Labor Statistics reports that overexertion and bodily reaction is the single largest cause of days-away-from-work cases, at roughly 35% in recent data ^[3]. Those injuries almost always have a story behind them. A good narrative captures it. A bad one buries it.

How is an incident report different from an OSHA 300 log entry?

This trips up a lot of small business owners. They think filling out the OSHA 300 log is the same as doing an incident report. It isn't.

The OSHA 300 log is a running list of every recordable injury and illness across the year ^[1]. You add a line for each qualifying event. The OSHA 301 is the supplemental form with details on each specific event. The OSHA 300A is the annual summary you post every February through April ^[1].

Your internal incident report is none of those. It's the investigation document that comes first. It's longer, more detailed, and it has root cause and corrective action fields that OSHA's own forms skip.

The practical workflow looks like this:

Step	Document	Who Completes It	Deadline
1	Internal incident report	Supervisor + safety officer	Within 24 hours
2	OSHA 301 (or equivalent)	Employer	Within 7 calendar days of recordable incident [1]
3	OSHA 300 log entry	Employer	Within 7 calendar days [1]
4	OSHA 300A annual summary	Employer	Posted Feb 1 through Apr 30 each year [1]
5	Fatality/hospitalization report	Employer	Fatality: 8 hours; Amputation/eye loss/inpatient hospitalization: 24 hours [4]

Have a serious incident, and the 8-hour and 24-hour reporting windows are non-negotiable. You call OSHA directly at 1-800-321-OSHA or report online. That call is separate from and far more urgent than any paperwork.

How do you conduct a root cause analysis in an incident report?

Most incident reports name the immediate cause and stop. The immediate cause is what directly triggered the injury. The root cause is why that trigger existed. Fix only the immediate cause and the same event happens again with a different employee.

A few methods work at the small business level with no consultant required.

The 5 Whys. Ask "why" five times, each answer feeding the next question. It sounds simple, and it is, but it works for most non-catastrophic incidents. Maria's box fell because the shelf had no lip guard (why 1). Lip guards weren't part of the warehouse setup standard (why 2). There was no written shelving standard (why 3). No one owned the safety program for the warehouse (why 4). Safety responsibilities were never assigned in writing (why 5). Now you're at a real corrective action: assign ownership and write the standard.

Fishbone diagram (Ishikawa). Better for tangled incidents with multiple contributing factors. You sort causes into buckets: people, methods, machines, materials, environment, management systems. Good when the immediate cause is obvious but the contributing factors are knotted together.

Fault tree analysis. More involved. Usually reserved for serious injuries or incidents with several simultaneous failures. Most small businesses never need it for routine events.

The 5 Whys handles maybe 80% of what a small business sees. The point is to document your analysis in the report, not leave it in someone's head. If OSHA asks how you investigated, "we talked about it at the safety meeting" is not an answer that helps you.

What are near miss incidents and do they need a report too?

A near miss is an event that could have caused injury or damage but didn't, usually thanks to luck rather than control. A forklift reversing toward an employee who steps clear at the last second. A chemical container stored wrong that hasn't spilled yet.

OSHA doesn't require you to record near misses on your 300 log, because no injury or illness happened. But any serious safety professional will tell you near misses are the most valuable data you have. They show where your system is failing before someone gets hurt.

Near miss reports should use the same format as injury reports, with the injury fields marked "none" or "N/A." The root cause and corrective action sections matter just as much, arguably more, because you still have the chance to prevent the injury entirely.

Want a near-miss reporting culture? Make the process easy and blameless. Employees won't report near misses if they think it'll get them in trouble. Separate near-miss reporting from disciplinary processes explicitly, in writing, in your safety program.

Facilities that run forklifts should treat near-miss reporting as a priority. OSHA estimates forklifts cause roughly 85 fatal accidents and 34,900 serious injuries a year ^[5]. Most of those had at least one prior near miss that nobody reported. If your operation involves forklift certification requirements, wire near-miss reporting straight into your forklift safety protocol.

How soon after an incident should a report be completed?

The honest answer: as fast as physically possible, and almost always within 24 hours.

Here's why timing matters. Witness memories drift. Physical conditions get cleaned up. Equipment gets repaired. Employees talk, and stories converge or diverge in ways that make investigation harder. The further you get from the event, the worse your data.

For fatalities and certain serious injuries, OSHA sets hard legal deadlines. A work-related fatality must be reported within 8 hours. An in-patient hospitalization, amputation, or eye loss must be reported within 24 hours ^[4]. Miss those and the failure itself is a citable violation.

For the internal investigation report, there's no OSHA-mandated clock. Standard occupational safety practice is 24 hours for the initial report and 72 hours for a fuller root cause analysis on serious incidents. Some insurance carriers and workers' comp programs set their own windows, often 24 to 72 hours, and missing them can affect how your claim gets handled.

Set a firm internal policy. Something like: "The supervisor on duty completes the initial incident report before the end of their shift or within 4 hours, whichever comes first." That's a rule your team can actually follow.

What format should the report be in, paper or digital?

Either works legally. OSHA accepts electronic records. Under 29 CFR 1904.41, certain employers must electronically submit their 300A summary, and in some cases their 300 log and 301 data, to OSHA's Injury Tracking Application (ITA) ^[6]. That's government recordkeeping, though, not your internal report.

For internal incident reports, digital usually wins at the small business level. Paper forms get lost, faded, or misfiled. Digital forms can be filled out on a phone right after an incident, time-stamped, and stored with photos attached. They're searchable when you need to pull prior incidents in a specific area.

Go digital and make sure the system works without internet if your facility has dead zones. Make sure every supervisor knows how to use it before an incident happens. A form nobody can find when they need it is worse than no form at all.

Go paper and use a carbonless two-part form, so a copy stays in the field and the original goes to HR or safety. Number your forms in sequence so you can spot gaps.

SafetyFolio's safety program generator can produce a customized incident report template matched to your industry and workforce size, along with the written safety program it feeds, usually in about 15 minutes.

Photographs should go with the written report for any serious incident. Attach them to the digital report or staple them to the paper one. Photograph the scene before anything is moved or cleaned. Photograph the equipment involved, the area around it, and any contributing conditions like spills, poor lighting, or missing guards.

Who should receive a copy of the completed incident report?

It depends on your size and structure, but a basic distribution list for most small businesses looks like this:

• The injured employee (they have a right to their own records under OSHA ^[7])
• The direct supervisor
• HR or whoever manages workers' comp
• The safety officer or safety committee (if you have one)
• Senior management for any serious incident

OSHA gives employees and their representatives the right to access the OSHA 300 log and 301 forms ^[7]. Your internal incident report sits outside that, but handing the injured employee a copy is both good practice and good faith.

Don't share incident reports with people who don't need them. A report that circulates widely before the investigation wraps up can taint witness accounts, and in litigation it can surface in discovery in ways that are hard to manage.

Insurance carriers often want a copy of your incident report as part of the claims process. Learn your carrier's requirements before an incident happens, not after. Some carriers have supplemental forms they want completed alongside yours.

Got a union? The collective bargaining agreement may set its own reporting and disclosure requirements. Check it.

What are the most common mistakes in incident report formats?

After looking at what OSHA citations cover and what gets flagged in workers' comp disputes, these are the problems that show up most.

Vague language. "Employee was injured" instead of how, where on the body, and under what exact circumstances. Vague language protects no one and hides the real problem.

Missing root cause. The form has a box for it, and someone wrote "carelessness" or left it blank. Carelessness is almost never a root cause. It's a symptom of a system that doesn't support safe behavior.

No corrective action with an owner and a deadline. "Will review procedure" means nothing. "Warehouse manager will install lip guards on all top-shelf positions by June 30" means something.

Completed too late. Reports filed days after the event, built on memory and secondhand accounts. The details will be wrong.

Blaming the employee. This is the big one. Reports that pin everything on employee error, especially when that's the only root cause named, signal to OSHA and to plaintiffs' attorneys that you never looked at the system. OSHA's enforcement philosophy holds employers responsible for creating safe conditions, more than for hiring careful people.

No witness statements captured separately. The narrative summary helps, but verbatim witness statements recorded close to the event carry more weight in a dispute.

Inconsistency with the OSHA 301. If your internal report says one thing and the 301 says another, you have a credibility problem. Reconcile them before filing.

Does the incident report format change for specific industries or hazard types?

The core structure stays the same, but some industries carry extra requirements worth building into your template.

Construction. Falls are the leading cause of death in construction, accounting for 395 of 1,069 construction fatalities in 2022 ^[8]. A construction incident report should have fields for fall height, whether fall protection was in use, and whether a fall protection plan existed and was followed. Struck-by, caught-in, and electrical incidents deserve their own cause-specific fields.

Chemical and manufacturing. If a chemical exposure is involved, the report needs to reference the safety data sheet (SDS) for the substance. A proper hazard communication program under 29 CFR 1910.1200 requires SDS access and training, and your incident report should link the incident to the relevant SDS where it applies ^[9].

Healthcare. Needlestick and sharps injuries carry specific recording requirements under 29 CFR 1904.8 and must be logged separately ^[10]. A healthcare incident report template should have dedicated fields for device type, whether it was safety-engineered, and what procedure was underway.

Vehicles and forklifts. Include vehicle ID, operator's license and certification status, speed estimate, load characteristics, and road or surface conditions.

General industry. For lockout/tagout incidents, the report has to capture whether the machine was properly de-energized, who performed the lockout, and whether written procedures existed. See OSHA's standard at 29 CFR 1910.147 ^[11]. To square up your written procedures, lockout tagout requirements are worth a review.

If you operate in a state with its own OSHA plan (there are 22 state plans covering private-sector employers), check whether your state piles on reporting requirements beyond the federal floor. California's Cal/OSHA, for one, requires a serious injury report within 24 hours to the nearest district office, separate from the federal rule.

How long do you have to keep incident reports?

For OSHA 300, 300A, and 301 forms: 5 years from the end of the calendar year they cover ^[14]. That's the federal minimum under 29 CFR 1904.33. You have to make them available to current and former employees, their representatives, and OSHA during that window.

Internal incident reports have no specific OSHA retention rule. Keeping them for the same 5-year period makes sense, since they back up your OSHA records. Workers' comp and general liability concerns often push that longer, especially for latent injury claims. Occupational disease claims can surface years after exposure. A practical default for most small businesses is 7 to 10 years, stored in a format you can actually pull up.

Store records securely. Medical information, including injury descriptions, has privacy implications under HIPAA in healthcare settings and under OSHA's medical records standard, 29 CFR 1910.1020, which requires 30-year retention for medical and exposure records in certain situations ^[12]. If your incident report includes detailed medical information, keep it in a separate, access-controlled file, not in a general HR folder.

Digital storage with redundant backup is the safest bet. A filing cabinet in a basement that floods is not a records retention strategy.

What's a simple incident report template structure you can use right now?

Here's a clean, practical structure you can adapt. This isn't a legal form. It's a starting framework. Adjust the fields to match your industry and the hazards specific to your workplace.

---

WORKPLACE INCIDENT REPORT

Report #: _______ | Date of Report: _______ | Completed by: _______

SECTION 1: BASIC INFORMATION Date of incident: _______ Time: _______ AM/PM Location (be specific): _______ Department: _______ Supervisor on duty: _______

SECTION 2: PEOPLE INVOLVED Employee name: _______ Job title: _______ Tenure: _______ Witnesses (name + contact): _______

SECTION 3: WHAT HAPPENED Describe the sequence of events in plain language. Include what the employee was doing, what equipment or materials were involved, and environmental conditions. [4-6 lines of space]

SECTION 4: INJURY/ILLNESS/DAMAGE Nature of injury: _______ Body part: _______ Treatment given: First aid on site / Sent to clinic / ER / Refused treatment Property or equipment damage: _______

SECTION 5: CAUSE ANALYSIS Immediate cause (the direct action or condition): _______ Root cause (the underlying system failure): _______ Contributing factors: _______

SECTION 6: CORRECTIVE ACTIONS

SECTION 7: SIGNATURES Injured employee: _______ Date: _______ Supervisor: _______ Date: _______ Safety officer / HR: _______ Date: _______

Attach: Photos, witness statements, medical records (separate file), equipment inspection reports.

---

This structure feeds directly into the OSHA 301 form. Want a version customized to your specific industry and state requirements? SafetyFolio's program generator produces templates as part of a complete written safety program, with the incident report format matched to the hazards OSHA expects you to address.

Frequently asked questions

Is there an OSHA-required incident report form I have to use?

OSHA doesn't require a specific internal incident report form. What's required under 29 CFR 1904 is that employers with 11 or more employees record qualifying work-related injuries and illnesses on OSHA Forms 300, 300A, and 301. Your internal incident report is separate from those forms, though it should hold the information you need to complete them accurately.

What is the difference between a near miss report and an incident report?

A near miss report documents an event that could have caused injury or damage but didn't. An incident report documents an event where injury, illness, or damage actually happened. The format is nearly identical. Near misses don't go on the OSHA 300 log because no injury or illness resulted, but they're among the most valuable safety data you can collect, and they deserve the same root cause analysis as actual incidents.

How long do I have to file an incident report after a workplace injury?

For internal reports, best practice is within 24 hours of the event. For OSHA 300 log and 301 form entries, you have 7 calendar days from learning of the recordable incident. For serious incidents, separate deadlines apply: fatalities within 8 hours to OSHA, and in-patient hospitalizations, amputations, or eye losses within 24 hours. Missing those last two is a citable violation under 29 CFR 1904.39.

Can an employee refuse to sign the incident report?

Yes. An employee can decline to sign. Don't force it. Note on the form that the employee was offered the chance to sign and declined, and record the date and time. Their refusal doesn't invalidate the report. The signature line is for acknowledgment, not agreement. Complete the report accurately regardless of whether the employee signs.

Do I need to report a near miss to OSHA?

No. OSHA doesn't require near miss reporting to the agency. Near misses are internal documents. That said, some states with their own OSHA plans may have different rules, so check your state plan if one applies. The value of near-miss reports is entirely internal: they let you find and fix hazardous conditions before someone gets hurt.

What should I do if the injured employee's account contradicts the witness account?

Document both accounts verbatim and separately. Don't try to blend them into a single narrative in the initial report. Note the discrepancy in the cause analysis section and describe what physical evidence or other information you used to reach your root cause conclusion. In workers' comp or litigation, preserving both accounts beats a smoothed-over version that looks like you hid a conflict.

How detailed does the root cause section need to be?

Detailed enough to drive a specific corrective action. If you can't name a concrete fix from reading your root cause statement, it's not specific enough. 'Inadequate training' is vague. 'No written procedure existed for overhead shelf retrieval; employees were not trained on the step ladder weight limit of 250 lbs' is specific and points straight at what needs to change.

Does OSHA have access to my internal incident reports?

OSHA does not routinely have access to your internal incident reports. They do have the right to inspect your OSHA 300 log, 300A, and 301 forms during an investigation or inspection. If OSHA runs an on-site inspection after a serious incident, they may request your internal report as part of that investigation. It's not legally protected the way attorney-client communications are.

What happens if I don't complete an incident report?

OSHA can cite you for recordkeeping violations under 29 CFR 1904. Penalties for serious recordkeeping violations can reach $16,131 per violation as of 2024, and willful or repeat violations run higher. Beyond OSHA, failing to document incidents hurts you in workers' comp disputes, creates liability exposure in civil litigation, and stops you from spotting patterns that lead to future injuries.

Can I use a digital app to complete incident reports?

Yes. OSHA accepts electronic records. Digital incident report apps have real advantages: they time-stamp automatically, allow photo attachments, can't be lost, and stay searchable. Make sure your system works without reliable internet if your facility has coverage gaps, and make sure every supervisor knows how to use it before an incident happens. The best form is the one your team will actually complete.

Do small businesses with fewer than 10 employees need to complete incident reports?

Small businesses with 10 or fewer employees are partially exempt from OSHA 300 log requirements under 29 CFR 1904.1, meaning they don't have to keep the running OSHA 300 log. But they still must report fatalities, hospitalizations, amputations, and eye losses directly to OSHA, and they're still bound by OSHA safety standards. A good internal incident report is worth doing regardless of size.

Should the incident report include the employee's medical diagnosis?

Be careful here. Putting detailed medical information in a general incident report creates privacy concerns, especially in healthcare settings covered by HIPAA. Best practice is to describe the nature of the injury as observed (laceration to left hand, burn on forearm) in the main report and keep formal medical records, physician notes, and diagnoses in a separate, access-controlled medical file under 29 CFR 1910.1020 if that standard applies to your workplace.

What is the difference between a recordable incident and a reportable incident under OSHA?

A recordable incident goes on your OSHA 300 log: any work-related injury or illness resulting in days away from work, restricted work, medical treatment beyond first aid, loss of consciousness, or diagnosis of a significant condition. A reportable incident requires direct notification to OSHA: fatalities within 8 hours, and in-patient hospitalizations, amputations, or eye losses within 24 hours under 29 CFR 1904.39.

Sources

1. OSHA, Recordkeeping Rule Overview (29 CFR 1904): Employers with 11 or more employees must record work-related injuries and illnesses on OSHA Forms 300, 300A, and 301 within 7 calendar days; 300A must be posted February 1 through April 30.
2. OSHA Form 301, Injury and Illness Incident Report: OSHA Form 301 collects details on who was injured, what they were doing, how the injury occurred, and what object or substance was involved.
3. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses (2022): Overexertion and bodily reaction accounts for approximately 35% of cases involving days away from work.
4. OSHA, Reporting a Fatality or Severe Injury (29 CFR 1904.39): Employers must report work-related fatalities within 8 hours and in-patient hospitalizations, amputations, or eye losses within 24 hours to OSHA.
5. OSHA, Powered Industrial Trucks Safety (Forklift Facts): Forklifts cause approximately 85 fatal accidents and 34,900 serious injuries annually in the United States.
6. OSHA, Injury Tracking Application (ITA) and Electronic Submission Requirements (29 CFR 1904.41): Certain employers are required to electronically submit 300A summary data and in some cases 300 log and 301 data to OSHA's Injury Tracking Application.
7. OSHA, Access to Injury and Illness Records (29 CFR 1904.35): Employees and their representatives have the right to access the OSHA 300 log and 301 forms under 29 CFR 1904.35.
8. Bureau of Labor Statistics, National Census of Fatal Occupational Injuries in 2022: Falls accounted for 395 of 1,069 construction worker fatalities in 2022, making them the leading cause of death in the sector.
9. OSHA, Hazard Communication Standard (29 CFR 1910.1200): OSHA's Hazard Communication Standard requires employers to maintain Safety Data Sheets for hazardous chemicals and ensure employees are trained on their contents.
10. OSHA, Recording Criteria for Needlestick and Sharps Injuries (29 CFR 1904.8): Needlestick and sharps injuries must be recorded separately from other injuries on the OSHA 300 log under 29 CFR 1904.8.
11. OSHA, Control of Hazardous Energy (Lockout/Tagout) (29 CFR 1910.147): 29 CFR 1910.147 requires written energy control procedures and employee training for controlling hazardous energy during equipment servicing.
12. OSHA, Access to Employee Exposure and Medical Records (29 CFR 1910.1020): Under 29 CFR 1910.1020, employee medical and exposure records must be retained for the duration of employment plus 30 years.
13. OSHA, Recordkeeping and Reporting Occupational Injuries and Illnesses (29 CFR 1904.1): Employers with 10 or fewer employees are partially exempt from maintaining OSHA 300 log records under 29 CFR 1904.1, but still must report severe injuries directly to OSHA.
14. OSHA, Retention and Updating of Old Forms (29 CFR 1904.33): OSHA Forms 300, 300A, and 301 must be retained for 5 years following the end of the calendar year they cover.