EHS Operations·9 min read
Incident Investigation: 5 Whys & PEEPO Field Guide
How to run incident investigations that prevent recurrence. The 5 Whys finds root cause, PEEPO finds blind spots, and BLS data shows 2.8M reasons it matters.
21 Apr 2026
Module · Core EHS
Incident management from first report to verified closure
Capture incidents on any device. Auto-generate titles with AI. Investigate using 5 Whys and PEEPO. Track every corrective action to verified closure.
Most incident investigations stop at the immediate cause and assign a corrective action that prevents nothing. Three months later the same incident happens again. The pattern is universal across industries and almost entirely avoidable.
HaloEHS Incident Management is built around structured investigation methods (5 Whys and PEEPO), AI assistance for the repetitive parts, and recurrence detection that surfaces patterns across history. The investigator's judgment stays central; the administrative drag is removed.
Safety Incident Management Software | HaloEHS: what you get
Six capabilities that turn incident management from a paperwork burden into a working safety loop.
AI auto-titles
Incident titles, severity, location, and equipment extracted automatically from the initial report. No manual triage typing.
5 Whys + PEEPO
Built-in templates for both frameworks. Use them independently or in sequence for thorough and deep investigations.
CAPA generation
Investigation findings convert to corrective and preventive actions with owners, deadlines, and verification steps.
Recurrence detection
AI flags when a new incident's root cause matches a previously closed one, pointing at a corrective action that failed.
Multi-evidence support
Photos, videos, witness statements, equipment logs, and external documents attach to the incident record.
Investigation collaboration
Multiple investigators, reviewers, and external auditors collaborate on the same record with role-based access control.
From first report to verified closure
An incident begins as a report, often originating from an observation that crossed the severity threshold. The system auto-titles the incident, captures evidence (photos, witness statements, equipment state), and routes it to the appropriate investigator based on type and location.
The investigator runs PEEPO first to identify contributing factors across People, Equipment, Environment, Process, and Organization. Each significant factor then gets a 5 Whys chain to drive to root cause. The combination produces both thorough and deep investigations.
Every root cause maps to a corrective or preventive action. Each action has a named owner, a deadline, and a required verification step. Closure requires evidence; signatures alone do not close a CAPA.
How AI accelerates investigation
AI handles the repetitive work that slows investigators down. Auto-classification removes triage typing. Similar past incidents surface automatically from the historical record, giving investigators relevant context from the start. Suggested PEEPO focus areas reflect which categories most often contribute for similar incident types.
Once an investigation is complete, AI helps generate a draft CAPA plan that the investigator reviews and refines. The investigator still owns every decision; the system removes the empty-page problem.
Recurrence detection across history
When the same root cause shows up across multiple incidents, the original corrective action failed. Most operations never see this pattern because their investigation records sit in separate spreadsheets.
HaloEHS runs recurrence detection continuously. When a new incident's root cause matches one previously closed, both the investigator and the safety manager are flagged. The previous CAPA is surfaced for review. The next corrective action is informed by the failure of the last one.
Choosing the right investigation method
Three structured investigation methods cover almost every operational incident: 5 Whys, PEEPO, and Fishbone (Ishikawa). The mistake operations make is picking one and using it for everything, then wondering why the investigations feel mechanical.
Use PEEPO first when the incident has multiple plausible contributing factors across categories — People, Equipment, Environment, Process, Organization. PEEPO surfaces breadth; each factor becomes a candidate for deeper analysis. Use 5 Whys after PEEPO on each significant contributing factor, to drive each one to root cause through a chain of causation. 5 Whys gives depth; without PEEPO upstream, it tends to over-converge on the single most visible factor and miss systemic ones. Use Fishbone when the investigation is collaborative and benefits from a whiteboard or workshop format, especially for cross-functional incidents where Maintenance, Operations, and Engineering all need to align on the root-cause picture.
Pick the depth by severity tier. Tier 1 (minor first-aid, no recurrence pattern): a single 5 Whys may be enough. Tier 2 (lost-time injury, or near-miss with major potential): PEEPO plus 5 Whys on each major factor. Tier 3 (fatality, multi-casualty, regulatory-reportable, or process-safety event): full TapRooT-style investigation with multiple methods, external review, and Management of Change. HaloEHS supports all three frameworks natively and routes investigations to the appropriate template based on initial severity classification. Investigators can switch methods mid-investigation if the scope changes; the evidence chain stays linked across the transition.
Incident Management FAQ
Under OSHA 29 CFR 1904, a recordable is any work-related injury or illness that results in death, days away from work, restricted work or job transfer, medical treatment beyond first aid, loss of consciousness, or a significant injury or illness diagnosed by a licensed healthcare professional. The distinction matters because recordables must appear on your OSHA 300 log and feed the annual 300A summary, and misclassifying first-aid-only cases as recordable (or vice versa) is a common source of citations. HaloEHS supports the full OSHA classification taxonomy, helps reviewers apply the recordability tests consistently, and maintains the 300/300A records automatically — so the determination is documented and defensible rather than a judgment call made under deadline pressure.
The classification model is trained on labelled EHS data — incident types, severity levels, locations, and equipment classes — so when a worker submits a free-form report, the AI maps that unstructured text to your operation's normalized taxonomy and suggests a title, category, and severity. This removes the data-entry burden that otherwise falls on a busy supervisor and keeps classification consistent across sites and reviewers. Crucially, AI never acts unsupervised: every auto-classification is presented to the reviewer for confirmation before the incident is routed, so a human always owns the final determination. Misclassifications are rare and fully editable, and each correction improves consistency over time.
Yes. HaloEHS ships with 5 Whys and PEEPO (People, Environment, Equipment, Procedures, Organization) templates out of the box, since those cover the majority of workplace investigations. Beyond that, your team can configure additional frameworks — Fishbone/Ishikawa diagrams, TapRooT-style structured trees, or your own custom checklists — and assign each to specific incident types so a minor first-aid case and a major process-safety event automatically use proportionate investigation rigour. Enterprise and on-premises deployments can lock template usage to match a regulated investigation procedure, ensuring every incident of a given class is investigated to the same documented standard for auditors.
Every finding from an investigation generates a draft corrective or preventive action directly inside the incident, so root causes never get identified and then forgotten. The investigator assigns each action an owner, a deadline, and a verification mechanism — the evidence that will prove the action worked — and it then flows into the Action Management module with a permanent link back to the originating incident. That linkage is what gives you a complete, auditable chain: the hazard observed, the incident investigated, the root cause found, the action taken, and the proof it was effective. It is also what prevents the most common CAPA failure, where actions are logged but never closed or verified.
Every state change on every record is captured automatically: who created the incident, who reviewed and classified it, who was assigned each action, who closed it, and what evidence was attached, each with a timestamp and the user identity. Nothing can be edited silently — the history is immutable and queryable. For an ISO 45001 or regulatory audit this means you can produce the full lifecycle of any incident on demand, including how recordability was determined and how each corrective action was verified, instead of reconstructing it from emails and spreadsheets. On-premises deployments keep this audit log entirely within your own infrastructure for organizations that require it.
Yes. HaloEHS integrates with the systems an incident workflow depends on: HR systems for worker and supervisor records, ERP and maintenance/CMMS systems for equipment and asset data, and identity providers including Active Directory, OAuth, SAML 2.0, and OIDC with SCIM provisioning for enterprise accounts. API access is available on Professional and Enterprise plans for custom integrations and data export to BI tools. For on-premises and private-cloud deployments, these integrations run inside your own network against your internal systems, so enterprise IT retains full control over what connects to what.
Related reading
EHS Operations·9 min read
Building a Near-Miss Reporting Program That Workers Use
Near-misses outnumber major injuries 300 to 1 (Heinrich, 1931). The reporting program that captures them prevents the next incident. Here is how to build one.
11 May 2026
EHS Operations·10 min read
CAPA Effectiveness: Closing the Loop on Every Action
ISO 45001 requires CAPA. Most operations log them; few close them effectively. Here is how to track corrective actions to verified closure and prove the loop.
11 May 2026
Other modules
Module
Observation
Empower every worker to report hazards in seconds. AI auto-classifies and routes observations for review, with anonymous reporting built in.
Learn more
Module
Action Management
Your command center for every CAPA across every module. Personalized task lists, automated reminders, evidence-based closure, and effectiveness tracking.
Learn more