Short answer: start after the scene is safe. Preserve evidence, build a neutral timeline, interview witnesses separately, identify both immediate and underlying workplace hazards, assign corrective actions, update the violent incident log, and date the plan review. The investigation record explains why and what changes; the log is the shorter de-identified event record.
Document that immediate danger ended, emergency services were contacted where needed, and injured people were offered appropriate care. Do not delay urgent reporting duties while beginning the investigation.
Secure footage, messages, access logs, photographs, damaged items, schedules, and relevant policies before they change or are overwritten. Record who collected each item and where it is kept.
Start with what is independently known: times, locations, communications, arrivals, departures, and response actions. Mark disputed or unconfirmed facts instead of forcing agreement.
Use open questions, record the interview date and participants, and ask what the witness directly saw or heard. Separate observation from assumption.
Look beyond who acted: access, visibility, isolation, staffing, cash handling, customer rules, reporting channels, prior warnings, training, response time, and whether the written plan matched actual practice.
For every supported hazard, identify the change, owner, due date, and method for verifying completion. Prioritize controls that remove or reduce the hazard rather than relying only on employee vigilance.
Make the required de-identified entry and add the response and corrective actions. Keep names, detailed witness statements, and medical information out of the log.
Date the post-incident review. Update the written plan and provide additional training when the investigation reveals a new hazard or changes a procedure.
Verify corrections, tell affected employees what changed without exposing private details, and retain the investigation file in a controlled location.
The log and investigation are different records. The log is standardized and de-identified. The investigation file can hold the evidence and analysis needed to understand the event, but the statutory investigation record should not contain medical information.
The state's post-incident investigation, hazard correction, plan review, and recordkeeping requirements.
Practical answers about incidents, logs, coverage, and employer-created forms.
The source text for investigations, record content, retention, and access.