Three workers in hard hats talking over a clipboard on a red-dirt mine site, two of them in orange high-visibility shirts, with a loader in the foreground, orange barrier bunting behind them and a haul truck raising dust in the distance.

Resources / Incident response

Blog, incident response, 2026

When the regulator arrives:
5 places incident response goes wrong

Most organisations have an incident response procedure sitting in a folder. The damage still tends to happen in the same five places, inside the first 24 hours, while everyone is still working out what actually happened. Here is where it goes wrong, and the two pieces of law worth knowing before you need them.

Published 15 September 202614 minute readSan Rangeon, Director, PocketModeSources: Work Health and Safety Act 2011, Comcare, WorkSafe Queensland
5
pinch points where prepared organisations still hurt themselves
14
days to challenge a notice, or fewer if the notice says so
2
separate processes: complying with a notice, and challenging it
0
conversations on site that are off the record

The short version

  • Work the first hour in order: treat the injured, make the scene safe, preserve the scene, contain the paperwork, then notify.
  • The scene you must preserve includes the plant and equipment, not just the ground.
  • Know who is on site and what their job is before the inspector walks through the gate.
  • Nothing said on site is off the record, and inspectors wear body-worn cameras.
  • You can ask an inspector to put a request in a formal notice. That is not refusing to cooperate, and for an individual it changes what can be used against you.
  • Complying with a notice and challenging it are two different processes. Doing one does not close the other.
  • The regulator will assess how you ran the response, not only the incident itself.

The structure here is not mine. Last week, I sat in on a 30-minute session on incidents, notices and regulator attendances at a state branch symposium of the Australian Institute of Health and Safety, given by a work health and safety lawyer with more than a decade of serious incident work behind her. She had half an hour for material that normally takes a day, so she skipped the walkthrough and went straight to the pinch points.

The five parts below are hers. The law is mine, traced back to the Act and to published regulator guidance so you can check it. And one line of hers is worth carrying through the whole thing: there is no such thing as a perfect incident response. The goal is not perfection, it is avoiding the avoidable mistakes while under maximum pressure.

Pinch point 1

The first call #

Someone rings you from a remote site. A worker is injured. The detail is sketchy, the person on the phone is beside themselves, and they want to be told what to do.

This is before you have assembled anyone, before counsel is engaged, and before you have any reliable picture of what happened. It is also exactly the moment when the decisions that come back to bite you get made, usually with entirely good intentions.

The priorities have an order, and the order matters more than the speed.

PRIORITY ORDER, FIRST HOUR 01 Emergency response Recover and treat TRAP 4 exceptions only: help the injured, remove a deceased person, make it safe, assist police. 02 Make the scene safe Stop the next one TRAP Rushing in creates a second incident. Your own risk assessment still applies here. 03 Preserve the scene Plant and equipment too TRAP Moving the machine because it blocks access. Not without the inspector's say-so. 04 Contain the evidence Who knows, what's written TRAP New documents, wide circulation, theories about cause put into writing by 10 people. 05 Notify Regulator, and others TRAP Writing more than has to be given, in the hour you understand the least. THE ORDER IS THE POINT. STEP 2 DONE BADLY IS HOW SITES GET A SECOND CASUALTY.
Figure 1. The first hour runs in a fixed order, and each step has one characteristic failure. Step 2, making the scene safe, is where a response most often creates a new hazard: the pressure to fix things fast is exactly when normal permit and risk assessment discipline gets skipped.

Two things in that figure are worth drawing out, because they are the ones people get wrong even after training.

  • The scene includes the plant. If the incident is notifiable, the site has to be left undisturbed until an inspector arrives, and that covers the machinery or equipment involved, not just the patch of ground. The moves that cause trouble are almost never sinister: the loader is blocking the only access road, or the fitter would genuinely rather inspect the failed component on a bench in the workshop. Both are reasonable instincts, and both interfere with the scene. The law does allow you to disturb it, but only for four reasons: to help an injured person, to remove a deceased person, to make the site safe or reduce the risk of it happening again, or to assist police. Convenience is not on the list. If it truly cannot wait, get the inspector’s direction first, and write down who gave it and when.
  • Try not to create documents. This sounds like lawyer’s instinct rather than practical advice, and it is worth understanding why it is not. In the first hours nobody knows what happened, so anything written down is a guess. Guesses written at 4pm on the day get read out three years later as though they were findings. Keep the circle small, keep the channel narrow, and let the records that already exist do the recording.

Who else do you have to notify? #

More people than you think, and working out exactly who is a real task. The notifiable incident clock starts as soon as you have enough information to know you have one, and the statutory timeframes for that are well documented and easy to look up. The harder question, and the one that catches people, is who else has to be told, and by whom.

The example given in the session was a coal business, where you would assume the mining regulator and stop. In practice the same business ran trains, a port that sat under the general work health and safety regulator rather than the mining one, airports, drones, explosives, and a reticulated gas system on a residential village that pulled it into the petroleum and gas regime as well. Working out which regulator applies to which part of an operation is not something you want to be attempting for the first time at 5pm on the day.

Notifiable incident The clock starts here The regulator but which one? Insurer timing can change cover Contract counterparties both directions, up and down Landlord or owner check the lease Union agreed procedures The family decide who makes this call General work health and safety Mining and resources Petroleum and gas Rail, ports, aviation, explosives ONE BUSINESS CAN SIT UNDER SEVERAL OF THESE AT ONCE. WHAT TO DO WHILE YOU WORK IT OUT Give only the information that actually has to be given. Keep a copy of every notification exactly as it was sent. Record who gave what, to whom, and at what time. Work out the applicable regime per site, now, not on the day.
Figure 2. Notification is a web, not a single call. The regulator branch is the one that hides work: a single business can sit under general work health and safety, mining, petroleum and gas, and transport regimes at the same time, and the correct answer differs by site and by activity.
Pinch point 2

Fielding a team before the gate opens #

Depending on where the incident happened you might have minutes or you might have hours before an inspector is on site. Either way it is often less time than you need to mobilise properly or get counsel there. So the question is not who you want on site. It is who is already there, and whether they know what their job is when that gate opens.

The analogy used was a team taking the field. Everyone needs a position, and if you are working out positions during play, you get caught out. In a smaller organisation you will not fill all six. That is fine. Just know which ones you have not filled.

INSPECTOR 01 Primary contact one interface, controls the flow 02 Escort one per inspector, with a camera 03 Second escort note what they look at and shoot 04 Document control a register in, a register out 05 Senior manager the regulator notices who shows up 06 Employee Assistance Program for witnesses, and for the people running the response MORE THAN ONE INSPECTOR USUALLY ATTENDS. ONE ESCORT EACH, OR YOU LOSE SIGHT OF WHAT THEY ARE BUILDING.
Figure 3. Positions to fill before the gate opens. There are five roles, but the escort is one per inspector and more than one inspector usually attends, so six is the realistic number. The escort is the role most often skipped and the one that pays back fastest: knowing what an inspector photographed and asked about tells you where the investigation is heading, days before any formal request arrives.

Two of those positions deserve more than a line.

  • Document control is a full-time job, and it needs one accountable person. After a look around the site, the next thing that happens is a request for documents, and the volume genuinely surprises people who have not been through it. On a fatality you can have police making requests, the regulator making requests, union officials attending with their own powers, and health and safety representatives with their own investigative rights, all at once. Those powers are not identical. Knowing where the boundaries of each one sit is as important as answering them.
  • Brief everyone that nothing is off the record. Everything said, done and written is potentially evidence, and an informal chat by the smoko hut is not a private conversation. Inspectors wear body-worn cameras. Assume you are being recorded from the moment the gate opens, because you almost certainly are.
Pinch point 3

The rules of play, and the one that surprises people #

Inspectors have broad powers: entry, examination, measurements, tests, recordings, photographs, video, and the power to take documents. They can also issue notices on the spot. But they exercise those powers inside a framework, and the framework has a feature most people never use.

The assumption almost everyone brings is that every request from a regulator has to be met, immediately and fully, because the regulator is the one with the power. What that misses is the difference between what an inspector asks for voluntarily and what they require under a coercive power. Inspectors will almost always try the voluntary route first, for good reasons of their own.

This matters most to individuals. At common law there is a privilege against self-incrimination: if information might tend to incriminate you, you have a right to silence. Under the Work Health and Safety Act, section 171 lets an inspector require you to produce documents and answer questions, and section 172 removes that privilege, so you cannot refuse. In exchange, for an individual, what you say or produce under that compulsion is not admissible against you in civil or criminal proceedings, and in the Queensland Act that protection extends to other evidence derived from it. The exception is narrow: it does not cover proceedings about an answer that was itself false or misleading.

An inspector asks you a question Informally, on site JUST ANSWER ASK FOR THE NOTICE ROUTE A, VOLUNTARY You answer You may also decline: the right to silence holds Anything you say can be used against you You kept the silence, you lost the shield ROUTE B, COMPELLED UNDER SECTION 171 You must answer Section 172 removes the privilege; you can't refuse Not admissible against you personally Narrow exception: false or misleading answers SAME COOPERATION. DIFFERENT EXPOSURE. Asking an inspector to use a power they already have is not a refusal to cooperate. THE CATCH The protection in Route B runs to individuals only. There is no equivalent for a body corporate. So the company's produced documents are usable against the company either way. Personal position and company position are not the same.
Figure 4. The same question, two routes, and the trade sits in the middle. Volunteering preserves a right to silence you may not want to exercise, while giving up the use protection. Asking for the notice does the reverse. Note the right-hand caveat: the protection under section 172 attaches to individuals, not to bodies corporate. That was not said out loud in the session, and it matters.

So the move, when an inspector informally asks you for something, is a sentence like: “Happy to answer that. Could you issue a formal notice under your powers?”

People hesitate to say it because they are afraid of looking obstructive, and that fear is the reason the protection goes unused. It is worth being clear about it. Asking an inspector to use a power the Act already gives them is not a refusal to cooperate. It is the framework working as designed. You can be professional, responsive and genuinely helpful and still be disciplined about what you hand over and on what basis.

Acting inside the framework is not refusing to cooperate.

Pinch point 4

The notice you comply with becomes evidence #

Say the rest has gone well. The inspector has been and gone, documents went out under a formal notice, and now an improvement notice lands on someone’s desk. It will state that the inspector believes a provision has been contravened, identify the provision, specify what has to be done about it, and give a deadline.

Not complying with it is an offence, so it cannot be ignored. The mistake is the opposite one: someone reads it, decides the required action looks fair enough, fixes it, and closes the file. That feels like good practice. It quietly gives away two things.

DAY 0 Notice received PROCESS 1, CHALLENGE IT 14 DAYS, OR LESS Apply for internal review Properly made? Action proportionate to the risk? For an improvement notice: the time stated in the notice, or 14 days, whichever is shorter. PROCESS 2, COMPLY WITH IT Do the work by the deadline in the notice Contravention remedied Not complying is an offence, so this is not optional 2 SEPARATE PROCESSES. DOING ONE DOES NOT CLOSE THE OTHER. WHAT COMPLIANCE LEAVES BEHIND Compliance history A recorded contravention, and the steps taken to remedy it, sitting on your record. Prosecution brief "You could have done that before." Your fix, read back as the control you skipped.
Figure 5. The clock and the consequence. Complying and challenging run in parallel, and the review window starts the day the notice arrives. For an improvement notice it is the shorter of the notice’s own timeframe and 14 days. The lower band is the part people do not expect: the corrective action itself becomes material, and it can be read back as proof the control was available all along.

The two things compliance gives away #

  • A compliance history. Once you comply, what sits on your record is not “we resolved a disagreement”. It is a contravention and the steps you took about it. That record has a long life and it gets read in contexts you are not thinking about on the day, including by the next inspector and by anyone doing due diligence on the business.
  • Material for a prosecution brief. This is the one worth reading twice. Corrective action taken after an event turns up in the particulars of a charge, with the regulator making the obvious argument: you did this afterwards, so you could have done it beforehand, and had you done so this would not have happened. It is not conclusive, and it is a perfectly answerable argument, but you have to know it is coming.

None of which is a reason not to fix the problem. It is a reason to read the notice critically before you act on it. Was it properly made? Is the contravention correctly identified? Is the remedial action actually proportionate to the risk, or does it go well beyond what remedying the contravention requires? The review clock is running from the moment the notice lands, and for an improvement notice it can be shorter than 14 days if the notice itself sets a shorter timeframe. This is a first-day decision, not a next-week one.

Pinch point 5

The response is its own hazard #

The last pinch point was the one there was no time left for, which is a shame, because it is the one that has changed most recently.

A serious incident obviously harms the person injured, and it harms witnesses and first responders. That much is well understood, and it is usually what an Employee Assistance Program gets mobilised for. The part that gets missed is the secondary harm created by the way the response itself is run.

  • Witnesses recounting what they saw over and over, to different people, for different purposes.
  • The people processing that material reading genuinely distressing statements as a work task.
  • The response team working very long days, for weeks, with no end date and no relief, because the response does not stop when everyone gets tired.

Those are psychosocial hazards. They arise from the design of the work, and they need controls in the same way any other hazard does. The practical problem is that most incident response procedures were written before the psychosocial regulations existed, and if an organisation has been fortunate enough not to have a serious incident, it has probably had no reason to open that procedure since. So it does not mention any of this.

The line that makes this urgent rather than merely good practice: the regulator will assess your response as well as the incident. The way you ran the fortnight after the event is itself in scope.

There is a question in that worth asking of any organisation, and it is not a sales question. When did you last review your incident response procedure against the psychosocial regulations? Most honest answers are “never”.

Five things to take away #

  1. Have a plan before you need one, so you can test it. No plan is perfect, and that is not the standard. The worst outcomes come from organisations improvising for the first 24 hours. It is better to be looking at it than looking for it.
  2. Know who is on site and what their job is in the window before a response team can physically get there, because that window is when the inspector arrives.
  3. Brief your people that nothing is off the record, and tell them why it matters to them personally as well as to the organisation. Acting inside the framework is not refusing to cooperate.
  4. Complying with a notice is not the only option. Complying and challenging are separate processes, and the corrective action you take shapes the evidence that can later be used about you.
  5. Treat psychosocial risk in the response as a legal requirement, not a nice to have, and check your procedure actually reflects that.

Common questions #

Can we move machinery after a notifiable incident? #

Not for convenience. The site has to be left undisturbed until an inspector arrives, and the site includes the plant and equipment involved. The law permits disturbing it only to help an injured person, remove a deceased person, make the site safe or reduce the risk of a further notifiable incident, or assist police. If something genuinely cannot wait, get the inspector’s direction first and record who gave it and when.

Do I have to answer an inspector’s questions? #

If the inspector uses their power under section 171 of the Work Health and Safety Act, yes. Section 172 removes the privilege against self-incrimination, so you cannot refuse on that ground. In return, for an individual, the answer or document is not admissible against that individual in civil or criminal proceedings, except in proceedings about an answer that was false or misleading. If the request is informal and voluntary, you may decline, but anything you do say can be used.

Does the section 172 protection cover the company? #

No. Comcare’s regulatory guidance states plainly that there is no similar protection for a body corporate. Documents produced by the company are usable against the company whether they were volunteered or compelled. The personal position and the company position are not the same, which is why individuals need their own advice.

How long do I have to challenge an improvement notice? #

Generally 14 calendar days from when the decision came to your notice. For an improvement notice specifically, WorkSafe Queensland states that the application must be made within the time stated in the notice or 14 calendar days, whichever is shorter. The clock starts the day the notice arrives, so treat it as a first-day decision.

If we comply with a notice, is the matter closed? #

No. Complying and challenging are two separate processes, and doing one does not close the other. Complying also records a contravention on your compliance history, and the corrective steps you took can appear in a prosecution brief as evidence that the control was available to you before the incident.

Does the regulator look at how we ran the response? #

Yes. The regulator will assess the response as well as the incident, and that includes the psychosocial risks the response itself creates, such as repeated witness interviews, exposure to distressing material, and sustained long hours for the response team.

What we took from it #

We build workforce software for outdoor and field work, so I went to this session as someone whose product sits in the middle of it. PocketMode records what happened during a shift, which is exactly the category of material that gets requested in the first week after an incident. Four things on our own build list changed as a result, and I would rather say them out loud than discover them in a customer’s worst fortnight.

  • Retention schedules can destroy the one record that matters. If a routine purge rolls over data covering the date of an incident, the system quietly deletes the most relevant thing in it. That is the digital equivalent of moving the machine because it was in the way. The answer is a legal hold that freezes a site, crew and date range on demand, exempts it from every retention rule, and logs who applied it and when.
  • Automated outputs are new documents. A weekly digest or an emailed summary that fires the morning after an incident is a document created by a machine, in the worst possible window, with nobody reviewing it. Recording should continue. Generating and distributing should be able to stop.
  • A production register belongs in the product. Every export stamped with who asked, on what authority, what scope and date range, who received it and when. And scoped exports rather than one download of everything, so a business can produce exactly what a notice requires and prove that is what it produced.
  • Our own position on requests for customer data. The advice about not volunteering applies to vendors too. We do not disclose customer or worker data voluntarily. We require lawful compulsion, produce only what the instrument requires, tell the customer unless we are barred from doing so, and log every production. That is going into our agreements rather than staying a good intention.

Why the record matters #

We are not going to tell you software protects you legally. Nothing in that session supports it. The claim we will make is narrower, and we think it is harder to argue with.

Memory is at its worst exactly when the stakes are highest. Adrenaline narrows what people notice and blurs the small details: who was where, what time it was, how long someone had been on task. Then, in the days afterwards, people talk to each other. Nobody sets out to reshape anyone else’s account, but that is what conversation does. Three weeks later, a set of entirely honest recollections have converged on a version of the shift that nobody actually saw.

A record written at the time does not have that problem. It was captured by the shift itself, before anyone knew it would matter and before there was anything to reconcile. It does not get louder about the parts that turned out to be important, and it does not quietly fill in the parts nobody can remember. That is what we are building PocketMode to do: make what actually happened knowable, in detail, before anyone has to ask.

About this write-up #

The lawyer who gave the session is not named here, and nothing in this piece should be read as her advice, her firm’s advice, or an endorsement of anything we make. The structure is hers. The legal references are mine, worked up afterwards from the notes I took on the day and traced back to the Act or to published regulator guidance. Any error in them belongs to me rather than to her.

Sources #

  1. Work Health and Safety Act 2011 (Qld), section 171. Power to require production of documents and answers to questions. austlii.edu.au
  2. Work Health and Safety Act 2011 (Qld), section 172. Abrogation of the privilege against self-incrimination, and the use protection for individuals. The Act is harmonised, so the equivalent sections carry the same numbers in the other model-law jurisdictions. austlii.edu.au
  3. Comcare regulatory guide, inspectors’ powers relating to documents and interviews. Source of the statement that there is no similar protection for a body corporate. comcare.gov.au
  4. WorkSafe Queensland, review of decisions. The 14 calendar day window, and the shorter timeframe that can apply to an improvement notice. worksafe.qld.gov.au
  5. WorkSafe Queensland, don’t disturb the site of an incident. The four circumstances in which the site may be disturbed before an inspector arrives. worksafe.qld.gov.au
  6. Australian Institute of Health and Safety. The state branch symposium where the session described here was presented, September 2026. aihs.org.au

Related reading: Officer due diligence in 2026: what can you actually prove about yesterday? · The codes stopped being advice, on the 1 July 2026 change that made codes of practice a duty rather than evidence.