Security Investigation Record (5 whys)

• Incident Report Number#

Event Notification and Investigation Record

• It is a requirement of this site that all incidents and accidents no matter how minor are reported to the ########## or delegate immediately upon the incident occurring. This is to ensure that the area can be made secure if an investigation into the incident is required. Under no circumstances is a worker to enter or continue work in an area where an incident has occurred.

• It is the responsibility of the ########### or delegate to determine if the site requires to be secured for the purposes of investigation.

• Below is a flow diagram of the reporting and investigation process:

Location of Incident

• Location

  a

Event Title

• Enter Event Title:

Report Entered by:

• Name:

PART 1 – Notification - Event details, must be completed for ALL event reports) Refer to the attached incident notification flow chart.

• Event Date & Time:

  Date

• Event Reported Date & Time:

  Date

• Event Reported to:

• Witness Name/s:

• Event Description:

• Sketch event scene or picture of sequence of events, including locations of involved persons, equipment at the time of the event. Measure distances – use surveyors for serious events i.e. rollovers. Take photographs (attach in First Priority)

• Event Diagram:

  Media

• Exact Event Location:

• Event Type: Select the appropriate Event Type and complete the information within.

• Was drug and alcohol testing conducted / required?

  Yes

  No

  N/A

• Provide details:

• Was there a delay in reporting to either internal or external personnel

  Yes

  No

  N/A

• Provide details:

• Was a supplier or contractor involved in the incident?

  Yes

  No

  N/A

• Provide details:

• Was the incident a reportable incident as per the WHS legislative requirements?

  Yes

  No

  N/A

• Has the site been made safe and secured to preserve for investigation?

  Yes

  No

  N/A

• Has the applicable legislative department been informed?

  Yes

  No

  N/A

• Provide details:

  Yes

  No

  N/A

• Were any instructions provided by the Government Dept. Officials upon initial notification? Provide details.

• Has an investigation been initiated / conducted?

  Yes

  No

  N/A

• By whom and when?

• Have any other Agencies been notified? Provide details (i.e. agency, name of contact, time & date, details)

Event Type: Security

• Was the event a Security incident?

  Yes

  No

  N/A

• If yes, what type of security event:

  Select SEC - Cyber attack SEC - Lost / Stolen / Corrupt Data SEC - Theft SEC - Property break in SEC - Vandalism

  • SEC - Cyber attack
  • SEC - Lost / Stolen / Corrupt Data
  • SEC - Theft
  • SEC - Property break in
  • SEC - Vandalism

• If yes to a security incident, complete the below questions:

• Description of what was stolen or damaged sustained:

• Has a police report been submitted?

  Yes

  No

  N/A

• Police Report number if submitted:

PART 2 - Cost

• Are there any costs associated with this incident?

  Yes

  No

  N/A

PART 3 – Consequence Risk Ranking - includes immediate corrective actions & initial sign off

• Refer to table for Consequence Risk Ranking:

• Actual Event Level

  Level 1

  Level 2

  Level 3

  Level 4

  Level 5

• Potential Event Level

  Level 1

  Level 2

  Level 3

  Level 4

  Level 5

Contributing Factors (Basic investigation only - 5 WHYS)

• Were there any Behavioural Causes? If yes, select all that apply below:

  Yes

  No

  N/A

• Fatigued?

• Procedure / Specification not appropriate?

• Procedure / Specification not completed?

• Procedure / Specification not followed?

• Risk assessment / JSEA / SLAM not appropriate?

• Risk assessment / JSEA / SLAM not completed?

• Stresses?

• Supervision not adequate?

• Task design not appropriate?

• Time pressure?

• Training insufficient?

• Unauthorised behaviour?

• Unprofessional behaviour?

• Working after hours?

• Working alone?

• Equipment not used correctly?

• Other, describe?

• Add additional information for each checked box?

• Physical Causes. If yes, select all that apply below:

  Yes

  No

  N/A

• Equipment malfuctioning?

• Equipment not appropriate?

• Flooring?

• Safety equipment malfunctioning?

• Safety equipment not appropriate?

• Safety equipment not used?

• Weather?

• Workplace design not appropriate?

• Workplace poorly maintained?

• Uncategorised cause?

• Other, describe?

• Add additional information for each checked box:

PART 4 - ICAM Process

• For all Actual Level 1 & 2 events, Parts 1, 2, 3, & 5 are to be completed.

• For all Actual Level 3 events and greater, Parts 1, 2, 3, 4 & 5 MUST be completed.

• Refer to the ICAM - Incident Investigation Reference Guide for assistance (located on SharePoint)

• Is a full ICAM required for this incident

  Yes

  No

  N/A

• If yes, complete investigation using Security Investigation Record (ICAM) form

Immediate, Correct or Preventative Actions

• Guidelines for Raising Corrective Actions

• The investigation should identify recommendations for corrective actions to prevent recurrence, reduce risk and advance safety. This can best be achieved by addressing all absent or failed defences and organisational factors identified by the ICAM analysis. Not all contributing factors can be completely eliminated, and some may be eliminated only at a prohibitive cost. The investigation team should work with line management in the development of corrective actions.
  
  Recommendations must have a direct link back to the incident and must target: Prevention of recurrence and Reduction of risk. Recommendation must address each Absent or failed defences and Organisational Factor.
  
  The corrective actions recommended by the investigation team should be SMARTER (Specific, Measurable, Accountable, Reasonable, Timely, Effective, Reviewed).
  
  

• Each recommendation is a written statement of the action management should take to correct a contributing factor. The team reviews each contributing factor and:
  
  • Formulates recommendations which, if implemented, will reduce the likelihood of that factor contributing to future incidents;
  • Recommends improvement to the system defences to limit the consequences of the contributing factor, so that residual risk is recognised by management as acceptable;
  • Makes interim recommendations for immediate corrective actions after an incident or near-miss as a short-term measure to mitigate current risks prior to the establishment of long-term
  corrective actions.
  
  It is essential any corrective action be fully evaluated by Management to ensure change/s do not weaken other defences or expose other risks. A recommendation must address an organisational or systemic deficiency; it should not be a one-time or band-aid fix.
  
  Recommendations should be based upon the Hierarchy of Control (refer to the Risk Management Procedure for further information).
  
  Each recommendation is numbered individually to ensure and simplify action assignment and completion control. The investigation should cross reference their recommendations to the identified absent / failed defences and organisational factors to ensure they have all been addressed.
  

Immediate, Corrective or Preventative Actions

• Include person responsible and due date:

• Action 1:

• Action 2:

• Action 3:

• Action 4:

• Action 5:

• Action 6:

• Action 7:

• Action 8:

• Action 9:

• Action 10:

PART 5 - Sign-off

Initial Sign-off

Supervisor Acceptance and Comments

• Name:

• Signature:

  Sign

• Date & Time:

  Date

• Comments:

Involved Person Acceptance and Comments

• Name:

• Signature:

  Sign

• Date & Time:

  Date

• Comments:

######## Acceptance and Comments

• Name:

• Signature:

  Sign

• Date:(dd/mm/yy)

  Date

• Comments:

############## Acceptance and Comments

• Name:

• Signature:

  Sign

• Date:(dd/mm/yy)

  Date

• Statutory Reporting Requirements:

  Yes

  No

  N/A

• Completed:

  Yes

  No

  N/A

• Corrective Actions Required:

  Yes

  No

  N/A

• Completed:

  Yes

  No

  N/A

• Communication to personnel (specify medium and date (i.e. safety meeting, TBT, audit, KPI's, other))

• Review Date:

  Yes

  No

  N/A

• Comments:

  Yes

  No

  N/A

Final Sign Off (actions have been completed and verified by#########)

• Name:

• Signature:

  Sign

• Date & Time:

  Date

• Comments: