Incident reporting system: how to build one that actually works

Last updated 2026-07-09

What is an incident reporting system and why does it matter?

An incident reporting system is the set of procedures, forms, and follow-up steps your workplace uses whenever something goes wrong: an injury, an illness, a near-miss, or a dangerous condition that could have hurt someone. It answers four questions. What happened. Who was involved. Why it happened. What you're going to do so it doesn't happen again.

OSHA's injury and illness recordkeeping rules under 29 CFR 1904 are the legal backbone of any system in the U.S. ^[1] Most employers with 10 or more employees in non-exempt industries have to keep injury logs, complete incident summaries, and post annual totals. The legal minimum, though, is not a useful system on its own. Filling out a form after someone gets hurt prevents nothing.

The value is in what happens before the form. Employees need a way to report hazards and near-misses without fear of punishment. Supervisors need a checklist so investigations come out consistent. Management needs to read trends instead of reacting to one incident at a time. Build those pieces and the recordkeeping part takes care of itself.

The Bureau of Labor Statistics counted roughly 2.8 million nonfatal workplace injuries and illnesses among private employers in 2022. ^[2] That's the universe your system works against. Most of those events had warning signs somebody noticed and nobody reported.

What does OSHA actually require you to report and record?

Two separate obligations get confused all the time: reporting to OSHA and recording in your own logs. They overlap, but they aren't the same thing.

Reporting to OSHA (the federal deadlines):

Under 29 CFR 1904.39, you must report the following directly to OSHA ^[3]:

• A work-related fatality: within 8 hours of learning about it.
• An in-patient hospitalization of one or more employees: within 24 hours.
• An amputation: within 24 hours.
• A loss of an eye: within 24 hours.

Report by calling the OSHA area office, calling the 24-hour hotline at 1-800-321-OSHA (6742), or using the online reporting application at osha.gov. All three are valid.

Recordkeeping in your own logs:

If you have 10 or more employees and your industry isn't partially exempt (29 CFR 1904.2 lists the exempt industries, which include many retail, finance, and service categories), you must keep three forms ^[1]:

• OSHA Form 300: the injury and illness log, where you record each case.
• OSHA Form 300A: the annual summary, which you post in the workplace every February 1 through April 30.
• OSHA Form 301: the incident investigation report for each case.

A recordable case involves a work-related injury or illness that results in days away from work, restricted duty, medical treatment beyond first aid, loss of consciousness, or a significant condition diagnosed by a licensed healthcare professional. ^[1] First-aid-only cases don't go on the 300 log.

Electronic submission is an extra layer for certain employers. Under the final rule published in July 2023, establishments with 100 or more employees in high-hazard industries must electronically submit their Form 300 and 301 data every year, on top of the 300A summary. ^[4] That submission is due March 2 of the year after the calendar year covered.

Which employers are exempt from OSHA recordkeeping?

Two categories of employers are fully or partially exempt from the routine recordkeeping requirements in 29 CFR 1904, and neither exemption gets you out of reporting deaths and severe injuries.

First, the size exemption. Employers with 10 or fewer employees at all times during the previous calendar year don't have to keep OSHA injury logs. They still must report fatalities and severe injuries. ^[1]

Second, the low-hazard industry exemption. Certain industries classified as low-hazard are exempt even with more than 10 employees. These include most retail establishments, real estate, finance, insurance, and several service industries. OSHA's list of partially exempt industries runs on NAICS codes and appears in Appendix A to Subpart B of 29 CFR 1904. ^[1]

Here's the caveat that catches people: being exempt from routine recordkeeping doesn't exempt you from fatality and severe injury reporting. Every employer, regardless of size or industry, must call OSHA when a worker dies or is hospitalized.

State-plan states (22 of them cover private sector employees, plus 7 more that cover public employees only) sometimes go beyond the federal baseline. ^[5] California's Cal/OSHA, for example, has an Injury and Illness Prevention Program requirement under Title 8 CCR 3203 that ties directly into how you document and investigate incidents. If you're in a state-plan state, check your state's rules before you assume the federal forms are enough.

What should a workplace incident report form include?

OSHA's Form 301 is the minimum for recordable cases, but most employers do better with a more detailed internal form that feeds into the 301. The OSHA form asks for the injured employee's information, the date and time, where it happened, what the person was doing, how the injury occurred, the object or substance involved, and the nature of the injury. ^[6]

A good internal report goes further. It should capture:

• The full sequence of events leading up to the incident, more than the moment of injury.
• Environmental factors: lighting, weather, floor condition, equipment state.
• Whether the employee had been trained on the task.
• Whether personal protective equipment was in use, and if not, why.
• Any similar incidents in the same area or task in the past 12 months.
• Contributing factors from the investigation, both immediate causes (the employee slipped) and root causes (the floor mat was missing because nobody was assigned to check it).
• Corrective actions with assigned owners and due dates.

The form should be completable within 24 hours. Wait longer and memories fade and the physical scene changes. Some employers run a two-part system: a brief initial report from the employee or supervisor within the hour, then a full investigation report within 24 to 72 hours.

For near-miss reporting, keep the form short on purpose. If reporting a near-miss takes 20 minutes, people won't do it. A five-field digital form (what almost happened, where, when, immediate cause, suggested fix) pulls in far more reports than a formal document.

See our deeper guide on writing up individual cases in our incident report walkthrough.

How do you build a near-miss reporting culture when workers are afraid to report?

Fear of blame is the single biggest reason near-misses go unreported. Workers have seen coworkers get written up after reporting an incident, so they stay quiet. If your near-miss reports are sitting at zero, that's almost certainly what's happening.

Section 11(c) of the OSH Act prohibits disciplining workers for exercising safety rights, and OSHA reads that to include good-faith injury and hazard reporting. ^[7] The agency treats retaliation against a reporting employee as a serious violation.

Here's what works. Separate the near-miss report from any disciplinary process. A near-miss report should never become evidence in a corrective action unless it exposes an intentional safety rule violation. Close the feedback loop fast. When someone reports a near-miss, tell them within a week what happened with it, even when the answer is "we looked and decided no action was needed because X." Silence after a report tells workers the system is theater. Have supervisors model it. A supervisor who reports their own near-miss in a team meeting sends a signal no policy memo can match.

Anonymous reporting is a good bridge while you build trust. A QR code that opens a simple web form with no login removes the identity barrier. As workers watch reports turn into fixes instead of blame, you can move toward identified reporting, which gives you more to work with in a root cause analysis.

The National Safety Council's Injury Facts reports that a large share of workers say they don't always report workplace injuries, often citing fear of consequences. ^[8] The number for near-misses is almost certainly worse. Your system has to push against that every day.

What are the steps in a proper incident investigation?

An incident investigation is a structured process for understanding why something went wrong so you can stop it from happening again. It's not paperwork. Match the depth to the severity: a first-aid slip gets a supervisor-level look, a hospitalization gets a formal team investigation.

Here's a sequence that works:

Step 1: Secure the scene. Before anyone moves anything, photograph the area from several angles. Note equipment position, spills, lighting, and what PPE the person was wearing. In serious cases the evidence disappears fast.

Step 2: Care first. Get the injured person medical attention. The investigation runs in parallel with care, never instead of it.

Step 3: Gather accounts. Talk to the injured worker (if possible), witnesses, and the supervisor, separately. Accounts shift once people hear each other's versions. Write down what they say, verbatim when you can.

Step 4: Review the documents. Pull training records for the worker and the equipment. Check maintenance logs. Look at the job hazard analysis for the task, if one exists. Those documents either explain the incident or expose a gap in your program.

Step 5: Find immediate and root causes. The immediate cause is the physical event: the ladder slipped, the machine guard wasn't in place, the chemical splashed. The root cause is the management failure behind it: no inspection schedule for ladders, a guard disabled weeks ago that nobody flagged, no SDS on hand for that chemical. OSHA's incident investigation guidance recommends asking "why" until you get past the behavior level to the system level. ^[6]

Step 6: Assign corrective actions. Each one needs a named owner and a deadline. "We'll look into it" is not a corrective action.

Step 7: Follow up. Verify the fixes happened. Close the loop on the Form 301 when the case resolves. Review the incident at your next safety meeting.

What are the OSHA recordkeeping deadlines you must meet?

Missing these deadlines is one of the most common OSHA citations small employers pick up, and every one of them is avoidable. The table below is the whole set.

Event	Deadline	Where to report
Work-related fatality	8 hours	OSHA (phone or online)
In-patient hospitalization (1+)	24 hours	OSHA (phone or online)
Amputation	24 hours	OSHA (phone or online)
Loss of an eye	24 hours	OSHA (phone or online)
Entry on Form 300 log	7 calendar days after learning of the case	Internal log
Form 300A posted in workplace	February 1 through April 30	Workplace posting
Electronic submission (100+ employees, high-hazard)	March 2	OSHA ITA portal
Electronic submission (250+ employees in covered industries)	March 2	OSHA ITA portal

The 7-day rule trips people up. You have 7 days from when you learn about the case, not 7 days from when it happened. If an employee tells you Friday about an injury from the previous Monday, the clock started Monday, and you have until that Friday to log it.

Keep OSHA 300 logs for 5 years following the year they cover. ^[1] Your 2024 log has to survive through the end of 2029. Former employees, their representatives, and government officials all have a right to access their individual records.

What does an OSHA-compliant written incident reporting procedure look like?

A written incident reporting procedure is part of several specific OSHA standards, and it's plain good practice for any workplace. If you already have written programs for lockout/tagout (lockout tagout) or hazard communication, your incident reporting procedure belongs in the same document library.

At minimum, the procedure needs to cover:

1. Who completes the initial incident report (usually the immediate supervisor). 2. The time window for initial reporting (most workplaces use "immediately" or "within the hour" for injuries, "within 24 hours" for near-misses). 3. Where to submit the form (a named person or email, not "the safety department"). 4. Which incidents trigger OSHA notification, and who makes that call. 5. How the investigation works and who leads it. 6. How corrective actions get tracked and closed. 7. Employee rights: no retaliation for reporting, and the right to access their own records.

It doesn't need to be long. Two to four pages covers most small businesses. What matters is that employees can find it, have been trained on it, and can describe the basic steps if asked. An OSHA compliance officer will ask.

If you want a starting point, SafetyFolio's safety program generator can produce a written incident reporting procedure specific to your industry in about 15 minutes, which you then customize to match your actual workflow.

For employers with OSHA training obligations, cover incident reporting during new hire orientation. It should never be the thing employees learn only after someone gets hurt.

How does electronic submission to OSHA work, and who has to do it?

OSHA's Injury Tracking Application (ITA) at injurytracking.osha.gov is the portal for electronic submission. You create an account, enter your establishment details and NAICS code, and submit data once a year.

The 2023 final rule expanded who has to submit electronically. ^[4] The current requirements:

• Establishments with 250 or more employees that are required to keep records must submit their Form 300A data annually.
• Establishments with 20 to 249 employees in designated high-hazard industries must submit their Form 300A data annually.
• Establishments with 100 or more employees in high-hazard industries (the tier added in 2023) must also submit their Form 300 log and Form 301 incident reports.

The high-hazard industry list runs on NAICS codes and includes construction, manufacturing, warehousing, agriculture, healthcare, and others. OSHA publishes the specific list in Appendix B to Subpart E of 29 CFR 1904. ^[4]

So if you run a 100-person warehouse, OSHA now holds your individual incident reports, more than your aggregate totals. That's a real shift in what the agency can see. Make sure your Form 301 narratives are accurate and complete, because they're part of a dataset OSHA actively analyzes.

The submission deadline is March 2 each year for the prior calendar year's data. If March 2 lands on a weekend, submissions are due the following Monday. Miss it and you can be cited under 29 CFR 1904.41.

What are the OSHA penalties for failing to report or record incidents correctly?

Recordkeeping violations are among the most frequently cited in OSHA inspections. In fiscal year 2023, recordkeeping violations under 29 CFR 1904 landed on OSHA's list of top 10 most frequently cited standards. ^[9]

OSHA sorts violations into other-than-serious, serious, willful, and repeat. Recordkeeping failures usually come in as other-than-serious or serious, depending on context.

• Other-than-serious violation: up to $16,131 per violation (2024 amounts, adjusted annually for inflation). ^[10]
• Serious violation: up to $16,131 per violation.
• Willful or repeat violation: up to $161,323 per violation.

Failing to report a fatality or severe injury inside the required window gets treated harder than a paperwork slip on the 300 log. OSHA has issued citations in the roughly $10,000 to $40,000 range for late fatality reporting.

Here's what many employers miss. OSHA can inspect records going back 5 years. A single audit can surface dozens of recording failures, and each one is a separate violation. A warehouse that failed to log 20 cases over three years can face penalties well into six figures, even at the other-than-serious rate.

The honest way to reduce that risk isn't to game the system. It's to build a real one. Employers who can show a documented procedure, trained supervisors, and a good-faith effort get much better treatment during inspections than employers with nothing.

How do you use incident data to actually reduce injuries over time?

A log full of incidents is only useful if someone reads it. The point of tracking is to find patterns, and patterns only show up when you review the data on a schedule.

At minimum, run a quarterly review of your Form 300 log and ask: Which department or work area has the most incidents? Which injury type keeps coming back (strains, lacerations, eye injuries)? Which shift or time of day sees the most events? Is one task or one piece of equipment showing up over and over?

The BLS Occupational Injuries and Illnesses program publishes industry-level incidence rates, so you can benchmark your own rate against peers. ^[2] Your total recordable incident rate (TRIR) is (number of OSHA recordable incidents x 200,000) / total hours worked. An 18-person restaurant with 3 recordable injuries in a year runs a TRIR of (3 x 200,000) / (18 x 50 x 40), which is about 1.67. That's below the BLS full-service restaurant average, which sits around 3 recordable cases per 100 workers. Context matters.

Leading indicators beat lagging ones for prevention. Near-miss reports, worker hazard observations, training completion rates, and equipment inspection results all predict future injuries better than last year's TRIR does. Track only recordable injuries and you're always looking backward.

Monthly safety meetings are a natural place to share trends without naming names. "We had three strain injuries in the shipping area this quarter, all on the same type of lift" is actionable. "John hurt his back" is not.

For employers who want to connect their OSHA 30 training to their day-to-day system, incident trend review is a core skill in the OSHA 30-hour curriculum for supervisors.

What's the difference between a first-aid case and a recordable case?

This distinction matters because recording a non-recordable case inflates your TRIR, and missing a recordable case is a violation. The line between first aid and medical treatment lives in 29 CFR 1904.7. ^[1]

First-aid treatment (not recordable on its own) includes:

• Using a non-prescription medication at nonprescription strength.
• Applying bandages, gauze, butterfly closures, or Steri-Strips.
• Using non-rigid means of support such as elastic wraps.
• Cleaning, flushing, or draining a wound.
• Using eye patches.
• Removing a foreign body from the eye with irrigation or a cotton swab.
• Using finger guards.
• Using massages.
• Drilling a fingernail or toenail to relieve pressure.
• Drinking fluids for heat stress relief.

If a physician or other licensed healthcare professional recommends any treatment beyond that list, or the injury causes days away from work, restricted duty, or loss of consciousness, the case is recordable no matter how minor it looks.

OSHA's letters of interpretation have produced hundreds of rulings on edge cases. OSHA has clarified, for one, that using a prescription medication at prescription strength, even a single dose, makes a case recordable. ^[6] When you're unsure, record it. An overrecorded case costs you nothing. An underrecorded one costs you a citation when an inspector finds it.

Frequently asked questions

Do I need an incident reporting system if I have fewer than 10 employees?

Yes, though the legal requirements are narrower. Employers with 10 or fewer employees are exempt from routine OSHA recordkeeping under 29 CFR 1904.1, so you don't keep Form 300 logs. You still must report fatalities within 8 hours and in-patient hospitalizations, amputations, and eye losses within 24 hours. Beyond the minimum, a simple internal reporting process helps you spot hazards before they turn serious.

How long do I have to complete an OSHA Form 300 entry after an injury?

You have 7 calendar days from the date you learn about the work-related injury or illness, under 29 CFR 1904.29. The clock starts when you first become aware of the case, not when it happened. If the injury is reported to you a week after it occurred, you have 7 days from that notification date to enter it in the log.

What's a near-miss and do I have to report it to OSHA?

A near-miss is an event that could have caused an injury or illness but didn't, either by luck or because someone reacted fast. OSHA does not require near-miss reporting to the agency, and you do not log near-misses on the Form 300. Tracking them internally is one of the highest-value things a safety program can do, because a near-miss is a warning before the actual injury. Build a simple internal process and protect reporters from blame.

Can OSHA cite me for underreporting injuries even if I didn't do it intentionally?

Yes. OSHA can cite employers for recordkeeping failures without proving intent. Good-faith errors usually draw other-than-serious citations with lower penalties, but willful underreporting, which OSHA defines as knowing and deliberate, carries penalties up to $161,323 per violation as of 2024. A documented procedure and consistent supervisor training are your best evidence of good faith.

What is a total recordable incident rate (TRIR) and how is it calculated?

TRIR measures OSHA recordable injuries and illnesses per 100 full-time workers. The formula is (number of recordable incidents x 200,000) divided by total hours worked in the period. The 200,000 constant represents 100 workers x 50 weeks x 40 hours. BLS publishes industry-average TRIR data every year so you can benchmark your rate against comparable employers.

Who is allowed to access OSHA injury and illness records?

Under 29 CFR 1904.35 and 1904.40, current and former employees, their personal representatives, and authorized employee representatives such as union reps can access their own injury records. OSHA inspectors can review logs during an inspection, and you must provide records to a compliance officer within 4 business hours of a request. Keep logs for 5 years from the end of the year they cover.

Does workers' compensation filing replace OSHA recordkeeping?

No. Workers' compensation and OSHA recordkeeping are separate systems with different thresholds. A comp claim can be filed for cases that aren't OSHA recordable, and the reverse happens too. OSHA recordability turns on whether the injury is work-related and required treatment beyond first aid, not on whether a claim was paid. Never use comp claim status to decide what goes on the Form 300.

What should I do if an employee refuses to fill out an incident report?

An employer can require incident reporting as a condition of employment, as long as the requirement itself isn't used to discourage reporting. Make clear in your written policy that all employees must report work-related injuries. If an employee refuses, document your attempts to get the information and complete the Form 300 entry from what you know. OSHA's anti-retaliation rules protect reporters, not silence.

How do state-plan states handle incident reporting differently from federal OSHA?

The 22 state-plan states that cover private sector employees must run programs at least as effective as federal OSHA, and some go further. California requires an Injury and Illness Prevention Program under Title 8 CCR 3203 that includes incident investigation procedures. Washington's L&I has its own reporting portal. Check your state's specific requirements; the federal forms are a floor, not a ceiling.

What is the OSHA Injury Tracking Application and who has to use it?

The Injury Tracking Application (ITA) at injurytracking.osha.gov is OSHA's electronic submission portal. Establishments with 250 or more employees in covered industries must submit Form 300A data annually. Establishments with 20 to 249 employees in high-hazard industries must submit 300A data. Since the 2023 rule change, establishments with 100 or more employees in high-hazard industries must also submit Form 300 and 301 data. The deadline is March 2 each year.

Should small businesses use paper or software for incident reporting?

Either works legally. Paper forms are fine if you store them securely, can retrieve them within 4 business hours of an OSHA request, and actually review them. Software has real upsides: automatic reminders for 300 deadlines, easier trend analysis, and built-in e-submission for the ITA portal. For a business under 25 employees with occasional incidents, a consistent paper system beats expensive software you never open.

How do I handle a situation where the work-relatedness of an injury is unclear?

OSHA's work-relatedness standard under 29 CFR 1904.5 says an injury is work-related if an event or exposure in the work environment caused, contributed to, or significantly aggravated a pre-existing condition. Common exceptions include injuries from personal tasks at work, voluntary wellness program participation, and personal grooming. When it's genuinely unclear, record it. The penalty for overrecording is nothing; the penalty for missing a recordable is a citation.

What training do supervisors need to run the incident reporting process?

Supervisors should be able to recognize which incidents are recordable versus first-aid only, complete OSHA Forms 300 and 301 accurately, secure a scene and gather witness statements, run a basic root cause analysis, and know when to call OSHA for mandatory reporting. The OSHA 30-hour course covers these skills for supervisors. At minimum, run an annual refresher so nobody forgets the 8-hour and 24-hour reporting deadlines.

Can I discipline an employee who violated a safety rule and then got hurt?

Yes, but carefully. OSHA's anti-retaliation rules under Section 11(c) of the OSH Act protect workers who report injuries or hazards. You can discipline for a genuine, consistently enforced safety rule violation, but the discipline has to rest on the violation, not on the act of reporting. If you only discipline workers who get hurt and report it, that's retaliation regardless of the rule framing. Document that the rule gets enforced whether or not anyone was injured.

Sources

1. OSHA, 29 CFR Part 1904 Recordkeeping Rule: OSHA's recordkeeping regulation covering Forms 300, 300A, and 301, the 10-employee exemption, and the 7-day logging deadline
2. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities program, 2022: Roughly 2.8 million nonfatal workplace injuries and illnesses among private employers in 2022; industry-level TRIR benchmarks
3. OSHA, 29 CFR 1904.39 Reporting Fatalities, Hospitalizations, Amputations, and Eye Losses: Fatalities must be reported within 8 hours; hospitalizations, amputations, and eye losses within 24 hours
4. OSHA, Final Rule: Improve Tracking of Workplace Injuries and Illnesses, July 2023: The 2023 final rule requires establishments with 100 or more employees in high-hazard industries to submit Forms 300 and 301 electronically by March 2
5. OSHA, State Plans: There are 22 state-plan states covering private sector employees, each with requirements at least as effective as federal OSHA
6. OSHA, Incident Investigation Guidance: OSHA guidance on root cause analysis methodology and completing Form 301; prescription medication use at prescription strength makes a case recordable per letters of interpretation
7. OSHA, Whistleblower Protection Programs (Section 11(c) of the OSH Act): Section 11(c) of the OSH Act prohibits retaliation against employees who report injuries or exercise safety rights
8. National Safety Council, Injury Facts: A large share of workers report they do not always report workplace injuries, often citing fear of consequences
9. OSHA, Top 10 Most Frequently Cited Standards: Recordkeeping violations under 29 CFR 1904 appeared among OSHA's top 10 most frequently cited standards in fiscal year 2023
10. OSHA, Penalties: 2024 maximum penalty amounts: $16,131 per serious or other-than-serious violation; $161,323 per willful or repeat violation