Why root cause analysis matters
When something goes wrong at work, the instinct is to fix the immediate problem and move on. A machine breaks? Repair it. Someone slips? Clean the floor. These responses address symptoms but miss the underlying issues that caused the incident in the first place.
Root cause analysis digs deeper. It asks why the machine broke, why the floor was slippery, and what conditions allowed the incident to occur. Without understanding root causes, the same incidents keep happening, the same near misses keep appearing, and eventually something more serious occurs.
Effective incident investigation is not about assigning blame. It is about understanding what happened and preventing recurrence. Organisations that do this well see their incident rates fall over time because they are addressing systemic issues rather than surface problems.
See how it works: MyRiskLog structures your incident investigations with built-in root cause analysis workflows.
Gathering evidence
Before analysing causes, you need reliable information about what happened. This means gathering evidence while it is fresh, before memories fade and conditions change.
Immediate steps
- Secure the scene if safe to do so
- Take photographs from multiple angles
- Note the time, date, and conditions
- Identify all witnesses
- Preserve any physical evidence
Witness interviews
Speak to everyone involved as soon as practical. Ask open questions: What happened? What did you see? What were you doing? Avoid leading questions that suggest answers.
Interview people separately. When witnesses discuss an incident together, their memories can merge and details get lost. Individual accounts, even when they differ slightly, provide a more complete picture.
Documentary evidence
Gather relevant records: maintenance logs, training records, risk assessments, previous incident reports for the same area or activity. Patterns in documentation often reveal systemic issues.
Related reading: RIDDOR reporting: what incidents must you report?
The 5 Whys technique
The 5 Whys is a simple but powerful method for drilling down to root causes. Start with the incident and ask why it happened. Then ask why that happened. Keep asking until you reach a fundamental cause that can be addressed.
Example application
Incident: Worker slipped and injured their wrist
Why 1: The floor was wet
Why 2: A pipe was leaking
Why 3: The pipe fitting had corroded
Why 4: It had not been inspected for 18 months
Why 5: There was no scheduled maintenance programme for that area
The surface cause was a wet floor. The root cause was lack of a maintenance programme. Mopping the floor addresses the symptom. Implementing scheduled maintenance addresses the root cause.
When to use it
The 5 Whys works well for relatively straightforward incidents with clear causal chains. It is quick to apply and does not require specialist training. For more complex incidents with multiple contributing factors, you may need additional techniques.
Explore the platform: MyRiskLog guides you through the 5 Whys with structured prompts and documentation.
Fishbone diagrams
Also called Ishikawa diagrams or cause-and-effect diagrams, fishbone diagrams help map multiple contributing factors. They are particularly useful when an incident has several interacting causes rather than a single linear chain.
How to build one
Draw a horizontal arrow pointing to the incident on the right. Draw diagonal lines branching off like fish bones, each representing a category of potential causes.
Standard categories
| Category | Questions to ask |
|---|---|
| People | Training, experience, fatigue, communication |
| Equipment | Design, maintenance, suitability, condition |
| Materials | Quality, availability, storage, handling |
| Methods | Procedures, work instructions, supervision |
| Environment | Lighting, temperature, noise, layout |
| Management | Policies, resources, planning, culture |
For each category, brainstorm potential contributing factors. Then investigate which factors actually played a role in this specific incident.
Example
An incident where machinery injured an operator might have contributing factors across multiple categories: training gaps (People), guard removed (Equipment), rush to meet targets (Management), and poor lighting (Environment). Addressing only one factor would leave others in place.
Avoiding common investigation mistakes
Stopping at human error
Concluding that an incident happened because someone made a mistake is rarely useful. People make mistakes. The question is why the system allowed that mistake to cause harm. What barriers should have been in place? Why did they fail?
Confirmation bias
Investigators sometimes start with a theory and then look for evidence to support it. Effective investigation keeps an open mind and follows the evidence wherever it leads.
Blame focus
When investigations focus on finding someone to blame, people stop sharing information. A just culture separates honest mistakes from negligent behaviour and focuses on learning rather than punishment.
Superficial recommendations
Recommendations like 'be more careful' or 'pay more attention' are not actionable and do not address root causes. Good recommendations are specific, measurable, and target systemic factors.
See how it works: MyRiskLog prompts for specific, actionable recommendations linked to identified root causes.
Writing effective recommendations
The point of investigation is preventing recurrence. Recommendations should directly address the identified root causes and be practical to implement.
SMART recommendations
- Specific: Clear about what needs to happen
- Measurable: You can verify completion
- Achievable: Within the organisation's capability
- Relevant: Directly addresses the root cause
- Time-bound: Has a deadline for implementation
Hierarchy of controls
When choosing control measures, prefer more effective options:
- Eliminate: Remove the hazard entirely
- Substitute: Replace with something less hazardous
- Engineering: Physical controls (guards, barriers, interlocks)
- Administrative: Procedures, training, signage
- PPE: Personal protective equipment (last resort)
A recommendation to add a machine guard (engineering control) is more robust than a recommendation for additional training (administrative control) because it does not rely on human behaviour.
Assigning ownership
Every recommendation needs an owner responsible for implementation and a target date for completion. Without clear ownership, recommendations stall.
Tracking recommendations to closure
Investigation reports that sit in a drawer do not prevent incidents. Recommendations need active tracking until implementation is verified.
Implementation monitoring
- Record all recommendations with owners and deadlines
- Review progress regularly (weekly or monthly depending on urgency)
- Escalate overdue items
- Verify implementation, do not just accept completion reports
Effectiveness review
After recommendations are implemented, check whether they are working. Have similar incidents reduced? Are the new controls being used? Sometimes initial solutions need adjustment.
Explore the platform: MyRiskLog tracks recommendations from assignment through to verified closure.
Building investigation capability
Not every manager needs to be an incident investigation expert, but organisations benefit from having trained investigators available. For serious incidents, this might mean bringing in specialists. For everyday events, line managers with basic training can conduct effective investigations.
Training needs
- Understanding of investigation techniques
- Interview skills
- Evidence preservation
- Root cause analysis methods
- Report writing
When to escalate
Some incidents warrant external investigation or specialist involvement: RIDDOR reportable events, incidents with serious injury potential, incidents suggesting criminal activity, or situations where internal investigation might appear conflicted.
FAQs: incident investigation
How quickly should investigation start?
As soon as the immediate situation is safe and stable. Evidence degrades quickly, memories fade within hours, and conditions change. For serious incidents, begin gathering evidence immediately while arranging more detailed investigation.
Who should conduct investigations?
Someone with investigation training, independence from the immediate work area, and authority to access information and people. For serious incidents, this might be a safety professional or external investigator. For routine events, a trained line manager may be appropriate.
How detailed should investigation be?
Proportionate to the incident severity and potential for learning. A minor near miss might warrant a brief investigation and single recommendation. A serious injury or high potential incident needs thorough analysis with multiple techniques.
What if no single root cause exists?
Many incidents have multiple contributing factors rather than one root cause. The fishbone diagram helps map these. Recommendations should address all significant contributing factors, not just the most obvious one.
Learning from incidents
Effective incident investigation transforms negative events into organisational learning. Every incident, even minor ones, provides information about where controls are weak and what could go wrong.
Organisations that investigate thoroughly, identify true root causes, implement practical recommendations, and track them to closure see their incident rates improve over time. Those that skip investigation or produce superficial reports keep experiencing the same problems.
The techniques are straightforward. The discipline is applying them consistently, treating every incident as a learning opportunity, and following through on recommendations until controls are genuinely improved.
Ready to improve incident management? Join the Founding Partner waitlist to see how Compliance Cover structures investigations, tracks recommendations, and builds organisational learning from every incident.