Incident Investigation Guide

The 5 Whys Incident Investigation Methodology: A Step-By-Step Guide

The 5 Whys incident investigation methodology is a fast, reliable way to uncover the root cause of an event. By asking “Why?” repeatedly until systemic factors are revealed, you move beyond symptoms, document targeted corrective actions, and prevent recurrence.

What Is the 5 Whys Method?

Definition: The 5 Whys is a root cause analysis technique that involves asking “Why?” successively (often five times) to trace an incident from the immediate cause back to underlying system or process factors.

Quick Tip

Five is a guideline—not a rule. Continue asking “Why?” until you reach a cause that, if addressed, would have prevented the incident.

When to Use 5 Whys

  • Rapid investigations where speed and clarity are essential
  • Incidents or near misses with straightforward causal chains
  • Continuous improvement and corrective action validation
  • As a precursor to deeper tools (e.g., fishbone/Ishikawa, bow-tie)

Strengths

  • Simple, low-barrier method—no specialist software required
  • Drives a no-blame, learning culture focused on systems
  • Supports ISO 45001 and WHS due diligence principles

Limitations

  • May oversimplify complex events if used alone
  • Requires evidence to avoid bias or “single-story” causes
  • Best paired with structured documentation and sign-off

How to Do a 5 Whys Analysis (Step-By-Step)

Define the Problem

Write a clear problem statement (who/what/where/when). Avoid assumptions and blame—stick to observable facts.

Ask the First “Why?”

Capture the immediate cause (e.g., “floor was oily”). Record supporting evidence (photos, witness notes).

Ask Subsequent “Whys?”

Continue asking “Why?” until reaching a systemic/process factor (e.g., “no preventive maintenance schedule”).

Identify the Root Cause

Test root cause candidates: If corrected, would the incident be prevented or the risk significantly reduced?

Define Corrective & Preventive Actions

Assign owners and due dates. Link actions to the hazard/incident record for tracking and verification.

Verify Effectiveness

After implementation, confirm the risk is controlled (e.g., targeted inspection, data trend review, audit check).

Worked Example

Problem: Worker slipped and fell in the warehouse.

  1. Why did the worker fall? → Oil on the floor.
  2. Why was there oil? → Forklift leaked hydraulic fluid.
  3. Why did it leak? → Preventive maintenance overdue.
  4. Why overdue? → Maintenance schedule not followed.
  5. Why not followed? → No reminder/accountability workflow.

Root Cause: Lack of an effective preventive maintenance scheduling and reminder process.

Actions: Implement maintenance reminders, supervisor sign-off, and post-maintenance verification logs.

Best Practices & Evidence

  • Involve people closest to the work—capture their perspectives early
  • Document evidence (photos, inspection records, interview notes)
  • Frame causes as system/process gaps rather than individual blame
  • Record actions with owners, dates, and verification criteria
  • Periodically review similar incidents to identify patterns and weak signals

Evidence to Attach

  • Photos of scene/equipment and isolation points
  • Maintenance logs, procedures, SWMS/JSEA excerpts
  • Training/competency records and toolbox talks

Validation Checks

  • Is the identified root cause supported by facts?
  • Would fixing it prevent recurrence?
  • Are actions proportionate to risk and reasonably practicable?

Digital Documentation & Workflows

Using a structured digital form simplifies consistency, traceability, and audits. Helpful capabilities include:

  • Dedicated 5 Whys fields with photo/file attachments
  • Action assignment with due dates and completion evidence
  • Email notifications when a form is submitted or actions are created/updated

Note for DIGI CLIP users: Offline usage is supported; forms must be manually submitted once connectivity is restored. Alerts are email-only and are triggered by smart fields, form submission, or the Action Register.

Further Reading & Resources

Frequently Asked Questions

Is it always exactly five “Whys”?

No. Use as many as needed to reach a cause that would prevent or significantly reduce recurrence if addressed.

Can we combine 5 Whys with other RCA tools?

Yes. Use 5 Whys to quickly hypothesise root causes, then validate with tools like fishbone diagrams, fault tree, or bow-tie analysis.

Who should lead a 5 Whys investigation?

A trained investigator or supervisor, with input from people closest to the task and support from HSEQ personnel.

What counts as a good corrective action?

Actions that address system/process factors (procedures, training, maintenance, design). Assign owners, due dates, and verification steps.

How do we verify effectiveness?

Schedule a review after implementation (inspection, data trend check, or audit) to confirm the control is working.

Back to top ↑

If you liked this post, why not share it!

Revolutionising Compliance with Digital Checklists