Incident reporting: what HSWA asks for, and a system people will actually use

01

What the law asks of incident reporting in New Zealand

Workplace health and safety in New Zealand is governed by the Health and Safety at Work Act 2015 (HSWA), which came into effect on 4 April 2016. Its duties fall mainly on the PCBU, the person conducting a business or undertaking. As WorkSafe's fact sheet puts it, PCBUs must, so far as is reasonably practicable, keep workers and others affected by their work healthy and safe.

The Act has one set of incident reporting duties that are spelled out in full, and they apply to notifiable events: a death, a notifiable injury or illness, or a notifiable incident arising from the conduct of the business or undertaking. WorkSafe's guidance What events need to be notified? sets out the three things a PCBU must do when one happens, drawn from sections 55 to 57 of the Act:

1. Preserve the site (section 55). The PCBU who manages or controls the workplace must take all reasonable steps to make sure the site is not disturbed until an inspector gives permission for normal work to resume, with exceptions such as helping an injured person or making the site safe.
2. Notify the regulator (section 56). WorkSafe must be notified "as soon as possible" after the PCBU becomes aware of the event, even if emergency services attend.
3. Keep records (section 57). The PCBU must keep records of notifiable events for at least five years from the date the regulator was notified.

WorkSafe's quick guide is explicit that "only serious events are intended to be notified". The Act does not set out a general register for every bump and bruise. The expectation for the rest comes from the primary duty and from WorkSafe's guidance on managing risk. Its fact sheet How to manage work risks tells PCBUs to "implement appropriate means for workers to report incidents, near misses, or health and safety concerns", to "encourage appropriate reporting" and to "avoid processes that may encourage under-reporting". It also says to use the investigations into incidents and near misses to make sure control measures are continually improved.

So incident reporting has two layers: a narrow statutory one for notifiable events, and a wide practical one for every incident, near miss and hazard a worker notices. Most of the value, and most of the failures, sit in the second.

02

What an incident reporting system should capture

A good incident reporting process draws a wide net, then sorts. Workers should not have to decide whether something is serious enough before they report it; the person reviewing the report makes that call. In a building with cleaning, security and maintenance teams on site, the reports usually fall into these kinds:

• Notifiable events: a death, an injury or illness that needs (or would usually need) admission to hospital for immediate treatment, the specified serious injuries such as amputation, serious head, eye or spinal injuries, serious burns and lacerations, and the notifiable incidents such as a substance escaping, a fire, a lethal-capable electric shock, the fall of something from height or the collapse of a structure. These go to WorkSafe as well as into your own records.
• Injuries and illness below that line: the cut treated with a plaster, the sprain that did not need admission, the cleaner whose skin reacted to a product. They are not notifiable, but they are the pattern that tells you where the next serious one will come from.
• Near misses: nobody was hurt, but it could easily have been different, such as a box falling from a high shelf in the store room. See the guide to near miss reporting.
• Hazards and unsafe conditions: a wet floor with no sign, a lifted carpet edge on a stair, a fire door wedged open, a blocked exit. These feed the hazard register.
• Security incidents: aggression towards a worker, a threat, trespass or forced entry, where a worker was put at risk.
• Damage: to plant, vehicles or the building, where it could have hurt someone or shows a control has failed.

Not every health event at work is work-related. WorkSafe's quick guide gives examples that are not notifiable, such as a worker fainting from a non-work related cause. A reporting system can still record them, since someone may need first aid, but they are sorted out of the work-related trend.

For a facilities team, one person's report often concerns another business's risk: the cleaner finds the damaged stair nosing, the security officer the leaking drum. The system has to carry those reports to whoever controls the risk, which in a shared building is not always the reporter's own employer.

03

When the incident is a notifiable event

A notifiable event changes the order of things. First deal with the emergency: first aid, the ambulance on 111, making the area safe. Then preserve the site. WorkSafe's quick guide lists what that means in practice: the work set-up should not be changed, any plant, substances or other things involved should stay where they are, work that could interfere with the scene should stop, and no alterations should be made to the plant, vehicles or structures involved. Work can continue in other parts of the workplace.

Then notify. WorkSafe's Notify WorkSafe page gives two routes: if someone has been killed, call 0800 030 040 immediately, a line staffed around the clock that after hours also takes a serious injury, illness or incident needing immediate attention; for injuries, illnesses and incidents, use the online Notify WorkSafe form, which guides you through a series of questions. WorkSafe's quick guide adds that WorkSafe relies on PCBUs to work out whether an event is notifiable, with the online tool there to help, that only one notification is required for each notifiable event, and that the regulator must be notified by the fastest way possible in the circumstances.

Then keep the record for at least five years from the date WorkSafe was notified. It is sensible to keep the notification, any acknowledgement from WorkSafe (it sends one for phone notifications) and the facts gathered at the time.

HSWA does not explicitly require a PCBU to investigate a notifiable event, but WorkSafe's quick guide says investigation forms part of good practice, and that afterwards a PCBU should consider investigating what happened, working out what can be changed to prevent it happening again, and making those changes. The detail of what counts, including the full table of notifiable injuries and illnesses, is in the guide to the notifiable event.

04

Who reports what in a shared building

Most commercial buildings have several PCBUs working in them at once: the owner or body corporate, the tenants, the cleaning and security companies, the lift and fire contractors. HSWA calls this overlapping duties. WorkSafe's Overlapping duties – quick guide says that businesses must, so far as is reasonably practicable, consult, cooperate and coordinate activities with all the other businesses they share duties with. The guide to overlapping duties covers the principle in full.

Incident reporting is one of the clearest overlapping duties. The same quick guide names the duty to notify WorkSafe of a notifiable event as a duty several businesses can share: the parties decide which of them is best placed to notify, and that business tells the others. WorkSafe's notification guide adds that where multiple PCBUs are involved, one should be nominated to notify the regulator, but all of them are responsible for making sure a notification is made. That is worth settling in writing before anything happens. For a building, the questions are:

• Who does a contractor's worker report to: their own supervisor, the building manager, or both?
• How does a report about the building, such as a loose handrail, reach whoever controls it?
• Who decides whether an event is notifiable, and who makes the notification?
• Who preserves the site, given that the PCBU who manages or controls the workplace carries that duty?
• Who follows up, and how is the reporter told what was done?

Workers have duties too. WorkSafe's page Your rights and obligations says workers must take reasonable care of their own health and safety, make sure their actions do not harm others, and comply with any reasonable instructions, policies or procedures on how to work safely. On reporting it is candid: workers should tell supervisors or health and safety representatives about concerns, although this is not legally mandatory. So it is the business's job to make reporting easy and worthwhile.

Health and safety representatives (HSRs) have a role too. WorkSafe's page on HSR functions and powers lists investigating complaints and risks to worker health and safety among their functions, and an HSR need not give notice before inspecting a workplace in the event of an incident.

05

What a good incident report contains, and what happens next

An incident report is useful when someone who was not there can understand it and act on it. A phone, a paper form or a security officer's log can all work if they capture the same facts:

• Where: the building, floor and exact location, not "the stairs".
• When: the date and time it happened, and the time it was reported, if different.
• What happened: in plain words, including what the person was doing and what went wrong. Facts first; opinions about fault belong in the investigation.
• Who: who reported it, who was involved or injured, and any witnesses, with only the personal detail the business needs.
• Injury or harm: what the injury was and what treatment was given, including first aid, a visit to a doctor or admission to hospital. Hospital admission is a trigger for a notifiable event.
• Immediate action: what was done to make the area safe, and whether the site has been preserved.
• A photograph, as evidence of the conditions when the incident occurred, where it is safe to take one and it does not disturb a preserved site.
• Who was told: the supervisor, the building manager, the other PCBU, WorkSafe.

Reporting is only half the process. Each report needs an owner, who decides whether it is notifiable, whether it needs an investigation and what control should change, and it closes when the cause has been dealt with, not when the paperwork is filed. WorkSafe's fact sheet puts this in the Act part of its plan-do-check-act cycle: review incidents or near misses, and talk to your workers to check the control measures are effectively eliminating or minimising work risks.

Record the corrective actions agreed, who owns each one and the date each was completed, so the follow-up can be checked later.

Tell the reporter what happened to their report; people stop reporting when reports disappear. Handle personal information with care: WorkSafe's HSR guidance notes that an HSR's right to information about workers' health and safety excludes personal information unless the worker consents. Keep names and medical detail to those who need them, and share the facts about the hazard widely.

Finally, read the reports together. One wet-floor slip is an incident; six in a month at the same entrance is a design problem. Reviewing reports by location and type with the workers who do the job is where incident reporting starts to prevent harm rather than only record it.

06

Where incident reporting fails, and what SiteClara does about it

Most incident reporting failures happen before the report reaches anyone. The cleaner who finds the loose stair nosing at 5am has nobody to tell and no easy way to tell them; the security officer writes the leaking drum in a book the building manager never reads; the report arrives as "the light's out by the stairs" with no building or floor. In a shared building the report often reaches the reporter's own supervisor and stops there, because the person who controls the risk works for a different business. Nobody closes it because nobody owns it.

SiteClara puts a printed QR poster, with an NFC tag behind it if you want staff to tap, at each location in a building. Staff scan or tap with their own phone, with no app to install, and report an issue with a photo; the report arrives already knowing the building and the location, with the time and the named person recorded as it happens, and goes onto the team's list of jobs until someone closes it. The same tag carries the scheduled checks for that location, so a hazard found on a round is reported where it was found.

The supervisor's queue groups open jobs by building and floor, and a supervisor can escalate a job to the building manager, who can answer it, which gives a contractor's report a route to whoever controls the building. Each day the supervisor approves a report that goes to nominated management or client contacts at 8am the next morning, showing what was reported, what was completed and what is still open.

07

Questions people ask

Which incidents must be reported to WorkSafe?

Only notifiable events. WorkSafe's page What events need to be notified? says "a notifiable event is any of the following work-related events: a death, a notifiable injury or illness or a notifiable incident", and that deaths, injuries or illnesses unrelated to work are not notifiable events. Everything below that line, from a minor cut to a near miss, belongs in the business's own incident reporting system rather than with WorkSafe.

What are some examples of incidents that require a report?

WorkSafe's page What events need to be notified? lists the notifiable incidents, including a substance escaping, spilling or leaking; an implosion, explosion or fire; gas or steam escaping; a pressurised substance escaping; and an electric shock from anything that could cause a lethal shock, along with certain structural failures and equipment malfunctions. Each of these is notifiable when it exposes workers or others to a serious risk from immediate or imminent exposure, and then goes to WorkSafe as well as into the business's own records.

How long must incident records be kept?

For notifiable events, at least five years. WorkSafe's page What events need to be notified? says "the PCBU must keep records of notifiable events for at least five years from the date the regulator was notified about the event", which is section 57 of the Health and Safety at Work Act 2015. That duty covers notifiable events only; other incident reports are kept for as long as the business needs them to review trends and follow-up.

Do workers have to report incidents?

Not as a legal requirement. WorkSafe's page Your rights and obligations says workers should let someone at the workplace, such as a supervisor or a health and safety representative, know if they have a health and safety concern, "even though this is not a legal requirement". That is why the business has to make reporting quick and show that reports are acted on.

08

Where to read the official guidance, and a list to take away

WorkSafe's guidance on What events need to be notified? is the place to start for notifiable events, and its quick guide of the same name (What events need to be notified? quick guide, March 2024) has the full table of notifiable injuries and illnesses and the notifiable incidents. The fact sheet How to manage work risks covers reporting and review as part of managing risk, and the Overlapping duties – quick guide covers working with the other businesses in a building. The Act itself is on the New Zealand Legislation website.

The law is changing. WorkSafe's page on changes to health and safety law says the Government has passed the Health and Safety at Work Amendment Bill and that the changes come into effect on 1 April 2027; the page describes changes to the purpose of the Act, critical risks and the duties of small and large PCBUs. Check it before relying on this guide after that date.

Before you rely on your incident reporting system, check that:

• every worker on site, including contractors' workers, knows how to report an incident, near miss or hazard, has been shown how at induction, and can do it in less than a minute;
• reports carry the building, floor and exact location, the time and the reporter's name;
• someone owns each report, decides whether it is notifiable, and closes it when the cause is dealt with;
• the businesses sharing the building have agreed who notifies WorkSafe and who preserves the site;
• the WorkSafe number, 0800 030 040, and the online form are known to supervisors on every shift;
• records of notifiable events are kept for at least five years from the date WorkSafe was notified;
• reporters are told what happened to their report;
• reports are reviewed together, by location and type, with the workers who do the job and their HSRs.