How to Conduct a Root Cause Analysis

What a Root Cause Analysis Is and Why It Matters

A root cause analysis is the part of an incident investigation that answers "why?" The investigation gathers the facts: the scene, the equipment, the documents and the witness accounts. The analysis takes those facts and works out what allowed the event to happen, so the fix reaches the cause and not just the symptom. If you haven't read it yet, our guide on how to investigate a workplace incident covers the first hour, evidence, interviews and the timeline that a root cause analysis builds on.

The US Department of Energy's long-standing guidance defines a root cause as the cause that, if corrected, would prevent this and similar occurrences from happening again. The words "and similar" matter. A good analysis doesn't only stop the same worker from having the same incident with the same tool. It finds the weakness in how the work is organized that could produce a whole family of incidents. The UK Health and Safety Executive makes the same point in plain terms: root causes are generally failings in management, planning or organization. The US Chemical Safety Board, which investigates major chemical incidents, says root causes are usually deficiencies in safety management systems.

That's why root cause analysis matters to the business as well as to safety. An incident that's only analyzed at the surface tends to come back, sometimes somewhere else and with a worse outcome. Repeat incidents drive claims costs, lost time, production delays, regulator attention and audit findings. Consider a warehouse with three forklift and pedestrian near misses in a year, each one closed with "reminded worker to watch for traffic". When the fourth event is an injury, the earlier files show the hazard was known and the fix didn't work, which is the opposite of the due diligence an employer wants to be able to show.

The safety researcher James Reason described two ways of looking at error. The person approach focuses on the unsafe acts of the people closest to the event and tries to fix them through reminders, discipline and retraining. The system approach treats those acts as consequences rather than causes, and looks at the conditions people were working under. Reason's point was that you can't change the human condition, but you can change the conditions people work under. A root cause analysis is built on the system approach.

The Loss Causation Path

Frank Bird and George Germain updated Heinrich's well-known domino model into what's usually called the Loss Causation Model, which ties the causes of accident loss directly to management control. In its usual form, the model runs from a lack of management control, through basic causes (personal factors and job factors) and immediate causes (unsafe acts and unsafe conditions), to the incident and the loss.

This guide's approach to root cause analysis uses the same cause-and-effect logic in plain language. Each event is recorded along one path:

Actual or potential loss → Event → Immediate causes → Root causes → System correction

You record the path in that order, but you usually work it backward. Start with what happened and what was lost or nearly lost, trace back through the immediate causes to the root causes, then work forward again to the corrections that will stop it happening again.

Give each event a record identifier so it can be followed through the root cause analysis and the actions that come out of it. A simple format works, for example Event ID 2026-014: Suspended load struck a barrier; no injury or damage. The identifier is for tracking the file. It isn't a cause number or a code, and this approach doesn't use a numbered cause-coding system. The categories in this guide are prompts to make sure nothing's missed, not a substitute for explaining what the evidence shows.

Expect more than one cause. One event can have several immediate causes and several root causes, and a single root cause can contribute to more than one part of the event. That matters, because research on investigation manuals has found that the accident model behind an investigation shapes what investigators look for, and therefore what they find. A path that pushes past the immediate causes into job factors helps keep the analysis from stopping at the person closest to the event.

Loss, Potential Loss and the Event

Three terms anchor a root cause analysis, and getting them right at the start makes the rest of the work clearer.

• Loss is the actual harm, damage or other unwanted result. It may involve injury or illness, damage to property or equipment, an environmental impact or an interruption to work. If no loss occurred, record that clearly and document the potential loss.
• Potential loss is the credible harm or damage that could have occurred in the circumstances. To judge it, consider the source of energy or exposure, its path, what was exposed and the safeguards that were present.
• The event is the unplanned occurrence, or sequence of occurrences, that brought a person, property or another asset into contact with a hazard, or exposed it to hazardous energy or conditions. The event may cause actual loss, or it may create a credible potential for loss that's avoided.

Begin with the facts, not a conclusion about cause. Before anyone writes "root cause" on the form, the record should hold:

• the event identifier, date, time and location;
• the people, equipment, materials or operations involved, and the work being done;
• what happened, in sequence;
• the actual loss, if any, and the credible potential loss;
• the source of energy or exposure;
• the safeguards that were present and what each one did;
• the evidence collected, such as photographs, equipment condition, records, measurements and witness accounts.

Separate confirmed facts from assumptions and unresolved questions, and record conflicting information where it could affect the findings. A two-line statement that "the load swung and hit the barrier" isn't enough for a root cause analysis. A sequence that shows when the lift started, where people were standing, what the signal person could see and when the load moved gives the analysis something to work with.

Near Misses and the Harm Threshold

Near misses are some of the most valuable events for a root cause analysis, because they often show the same causes as an injury, without the cost. The challenge is deciding which events were genuine near misses and how close they came. The idea of a harm threshold helps.

A harm threshold is the level of energy, exposure or force at which harm or damage could reasonably occur in the circumstances. It depends on the hazard and on what was exposed: an impact force, a fall from height, electrical energy, pressure, temperature, a hazardous concentration or another source of harm. The threshold often can't be stated as a precise number. Describe it using the evidence and the conditions at the time, and don't treat one fixed measurement as the threshold for every type of event.

A near miss is an unplanned event in which no actual loss occurred, but a person, property or other asset was exposed, or came close enough to exposure, that the harm threshold could reasonably have been crossed. The loss may have been avoided because a safeguard worked, an object missed, a person moved or circumstances happened to prevent harmful contact. A hazard observation is different: a hazard is present, but no unplanned event or near-contact has happened. A simple example shows the difference:

• A leak is found on a walkway before anyone encounters it: a hazard observation.
• A worker slips on the leak, regains their balance and avoids a fall: a near miss.
• A worker slips, falls and is injured: an event with actual loss.

For a near miss, record the source of energy or exposure, what was exposed or nearly exposed, how close the event came to crossing the harm threshold, what prevented actual loss and the evidence that supports your assessment. That record helps you decide how deep the analysis should go, and it matters legally. Alberta requires employers to investigate potentially serious incidents, British Columbia requires investigation of incidents with the potential to cause serious injury, and Manitoba requires investigation of occurrences that could have caused a serious incident. A well-documented harm threshold helps you show which near misses met that bar.

Immediate Causes: Conditions and Actions

Immediate causes are the conditions and actions closest to the event. They describe what was present or happening at the time. Start with two types, conditions and actions, and expect both to apply to the same event. British Columbia's Workers Compensation Act uses similar language: both the preliminary and the full investigation must identify any unsafe conditions, acts or procedures that significantly contributed to the incident.

Conditions

Conditions are hazardous or deficient circumstances present at the time of the event. Use these subcategories as prompts:

• Equipment, tools or materials: defective, unsuitable, unstable, improperly prepared or positioned in a way that contributed to the event.
• Guards or protective devices: missing, inadequate, damaged, bypassed or ineffective.
• Work area or environment: poor housekeeping, restricted access, inadequate lighting, slippery or uneven surfaces, adverse weather or other environmental conditions.
• Hazardous energy or exposure: moving parts, falling objects, electrical energy, pressure, heat, chemicals or another source capable of causing harm.
• Warnings or protective arrangements: missing or ineffective warnings, barriers, separation or other safeguards.

Actions

Actions are things a person did or didn't do that contributed directly to the event:

• Operating or using equipment: operating without the required authorization, using equipment improperly, or operating at a speed or in a manner that contributed to the event.
• Work method or sequence: using an unsuitable method, missing a necessary step, or carrying out steps in a sequence that increased exposure.
• Position, lifting, loading or placement: taking an exposed position, lifting improperly, or loading or placing materials in a way that contributed to the event.
• Use of safeguards: not using a required safeguard, or removing, bypassing or defeating it.
• Use of defective equipment: using equipment known, or reasonably identifiable, as defective.
• Communication or coordination: failing to warn, confirm, coordinate or respond to a change in conditions.
• Response to a hazard: entering an area or continuing work without first dealing with a recognized hazard.

Describe the specific action or condition. "Unsafe work" isn't a finding. "The worker entered the machine's operating area while the machine was running" identifies an action that can be investigated. And an action is never, by itself, the explanation of why the event happened. It's the point where the analysis turns to the factors that influenced or allowed it.

Root Causes: Human Factors and Job Factors

For each immediate cause, ask why it existed, continued or wasn't controlled. In this approach, root causes are first considered under two headings, human factors and job factors, and both often contribute.

Human factors

Human factors relate to the person's ability to do the task and the things that affected how they interacted with it:

• Capability: did the physical or mental demands of the task exceed the person's capacity in the circumstances?
• Knowledge: did the person know about the hazard, the required controls and the safe method?
• Skill or experience: had the person shown they could do the task?
• Stress, fatigue or attention: could workload, fatigue, stress, distraction or competing demands have affected performance?
• Motivation and expectations: did workplace expectations, incentives or pressures influence how the task was approached?
• Communication and understanding: was information missing, unclear, misunderstood or not confirmed?

A human factor finding doesn't automatically mean the worker was at fault. Explain the evidence and look at how the work system shaped the factor. If a worker didn't know the hazard, the next question is why the planning, orientation or briefing didn't tell them.

Job factors

Job factors relate to how the work was designed, planned, equipped, directed and controlled:

• Leadership and supervision: were responsibilities, direction, oversight and follow-up adequate?
• Engineering and task design: did the design of the task, equipment or work area create exposure or fail to control it?
• Purchasing and selection: were hazards considered when equipment, tools, materials or services were chosen?
• Maintenance: were inspections, servicing, repairs and defect reporting adequate?
• Tools and equipment: were the right tools and equipment available, suitable and working?
• Work standards: were procedures or standards missing, unclear, impractical, out of date or not applied?
• Wear and deterioration: had equipment or materials deteriorated, and was that found and dealt with?
• Use or misuse: were normal use, foreseeable misuse and unauthorized changes considered and controlled?
• Planning and resources: were time, staffing, coordination and other resources adequate for the task?
• Monitoring and learning: were earlier hazards, reports, inspections and similar events acted on, and were previous corrective actions checked?

Don't stop at a label such as "lack of training" or "procedure not followed". Describe what was missing or ineffective, how it contributed to the event and what evidence supports that conclusion. "The written procedure for this lift didn't define an exclusion zone, and the supervisor's pre-lift briefing didn't cover one" can be fixed. "Procedure not followed" can't.

If you've used our investigation guide, you'll recognize the three levels it describes: immediate, underlying and root causes. The human factors and job factors here cover the underlying and root levels together. Job factors such as leadership and supervision, planning and resources, and monitoring and learning are where management system decisions show up, which is what the HSE and the Chemical Safety Board mean when they place root causes in management and safety systems.

How to Get From the Event to the Root Cause

Knowing the categories is one thing. Getting from a messy event to a cause you can actually fix is another, and it follows the same order every time.

• Map the energy and the safeguards. Ask what source of energy or exposure was involved, what path it took, who or what was exposed, and which safeguards were meant to stand in between. Every safeguard that was missing, bypassed or ineffective, and every condition or action that brought the energy and the person together, is a candidate immediate cause.
• Ask why three ways. For each immediate cause, ask why it existed, why it continued and why it wasn't controlled. The first question looks at how it came about, the second at why inspections, reporting and supervision didn't catch it, and the third at why the planned controls didn't stop it.
• Follow every human factor to a job factor. If a worker didn't know the hazard, ask why the planning, orientation or briefing didn't tell them. If someone was fatigued, ask how hours and staffing were planned.
• Know when to stop. You've reached a root cause worth correcting when it's backed by evidence, removing it would probably have prevented the event, it sits within the organization's control, correcting it would prevent similar events, and you can write a specific correction for it. A finding that names only a person, or a correction that's only a reminder, means you stopped too early.

Our free Root Cause Analysis Explanation Guide takes this further. For every condition, action, human factor and job factor, it gives the questions to ask, the evidence to look for and an example of a specific finding or correction, along with two worked cause chains and examples of weak and stronger findings.

Tools That Help You Ask Why

The path tells you where to look. A few simple tools help you get there without skipping steps.

The five whys. Asking "why?" of each immediate cause, again and again, is the most familiar root cause analysis tool, and it's useful for getting a team past the first answer. As our investigation guide notes, it's a good starting tool; used on its own, though, it has real limits. An analysis in BMJ Quality & Safety argues that the five whys pushes users down a single line of reasoning, tends to settle on one root cause, and gives results that two teams are unlikely to reproduce. Its popularity isn't based on evidence that it works.

So run it separately for each immediate cause, branch wherever a "why?" has more than one answer, and check every answer against the evidence before you accept it.

A cause diagram. Often called a fishbone, a cause diagram sorts possible causes into categories so the team doesn't fix on the first idea. The human factor and job factor prompts above make good bones for the diagram. The US Department of Energy's root cause guidance groups causes into a similar set of coded categories: equipment and material problems, procedure problems, personnel error, design problems, training deficiencies, management problems and external phenomena.

The timeline. A sequence of what happened, minute by minute where it matters, shows where conditions changed and where decisions were made. Most root causes sit at one of those points. Our investigation guide explains how to build one from photographs, records and witness accounts.

The cause test. Before you accept any cause, test it. Is it supported by the evidence? If it hadn't been present, would the event still have happened? Is it something the organization can change? Causes that pass all three are the ones to act on.

Keeping the Analysis Fair and Evidence-Based

Once you know how an event ended, the path to it looks obvious. Researchers call this hindsight bias, and it's a well-documented risk in any investigation. Knowing the outcome makes it seem that the people involved should have seen it coming, when at the time the signs were mixed in with everything else going on. Judge each decision on what the person knew, saw and was under pressure to do at the time, not on what you know now.

A few habits keep a root cause analysis honest:

• Keep facts, assumptions and open questions apart. Label each one in the record, and don't let an assumption become a finding because it's been repeated.
• Record conflicting accounts. Two witnesses who disagree are telling you something about visibility, communication or how the job is normally done.
• Analyze as a team. Include someone who does the work, a supervisor, a committee member or worker representative and someone trained in investigation, and for serious events a manager with authority to act. Several Canadian jurisdictions require worker participation in investigations, and it's the best protection against an analysis that blames whoever isn't in the room.
• Keep blame out of it. The HSE's investigation workbook says investigations should be carried out with prevention in mind, not to place blame. The Chemical Safety Board's reports don't assign blame or name individuals. If a separate review finds wilful or reckless behaviour, handle it through your normal human resources process, apart from the safety analysis.

From Root Cause to System Correction

Every root cause you choose to address needs a system correction: the change intended to address the cause and prevent recurrence. A correction that only deals with the outcome, such as checking and resetting the barrier the load struck, may be needed, but it isn't a system correction. Each correction should state:

• the specific change required;
• the person responsible for completing it;
• the due date;
• any interim controls needed until it's done;
• how completion will be verified;
• how effectiveness will be checked once the change is in place.

Where practical, change the task design, equipment, isolation, physical barriers or work arrangement before relying on reminders or retraining. That follows the hierarchy of controls: NIOSH explains that elimination, substitution and engineering controls are more effective than administrative controls and PPE because they don't depend on people getting it right every time. Health care's RCA² guidance ranks actions the same way. Physical changes, forcing functions, simpler processes and standardized equipment are stronger actions; warnings, new policies and training are weaker ones.

The research shows why this matters. A review of 302 root cause analyses over eight years at a large academic medical centre found that, of the 731 solutions proposed, the most common were training (20 per cent), process change (19.6 per cent) and policy reinforcement (15.2 per cent), and that several types of event kept happening despite repeated analyses. Training and communication are sometimes the right answer, but only when they address a demonstrated gap, and never as a replacement for a needed change to the work system.

Close a correction only after the change is complete and the effectiveness check is recorded. If the check shows the correction didn't control the cause, revise it and check again. Our guide on how to manage corrective actions explains how to assign, track and close them in one log.

Several Canadian laws expect an investigation to link causes and corrections, even though most don't use the term "root cause analysis". British Columbia's full investigation must determine the cause or causes of the incident and the corrective action needed to prevent similar incidents. Saskatchewan's investigation report includes the causes and the immediate and long-term corrective actions. Manitoba's report includes the causes, including indirect factors.

Reports in the Northwest Territories and Nunavut cover the unsafe conditions, acts or procedures, the causes and the corrective actions, and federally regulated employers record the direct causes and the corrective measures, with implementation dates, in their hazardous occurrence report. In Alberta, the report must outline the circumstances and any corrective action taken to prevent a recurrence.

ISO 45001, the international standard for occupational health and safety management systems, asks organizations to investigate incidents, determine their causes, take corrective action and review whether it worked.

Before You Close the Analysis

Before you close a root cause analysis, confirm that the record:

• describes the event and its sequence using evidence;
• identifies the actual and potential loss;
• assesses the harm threshold for a near miss, where it applies;
• records the immediate causes as conditions or actions;
• traces each immediate cause to human factors or job factors;
• separates findings from assumptions;
• identifies a system correction for each root cause being addressed;
• assigns each action and sets a due date;
• records how completion and effectiveness will be verified.

The working rule: describe the event, identify the immediate condition or action, determine the human factor or job factor that explains it, then correct the system and verify the change.

Common Root Cause Analysis Mistakes to Avoid

• Stopping at the person. "Worker error", "not paying attention" and "failed to follow procedure" describe an action, not a cause.
• Writing labels instead of findings. "Lack of training" or "unsafe work" can't be acted on. Say what was missing, how it contributed and what shows it.
• Settling on a single root cause. Most events have several. Follow every immediate cause back, not just the most obvious one.
• Treating categories as codes. Ticking a box isn't analysis. The categories are prompts; the finding is the description.
• Judging with hindsight. Ask what people knew and saw at the time, not what you know now.
• Ignoring near misses. Analyzing only injuries means waiting for harm to learn what a near miss could have taught you for free.
• Choosing weak corrections. Reminders, new signs and retraining rarely change the conditions behind an event.
• Closing actions before checking them. A correction isn't finished until its effectiveness check is recorded.

Download the Root Cause Analysis Worksheet and Guides

• Root Cause Analysis Worksheet (PDF). A fillable worksheet with clickable checkboxes that follows the loss causation path: the event record, actual and potential loss, the harm threshold for near misses, immediate causes, human factors and job factors, system corrections and a closing checklist.
• Root Cause Analysis Quick Guide (PDF). A two-page summary of the path, the key terms, the cause prompts and the working rule, sized to keep with your investigation kit.
• Root Cause Analysis Explanation Guide (PDF). An 11-page guide to getting from the event to the root causes: the questions to ask and evidence to look for under every category, how to know when you've reached a root cause, weak and stronger findings, and two worked cause chains.

Adapt the worksheet to your workplace and confirm the investigation requirements for your own jurisdiction.

About the author

John Duplessis, B.Sc., CRSP

President and Principal Health & Safety Consultant

John Duplessis is a Canadian Registered Safety Professional with more than 30 years of occupational health and safety experience in oil and gas, construction, green energy, midstream operations and industrial project work.

Meet our team