Root cause analysis for incident investigation: near misses, 5 whys and fishbone

What root cause analysis means in an investigation

An incident investigation answers two questions: what happened, and what allowed it to happen. The second question is the one that prevents the next event. Root cause analysis is the part of the investigation that keeps asking it until you reach causes the organisation can actually change.

The UK Health and Safety Executive's workbook Investigating accidents and incidents (HSG245), widely used as a reference in Malaysia too, sorts causes into three levels:

Fix only the immediate cause (mop the floor) and the same conditions produce the next slip, possibly with worse consequences. Fix the root cause and you prevent a whole family of events.

Start with reporting: near misses and first reports

You can only investigate what gets reported. A near miss is an event that did not cause harm but could have: a dropped spanner that lands a metre from someone, a forklift that stops just short of a pedestrian, a gas alarm during a hot work job. Near misses share causes with serious accidents, and they cost nothing in injuries, which makes them the cheapest lessons you will get.

Make reporting easy and safe:

• One simple channel (a short form, an app or a phone number) that any worker or contractor can use, in the languages your workforce reads.
• A quick acknowledgement and visible feedback: "you reported this, here is what we changed".
• No punishment for honest reporting. If people see a reporter disciplined, reporting stops and you lose your early warning.

Malaysian law already expects this loop. Under regulation 13 of the Occupational Safety and Health (Safety and Health Committee) Regulations 1996, the committee must inspect the place of work, as soon as it is safe, after any accident, near-miss accident, dangerous occurrence, occupational poisoning or occupational disease. Where a safety and health officer is employed, the officer reports the findings of the investigation to the committee chairman, who convenes a meeting to discuss it. Serious events must also be notified to DOSH; see how to report an accident to DOSH.

Decide how deep to go

Not every event needs a team of five and a month of work. HSG245 suggests choosing the level of investigation from the likelihood of recurrence and the worst potential consequence, not the actual outcome. A scaffold board that falls and hits nobody could have killed someone, so it deserves a deep look.

• Minimal: the supervisor looks at the circumstances and takes the obvious lessons.
• Low: a short investigation by the supervisor or line manager into immediate, underlying and root causes.
• Medium: a more detailed investigation by the line manager, the safety adviser and employee representatives.
• High: a team investigation under senior management, for events with fatal or major potential.

Write your trigger levels into your procedure so people do not argue about it on the day.

Gather the evidence quickly

HSG245 sets out four steps: gather the information, analyse it, identify risk control measures, and agree and implement an action plan. Gathering starts straight away, because evidence fades: spills get cleaned, equipment gets reset and memories merge with what colleagues say over lunch.

1. Make the scene safe and care for the injured first. Then preserve the scene. After a serious accident, do not disturb it beyond what is needed to rescue people or prevent further harm.
2. Collect the four Ps: people (who was there, who saw what), positions (where people, equipment and materials were; photos and a sketch with measurements), parts (failed components, tools, PPE; tag and keep them) and paper (permits, procedures, risk assessments, training records, maintenance logs, shift handover notes, alarm and control system logs).
3. Interview one person at a time, privately, as soon as practicable. Explain that the aim is prevention, not blame. Ask open questions ("talk me through what you were doing") and let them show you at the scene.
4. Build a timeline from before the event (what changed, what was normal) through to the response. Gaps and contradictions in the timeline point to the questions you still need to ask.

Analyse: 5 whys and the fishbone diagram

Two simple tools cover most workplace investigations. Use them together: the fishbone stops you missing a category, and 5 whys takes each strand down to a root cause.

5 whys

State the event, ask why it happened, then ask why again of each answer until you reach something the organisation controls. Five is a rule of thumb, not a target.

Notice where a weak investigation would stop: "technician bypassed the interlock". The useful findings are further down.

Fishbone (Ishikawa) diagram

Write the event at the head of the "fish" and draw a bone for each category of cause. A common set for workplace safety:

• People: competence, fatigue, staffing, supervision.
• Method: procedures, permits, risk assessment, handover.
• Equipment: design, guarding, maintenance, alarms.
• Materials: substances, labelling, quality of parts.
• Environment: lighting, heat, noise, housekeeping, weather.
• Management: priorities, resources, monitoring, response to earlier warnings.

Brainstorm possible causes on each bone with the people who do the work, then test each one against the evidence. Keep only what the evidence supports.

Human factors and avoiding blame

HSG245 is blunt: investigations that conclude operator error was the sole cause are rarely acceptable. Behind most errors sit conditions that made them likely, such as poor design, unclear procedures, time pressure, fatigue, inadequate training or supervision.

It helps to name the type of failure, because each has a different fix:

• Slip or lapse: a skilled person does the wrong thing or forgets a step without meaning to (pressed the wrong button, skipped a check after an interruption). Fix the design: distinct controls, checklists, interlocks, fewer interruptions.
• Mistake: the person did what they intended, but the plan was wrong because of a gap in knowledge or a misread situation. Fix training, information and supervision.
• Violation: a deliberate departure from a rule. Most are routine and well-meant ("everyone does it to hit the target"). Ask why the rule was hard to follow, and fix the pressure or the rule, before considering discipline.

Attempting to apportion blame before the investigation is complete makes people defensive and the facts dry up. Only after the investigation is finished is it appropriate to consider whether anyone acted inappropriately, and that is a separate process from the safety investigation. The Human Factors lesson lets staff practise telling slips, mistakes and violations apart in a 3D work scene.

Write actions that fix causes

The investigation is only worth what its actions change. Good actions:

• Map to a cause. Every root and underlying cause should have at least one action, and every action should point to a cause.
• Climb the hierarchy of control. Eliminate or engineer out the hazard where possible. "Remind staff to be careful" and "retrain" are weak on their own; use them alongside stronger controls, not instead of them.
• Are specific. "Fit a jam-clearing tool and a guard-closed reset button on slitter 2" beats "improve guarding".
• Have an owner and a due date, agreed with the person who will do the work.
• Are verified. Someone checks that the action was done and that it works, for example by watching the task a month later.

Then close the loop: update the HIRARC and safe work procedures for the activity, brief the crew in a toolbox talk, share a short lessons-learned note with similar sites, and report back to whoever raised the near miss. Track open actions at the safety and health committee until each one is closed.

Big industrial disasters follow the same pattern on a larger scale, with earlier warnings that were never acted on. See our industrial disaster case studies.