Under the Occupational Safety and Health Act 1994, as amended in 2022, a Malaysian employer who experiences a notifiable incident is required to investigate it, document the findings, and report to DOSH within defined timeframes. This is a sound regulatory requirement. The structural tension it creates is less often discussed: the organisation required to investigate the incident is the same organisation whose management decisions, resource allocations, and system design produced the conditions in which the incident occurred.
Two Roles, One Organisation
When a serious incident happens at a Malaysian manufacturing or process facility, the employer typically assembles an internal investigation panel. The panel interviews witnesses, reviews CCTV, examines maintenance records, and produces findings.
The employer in this scenario is occupying two roles simultaneously: the party responsible for investigating the incident, and the party whose management system is under investigation. These roles have inherently different interests. One role is served by finding every contributing factor — including systemic and management-level factors — and addressing them structurally. The other role is served by finding the simplest explanation that closes the regulatory file with minimal disruption.
This is not a claim that employers investigate dishonestly. Most investigation panels are genuinely trying to find what went wrong. The structural problem is that the methodology most commonly used — root cause forms built around immediate causes and corrective actions — is not designed to find management system failures. It is designed to produce a finding that can be documented and closed.
Where Investigation Frameworks Stop Short
The most widely used investigation frameworks in Malaysian workplaces — incident report forms, root cause templates, and simplified 5 Whys worksheets — are built around identifying the immediate cause of an incident and specifying a corrective action for it. They are efficient, familiar, and accessible. They are also consistently shallow.
“Operator did not follow procedure” is the type of finding these frameworks produce. It is accurate as a description of the immediate act. It is useless as an explanation of why the operator did not follow the procedure — and therefore useless as a basis for preventing the next incident, which may involve a different operator making the same kind of error in the same kind of conditions.
Tripod Beta is specifically designed to address this limitation. Its causation chain explicitly requires investigators to trace past the Substandard Act — the immediate deviation — to the Precondition (the state the operator was in that made the deviation likely) and the Underlying Cause (the management system gap that produced that state). Both of these elements sit above the individual. Both of them are management system findings. Both of them are what most employer investigations never reach.
The OSHA 2022 Dimension
The Occupational Safety and Health (Amendment) Act 2022 extended the potential for personal liability in Malaysian workplace incidents to directors, managers, and persons who exercise control over workplaces. This is a significant development for how investigation findings should be interpreted at the board and senior management level.
If an investigation finds only “operator error,” it implies that the management chain — which made decisions about staffing, training, resource allocation, procedure maintenance, and supervisory structure — bears no responsibility for the incident. Under OSHA 2022, that conclusion has become harder to sustain in front of a court. The amendment creates accountability for those whose decisions shape working conditions, not just those who perform the final act.
For directors and senior management, this changes the risk calculus around investigation methodology. A shallow investigation that finds individual error protects the organisation from short-term administrative burden. It leaves the management system that produced the incident intact, and leaves directors and managers exposed to the argument that they knew — or should have known — that the conditions existed.
A thorough investigation that finds and corrects management system failures protects the organisation and its leadership from the same incident recurring, and provides evidence that the duty-holders took their obligations seriously.
What DOSH Expects in a Fatal Incident
DOSH independently investigates fatal incidents in Malaysian workplaces. For serious non-fatal incidents, the employer’s investigation report is typically the primary record. DOSH reviews these reports — and experienced DOSH investigators recognise the pattern of an investigation that stopped at the individual level before reaching the system.
A corrective action register that shows “retraining conducted” and “verbal warning issued” across multiple incidents over multiple years, without any finding that addresses the management system, is a record that shows the investigation method has consistently produced the same shallow result. It does not show that the management system is sound.
The Question for Directors and HR
The relevant question for senior management is not: do we have a thorough investigation process? The relevant question is: is our investigation process capable of finding a management system failure — even when that failure was produced by decisions that our own management team made?
If the methodology stops at the operator level, the answer is no — regardless of how thorough the investigation team believes itself to be.
Want your management team to understand their personal obligations under OSHA 2022 — including what a system-level investigation means for director liability? Cikgu Barrier’s OSH Obligations for Management program is built for directors, plant managers, and HR teams who need to understand what they’re responsible for, what DOSH expects, and what a robust investigation framework looks like at the management level.