Root Cause Analysis: A Practical Guide to Effective Incident Investigation

When something goes wrong at work, it’s tempting to stop at the obvious answer: the worker didn’t follow the procedure. Root cause analysis asks why, and keeps asking until it reaches causes you can actually fix, such as unclear procedures, poor equipment design, time pressure or gaps in training. This guide covers the levels of cause, the steps of an investigation, the most useful RCA methods, and how to make sure corrective actions stick.

The three levels of cause

• Immediate cause: the event that directly led to the incident, such as a forklift reversing into a pedestrian.
• Underlying cause: the conditions that allowed it, such as no separation between the walkway and the forklift route, or a reversing alarm that didn’t work.
• Root or systemic cause: the gaps in the system behind those conditions, such as no traffic management plan, or pre-start checks that don’t lead to repairs.

Fixing only the immediate cause usually means the problem comes back in a different form.

How to conduct a root cause analysis

1. Make the scene safe and preserve it. Provide first aid, control ongoing risks and, for notifiable incidents, preserve the site and notify the WHS regulator as required.
2. Gather the facts. Collect photos, witness accounts, records, maintenance history, rosters and procedures while details are fresh.
3. Build the sequence of events. Put together a timeline of what happened, before, during and after.
4. Analyse the causes. Use an RCA method to work back from what happened to why it happened, at each level.
5. Agree corrective actions. Set actions that address the root causes, with owners and due dates.
6. Follow up and share lessons. Check actions are completed and effective, and share what was learned.

Root cause analysis methods

The 5 Whys

Ask “why?” repeatedly, usually around five times, until you reach a cause you can fix. It is quick and works well for simpler incidents. See our step-by-step guide to the 5 Whys.

Fishbone (Ishikawa) diagram

Groups possible causes into categories, such as people, equipment, methods, materials, environment and management. It helps teams think broadly and avoid fixating on one cause.

ICAM

The Incident Cause Analysis Method is widely used in Australian mining, aviation and other high-risk industries. It looks at absent or failed defences, individual and team actions, task and environmental conditions, and organisational factors.

Timeline and change analysis

Compares what happened with what normally happens, to find what changed: a new crew member, a different machine, a rushed job or a changed procedure.

Corrective actions that stick

• Target the root cause: retraining one worker rarely fixes a system problem.
• Use the hierarchy of controls: prefer removing the hazard, isolation and engineering controls over signs and reminders. See our guide to workplace risk assessments.
• Be specific: each action needs a named owner, a due date and a clear description of done.
• Verify: check the action was completed and that it worked, for example through a follow-up inspection.
• Update: revise risk assessments, procedures and checklists so the fix becomes part of how work is done.

Common mistakes

• Stopping at human error: “worker didn’t follow the procedure” is a starting point, not a root cause.
• Blame: people stop reporting when investigations are about finding someone to blame.
• Too slow: evidence and memories fade quickly.
• Weak actions: “remind staff to be careful” won’t prevent a repeat.
• No follow-up: actions stay open or are closed without checking they worked.

Investigations in DIGI CLIP

Safety Tracker, included in the DIGI CLIP Compliant plan, has an investigation template that links to our 5 Whys guide for root cause analysis. Investigators select the severity level and investigation type, and corrective actions added in the investigation flow into the Action Log, where they are assigned, tracked and closed out with evidence. Each form is location- and time-stamped.

Illustrative scenario: a repeat hand injury

After a second hand injury on the same packing machine in three months, a site investigates using a fishbone diagram. They find a guard is removed to clear jams because jams are frequent, and jams are frequent because a worn feed roller was never replaced. Actions are raised to replace the roller, fit an interlocked guard and add the roller to the maintenance schedule. Each is closed out with evidence, and a follow-up inspection a month later confirms jams have dropped.

This scenario is illustrative. It shows how a business could use DIGI CLIP and is not an account of a specific customer.