Read -> Cluster -> Flag Repeats -> Review -> Investigate

Incident Repeat-Cause and Action-Effectiveness Agent

The agent reads your incident and near-miss register and the corrective-action log to find incidents that keep recurring with the same root cause, and it flags corrective actions that are overdue or that did not stop the problem coming back. It reads the incident register, the action log, and investigation notes, then returns cause clusters, repeat flags, and an overdue-action list. It also drafts an investigation starter so the next inquiry begins with the history in hand.

The Problem

Same pump seal. Same cause. Third time this year. The first two fixes were signed off as done.

A seal fails on a transfer pump and a near-miss report is filed. The investigation blames a fitting procedure, an action is raised to retrain the crew, and the action is closed. Four months later the same seal fails the same way, and again the action closes. Because each incident sits as its own record, nobody has laid the three together to see that the fix keeps being signed off and the failure keeps coming back.

What Changes

The history read across records, not one incident at a time

The agent groups incidents and near-misses by root cause and equipment so recurring problems surface as clusters, not isolated events. Where a corrective action was completed and the same cause recurred afterward, it raises a flag that the fix did not hold. It lists overdue actions and drafts an investigation starter that carries the prior history, so the team can show whether a fix actually worked.

Humans stay in control: the agent surfaces repeats and weak actions, and your investigation lead decides what is reopened and re-investigated.

HOW THE AGENT WORKS

TRIGGERLLMAPIDECISIONACTIONWAIT

TRIGGERNew incident or scheduled runFires when an incident or near-miss is logged and on a weekly review schedule.

APIRead incident and action recordsPulls the incident and near-miss register, the corrective-action log, and investigation notes.

LLMCluster by root causeGroups incidents by root cause and equipment to find recurring patterns.

LLMCheck action effectivenessFinds causes that recurred after their corrective action was completed and lists overdue actions.

DECISIONAny repeat or weak action?

LLMDraft findings and starterWrites cause clusters, repeat flags, an overdue-action list, and an investigation starter draft.

ACTIONSend findings to safety leadDelivers the clusters, flags, and draft to the investigation lead for review.

The agent does not run the investigation, judge root cause, or close actions. Your investigation lead does. The agent removes the manual job of reading the whole register to spot a repeat.

HOW TO BUILD IT

Three levels of depth. Pick the one that matches where you are.

For the ops person who needs to understand what's involved and brief their team.

Your Incident RecordsIncident and near-miss register, action log, investigation notes

The AgentWorkflow engine + LLM

Your Safety TeamInvestigation lead reviews the findings

WHAT YOUR TEAM PROVIDES ONCE

Incident and near-miss register - your logged events with root cause, equipment, and date
Corrective-action log - the actions raised against incidents with status and close dates
Investigation notes - the write-ups that hold the detail behind each root cause
A cause taxonomy - the categories you group root causes under, even a rough one
A notification channel - email, Teams, or Slack where the findings land

What happens day-to-day: when an incident is logged, or on a weekly run, the agent groups events by root cause and checks whether any cause recurred after its action was closed. The investigation lead gets cause clusters, repeat flags, an overdue-action list, and a starter draft that already carries the history. The lead decides what to reopen.

For the IT person or technical lead who needs to scope the integration.

INQUIRY SOURCES

Incident and near-miss register export

Corrective-action log export

Investigation notes

WORKFLOW ENGINE (N8N)

Incident event or schedule

Fetch incidents and actions

Cluster incidents by cause

Score action effectiveness

Repeats or weak actions?

Draft findings JSON

Post findings to safety channel

CONNECTS TO

Incident system (Intelex / Enablon / spreadsheet)Read: incidents, root causes, equipment. Write: none

Action log (Intelex / SAP / spreadsheet)Read: corrective actions, status, close dates. Write: none

Document store (SharePoint / network drive)Read: investigation notes. Write: none

Notification (Email / Microsoft Teams / Slack)Read: none. Write: clusters, flags, and the starter draft

WITHOUT PMS API

Without API access, the register and action log are exported to spreadsheets and the agent reads those on a schedule. The clusters and repeat flags are the same, they just reflect the last export.

WITH PMS API

With API access to the incident system, the agent re-clusters as each new incident lands and can flag a repeat the moment it is logged, with the prior history attached. Best experience.

For the person who wants to build this agent step by step. Each node below maps to an n8n workflow node.

TRIGGERNode 1

Trigger - new incident or weekly run

n8n Webhook on new incident, plus a Schedule node for the weekly pass.

Output: The incident set and linked actions to analyze.

APINode 2

HTTP Request - read register and actions

GET incidents, near-misses, corrective actions, and note references.

Output: A joined dataset keyed by incident id and equipment.

LLMNode 3

LLM - group incidents by root cause

Send the incident set, ask for clusters of the same root cause on the same or similar equipment.

You are a safety analyst. Group these incidents into clusters that share a root cause and equipment. For each cluster, list the incident ids, the shared cause, and the equipment.

Incidents: {incidents}
Cause taxonomy: {taxonomy}

Respond ONLY with valid JSON. No explanation.

INPUT

three seal failures on pump P-102 in one year, all root cause fitting procedure

OUTPUT

{"clusters": [{"cause": "fitting_procedure", "equipment": "P-102", "incidents": ["INC-041", "INC-119", "INC-203"], "count": 3}]}

DECISIONNode 4

IF - repeat or overdue found

n8n IF node on cluster count above one or overdue actions present.

Output: Routes findings to the draft builder.

LLMNode 5

LLM - flag weak actions and draft a starter

Send clusters with action close dates, ask which causes recurred after an action closed, and draft an investigation starter.

For each cluster, check whether a corrective action was completed before a later incident with the same cause. Flag those as action-did-not-hold. List overdue actions. Then draft a short investigation starter that summarizes the history.

Clusters: {clusters}
Actions: {actions}
Today: {today}

Respond ONLY with valid JSON. No explanation.

INPUT

cluster P-102 fitting_procedure, action A-12 closed after INC-041 but INC-119 recurred; action A-30 overdue

OUTPUT

{"action_did_not_hold": [{"cluster": "P-102 fitting_procedure", "action": "A-12", "recurred_in": "INC-119"}], "overdue": ["A-30"], "starter": "P-102 seal failed 3 times on fitting procedure; retraining action A-12 did not prevent recurrence."}

ACTIONNode 6

Send - notify investigation lead

n8n Email node sending clusters, flags, and the starter draft.

Output: A message with the findings and the draft.

MVP vs Advanced — Where To Start

MVP — START HERE

Start with one equipment class and one year of incidents so the clusters are easy to check.
Export the register and action log to a spreadsheet with a clean root-cause column.
Have the investigation lead confirm the first clusters by hand to check the cause grouping.
Add the action-effectiveness check once the clusters are trusted.
Keep the investigation starter as a draft only, never an auto-filed report.
Only then widen to all equipment and multiple years.

ADVANCED — ADD LATER

=+ Connect the incident system API so a repeat is flagged the moment a new incident is logged.
=+ Pull free-text investigation notes so clustering uses the detail, not just the cause code.
=+ Add a similarity check so near-identical causes with different labels still group together.
=+ Track how long causes stay closed after an action to measure whether fixes hold.
=+ Produce a quarterly repeat-cause report for the management review.
=+ Link clusters to the relevant procedure so a weak action points at the document to change.

Full Video Walkthrough Coming Soon

Watch the agent flag a root cause that recurred after its action closed.

Everything on this page is free to learn.

When you're ready to build — do it yourself or bring us in.

Book a call to scope this

OTHER AGENTS IN LEASING & MARKETING

Change and Relief-Verification Agent

Flags changes that skipped a step or left a relief scenario unverified

Permit-to-Work Conflict and Simultaneous-Work Checker

Flags clashing permits and open-but-expired work before the shift starts

Statutory Safety Test and Certificate Agent

Keeps one live list of every statutory test and its due date

Frequently asked questions

Incident Repeat-Cause and Action-Effectiveness Agent is an AI agent that catches repeat root causes and corrective actions that did not work.

Same pump seal. Same cause. Third time this year. The first two fixes were signed off as done. The Incident Repeat-Cause and Action-Effectiveness Agent addresses this: catches repeat root causes and corrective actions that did not work.

No. Your team stays in control. The agent does not run the investigation, judge root cause, or close actions. Your investigation lead does. The agent removes the manual job of reading the whole register to spot a repeat.

This is 2 of 4 agents in Safety, Health & Environment. → · Explore all 15 departments →