How to make an incident report: a step-by-step guide

Last updated 2026-07-09

What is an incident report and why does it matter?

An incident report is a written record of any unplanned workplace event that caused, or could have caused, injury, illness, or property damage. That covers the obvious stuff like a slip and fall or a machine crush injury. It also covers near-misses: the forklift that almost clipped a pedestrian, the chemical that splashed but missed someone's eyes. OSHA doesn't require near-miss reports in most industries. Experienced safety people write them anyway, because a near-miss is a free warning.

OSHA requires covered employers to record work-related injuries and illnesses that hit specific severity thresholds on Form 300 (the Log), Form 300-A (the Summary), and Form 301 (the Incident Report) ^[1]. Those forms are separate from your internal incident report, but your internal report feeds them. Write a weak internal report and your OSHA forms end up thin. Thin forms can turn into a citation.

Compliance is only half the point. The real reason to write a thorough report is prevention. The Bureau of Labor Statistics counted about 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023 ^[2]. Most had a preventable root cause. A good report forces you to find it.

Who is required to complete an incident report under OSHA rules?

OSHA's recordkeeping standard at 29 CFR 1904 applies to most private-sector employers with 11 or more employees ^[1]. Employers with 10 or fewer employees, and employers in certain low-hazard industries like retail, finance, and insurance, are partially or fully exempt from routine recordkeeping. They still have to report severe injuries (hospitalizations, amputations, loss of an eye) to OSHA directly ^[1].

Exempt from OSHA recordkeeping doesn't mean off the hook. Your workers' comp carrier almost certainly wants a written incident report. And if a case ends up in court, judges read the absence of any documentation as its own kind of evidence. So the honest answer is short: every employer should complete an internal incident report for every significant event, exemption or not.

The person filling it out is usually a supervisor, HR manager, or safety officer. The injured worker should add information too, and many companies use a separate employee statement for that. What matters is that someone with direct knowledge and authority writes it down promptly.

What information must be included in an incident report?

A complete incident report covers seven core areas. Skip one and you'll be reconstructing the event from memory weeks later, which is never accurate.

1. Basic identifying information. Employer name, establishment address, date and time of the incident, and the name of the person completing the report.

2. Employee information. Name, job title, department, date of hire, and shift. OSHA Form 301 also asks for home address and date of birth, though you can keep those fields in a restricted-access file if your HR policies require it ^[1].

3. Incident description. A plain, factual narrative of what happened. Not what you think caused it. What happened. "Employee was descending the north staircase carrying a box and slipped on step three. She fell to the landing below." Short, specific, past tense.

4. Injury or illness details. Part of the body affected, nature of the injury (laceration, sprain, burn, and so on), and the object or substance that caused it. Match your classification to the injury/illness types on OSHA Form 300.

5. Medical treatment. Whether the employee got treated on-site, sent to urgent care or the ER, or transported by ambulance. Record the facility name and treating provider if you know them. OSHA's recording threshold turns on whether the treatment went beyond first aid ^[1].

6. Witness information. Names and contact information for anyone who saw the event or reached the scene right after.

7. Root cause and corrective actions. This is the section most small employers rush or leave vague. "Employee wasn't paying attention" is not a root cause. It's a symptom. The root cause is the condition or system failure that made the incident possible: no non-slip tread on the stairs, no policy requiring both hands free when descending, no inspection checklist that would have caught the worn treads. Corrective actions name who does what by when.

OSHA Form 301 mirrors most of these fields, so build your internal form around Form 301 and you fill everything out once ^[1].

What are the OSHA deadlines for recording an incident?

OSHA gives covered employers seven calendar days from the day they learn about a recordable work-related injury or illness to enter it on Form 300 ^[1]. The clock starts when management or a supervisor learns of the incident, not when the employee reports it to HR. If a worker tells their foreman on Monday and the foreman tells HR on Thursday, the clock started Monday.

Severe injuries run on a much tighter timer. If an employee dies from a work-related incident, you must report it to OSHA within eight hours ^[1]. For in-patient hospitalizations, amputations, or loss of an eye, you have 24 hours ^[1]. Those reports go to OSHA directly, by phone to the nearest Area Office or online at osha.gov, and they're separate from your recordkeeping obligation.

Your internal incident report should be done the same day whenever you can manage it. Wait even 24 hours and memories blur, spilled material gets mopped up, and witnesses scatter to other shifts. The seven-day window is a recording deadline. It is not permission to wait a week before you start writing.

How to write the incident description section correctly

The narrative description is where most reports fall apart. People write too little ("Employee fell") or too much guesswork ("Employee was probably rushing because the shift was behind").

Write what you know as fact. Use past tense. Walk the sequence: what was the employee doing, where were they, what surface or equipment was involved, what happened physically, what happened next. Include environmental conditions if they matter: wet floor, low light, temperature extremes, noise loud enough to mask a warning shout. Describe the path of the injury, meaning how the body part came into contact with the hazard.

Drop the blame language. "Employee failed to" and "employee neglected to" are judgment calls that don't belong in a description. Observations go in the narrative. Conclusions go in the root cause section, labeled as analysis.

Measurements help. "Three feet of clear aisle space" beats "limited space." "Step three of the north staircase" beats "the stairs." Got photos? Reference them in the narrative ("see Photo 1, attached") and actually attach them.

One more thing. Write in plain language. Workers' comp adjusters, OSHA compliance officers, lawyers, and supervisors who never saw the event all read these. If your report only makes sense to the machinist in cell four, it isn't doing its job.

How do you determine whether an injury is OSHA recordable?

This trips up small employers constantly. Not every workplace injury belongs on Form 300. OSHA's recordkeeping rule at 29 CFR 1904.7 defines a recordable case as any work-related injury or illness that results in days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, a significant injury or illness diagnosed by a healthcare professional, or death ^[10].

First aid is defined in the standard, and the definition does the heavy lifting. It includes non-prescription medications at nonprescription strength, cleaning wounds, applying bandages, hot or cold therapy, and a single visit to a healthcare professional for observation. Treatment past that list is recordable ^[10].

Here's a simple decision table:

Event or Treatment	Recordable?
Employee cleans and bandages minor cut themselves	No
Nurse applies bandage, employee returns to full duty	No
Doctor prescribes antibiotics for an infected cut	Yes
Employee takes one OTC ibuprofen and finishes shift	No
Doctor recommends light duty for three days	Yes
Employee loses consciousness, even briefly	Yes
Fracture confirmed by X-ray	Yes
ER visit, treated and released with no restrictions	Depends on treatment received

When you're on the fence, record it. OSHA does not penalize over-recording. It penalizes failing to record ^[1].

For a closer look at what the agency's authority actually covers, see our guide on osha.

What does a root cause analysis look like in an incident report?

Root cause analysis sounds complicated. For most small-business incidents, it isn't. You ask "why" enough times to get past the symptom and reach the system failure underneath.

Say a worker cuts their hand on an unguarded blade.

• Why? The guard was missing.
• Why? It got removed for a cleaning task three days ago.
• Why? No procedure requires guards to be reinstalled before the machine goes back into service.
• Why? Nobody ever wrote a machine guarding procedure.

Root cause: no documented procedure for returning equipment to service after maintenance. Corrective action: write the procedure, train the operators, add a pre-use inspection checklist to the machine.

For messier incidents, a fault tree or a fishbone (Ishikawa) diagram works fine, but don't let the method crowd out the thinking. The question you're answering is one sentence long: what would we have needed to change, before this incident, to prevent it?

Record each corrective action with three pieces of information: what gets done, who owns it, and the target completion date. Then follow up. An incident report full of corrective actions that never close out is worse than no report at all, because it documents that you knew about the hazard and left it there.

What is the difference between an incident report and an OSHA 300 log?

They're related but distinct. Your internal incident report is your own document. It can be as detailed as you want, hold photos, carry sensitive medical information, and follow your own format. It feeds OSHA's forms. It is not itself an OSHA form.

The OSHA 300 Log is a running annual record of every recordable work-related injury and illness at an establishment ^[1]. Each recordable case gets its own line. The 300-A Summary tallies the 300 Log for the year and must be posted in the workplace from February 1 through April 30 ^[3]. The OSHA 301 Incident Report is a one-page form covering the details of a single case, and you can substitute your own form as long as it captures the same information ^[1].

Covered employers with 250 or more employees, plus employers in certain high-hazard industries with 20 or more employees, also have to submit their Form 300A data electronically to OSHA through the Injury Tracking Application (ITA) ^[5]. That deadline is March 2 of the year after the calendar year covered.

The 300, 300-A, and 301 are not public by default, but OSHA compliance officers can request them during an inspection. Employees and their representatives have the right to access the 300 Log under 29 CFR 1904.35 ^[1].

How should you handle medical information in an incident report?

Medical privacy is a real tension in incident reporting. OSHA's rules require you to capture the nature of the injury and the body part affected. They do not require you to document a worker's full medical history, diagnosis codes, or prescription details beyond what you need to decide recordability.

On the OSHA 300 Log, you must keep the identities of workers in privacy-concern cases confidential. Under 29 CFR 1904.29(b)(7), those cases include sexual assaults, mental illnesses, HIV infections, hepatitis, tuberculosis, needle-stick injuries involving blood-borne pathogens, and other sensitive diagnoses ^[1]. For those, leave the name column blank on the 300 Log and keep a separate confidential list instead.

Your internal incident report may hold more medical detail, especially when a workers' comp claim is attached. Store that document in a separate, restricted file, not the employee's general personnel folder. The ADA requires medical records to stay confidential and separate from personnel records, and that rule holds even in small businesses ^[8].

The practical rule: record what the safety investigation needs, handle it the way you'd want your own medical information handled, and store it accordingly.

What are the most common mistakes employers make on incident reports?

The same mistakes show up over and over in safety practice and OSHA audit reviews.

Waiting too long. Physical evidence disappears. Witnesses forget, or their stories quietly drift toward each other. An injury that looked minor on day one needs surgery on day five, and now you're piecing the event together from memory. Write it the same day.

Vague descriptions. "Employee injured back while lifting" tells you nothing. Where exactly? Lifting what? What weight? What posture? What surface were they standing on? Detail drives prevention, and it defends your classification if OSHA asks.

Blaming the worker instead of the system. Human error is almost always the last link in a chain of system failures. Stopping at "employee wasn't careful" protects nobody, because the next person in that same system makes the same error.

Skipping near-misses. OSHA doesn't require near-miss recording in most industries. Your own data does. If a specific machine has generated five near-misses in a year and then someone gets hurt on it, that history is the whole story.

Not closing out corrective actions. The report isn't done when it's written. It's done when the hazard is fixed and the fix is verified.

Inconsistent classification. Deciding whether a case is recordable on a gut feeling, or on whatever the workers' comp carrier says, instead of applying the actual 29 CFR 1904.7 criteria leads to under-recording. That's an OSHA violation ^[1].

If your company doesn't have a formal written safety program with an incident reporting procedure baked in, the SafetyFolio program generator can build one in about 15 minutes, customized to your industry and headcount.

How long do you need to keep incident reports?

OSHA requires covered employers to keep their 300, 300-A, and 301 forms for five years after the end of the calendar year they cover ^[1]. That five-year window holds even after the employee leaves.

Internal incident reports are messier. Workers' comp statutes vary by state, and some have claim windows that run several years past the date of injury. If a worker develops an occupational illness with a long latency period, like asbestos disease or noise-induced hearing loss, a claim can land years after the exposure. Most employment attorneys tell you to keep incident reports for the duration of employment plus 10 years. For incidents involving minors, keep them until the minor turns 21 plus the applicable statute of limitations, which can stretch further still.

Digital storage is fine. OSHA does not require paper. Just make sure your system is backed up, access-controlled, and able to actually produce the documents when an OSHA inspector or an attorney asks.

What does an incident report template look like?

You don't need anything fancy. You need a consistent form that captures the same information every time, from any supervisor, for any type of incident. Here's a field-by-field outline you can turn into a Word document, Google Form, or paper form today.

Section 1: Incident basics

• Date and time of incident
• Date and time report completed
• Location (building, floor, specific area)
• Type of incident (injury, illness, near-miss, property damage, security)

Section 2: Person involved

• Name, job title, department
• Date of hire, shift, employment type (employee, contractor, visitor)
• Supervisor name

Section 3: Incident description

• Narrative of what happened (plain language, factual, sequential)
• Environmental conditions at time of incident
• Equipment, materials, or substances involved
• Photos attached? (Y/N, list filenames)

Section 4: Injury or illness detail (if applicable)

• Part of body affected
• Nature of injury or illness
• Medical treatment provided (first aid only / urgent care / ER / hospitalized)
• Days away from work (if known at time of report)

Section 5: Witnesses

• Name, job title, contact information for each witness

Section 6: Root cause and contributing factors

• Immediate cause (what directly caused the harm)
• Root cause (what system, condition, or practice let the immediate cause exist)
• Contributing factors

Section 7: Corrective actions

• Action, responsible person, target date, completion date (one row per action)

Section 8: Signatures

• Completing supervisor, date
• Safety officer review, date
• HR review (if recordable), date

OSHA's own Form 301 is publicly available and makes a serviceable starting template if you want something pre-formatted ^[3]. Download it from osha.gov and add your root cause and corrective action sections, which Form 301 doesn't have.

How does incident reporting connect to your overall safety program?

Incident reporting isn't a standalone chore. It's one piece of a larger system. A report that sits in a file drawer and never gets read does almost nothing for safety.

The data from your reports should feed a monthly or quarterly safety review. Hunt for patterns: same department, same time of day, same equipment, same injury type. BLS data shows certain industries, especially warehousing, construction, and healthcare, carry disproportionately high rates of sprains and strains from overexertion ^[2]. That pattern persists because those industries haven't killed the root causes. Your own incident log is your company-specific version of that data.

Incident reports also tie directly into your hazard communication obligations when chemicals are involved, and into your lockout tagout program when a machine hurts someone. A run of similar incidents is a signal to check whether your osha training is reaching the right people in the right way.

To see the wider structure your incident reporting fits into, the osha 30 course covers hazard identification and recordkeeping in some depth, and the osha 30 training options page explains where to get it.

A safety program with a clear incident reporting procedure, assigned responsibilities, and a real review process is also a signal to OSHA during inspections. It won't prevent citations. It shows good faith and can pull down penalty amounts under OSHA's penalty calculation framework.

Frequently asked questions

Does OSHA require employers to have a written incident report form?

OSHA requires covered employers to use Forms 300, 300-A, and 301 (or an equivalent) for recordable cases under 29 CFR 1904. There is no separate OSHA rule mandating a specific internal incident report form. You do have to capture enough information to complete OSHA's required forms accurately, and a consistent internal form is the most reliable way to do that.

What is the difference between a near-miss report and an incident report?

A near-miss is an unplanned event that caused no injury or illness but easily could have. An incident report usually refers to an event where harm actually happened. OSHA generally doesn't require near-miss reporting in private-sector industries, but safety pros recommend documenting them because they expose hazards before someone gets hurt. The form structure is nearly identical; you just note that no injury resulted.

Can an employee refuse to provide information for an incident report?

Most company policies can require employees to participate in incident investigations as a condition of employment. OSHA's anti-retaliation rules at 29 CFR 1904.35 bar employers from discouraging workers from reporting injuries, but they don't stop you from requiring cooperation with an investigation. The catch is that the process can't feel punitive, because that discourages the honest reporting you actually need.

How do I report a serious injury to OSHA?

Report any work-related fatality to OSHA within eight hours. Report in-patient hospitalizations, amputations, and loss of an eye within 24 hours. You can call 1-800-321-OSHA, call your nearest OSHA Area Office directly, or use the online reporting form at osha.gov. These reports are in addition to your 300 Log entry, not a replacement for it.

What happens if an employer fails to record a workplace injury on OSHA Form 300?

Failing to record or report a recordable injury is an OSHA violation under 29 CFR 1904. OSHA can issue a citation with penalties up to $16,550 per serious violation (the cap adjusts annually for inflation). Willful violations can reach $165,514 per violation. OSHA can inspect 300 Logs going back five years, so a pattern of under-recording compounds fast ^[6].

Should I include contractor injuries in my incident report?

Under OSHA's recordkeeping rules, you record injuries to workers you supervise day-to-day, regardless of who signs their paycheck. If your site supervisor directs a contractor's employees, injuries to those workers generally go on your 300 Log rather than the contractor's. The test is supervision and control, not the formal employment relationship.

Is an incident report the same as a workers' comp first report of injury?

No, though they cover similar ground. A first report of injury (FROI) is a state-mandated form filed with your workers' comp carrier and often the state workers' comp board. Your internal incident report is your own document. An OSHA 301 is a federal recordkeeping form. For a recordable injury with a workers' comp claim you'll usually need all three, and the information should match across them.

How detailed should the description be for a minor injury?

Even minor injuries deserve a clear description. At the time of reporting, you don't know whether the injury stays minor. A trivial-looking cut can get infected and require treatment that makes it OSHA-recordable days later. Write the full narrative while the facts are fresh. A paragraph usually covers a genuinely minor event, and more detail is always better than less.

Who should review incident reports before they are finalized?

At minimum, the completing supervisor and a safety officer (or whoever owns safety at your company) should review every report. For recordable cases, HR review is standard because the 300 Log classification carries legal and insurance weight. For serious incidents, add management review. The point is a second set of eyes on both the facts and the recordability call before the case closes.

Can incident reports be stored electronically?

Yes. OSHA accepts electronic records and doesn't require paper originals for Form 300, 300-A, or 301 under 29 CFR 1904. Your internal reports can live digitally too. Make sure the system is backed up, access-controlled, and can produce records on demand. Some employers use safety management software, others use a shared drive with a locked folder. Either works as long as the documents are retrievable.

What industries have the highest workplace injury rates?

BLS data puts private-sector industries with the highest total recordable case rates in logging, roofing, fishing, and commercial trucking, all above 3.0 cases per 100 full-time workers. Within broader sectors, construction, warehousing, and healthcare generate high absolute volumes of injuries. Knowing your industry benchmark tells you whether your own incident rate sits above or below average ^[9].

Do I have to give employees a copy of their own incident report?

Under 29 CFR 1904.35, employees (or their authorized representatives) have the right to access the OSHA 300 Log for their current establishment. For Form 301, employees can request copies of entries relating to their own injuries. OSHA doesn't mandate handing over your internal incident report, but your own policy or a union contract might, and withholding it from an employee with a legitimate need can create problems.

How is a vehicle accident on company time handled in an incident report?

A vehicle accident is work-related if the employee was in a company vehicle or conducting company business at the time. It runs through the same incident report process as any other workplace injury. If the crash caused an injury meeting the 1904.7 recording criteria, it's OSHA-recordable. Commuting to and from work in a personal vehicle is generally not work-related, even if the employee was thinking about work.

Sources

1. OSHA, Recording and Reporting Occupational Injuries and Illnesses (29 CFR 1904): Requirements for Forms 300, 300-A, 301; seven-day recording deadline; severe injury reporting timelines (8 hours for fatalities, 24 hours for hospitalizations/amputations/eye loss); first aid definition; privacy case rules; employee access rights; electronic submission requirements under ITA
2. U.S. Bureau of Labor Statistics, Employer-Reported Workplace Injuries and Illnesses (2023): Approximately 2.6 million nonfatal workplace injuries and illnesses in private industry in 2023; industry-level incidence rate data
3. OSHA, Injury and Illness Recordkeeping Forms 300, 300A, 301: OSHA Form 301 field structure; Form 300-A posting requirement February 1 through April 30
4. OSHA, Injury Tracking Application (ITA) Electronic Submission: Employers with 250 or more employees and those in high-hazard industries with 20 or more employees must submit 300A data electronically by March 2
5. OSHA, Penalties: Serious violation penalty cap of $16,550 per violation; willful violation cap of $165,514 per violation (adjusted annually for inflation)
6. U.S. Equal Employment Opportunity Commission, ADA and Medical Records Confidentiality: ADA requires medical records be kept confidential and separate from general personnel files
7. BLS, Injuries, Illnesses, and Fatalities: Industry Injury Rates: Industries with highest recordable case rates including logging, roofing, fishing, and commercial trucking above 3.0 cases per 100 full-time workers
8. OSHA, Recordkeeping Rule: Recording Criteria (29 CFR 1904.7): Definition of recordable case including days away from work, restricted work, medical treatment beyond first aid, loss of consciousness; first aid list