Investigating Properly
The sequence that finds a cause rather than a culprit, and the four questions an investigation must ask beyond what the worker did.
The response · Procedure
An incident involving a lone worker is investigated with less evidence than any other kind, because the only witness is the person it happened to.
When investigating properly also depends on reliable work records, online timesheet tools can support time, attendance and workload review without being treated as the emergency response itself. Compare any workflow with HSE lone-working guidance and keep alarm ownership, escalation and dispatch responsibilities explicit.
Starting position
The worker is not a witness until they are ready, which may be days.
Their account immediately afterwards will be incomplete and may be wrong in details, which is normal and should not be treated as inconsistency later.
Take it gently, record it, and expect to revisit it.
Separating investigation from blame
Conducted by somebody who was not in the escalation chain and is not their line manager.
Framed as finding out what happened rather than what the worker did wrong, which changes what they tell you.
And stated explicitly at the start, because the assumption otherwise is the opposite and it shapes every answer.
The evidence
The alarm log, with every timing.
Location data, and what the responder could see at the time.
Audio, where any exists.
The schedule: what they were doing, how late they were running, what was next.
Hours worked, including the preceding days.
The address record and any flag.
And prior near-miss reports at that location, which is the item most often not looked for and most often revealing.
The four questions beyond the worker
Was this situation in the risk assessment?
Did the schedule make the safe action difficult? A visit running late, a round with no slack, a target that made withdrawal costly.
Did the information reach them? A flag that existed and did not travel is a system failure, not a worker one.
And could this have been done in pairs, at another time, or not at all?
An investigation that did not ask these four has located a cause in the only person who was there, which is where investigations default to when they stop early.
Reconstructing the timeline
Minute by minute, from the records rather than from memory.
Against what the arrangement said should happen.
The gaps are the findings, and they are usually in decision steps rather than technical ones: a responder unsure of their authority, a call not made because somebody assumed.
Publish the timeline internally, anonymised. It is the most persuasive training material the organisation will produce.
What to do with the conclusion
Change something.
A flag, an interval, a pairing rule, a route, an arrangement with a client, an authority.
And tell everybody what changed and why, because an incident that produces a report and no change is the strongest argument available for not reporting anything.
Regulatory reporting
General orientation, not legal advice.
Certain injuries and incidents must be reported to a regulator within stated periods, and violence at work is reportable in many jurisdictions and under-reported almost everywhere.
Know which thresholds apply before one is crossed, because the clock starts at the incident rather than at the review.
Closing it with the worker
Tell them what the investigation found and what changed.
Including where the finding was about the organisation, which is what makes the process feel like an investigation rather than an examination of them.
And ask what would have helped, which is the question that produces the most useful single sentence in most reviews.
Preserving what will be needed
Trigger a hold at the moment of report, before any review begins.
Routine deletion runs on a schedule that does not know an incident occurred, and the location data and audio are frequently the shortest-retained items in the system.
Scoped to the vehicle or worker and a window, with a record of who triggered it.
And released when the matter closes, so a hold does not quietly become indefinite retention for one person.
Involving the responder
Whoever answered the alarm has information nobody else has: what they could see, what they could not find out, and what they hesitated over.
Interview them as part of the investigation rather than treating them as a log entry.
Their account of the decision step is usually where the improvement is, and they will tell you plainly if asked without implication.