Last updated:
The 5 Whys is a root cause analysis method where you ask "Why?" again and again, starting from what happened, until you reach a cause in your systems or processes that, if fixed, would stop it happening again.
The 5 Whys Incident Investigation Methodology: A Step-by-Step Guide
A practical guide to finding the real cause of an incident, and proving it's been fixed.
The 5 Whys helps you look past the obvious answer ("the floor was slippery") to the system gap behind it ("there was no working maintenance reminder"). Done well, it gives you a root cause you can act on and a clear record of what you did about it.
Using DIGI CLIP Safety Tracker? This guide follows the investigation template section by section. Jump to the template walkthrough.
What Is the 5 Whys Method?
The 5 Whys is a simple root cause analysis technique. You start with a clear statement of what happened, ask why it happened, then ask why again about each answer. Each "why" moves you one step further from the immediate cause and closer to the underlying system or process factor.
Five is a guideline, not a rule.
Keep asking until you reach a cause that, if addressed, would have prevented the incident or significantly reduced the risk. Sometimes that's three whys, sometimes it's seven.
When to Use the 5 Whys
- Incidents and near misses with a fairly clear chain of events
- Investigations where you need a clear, practical answer quickly
- Checking whether a corrective action actually addressed the cause
- As a starting point before deeper tools such as a fishbone (Ishikawa) diagram or bow-tie analysis
Strengths
- Simple to learn, with no specialist training or software required
- Keeps the focus on systems and processes rather than blaming individuals
- Produces a clear, easy-to-follow record of your reasoning
Limitations
- Can oversimplify complex events if it's the only tool you use
- Tends to follow a single chain, so it can miss other contributing causes
- Only as good as the evidence behind each answer
Basic or Comprehensive Investigation?
For a basic investigation (Low severity with minor or quickly reversible harm, or Moderate severity where there's no regulator trigger or repeat pattern), a single 5 Whys chain is often enough. For a comprehensive investigation (High or Critical severity, regulator-notifiable events, multiple contributors or systemic risks), run a separate 5 Whys chain for each significant contributing factor, and consider pairing it with a broader tool.
In Safety Tracker, the investigator chooses both the Severity Level and the Investigation Type. Neither is set automatically, so use the criteria above as a guide and record your reasoning in Justification for Investigation Type.
How to Do a 5 Whys Analysis, Step by Step
- Define the problem. Write a clear, factual statement of what happened: who, what, where and when. Stick to what was observed and avoid assumptions or blame.
- Ask the first "Why?" Record the immediate cause, for example "there was oil on the floor". Note the evidence that supports it, such as photos or witness statements.
- Keep asking "Why?" Ask why about each answer in turn. Each answer should be supported by evidence, not guesswork. Stop when you reach a system or process factor, such as "there was no preventative maintenance reminder".
- Identify the root cause. Test your answer: if this were fixed, would the incident have been prevented or the risk significantly reduced? If not, keep going or look for another chain.
- Define corrective and preventative actions. Give each action an owner and a due date. Aim for controls that fix the system, such as engineering changes, scheduled maintenance or updated procedures, rather than relying only on reminders to "be more careful".
- Verify effectiveness and sign off. Once actions are complete, check that the risk is actually controlled, for example through a follow-up inspection, a review of trend data or an audit check. Record the result before the investigation is signed off and closed out.
Worked Example: Slip in a Warehouse
This is an illustrative example to show the method. It isn't based on a specific incident.
Problem statement: A worker slipped and fell in the warehouse dispatch area at 11:20 am.
- Why did the worker slip? There was hydraulic oil on the floor.
- Why was there oil on the floor? A forklift was leaking hydraulic fluid.
- Why was the forklift leaking? Its scheduled preventative maintenance was overdue.
- Why was the maintenance overdue? The maintenance schedule wasn't being followed.
- Why wasn't the schedule followed? There was no reminder or accountability process to flag when a service was due.
Contributing factors: Equipment Failure, Organisational Factors.
Root cause: No effective process for scheduling, reminding and confirming preventative maintenance.
Corrective actions:
- Set up scheduled maintenance reminders for all forklifts (owner: Warehouse Manager, due in 2 weeks)
- Add a supervisor sign-off when each service is completed (owner: Maintenance Supervisor, due in 2 weeks)
- Add a hydraulic leak check to the daily forklift pre-start (owner: WHS Coordinator, due in 1 week)
Verification: Forklift pre-starts and maintenance records reviewed after three months showed no overdue services and no reported leaks. The investigation was then signed off and closed out.
Common Mistakes to Avoid
- Stopping at "human error". If the answer is "the worker wasn't careful", ask why the system allowed that to lead to harm.
- Following only one chain. Many incidents have more than one contributing cause. Run a separate chain for each significant one.
- Guessing instead of checking. Every answer should be backed by evidence such as photos, records or statements.
- Jumping to a fix too early. Agree on the root cause before deciding on actions.
- Choosing weak actions. Retraining or a toolbox talk on its own rarely fixes a system gap.
- Never checking the result. An action marked complete isn't the same as a risk that's been controlled.
Evidence and Validation Checks
Good Practice
- Involve the people closest to the work and capture their perspective early
- Frame causes as system or process gaps rather than individual blame
- Record every action with an owner, a due date and how it will be verified
- Review similar incidents regularly to spot patterns and weak signals
Evidence to Attach
- Photos of the scene, equipment and any isolation points
- Maintenance logs, procedures and SWMS or JSEA excerpts
- Witness statements and interview notes
- Training and competency records and toolbox talk records
Validation Checks
- Is the root cause supported by the evidence?
- Would fixing it prevent the incident happening again, or significantly reduce the risk?
- Are the actions proportionate to the risk and reasonably practicable?
Using This Guide With Your Safety Tracker Investigation
The DIGI CLIP Safety Tracker investigation report has the 5 Whys built in. Here's how each part of the template lines up with this guide.
| Template Section | What to Record | Guide Step |
|---|---|---|
| Investigation Type | Choose Basic or Comprehensive and explain why in Justification for Investigation Type | When to use |
| Incident Details | Date and time of the incident, location and area | Step 1 |
| Investigation Summary | Incident Overview (your factual problem statement), then choose the Severity Level: Critical, High, Moderate or Low | Step 1 |
| Investigation Status and Workflow | Lead investigator, start date and required completion date | Before you start |
| Witness Statements | Use Add Witness to record what each witness saw. It's optional, but statements are valuable evidence for your Why answers | Steps 2 and 3 |
| Personnel Information | Use Add Person for each person involved in the incident | Step 1 |
| Contributing Factors | Tick every factor that applied, such as Unsafe Condition, Equipment Failure or Organisational Factors | Steps 2 to 4 |
| 5 Whys Analysis | One answer per Why field. Use Continue Beyond 5 Whys if you need more | Steps 2 and 3 |
| Root Cause Explanation | The root cause, and how the contributing factors and 5 Whys led you there | Step 4 |
| Corrective Actions | Use Add Action for each action, with an owner and due date | Step 5 |
| Attachments | Photos, statements and records that support your findings | Evidence |
| Sign-Off | Sign off once actions are complete and their effectiveness has been checked | Step 6 |
Use Save Progress as you go, and Generate PDF when you need to share a copy. Corrective actions are followed through in the Action Log, and once the investigation is closed out, the record is final and retained for audit, regulatory and insurance purposes.
Frequently Asked Questions About the 5 Whys
Is it always exactly five "Whys"?
No. Ask as many as you need to reach a cause that, if addressed, would prevent the incident or significantly reduce the risk. In Safety Tracker, use Continue Beyond 5 Whys if you need more than five.
Can we combine the 5 Whys with other root cause analysis tools?
Yes. For complex incidents, the 5 Whys works well alongside a fishbone (Ishikawa) diagram to map contributing factors, or a bow-tie analysis to look at controls.
Who should lead a 5 Whys investigation?
Someone trained in incident investigation, supported by the people closest to the work. Involving supervisors and workers who know the task helps make sure each answer is based on what actually happens.
What counts as a good corrective action?
One that addresses the root cause, has an owner and a due date, and can be checked. Actions that change the system, such as equipment changes, scheduled maintenance or updated procedures, are usually stronger than retraining or reminders on their own.
How do we verify an action was effective?
Check the result after the action is complete, for example with a follow-up inspection, a review of incident or defect trends, or an audit. Record what you checked and what you found before signing off.
Should I choose a Basic or Comprehensive investigation?
A Basic investigation suits Low severity incidents with minor or quickly reversible harm, and Moderate severity incidents where there's no regulator trigger or repeat pattern. Choose Comprehensive for High or Critical severity outcomes, regulator-notifiable events, incidents with multiple contributors or systemic risks, or where there's community or reputational concern. The investigator makes this choice and records why in Justification for Investigation Type.
Where do I record the 5 Whys in Safety Tracker?
In the Root Cause Analysis and 5 Whys section of the investigation report. Tick the contributing factors, complete each Why field, then summarise the root cause in Root Cause Explanation.
Find It. Fix It. Prove It.
DIGI CLIP Safety Tracker gives you a structured investigation template with the 5 Whys built in, corrective actions tracked in the Action Log and a record that's ready when someone asks for it.
Free 14-day trial. No credit card required.
About DIGI CLIP
DIGI CLIP is an Australian-built mobile checklist, forms and inspection platform. Safety Tracker adds incident reporting and investigation, with corrective actions followed through to close-out in the Action Log. Inspections. Actions. Evidence.
