Skip to content

One incident investigation misses what a pattern would show

One incident investigation misses what a pattern would show

September 12, 2026

A single incident investigation answers one question well. It tells you what happened that day, on that job, with that crew. It does not tell you what keeps happening, and that second question is the one that decides whether you see the same injury again next quarter.

TL;DR: A single investigation finds the immediate cause of one event. Comparing investigations over time finds the pattern behind them, the same task, crew, or condition showing up again. Both steps matter. The second is where recurring hazards get fixed, because a trend is visible in a stack of reports and invisible in any one of them.

What one investigation is built to do

A good construction incident investigation is narrow on purpose. It reconstructs a sequence. Who was on the crew, what the task was, what the conditions were, what decisions got made in the minutes before, what the immediate cause was, and what sat underneath that immediate cause. Done right, it produces a corrective action that is specific enough to actually carry out.

The narrow focus is what makes it useful. A report that says a worker fell is worthless. A report that says a worker stepped backward off an unmarked edge while pulling a hose, on a deck where the perimeter warning line had been moved for a material drop and not reset, gives you something to fix by the end of the week.

Single-incident work is the raw material, and I want more of it. The problem is what happens next. In a lot of companies the report gets written, the corrective action gets checked off, the file gets closed, and the record stops moving. Then it’s a document, and documents sit. Nobody reads it again unless a lawyer asks for it.

The question a single report cannot answer

One report has a sample size of one. That’s the whole limitation, and it’s a big one. When you look at a single event, every contributing factor looks like a one-off. The weather was bad that morning. The foreman was short a man. The delivery came late so the sequence got compressed. Each of those reads as circumstance.

Line up six reports and the same three phrases start repeating. Short a man. Sequence compressed. Late delivery. At that point you are not looking at circumstance anymore, you are looking at how the company schedules work. The factor did not change between the first report and the sixth. Your ability to see it did.

There is a structural reason this gets missed on jobsites specifically. Crews are distributed, and different superintendents close out their own paperwork on different projects, sometimes in different systems, sometimes on a clipboard that never leaves a truck. The person who investigated the fall in March is not the person who investigated the near miss in June, and neither one has the other one’s file open. The investigators did fine work. The company just has nowhere to keep it.

The same thing happens with severity bias. A recordable gets a full write-up. A close call with identical mechanics gets a verbal mention at a toolbox talk and disappears. You end up with a record that captures outcomes rather than hazards, and outcomes are partly luck. Two men can make the same mistake on the same edge and one of them goes home fine. If you only look at the one who did not, you’re studying luck and calling it safety.

What the guidance recommends

The guidance already says this plainly. OSHA recommends grouping similar incidents and identifying trends in injuries, illnesses, and hazards reported, in addition to investigating each incident, illness, and close call to determine its underlying causes (OSHA, Hazard Identification and Assessment).

I read that as two separate obligations rather than one. The per-incident work and the grouped work are different activities that answer different questions. Doing the first one thoroughly does not get you the second one for free, which is the assumption I see companies make. They run careful investigations, they stack them in a binder, and they treat the binder as the trend analysis. It is not. A binder is storage. Analysis means somebody actually reads across the files with a question in mind.

The part of that guidance I would put in bold if I could is the inclusion of close calls alongside injuries. Close calls are free information. Nobody is hurt, nobody is off work, the insurance company is not involved, and the hazard is described in full. The only cost of collecting them is the discomfort of admitting how often something almost went wrong.

What counts as a pattern

A pattern is a repetition you can name and act on. Two or three events that share one specific factor is enough to earn a look. It doesn’t need to be statistically clean to be worth an afternoon.

What I would do is pick the grouping axes ahead of time and sort the same way at every review. Otherwise you go looking for a story and you will find one. The axes I would start with on a construction operation:

  • Task. Material handling, tear-off, flashing detail, hoisting, ladder access, equipment cleanup. The task is the most common real pattern and the easiest one to fix.
  • Phase of work. Mobilization, demolition, install, punch list, demobilization. Transitions between phases are where controls get moved and not put back.
  • Position in the shift. First hour, last hour, right after lunch, the push before a weather window closes.
  • Crew and supervisor. This one makes people nervous, and it should be handled carefully, because a cluster under one foreman may say more about the work he gets assigned than about him. Look at it anyway. Then look at what that crew was asked to do.
  • Tenure. Time on the job, time with the company, time on that specific task. A cluster among new hires points at onboarding, not at individuals.
  • Equipment and material. A single tool, a single fastener line, a single lift model showing up repeatedly belongs in a procurement conversation.
  • Site condition. Height, access route, occupied building, secure facility, cold, wind, restricted staging.

When a group lights up on more than one axis at once, that is your best lead. Same task, same phase, same tenure band is a much stronger signal than any one of those alone. It also tends to point straight at a fixable thing, usually a step in a procedure that assumes knowledge a newer hand does not have yet.

One caution I would hold onto. A pattern in the reports can also be a pattern in the reporting. If every incident in your file comes from two projects, the honest first question is whether those two projects are more dangerous or just more honest. Reporting culture shapes the data before you ever analyze it.

How findings should reach the crew

Analysis that stops at the conference room door is an expensive hobby. The point of finding a pattern is to change something the crew touches, and I judge the whole exercise on that.

My order of preference is to change the work before I try to change the worker. If the same hazard keeps appearing, first ask whether the task can be sequenced differently, whether a piece of equipment can remove the exposure, whether the material can be staged so the risky carry stops existing. Those fixes hold when attention slips. A reminder doesn’t.

When training is the right answer, tie it to the finding instead of the category. A generic fall-protection refresher after a fall is a compliance gesture. A ten-minute talk that walks through the actual sequence, names the specific step where the control got bypassed, and shows the crew the corrected method is a different thing, and they can tell immediately. They know when they are being taught and when they are being papered.

Then I would push the change upstream into the documents that govern the work. Update the job hazard analysis for that task. Update the pre-task plan template. Update what a new hire sees in their first week. If the pattern you found does not show up in any document a foreman actually uses, you have not fixed it, you have discussed it.

Last, verify in the field. Go look at the task on a live job after the change. Ask the crew to describe the new method in their own words. If they describe the old one, the rollout failed, and I’d rather know that now.

Practical takeaway

If you want the pattern work to happen, build it into the calendar and give it an owner. The shape I would use:

  • Keep investigations and trend review as two separate meetings. One is reactive and fast. The other is deliberate and slow. Combining them means the urgent one eats the important one.
  • Put every event in one place. Injuries, recordables, first aid, property damage, and close calls, all in a single log with consistent fields. A spreadsheet that everyone fills out the same way beats a slick database that half the field ignores.
  • Use fixed fields, not just narrative. Free text can’t be sorted. Task, phase, tenure, equipment, and site condition should be structured entries so you can group them without rereading forty paragraphs.
  • Pick a cadence and hold it. The review has to happen when nothing is on fire. A trend meeting that only convenes after a bad event is just another investigation.
  • Get the right people in the room. Safety brings the data. Operations brings the schedule pressure that shows up in half the findings. A working foreman brings the reality check that keeps the conclusions honest. An executive sits in so the fixes that cost money can actually get approved.
  • Leave with owners and dates. Each pattern gets a named person and a due date, same as any other work. Review the open list at the top of the next meeting before looking at anything new.
  • Report back to the field. Tell crews what the reports produced. People stop submitting close calls when submissions vanish into an office, and the day they stop is the day your data quietly gets worse.

None of that requires software or a consultant. It requires somebody whose job it is to read across the files and the authority to change something when they find it.

The thing I keep coming back to is what repetition means. A company that gets hurt the same way twice is carrying a record it has not read. The gap is between knowing what happened and knowing what keeps happening. Close it and the hard lesson only has to get paid for once.

Khary Penebaker

About Khary Penebaker

Khary Penebaker is Division President at MetalMaster-RoofMaster, the Upper Midwest division of Wolkow Braker Roofing Corp. He previously built Roofed Right America from startup to $35M+ in revenue with 180 employees (2014-2025) and founded Penebaker Enterprises, growing it from $1.5M to $15M. A gun violence prevention advocate and former Everytown for Gun Safety Fellow, Khary brings two decades of leadership in commercial roofing, architectural sheet metal, and civic engagement.

LinkedIn X / Twitter Full Bio

Want to reach me?

I write about leadership, resilience, and the things I care about. If something here landed with you, get in touch or read the whole story in my own words.

Get in touch

Common questions

Why investigate incidents individually and as a group?

The two reviews answer different questions. An individual investigation reconstructs one event and produces a specific corrective action. A grouped review reads across events to find the factor that repeats. OSHA recommends grouping similar incidents and identifying trends in injuries, illnesses, and hazards reported, in addition to investigating each incident, illness, and close call to determine its underlying causes.

What counts as a pattern across incidents?

A pattern is a repetition you can name and act on. Two or three events sharing one specific factor is enough to justify a look. Useful grouping axes on a construction operation are task, phase of work, position in the shift, crew or supervisor, tenure, equipment or material, and site condition. A group that lights up on more than one axis at once is the strongest lead.

How should investigation findings feed back into training?

Change the work before you try to change the worker. If sequencing, equipment, or staging can remove the exposure, do that first, because those fixes hold when attention slips. When training is the right answer, tie it to the actual finding rather than the general category, then update the job hazard analysis, the pre-task plan, and new-hire onboarding so the change lives in documents foremen use.

Who should review incident trends over time?

Give it a named owner and a fixed cadence that does not depend on something going wrong. Safety brings the data, operations brings the schedule pressure that shows up in many findings, a working foreman keeps the conclusions honest, and an executive in the room means fixes that cost money can be approved. Every pattern leaves the meeting with an owner and a due date.