When a serious workplace incident occurs, the decisions made in the first few minutes can determine how much an organisation will ever understand about what happened.
The immediate priorities are clear. Injured people need assistance, hazards must be controlled and emergency services may need to respond. At the same time, supervisors and managers face another responsibility that can be overlooked during the urgency of the response: preserving the incident scene.
Equipment may need to be isolated. Operations may be suspended. Access to the area may need to be restricted, while decisions about notification, evidence collection and the commencement of an investigation are made.
These decisions have consequences beyond the immediate event.
Poor scene preservation can compromise an investigation before it has properly begun. Physical evidence may be disturbed, electronic records overwritten and important details lost. Once this happens, investigators may be left trying to reconstruct events from incomplete information, making it more difficult to establish the facts and identify the contributing factors.
Recent charges announced by SafeWork SA provide a timely reminder that incident notification and scene preservation are important legal obligations. They also highlight a broader issue for organisations: whether their incident response arrangements adequately protect the evidence needed to understand what happened and prevent recurrence.
A South Australian Case Highlights the Importance of Scene Preservation
SafeWork SA announced charges following a workplace incident involving a forklift and trailer in South Australia.
REFERENCE: SafeWork SA, Charges laid over forklift-trailer incident. Read the regulator's announcement.
According to the regulator's announcement, the charges against two defendants included alleged failures relating to inspection, maintenance, information and supervision. Both defendants were also charged with allegedly failing to notify SafeWork SA and failing to preserve the incident site.
The charges are allegations and should not be interpreted as established breaches or findings of wrongdoing. The matters remain subject to determination through the legal process.
Nevertheless, the announcement highlights an important issue for organisations managing workplace incidents.
Incident notification and scene preservation are distinct responsibilities. Both require attention during the initial response, often before the full circumstances of an event are understood.
For managers and supervisors, this creates a practical challenge. They must manage an evolving emergency, determine whether regulatory notification is required and ensure that the actions taken do not unnecessarily compromise evidence.
The difficulty is that decisions made with good operational intentions can have unintended consequences.
Moving a vehicle to reopen an access road, removing damaged equipment for inspection or cleaning an area so work can resume may seem reasonable in the circumstances. However, where an incident is notifiable, disturbing the scene without appropriate authority may create legal issues. Even where regulatory preservation requirements do not apply, those actions may remove information essential to an effective investigation.
This is why scene preservation needs to be understood before an incident occurs, rather than worked out during the response.
Scene Preservation Begins Before the Investigation Team Arrives
One of the common weaknesses in incident management is the assumption that preserving evidence is primarily the responsibility of the investigation team.
In practice, the investigation team may not arrive until hours after the incident. For complex events, the appointment and mobilisation of an appropriately qualified team may take longer.
By that time, the scene may have changed considerably.
Emergency responders may have moved equipment to reach an injured person. Maintenance personnel may have isolated machinery. Other workers may have removed materials, adjusted controls or attempted to make the area safe.
Some of these actions may be necessary and entirely appropriate.
Others may be avoidable.
The distinction matters because evidence preservation starts with the people who first respond to the event.
Supervisors, emergency response personnel and site managers need to understand their responsibilities for protecting the scene until control can be formally transferred to the appropriate authority or investigation team.
Within the Safety Wise ICAM investigation process, securing the site forms part of the Immediate Actions stage. This occurs before detailed investigation planning, data gathering and analysis.
There is a sound reason for this sequence.
An investigation can only analyse the evidence that remains available. If significant information has been lost or altered during the initial response, the investigation team's ability to establish what happened may already be limited.
What Does Preserving an Incident Scene Actually Mean?
Scene preservation is sometimes interpreted as simply placing barricade tape around an incident location and preventing people from entering.
Although controlling access is important, effective preservation requires a broader understanding of what constitutes evidence.
An incident scene includes more than the immediate location where an injury or equipment failure occurred. Depending on the event, relevant evidence may extend to surrounding work areas, mobile equipment, operating systems, maintenance records and digital information.
Consider an incident involving a forklift and trailer.
The position of the forklift, the trailer configuration, the condition of connecting equipment and the location of other objects may all provide useful information. The position of switches, controls, restraints and safety devices may help investigators understand the equipment's operating state.
There may also be evidence that is less immediately visible.
Maintenance records could establish the equipment's history. Inspection reports may identify previously reported defects. CCTV footage might provide information about the sequence of events. Electronic equipment logs may help establish operating conditions before the incident.
If the forklift is moved, components replaced or electronic information overwritten before these matters are considered, the investigation may lose the opportunity to establish important facts.
Effective scene preservation therefore involves protecting the original condition of relevant evidence, controlling changes to that evidence and maintaining a reliable record of any changes that cannot be avoided.
It also requires recognising that the full relevance of an item may not become apparent until later in the investigation.
A component that initially appears unrelated may become important once witness information, operating records and other evidence are compared.
This is why premature assumptions about what caused an incident can be particularly damaging during the preservation stage.
Protecting People Must Remain the Immediate Priority
Scene preservation must never prevent necessary emergency response.
When someone is injured, providing first aid and enabling emergency services to assist takes priority. Similarly, action may be required to prevent further injuries, control an immediate hazard or make the area safe.
Australian work health and safety legislation recognises circumstances in which disturbance of a notifiable incident site is permitted, including actions necessary to assist injured people, remove deceased persons, make the site safe or minimise the risk of further incidents, subject to the applicable jurisdictional provisions.
The important distinction is between necessary disturbance and avoidable disturbance.
For example, emergency responders may need to reposition equipment to reach a trapped worker. A supervisor may need to isolate an energy source to prevent further harm. Firefighters may need to move materials to extinguish a fire.
These actions can materially change the scene, but they may be essential to protecting people.
Where practicable and without delaying emergency response, photographs or other records of the original conditions can assist investigators. Once the immediate danger is controlled, the organisation should document what was changed, why it was necessary, who authorised or performed the action and when it occurred.
This information becomes part of the incident record.
It can help investigators distinguish between conditions that existed at the time of the incident and changes introduced during the emergency response.
A well-managed response recognises both responsibilities: protecting people and preserving evidence wherever it is safe and lawful to do so.
The Evidence That Disappears First
Some forms of evidence are relatively stable. A damaged steel component, for example, may remain available for examination if it is appropriately secured and stored.
Other evidence can deteriorate or disappear quickly.
Environmental conditions may change within minutes. Weather can affect tyre marks, footprints, spills and surface conditions. Lighting and visibility can change as daylight fades or temporary equipment is removed.
Digital information presents another challenge. CCTV systems may automatically overwrite recordings after a defined retention period. Vehicle telematics, machine fault logs and electronic monitoring systems may have limited storage capacity.
Witness information is also time-sensitive. People may leave the workplace, discuss the incident with colleagues or be exposed to information that influences their recollection.
This does not mean witness accounts are unreliable or that people deliberately alter their recollections. Human memory is affected by perception, stress, elapsed time and subsequent information. These factors need to be considered when gathering evidence.
An effective initial response therefore needs to identify evidence that may be lost if action is delayed.
For digital systems, this may require an immediate request to preserve recordings and data. For environmental evidence, photographs, measurements and observations may be necessary before conditions change. For witnesses, it may involve identifying those present, recording their contact details and arranging appropriate interviews as soon as practicable.
The objective is to protect the information required to establish the facts, without allowing assumptions about the incident to dictate what is collected.
Why Scene Preservation Matters to ICAM Investigations
The Incident Cause Analysis Method (ICAM), developed by Gerry Gibb at BHP, provides a structured approach to understanding workplace incidents through the examination of contributing factors.
ICAM recognises that incidents typically involve a combination of conditions and influences within a system of work. These may include organisational arrangements, task and environmental conditions, individual or team actions, and absent or failed defences.
Identifying these factors requires reliable evidence.
An investigator may establish that a piece of equipment was involved in an incident, but understanding why the event occurred requires further examination.
Was the equipment operating as intended? Were relevant controls available and effective? Did the work environment introduce additional risk? Were maintenance and inspection arrangements adequate? Did organisational decisions influence the conditions under which the work was performed?
These questions cannot be answered through speculation.
They require information that can be gathered, tested and validated.
Scene preservation supports this process by protecting the evidence that investigators need to reconstruct the sequence of events and assess the performance of the system.
A damaged component, for example, may help establish how equipment failed. Maintenance records may provide information about earlier defects or inspections. Witness accounts may explain how the work was normally performed, while procedures and training records may help investigators understand the controls intended to manage the risk.
The value comes from examining these sources together.
Where evidence is missing, investigators may be forced to rely more heavily on assumptions or incomplete recollections. This increases the risk of reaching conclusions that are not adequately supported.
The result may be an investigation report that describes the event but does not fully explain the contributing factors.
That matters because recommendations are only as effective as the findings on which they are based.
If the investigation has not established why controls were absent, ineffective or unable to prevent the incident, the organisation may implement corrective actions that do little to reduce the risk of recurrence.
Using PEEPO to Guide Evidence Preservation
Safety Wise uses PEEPO as a structured approach to planning and gathering investigation evidence.
PEEPO considers five categories of information: People, Environment, Equipment, Procedures and Organisation.
Although PEEPO is primarily a data-gathering tool, it also provides a useful framework for thinking about evidence preservation during the early stages of an incident.
People: Identify those involved, witnesses and others who may hold relevant information. Record who was present, consider the impact of the incident on those individuals and make arrangements for interviews when appropriate.
Environment: Protect information about the conditions at the time of the incident. This may include lighting, visibility, weather, ground conditions, access arrangements, housekeeping and the location of relevant objects.
Equipment: Secure relevant machinery, tools, components and operating information. Consider equipment condition, control positions, isolation arrangements, inspection history and any electronic data that may be stored within the equipment.
Procedures: Preserve relevant operating procedures, risk assessments, permits, instructions and other documents applicable at the time of the incident. Where documents are revised after an event, the original versions may be important to understanding the controls that were in place.
Organisation: Identify records that may assist in understanding how the work was planned, resourced, supervised and managed. These could include maintenance schedules, training records, work allocation information, audit findings and previous incident reports.
Using these categories early helps broaden the response beyond the immediate physical scene.
It also reduces the risk of concentrating solely on the actions of the people directly involved while overlooking evidence relating to the wider system of work.
Importantly, PEEPO should guide the identification of potential evidence, not predetermine the findings. Investigators still need to establish which information is relevant and whether it supports a contributing factor.
The Risk of Restoring Operations Too Quickly
Following an incident, organisations often face significant operational pressures.
Equipment may be unavailable, production may be interrupted and essential services may be affected. Managers may be under pressure to restore operations, particularly where delays have financial or contractual consequences.
These pressures are understandable, but they need to be managed carefully.
A decision to restart equipment, remove damaged components or return an area to service may affect the evidence available to investigators. In some circumstances, it may also conflict with statutory site preservation requirements.
Before restoring operations, management needs to establish whether the incident is notifiable, whether the regulator has authorised disturbance where required, whether relevant evidence has been appropriately secured and whether the work can safely resume.
These are separate considerations.
Regulatory permission to disturb a scene does not necessarily establish that equipment is safe to operate. Equally, completing an internal evidence collection process does not remove the need to comply with applicable regulatory requirements.
Organisations should have a documented process for controlling these decisions, including the authority required to release equipment or an incident area.
Where operations must remain suspended, management should communicate the reasons clearly and make appropriate arrangements to manage the operational consequences.
A rushed return to work can create additional risk while also limiting the organisation's ability to learn from the original event.
Scene Preservation Is an Organisational Governance Responsibility
The responsibility for preserving an incident scene cannot rest solely with the person who happens to be supervising when an event occurs.
Organisations need arrangements that establish what is expected, who has authority and how decisions will be made.
This includes ensuring that supervisors understand notification requirements, that emergency response arrangements account for evidence preservation and that investigation teams can obtain timely access to relevant information.
There should also be clarity about who controls the scene following the emergency response, who can authorise changes and how evidence will be managed.
Where regulatory authorities are involved, these arrangements must recognise their powers and any directions relating to access, inspection or disturbance.
The governance challenge is particularly important for organisations operating across multiple Australian jurisdictions. Although work health and safety legislation has been harmonised in many parts of Australia, differences remain in legal requirements, regulator arrangements and applicable legislation.
A single corporate incident response procedure may therefore require jurisdiction-specific guidance.
Training also matters.
A supervisor who has never been instructed on scene preservation may reasonably focus on emergency response, hazard control and restoring operations. Without a clear process, important evidence may be disturbed before anyone recognises its significance.
Organisations should not assume that these responsibilities are understood simply because incident reporting procedures exist.
They need to be explained, practised and periodically tested.
Four Requirements for an Effective Initial Response
A practical incident response process should address four connected requirements.
1. Protect people and control immediate risks
Ensure appropriate emergency response is provided and take necessary action to prevent further harm. Establish control of the affected area and assess the risks associated with any subsequent access or investigation activities.
2. Determine and meet notification obligations
Assess whether the incident meets the applicable statutory notification criteria and notify the relevant regulator within the required timeframe. Record the notification details and any directions received.
Internal reporting arrangements should support this process, but they should not delay required external notification.
3. Preserve the scene and relevant evidence
Restrict unnecessary access, protect equipment and physical evidence, and take steps to prevent the loss of digital information. Avoid unauthorised disturbance and establish who is responsible for maintaining control of the scene.
Where disturbance is necessary for emergency response or risk control, record the changes as soon as practicable.
4. Capture evidence that may be lost
Identify information that is vulnerable to deterioration, alteration or deletion. This may include environmental conditions, CCTV recordings, electronic logs, equipment settings and the identities of witnesses.
Use a structured approach such as PEEPO to guide early evidence identification and support the subsequent investigation.
These requirements should be incorporated into incident management procedures and supported through practical training.
They also need to be tested against realistic scenarios. A procedure that appears clear during a document review may prove difficult to apply when emergency services are present, equipment remains hazardous and several managers are making decisions simultaneously.
Testing Whether Your Organisation Is Prepared
A useful way to assess incident response capability is to consider what would happen if a serious event occurred during a night shift or weekend, when senior managers and specialist safety personnel may not be immediately available.
Would the supervisor know whether the incident was potentially notifiable? Would they understand what equipment could be moved to protect people and what should remain undisturbed? Would someone know how to prevent CCTV footage from being overwritten?
Would the organisation have a clear process for recording necessary changes to the scene and transferring control to the investigation team?
These questions can reveal weaknesses that are not immediately apparent from reviewing written procedures.
Organisations can strengthen their arrangements through scenario-based exercises that require supervisors and managers to make decisions under realistic conditions.
For example, a simulated mobile equipment incident could require participants to manage an injured worker, isolate equipment, assess notification obligations and identify evidence that needs to be preserved.
The exercise could then introduce additional complications, such as a request to move the equipment, a CCTV system approaching its overwrite period or a maintenance contractor arriving to begin repairs.
Reviewing how participants respond can help determine whether the organisation's procedures provide sufficient guidance and whether responsibilities are clearly understood.
This is particularly valuable because the quality of the initial response can affect every subsequent stage of the investigation.
Evidence Preservation Supports Better Organisational Learning
The legal requirements associated with scene preservation are important, but compliance is only one part of the issue.
An organisation that preserves evidence effectively is better positioned to understand the conditions that contributed to an incident.
That understanding supports stronger investigation findings and more effective recommendations.
Conversely, when evidence is lost, the organisation may never establish whether a particular control was absent, failed or was affected by broader organisational conditions.
This uncertainty can limit the value of the investigation.
A finding that an operator made an error, for example, provides little guidance for improving the system unless the investigation also examines the conditions that influenced the action and the controls intended to prevent or mitigate its consequences.
The quality of that analysis depends on the quality of the available evidence.
Scene preservation therefore has a direct connection to the organisation's ability to reduce future risk.
It is also an important measure of investigation governance. Organisations that consistently preserve evidence demonstrate that incident response, investigation and operational management are connected through a disciplined process.
Are Your First-Response Arrangements Fit for Purpose?
The SafeWork SA announcement is a useful reminder that notification and scene preservation responsibilities need to be taken seriously.
For organisations, the more valuable question is whether their own arrangements would stand up to scrutiny following a significant event.
That requires more than a written procedure.
Supervisors need to understand their responsibilities. Managers need clear decision-making authority. Investigation teams need timely access to reliable evidence, and the organisation needs confidence that important information will be protected from the moment an incident occurs.
Safety Wise has supported organisations with incident investigations and investigation capability development since 2002. Our approach, built around ICAM and structured evidence gathering, recognises that effective investigations depend on the quality of the information collected and the discipline applied throughout the process.
Scene preservation is one of the earliest opportunities to demonstrate that discipline.
The decisions made before an investigation begins can determine what the organisation is able to learn from it.
Reference: SafeWork SA, Charges laid over forklift-trailer incident. Read the regulator's announcement.