Incident reporting form: what to include and how OSHA requires it

Last updated 2026-07-09

What is an incident reporting form and why does every workplace need one?

An incident reporting form is a structured document your employees fill out right after a workplace injury, illness, near-miss, or property-damage event. It captures the facts while memory is fresh: who was involved, what they were doing, what went wrong, and what happened next.

Think of it as the first link in a chain. The form feeds your OSHA 300 Log, starts your workers' comp claim, and gives you the raw data to figure out whether your controls actually work. Skip the form and you're left with verbal accounts that drift over time and supervisors who rebuild events from memory days later.

Near-misses matter here too, and almost nobody reports them. The National Safety Council frames near-miss reporting as an early warning system: catch the pattern before it puts someone in the hospital ^[1]. A good form catches those events before they turn into injuries.

The form itself is not the OSHA 300 Log or the OSHA 301 Incident Report. Those are the official recordkeeping documents. Your internal form is the thing that gathers facts fast enough to fill those records accurately and on time.

What does OSHA actually require you to record?

OSHA's recordkeeping rule, 29 CFR 1904, covers most employers with 11 or more employees in industries that aren't on the partially-exempt list ^[2]. If you qualify, you have to record any work-related injury or illness that results in days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a healthcare professional.

The regulation defines "medical treatment beyond first aid" with care. First aid means things like a non-prescription medication at non-prescription strength, cleaning and bandaging a wound, or a butterfly bandage. Go past that (a prescription, physical therapy, stitches) and the case becomes recordable.

OSHA gives you three forms for this ^[2]:

Form	Name	What It Does
OSHA 300	Log of Work-Related Injuries and Illnesses	Running annual log, one line per case
OSHA 300A	Summary of Work-Related Injuries and Illnesses	Posted Feb 1 to Apr 30 each year
OSHA 301	Injury and Illness Incident Report	Full narrative for each recorded case

Your internal form doesn't replace the 301, but if it collects the same information it can stand in for it. Under 29 CFR 1904.29(b)(4), you may use "an equivalent form" as long as it contains the same information ^[2].

The 300 Log has to be updated within 7 calendar days of learning about a recordable incident. That 7-day clock is exactly why your internal form needs to happen the same day, not at the end of the week.

What fields should an incident reporting form include?

You can build a form that runs two pages or ten, but the core breaks into four buckets. Leave one out and you'll either fail an OSHA audit or lose a workers' comp dispute.

About the person involved Full name, job title, department, date of hire, and whether they're a regular employee, temp, or contractor. Contractors sometimes land on your log and sometimes don't, depending on who directs their daily work ^[2].

About the incident itself Date, time, exact location (not "warehouse" but "north end of Warehouse B near dock 3"), task being performed, equipment or materials involved, and a narrative of what happened in sequence. The narrative is where people get lazy and where investigators find nothing useful. Train people to answer three things: what was the person doing, what changed or failed, what was the immediate outcome.

About the injury or illness Body part affected, nature of injury (laceration, strain, chemical burn, and so on), and medical treatment received or sought. If the person refused medical attention, write that down.

About root cause and corrective action At minimum, a field for the supervisor's read on the immediate cause and a field for what corrective action got taken or assigned, with a responsible person and a due date. Most forms skip this section. It's also the section that separates a form that prevents the next injury from one that just builds a paper trail.

Optional but genuinely useful: a witness section with contact info, a photo attachment field (most forms now live in apps where you can attach images), and a checkbox for whether the event counts as a "severe injury" that triggers immediate OSHA notification.

Severe injuries (an in-patient hospitalization, an amputation, or loss of an eye) must be reported to OSHA within 24 hours. Fatalities go to OSHA within 8 hours ^[2]. Your form should flag these loudly.

How is an internal incident report different from the OSHA 301 form?

The OSHA 301 is a specific form with fields covering the employee, the physician or healthcare professional, the case details, and the description of the injury ^[2]. It's the official record for each recordable case, and you keep it for 5 years past the end of the calendar year it covers.

Your internal form is yours to design. It should collect everything the 301 asks for, plus the root cause and corrective action detail the 301 has no room for. Many employers link the two: they fill out the internal form at the time of the event, then move the relevant data to the 301 inside the 7-day window.

The 301 or its equivalent has to be handed to current and former employees, or their representatives, who ask for their own records within 4 business hours of the request ^[2]. Your internal form may hold more sensitive material (supervisor opinions, witness statements) that you don't want disclosed the same way, which is one more reason to keep the two as separate documents.

Using a workers' comp "first report of injury" form instead of the 301? Check whether your state's form asks for equivalent information. Some do. Many don't. Don't assume the comp form satisfies OSHA.

For more on what OSHA recordkeeping requires from a compliance standpoint, see our guide to incident report documentation.

When does a workplace incident have to be reported to OSHA directly?

Most recordable incidents live on your internal log and go no further. You don't call OSHA about every sprained wrist. But three categories force you to pick up the phone or file online with OSHA directly ^[2]:

1. A work-related fatality: report within 8 hours of learning about it. 2. An in-patient hospitalization of one or more employees: report within 24 hours. 3. An amputation or loss of an eye: report within 24 hours.

You report by calling the nearest OSHA Area Office, calling OSHA's 24-hour hotline at 1-800-321-OSHA (6742), or using OSHA's online reporting portal at osha.gov ^[3].

State-plan states run their own OSHA programs and can add different requirements. As of 2025, 22 states and 2 territories operate OSHA-approved state plans that cover private-sector employers ^[4]. If you're in California, Michigan, Washington, or another state-plan state, check with your state agency, because reporting deadlines and thresholds sometimes shift.

The penalty for missing a severe-injury report on time runs up to $16,131 per violation, and that number adjusts every year ^[3]. Missing the 8-hour or 24-hour window is a separate violation from failing to record the incident on the 300 Log.

How do you write a root cause section that actually helps prevent the next incident?

This is where most small business forms fall apart. A root cause section that reads "employee not paying attention" is not analysis. It's blame. OSHA doesn't require root cause analysis on the 301, but it's the entire point of having an internal form.

The "5 Whys" method works fine at the small-business level. You ask "why" five times in a row. Employee slipped on a wet floor. Why was the floor wet? A pipe had been dripping. Why wasn't it fixed? Nobody reported it. Why? There was no system for reporting maintenance issues. That last answer is actionable. "Employee not paying attention" is not.

The form should have a field for each of these:

• Immediate cause (the direct physical event)
• Contributing factors (conditions or systems that let it happen)
• Root cause (the management system gap)
• Corrective action assigned, with a name and a deadline

If your form has no deadline field for corrective actions, add one now. Corrective actions without deadlines don't happen. That's not opinion. It's what shows up over and over when safety managers audit their own corrective action logs.

For training-related incidents, check whether your OSHA training records show the injured worker had the relevant training. If they didn't, that's a systemic gap, not a personal failing.

OSHA's general duty clause, Section 5(a)(1) of the OSH Act, requires employers to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm" ^[5]. Documenting that you found a hazard and fixed it is your defense against a general duty citation. The corrective action section on your form is what creates that record.

How long do you have to keep incident reporting records?

OSHA makes you keep the 300 Log, 300A Summary, and 301 Incident Reports (or equivalents) for 5 years after the end of the calendar year they cover ^[2]. So records from calendar year 2024 stay on file through December 31, 2029.

During that 5-year stretch, OSHA can ask to see your records during an inspection. Under 29 CFR 1904.40, you have to hand them over within 4 business hours of a request ^[2].

Your internal forms (the ones with root cause notes and supervisor opinions) aren't technically required to be kept under OSHA rule. Keep them the full 5 years anyway. Workers' comp disputes and litigation surface years after an incident, and your internal form is often the most detailed contemporaneous account of what happened.

One practical note. If you switch from paper forms to software mid-year, keep the old paper records somewhere you can find them. OSHA inspectors have written violations simply because the employer couldn't produce records that were sitting in a filing cabinet the whole time.

What industries are exempt from OSHA recordkeeping?

Two groups of employers get a partial exemption from OSHA's injury and illness recordkeeping under 29 CFR 1904 Subpart B ^[2].

Small employers: Businesses with 10 or fewer employees at all times during the previous calendar year are exempt from routine recordkeeping. They still have to report severe injuries and fatalities to OSHA.

Low-hazard industries: Employers in industries OSHA classifies as low-hazard are exempt regardless of size. The list covers retail trade, finance, insurance, real estate, and most service industries. OSHA publishes the full exempt-industry list by NAICS code ^[2].

Exempt from routine recordkeeping does not mean exempt from OSHA standards. You still have to comply with every applicable safety standard. You just don't maintain the 300 Log. And you still want an internal incident reporting process, because you still need the data to fix hazards, back workers' comp claims, and defend against litigation.

Employer Type	300 Log Required?	Severe Injury Reporting?
1-10 employees, any industry	No	Yes
11+ employees, high-hazard industry	Yes	Yes
11+ employees, low-hazard industry (per NAICS list)	No	Yes
Any employer, any size	N/A	Fatality within 8 hrs; hospitalization, amputation, eye loss within 24 hrs

What's a near-miss and should it go on your incident form?

A near-miss is any unplanned event that didn't cause injury or illness but easily could have. A forklift backing toward a pedestrian who steps aside in time. A chemical container that tips but doesn't open. A scaffold component that cracks but doesn't fail.

Near-misses aren't recordable on the OSHA 300 Log, because no injury happened. But they belong on your internal incident reporting system. OSHA's own guidance treats near-miss reporting as a proactive safety measure ^[5]. Near-miss tracking exists precisely because catching the pattern early is cheaper than treating the injury later.

The cultural problem is real. Employees don't report near-misses because they fear blame, because they figure nothing will come of the report, or because they don't recognize the event as anything worth mentioning. A near-miss form that reads like a punishment produces zero reports.

Make your near-miss form shorter and simpler than your injury form. Five fields, tops: what happened, where, when, what could have happened, suggested fix. Some companies use a physical drop box with anonymous slips. Others put a QR code on the shop floor that opens a one-page phone form. The method matters less than the culture. People have to believe reporting is safe and that it does something.

For how safety programs handle near-miss reporting inside a broader hazard system, see our hazard communication article.

How do you make an incident reporting form that employees will actually use?

A form nobody fills out is worse than no form. It builds a false sense of compliance while your hazards stay undocumented.

Employees skip incident forms for three reasons: they don't know they're supposed to, the form is too complicated, or they fear consequences. Each one has a fix.

They don't know: Your written safety program should say plainly that every employee is required to report injuries, illnesses, and near-misses, and should name the reporting process. Show people the form location (physical or digital) during new-hire orientation. Bring it up in toolbox talks now and then. Your OSHA training records should show employees got this information.

The form is too complicated: If your form runs longer than one page front and back, it's too long for the first report. Split it into two stages. The employee fills out page one right away (what happened, when, where, injury description). The supervisor completes the root cause section within 24 hours. That's a better workflow anyway, because the supervisor investigates while the employee gets care.

They fear consequences: A written policy that says reporting is not the same as fault matters. What happens after someone reports matters more. If the first thing a supervisor does after an injury report is ask whether the employee broke a rule, the message is obvious. If the first move is to get the person help and then fix the hazard, that's a different message entirely.

Plenty of small businesses are switching to app-based reporting because tapping a phone form beats hunting for a paper one. If you go digital, make sure the data syncs to a record system instead of living on one person's phone.

Can you build a compliant written safety program that includes incident reporting?

Yes, and you should. OSHA has no single universal rule forcing every employer to keep a written safety program, but dozens of specific standards require written programs to comply: 29 CFR 1910.119 (Process Safety Management), 1910.147 (lockout/tagout), 1910.1030 (Bloodborne Pathogens), and others ^[6]. Even where no standard mandates one, having a written program is strong evidence of good faith during an inspection.

A written safety program that covers incident reporting should include:

• A clear policy that all incidents and near-misses must be reported
• The step-by-step reporting procedure (who fills out what, by when)
• How form data flows to the OSHA 300 Log
• Who owns root cause investigation
• How corrective actions get tracked to completion
• The anti-retaliation statement

OSHA's anti-retaliation provisions under Section 11(c) of the OSH Act and the more recent 29 CFR 1904.35 bar employers from discouraging injury reporting through post-incident drug testing policies, incentive programs that reward low injury counts, or direct retaliation ^[7]. Your written program has to address this head-on.

Building a written program from scratch? SafetyFolio's safety program generator walks through the incident reporting section and the other required elements in about 15 minutes, which beats formatting a blank Word document.

For lockout tagout and other high-hazard work, your incident reporting procedure should cross-reference the specific standard's requirements.

What are the OSHA penalty ranges for recordkeeping violations?

Recordkeeping violations fall under several categories, and the penalty structure has climbed steadily since OSHA started annual inflation adjustments in 2016 under the Federal Civil Penalties Inflation Adjustment Act ^[3].

As of 2025, the ranges look like this ^[3]:

Violation Type	Maximum Penalty
Serious violation (including recordkeeping failures)	$16,131 per violation
Other-than-serious	$16,131 per violation
Willful or repeated	$161,323 per violation
Failure to report severe injury (fatality, hospitalization, amputation)	Up to $16,131

OSHA can cite each missing 300 Log entry as its own violation, and it can cite failure to post the 300A as another. Across a multi-year inspection, the math piles up fast.

The BLS Survey of Occupational Injuries and Illnesses estimated U.S. private-sector employers recorded about 2.6 million nonfatal workplace injuries and illnesses in 2023 ^[8]. That's the denominator OSHA enforcement runs against. OSHA conducted about 31,820 inspections in fiscal year 2023 ^[9].

Small employers often assume OSHA doesn't bother chasing recordkeeping at small shops. Wrong. The most common trigger for a recordkeeping audit is a severe-injury report, because inspectors cross-reference your 300 Log the moment they walk in.

How should the incident reporting process work in practice, step by step?

Here's a realistic workflow for a small business with 20 employees. Scale it up or trim it down.

Step 1: Immediate (within minutes) Employee or witness secures the scene if it's a hazard to others. Employee reports to the supervisor verbally. If the injury needs medical attention, that comes first, before any form.

Step 2: Same day (within a few hours) Employee completes Part 1 of the form while memory is fresh: what happened, when, where, what body part, what treatment was sought. Supervisor gets notified and reviews.

Step 3: Within 24 hours Supervisor completes Part 2: root cause, contributing factors, corrective actions assigned. Supervisor decides whether this is a severe injury needing immediate OSHA notification. Those 8-hour and 24-hour clocks have already been running, so this can't be a fresh discovery at hour 24.

Step 4: Within 7 calendar days Safety coordinator or owner reviews the completed form and decides whether the case is OSHA-recordable. If yes, they update the 300 Log and complete the 301 (or confirm the internal form qualifies as equivalent). If no, they document the determination.

Step 5: Ongoing Corrective actions get tracked to completion. At the next safety meeting or toolbox talk, the crew discusses the incident (with personal identifying information stripped where appropriate). Patterns across the year get reviewed during the January 300A summary process.

This lines up with OSHA's own injury and illness recordkeeping guidance ^[2] and with how most experienced safety managers run the process.

Frequently asked questions

Is an incident reporting form the same as the OSHA 301?

No, but they overlap. The OSHA 301 is the official agency form for recording each case on your 300 Log. Your internal incident reporting form is a tool you design to capture facts immediately after an event. Under 29 CFR 1904.29(b)(4), you can use an equivalent form instead of the 301, as long as it collects the same information. Most safety managers use both: the internal form for immediate fact-gathering and root cause, the 301 for the official record.

What is the deadline for filling out an incident reporting form?

OSHA requires the 300 Log to be updated within 7 calendar days of learning about a recordable incident. So your internal form needs to happen the same day as the event, leaving you time to evaluate recordability and hit the 7-day window. For severe injuries (fatalities, hospitalizations, amputations, eye loss), the notification to OSHA is due within 8 or 24 hours, so same-day documentation isn't optional.

Do small businesses with fewer than 10 employees need to complete incident reporting forms?

Employers with 10 or fewer employees at all times during the prior calendar year are exempt from OSHA's routine 300 Log recordkeeping under 29 CFR 1904 Subpart B. They are not exempt from reporting severe injuries and fatalities to OSHA directly. And they still benefit from internal incident forms for workers' comp claims, hazard identification, and litigation defense. Being exempt from the 300 Log doesn't mean incidents stop happening.

What happens if an employee refuses to fill out an incident report?

Your written safety program should state clearly that completing the form is a work requirement. An employee refusing to report an injury they sustained is unusual, since they have every incentive to document it for workers' comp. More common is the unreported near-miss. OSHA's anti-retaliation rules under 29 CFR 1904.35 protect employees who report injuries, but the obligation to report still stands. Supervisors should complete the form if the employee is incapacitated or refuses.

Can I use a digital app instead of a paper incident reporting form?

Yes. OSHA has no requirement that records live on paper. Under 29 CFR 1904.33, records must be maintained and accessible, and digital systems qualify. The key points: records must be retrievable and printable within 4 business hours if OSHA asks, and they must be kept for 5 years. Any app should produce a PDF or equivalent that matches the 300 and 301 data requirements, and you should keep a backup in case the service shuts down.

Does OSHA require near-miss reporting on a form?

OSHA does not require employers to record near-misses on the 300 Log, because that log is for actual injuries and illnesses. But OSHA encourages near-miss tracking as a proactive safety measure. More practically, many OSHA standards require hazard identification and correction, which a near-miss reporting system supports. Your written safety program should set up a near-miss reporting process even if it's separate from your injury form.

What is a recordable incident under OSHA rules?

A work-related injury or illness is OSHA-recordable if it results in days away from work, restricted duty or job transfer, medical treatment beyond first aid, loss of consciousness, or a significant diagnosis by a healthcare professional. First aid cases (non-prescription medications, simple wound care, non-prescription eye patches) are not recordable. The definition is in 29 CFR 1904.7. The 7-day clock to update the 300 Log starts when you learn the case is recordable.

How long do you have to report a workplace fatality to OSHA?

Eight hours from when you learn about the work-related fatality. The clock starts when the employer (including any manager or supervisor) has knowledge of the death, not necessarily when it happened. You report by calling the nearest OSHA Area Office, OSHA's 24-hour hotline at 1-800-321-OSHA, or using the online portal. Failure to report within 8 hours is a separate violation from recordkeeping failures and can carry penalties up to $16,131.

What information should be in the narrative section of an incident form?

The narrative should answer three things: what task was the employee performing, what specific event or exposure caused the injury, and what was the immediate result. "Employee hurt back" is not a narrative. "Employee was lifting a 60-pound box from floor level without mechanical assist when they felt sudden pain in the lower back" is useful. The more specific the narrative, the more it helps root cause analysis, workers' comp processing, and the OSHA recordability call.

Do contractor injuries go on your OSHA 300 Log?

It depends on who controls the contractor's day-to-day work. Under 29 CFR 1904.31, you record injuries to employees on your payroll. For contractors, the rule is: if you supervise their day-to-day activities, the injury goes on your log. If the contractor's own company supervises them and just operates at your site, that employer records the injury. Temporary staffing agency workers placed at your site are usually recordable on your log if you direct their work.

What's the difference between an incident report and an accident report?

The terms get used interchangeably in most workplaces, but safety professionals often prefer "incident" because "accident" implies randomness and something nobody could prevent. "Incident" is neutral and covers injuries, near-misses, property damage, and dangerous events. OSHA uses "injury and illness" on its official forms rather than either term. For your form title, either works, though "incident report" has become the more standard phrase in safety management over the past two decades.

Can OSHA fine you for incomplete incident reporting forms?

OSHA can cite you for failing to record a case on the 300 Log, for recording inaccurate information, or for failing to complete the 301 (or equivalent). An incomplete internal form that leads to an inaccurate 300 Log entry creates exposure. Penalties for serious recordkeeping violations run up to $16,131 per violation as of 2025. OSHA can cite willful recordkeeping violations at up to $161,323, which has happened where employers knowingly underreported injuries.

How do you handle an incident form when the injury shows up days after the event?

This happens all the time with musculoskeletal injuries, cumulative trauma, and occupational illnesses. The 7-day clock for updating the 300 Log starts when you learn the case is work-related and recordable, not when the original exposure happened. Document the original event date and the date you learned of the diagnosis separately. OSHA's recordkeeping rule at 29 CFR 1904.7 addresses delayed-onset cases and asks you to use professional judgment about work-relatedness based on what you know.

Should the incident form ask about drug or alcohol use?

Tread carefully. OSHA's 2016 anti-retaliation rule under 29 CFR 1904.35 restricts post-incident drug testing that has no legitimate safety justification, because blanket testing after every reported injury discourages reporting. You can test when there's reasonable suspicion or when the incident type makes impairment a plausible cause. A policy that requires testing only when the incident could have been caused by impairment, applied consistently, is generally defensible. Blanket automatic testing after all reports is not.

Sources

1. National Safety Council, Workplace Safety: The National Safety Council promotes near-miss reporting as an early warning system to prevent serious injuries
2. OSHA, Recordkeeping Rule 29 CFR 1904 and OSHA Forms 300, 300A, 301: OSHA recordkeeping requirements, 7-day update deadline, 5-year retention, partial exemptions, and equivalent form provisions under 29 CFR 1904.29(b)(4)
3. OSHA, Penalties: Maximum penalty for serious violations including recordkeeping failures is $16,131 per violation as of 2025; willful or repeated violations up to $161,323
4. OSHA, State Plans: 22 states and 2 territories operate OSHA-approved state plans covering private-sector employers as of 2025
5. OSHA, OSH Act of 1970 General Duty Clause: Section 5(a)(1) requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm; OSHA encourages near-miss reporting as a proactive safety measure
6. OSHA, Regulations Standard Number 1910: 29 CFR 1910.147 (lockout/tagout), 1910.1030 (Bloodborne Pathogens), and other standards require written programs as part of compliance
7. Bureau of Labor Statistics, Survey of Occupational Injuries and Illnesses 2023: U.S. private-sector employers recorded approximately 2.6 million nonfatal workplace injuries and illnesses in 2023
8. OSHA, Enforcement: OSHA conducted approximately 31,820 inspections in fiscal year 2023