Compliance & Risk Management: A 10-Day Incident Review Workflow

The point of the 10-day review

An incident form is not a risk-management system. A form can record that an athlete was injured, a gate failed, or a policy may have been breached. It cannot, on its own, establish who must be notified, whether a deadline applies, what conditions contributed, or whether the department’s promised fix actually happened.

The 10-day model supplies a manageable internal review period. It creates a short, repeatable sequence: preserve the record, assign a reviewer, screen for external reporting duties, examine the event and its conditions, approve a corrective action, and verify that action. The model is a management control—not a universal rule imposed by every state, school district, insurer, athletic association, or college conference.

That distinction matters. A school might set a target of completing an initial incident record within 24 hours, while a state law, insurance policy, district procedure, or governing-body rule sets a different notification window. NCAA institutions also work within applicable NCAA legislation and their conference and institutional procedures; high schools generally look to state law, district policy, and their state high school association, often operating within an NFHS-related framework. The athletic director must identify which requirements apply to the specific event.

Do not wait for the 10-day review to make urgent calls. A serious injury, suspected abuse, threat, equipment hazard, or possible crime may require immediate action and notification. Emergency response and required reporting take priority over the workflow below.

Start with a record that can be trusted

Within 24 hours, or sooner when the institution’s policy requires it, preserve the basic record. The purpose is to capture information while memories are fresh—not to declare fault or write a polished narrative. Separate what someone directly observed from what they heard later, and identify the source of each statement.

• Event details: date, approximate time, venue, specific location, activity, and event status (practice, competition, open facility, or other use).
• People and roles: injured or affected person, witnesses, staff present, responders, and the person completing the record. Restrict sensitive personal details to authorized systems and staff.
• What happened: a chronological description of observable facts, including what occurred immediately before and after the event.
• Immediate response: care provided, emergency services contacted, area closed or equipment removed, and who made those decisions.
• Evidence: photographs where appropriate, relevant schedules, equipment identifiers, inspection records, available video, and related communications. Record where each item is stored and who controls access.
• Notifications already made: recipient, date and time, method, and any confirmation or reference number.

Use neutral language. “The athlete’s foot contacted the loose edge of the mat” describes an observation; “the coach ignored an unsafe mat” assigns a conclusion that the record may not support. If accounts differ, preserve the differences rather than forcing a single version. A factual, imperfect first record is more useful than a confident reconstruction written days later.

Protect records in accordance with institutional privacy, records-retention, student-record, and insurance procedures. Do not circulate medical information or witness statements through an informal group chat simply because it is convenient. Preserve relevant material, but do not create broad access to it. If litigation, a formal complaint, or a serious safety issue is possible, consult the institution’s designated legal or risk-management contact before conducting interviews or distributing conclusions.

The 10-day workflow at a glance

Set “Day 0” as the date the department learns of the incident, not necessarily the date it happened. If the event is reported late, note both dates. Use calendar days for this internal model unless local policy specifies otherwise, and escalate a deadline that falls on a weekend or holiday rather than assuming it can wait.

This schedule is a control rhythm, not permission to defer action. If a hazard remains active, the responsible administrator should restrict use, post a warning, arrange an alternative, or take another proportionate interim measure immediately. If an external reporting deadline is earlier, that deadline governs.

Days 1–2: assign an owner and screen obligations

Every review needs one accountable owner. “Athletics” is not an owner, and an email sent to several people is not an assignment. Name an individual, identify a backup, and state who can approve temporary controls and the final corrective action. For a routine facility concern, that may be the facilities manager or athletic administrator. A serious injury, safeguarding allegation, or potential legal claim should be routed through the institution’s established escalation channels.

Next, perform a reporting-obligation screen. Do not try to answer it from memory alone. Check the current institutional policy, state law and regulations, district or campus reporting procedure, insurer or broker instructions, employment rules where relevant, and the applicable athletic-association or conference requirements. NCAA and NFHS materials are frameworks and sources of rules and guidance; neither label supplies one reporting deadline for every injury or incident. Applicable requirements depend on the event, jurisdiction, membership, institutional policy, and facts.

Record the question, the authority checked, the person consulted, the result, and the date. If the answer is unclear, record who will obtain a decision and by when. An unresolved question is a tracked task, not a reason to mark “no report required.” Where a matter could involve abuse, discrimination, hazing, a serious injury, or a possible legal violation, follow the institution’s designated reporting and investigation process rather than conducting an informal athletic-department inquiry that could interfere with it.

Use a simple trigger list to prompt the screen. It is not a substitute for policy, but it reduces the chance that an administrator treats every event as a routine injury:

• Emergency medical response, hospitalization, or a serious or potentially life-threatening injury
• Suspected abuse, harassment, discrimination, retaliation, hazing, or other safeguarding concern
• Facility, vehicle, equipment, or environmental failure that could affect others
• Possible violation of institutional, conference, state-association, NCAA, NFHS-related, or competition rules
• Claim, threat of legal action, media inquiry, or insurer-notice issue
• Repeated near misses or a previous corrective action that may not have worked

Days 2–4: examine the event, not just the person nearest it

A review should explain the conditions that made an event possible, not simply identify who was present. Consider supervision, workload, communication, access, weather, maintenance, equipment condition, event setup, and whether the written procedure was usable in practice. This is not a presumption that a person or department is at fault. It is a way to find controls that can prevent a repeat.

Build a concise timeline from records and separate confirmed facts from open questions. Interview witnesses individually where appropriate, use open questions, and document the date, interviewer, and source. Ask what the person saw, heard, or did—not what they think another person intended. If accounts conflict, note the conflict and the evidence that might resolve it. Do not promise confidentiality that the institution cannot guarantee.

One practical method is to ask “why” repeatedly about a documented condition until the review identifies a controllable process issue. This is sometimes called a 5 Whys analysis. It is a prompt for disciplined inquiry, not a scientific proof of root cause. Stop when the answer becomes speculative, and corroborate proposed explanations with records, inspection, or knowledgeable staff.

For example, suppose a spectator collides with a student near a gym entrance during a home game. The initial record says the check-in table stood beside the entry, a line formed across the walking path, and the collision occurred as players and spectators moved through the same area. The review might check the event layout, staff instructions, door width and egress requirements, prior event notes, and the timing of crowd arrival. “The spectator was distracted” is not an adequate finding if the arrangement repeatedly directs foot traffic into a pinch point.

Write findings in proportion to the evidence. A useful formulation is: “The review confirmed that the check-in table narrowed the primary entrance route and that no separate queue boundary was in place. The available record does not establish whether the collision was avoidable by any one person.” That statement identifies a condition without claiming more than the evidence supports.

Days 5–7: make the corrective action specific

A corrective action should change a condition, clarify a control, or improve detection. “Remind staff to be careful” is hard to verify and places the burden on attention alone. A stronger action names what will change, who will do it, when it is due, what evidence will prove completion, and who will verify it.

For the gym entrance example, an action could be: “The event manager will move check-in to the west lobby wall, maintain the marked exit route, and brief gate staff before the next home event on November 6. The facilities coordinator will inspect the setup before doors open and attach a dated checklist to the event record.” The specific date is illustrative; departments should use the actual next event and local requirements.

Choose an action that matches the risk. A small adjustment may resolve a low-risk setup problem; a recurring equipment failure may require removal from service, inspection by a qualified person, repair, and documented release before reuse. If the department cannot complete the permanent fix within 10 days, record an interim control, the reason for the delay, a firm completion date, and the person who will monitor the unresolved risk.

Use the hierarchy of controls as a decision aid: where feasible, remove the hazard or separate people from it before relying only on warnings, reminders, or personal attention. For example, relocating a table and defining a clear route generally provides a more observable control than asking staff to “watch the crowd.” The appropriate choice depends on the venue, applicable codes, and the institution’s facilities and safety procedures.

Days 8–10: verify before closing

An action is not complete because an owner replies “done.” The reviewer should inspect the change, check a dated record, confirm the required repair or training, or otherwise gather evidence appropriate to the action. If the action concerns an event setup, verify it at the next event—not only in an office. If the event does not recur within 10 days, record what can be verified now and schedule a follow-up check for the next relevant use.

Closure should answer three questions: Was the action completed? Did it address the identified condition? Does any residual risk require monitoring or further approval? If not completed, do not close the record to meet a calendar target. Escalate the delay, maintain interim controls, and assign a new due date with approval from the appropriate decision-maker.

Finally, check whether the issue has appeared before. A single event may reveal a pattern when compared with maintenance logs, prior injury records, event reports, or near-miss notes. Aggregate information carefully and limit access to personally identifiable or medical information. A quarterly review of categories—such as venue, time, activity, or recurring equipment issue—can help an athletic department direct inspections and spending toward repeated conditions rather than relying on anecdotes.

Copy-and-adapt incident review template

Use this template alongside, not instead of, the organization’s approved incident, medical, safeguarding, and insurance forms. Keep the record in the authorized system and apply local retention and access rules.

Keep the language factual and brief. The record should let a new administrator understand what was reported, what was checked, what was changed, and what remains open without requiring a string of informal messages to reconstruct the decision.

Common workflow failures—and the control that prevents them

• One deadline is treated as universal. Label the 24-hour and 10-day targets as internal standards, then check the actual law, policy, contract, and governing-body rules that apply.
• The first report is written as a verdict. Keep initial documentation descriptive. Record findings and responsibility decisions through the authorized process after evidence is reviewed.
• Everyone is copied, nobody is accountable. Assign one review owner and one action owner. They may be different people.
• The form records injury but ignores a near miss. Capture near misses and facility failures too. They can expose a control weakness before someone is harmed.
• Training becomes the default fix. A reminder may be appropriate, but test whether a layout, equipment, staffing, access, or procedure change would be more dependable.
• The record closes when an action is promised. Require evidence and independent verification proportionate to the risk.
• Sensitive material circulates without controls. Use approved systems, follow access rules, and consult the appropriate privacy, legal, or safeguarding lead when needed.

Making the workflow operational

Adopt the workflow through a short written procedure that identifies the first point of contact, the person who assigns review owners, the escalation route for serious matters, the approved record system, and the official who can authorize closure. Define what “Day 0” means and state plainly that external reporting deadlines take precedence. Share the process with coaches, athletic trainers, event staff, facilities teams, and other groups likely to discover an incident.

Test the procedure with a tabletop scenario before relying on it in a high-pressure event. Use the gym-entrance collision: ask who would make the immediate area safe, who would preserve available video, who checks reporting duties, who can move the table, and how a completed change will be verified. If staff cannot answer without searching through several folders, the workflow is not yet ready.

Track a small set of process measures: percentage of records assigned an owner, time from report to obligation screen, percentage of corrective actions with an evidence-based verification, overdue actions, and repeat incidents by category. Do not use speed alone as a proxy for quality. A rapid closure without a sound reporting screen or verified control is not a successful review.

The 10-day model works when its limits are visible. It gives athletic administrators a consistent way to move from report to action while preserving room for state-specific rules, NCAA or NFHS-related requirements, institutional policy, and the facts of each event. The essential test is not whether every file is closed on Day 10. It is whether urgent risks were addressed, duties were checked on time, decisions were assigned, and the department can show what changed.