Root cause analysis and the 5 whys method
A root cause analysis (RCA) looks for the real cause of a problem instead of the symptom. The best-known method is 5 whys: you keep asking “why did this happen?” until you reach a cause you can remove in a lasting way. Only then do you choose a measure.
Every ISO management system standard requires a cause analysis for nonconformities. It appears in clause 10.2 of ISO 9001 , and the same requirement applies to ISO 14001, ISO 45001 and ISO 27001. The certifying body also expects it: ISO/IEC 17021-1 requires you to analyse the cause of every nonconformity found in an external audit. See also nonconformities and corrective actions under ISO 9001 and CAPA under ISO 13485. The cause analysis is one step in the wider CAPA process with a CAPA register.
Why does an ISO standard ask for a root cause analysis?
If you do not remove the cause, you only fix the symptom. Then the problem comes back. For this reason the standards distinguish between a correction and a corrective action.
| Term | What it is | Example |
|---|---|---|
| Correction | Fixing the immediate problem | Swapping out the wrong delivery |
| Cause | The reason it could happen | The order picker used an outdated item list |
| Corrective action | Removing the cause so it does not return | Item list only digital, updated automatically |
An auditor who sees “employee spoken to” as the measure knows that no cause analysis was done. This is one of the most common findings at a surveillance audit.
How does the 5 whys method work?
You start with the problem and ask why. You then ask why again about the answer. The number five is a rule of thumb, not a requirement. Sometimes you reach a cause after three questions, sometimes only after six. You stop when the answer is a cause that you can change in your process, system or organisation.
The method comes from the Toyota production system. It is also widely used in healthcare. The Institute for Healthcare Improvement has published a worked worksheet for it.
Example: 5 whys for a nonconformity from an external audit
During the surveillance audit at a metalworking company, the auditor finds a calliper whose calibration expired four months earlier. Measurements for final inspection were made with it during that period. The company carries out a 5 whys analysis.
| Step | Question | Answer | Evidence |
|---|---|---|---|
| 1 | Why had the calibration expired? | The calliper was not sent to the calibration lab | Calibration overview |
| 2 | Why was it not sent? | It was not on the list that the quality officer uses | List checked: missing |
| 3 | Why was it not on the list? | The workshop buys new measuring equipment and does not report it | Purchase invoice from March |
| 4 | Why is it not reported? | The purchasing process has no step for registering measuring equipment | Purchasing procedure |
| 5 | Why does the purchasing process lack that step? | When the system was set up, only existing measuring equipment was reviewed | Procedure version history |
Root cause: the purchasing process does not ensure that new measuring equipment enters the calibration system.
Correction: the calliper was calibrated immediately, and the measurements from the previous four months were assessed for impact.
Corrective action: a mandatory field “measuring equipment yes/no” was added to the purchasing system. If the answer is “yes”, the quality officer receives a notification automatically.
Effectiveness: after three months, the company checked whether all newly purchased measuring equipment appeared on the list. Result: four out of four registered.
Record the evidence for each why step. Without evidence, a 5 whys is a guess in five steps. With evidence, it is an analysis that an auditor accepts.
Template: cause analysis for your nonconformity register
Use these fields in your register or form. They cover what ISO 9001 clause 10.2 requires and what the certifying body expects to see for a nonconformity.
| Field | What you enter |
|---|---|
| Problem | What went wrong, where, when, how often? |
| Correction | What did you do immediately to limit the consequences? |
| Scope | Could it also occur elsewhere? (other department, product, location) |
| Analysis | 5 whys or an Ishikawa diagram, with evidence for each step |
| Root cause | One sentence, focused on the process or system |
| Corrective action | What you remove, who does it, when is it finished? |
| Effectiveness check | How and when do you check that it does not return? |
Which root cause analysis method do you choose?
5 whys is not always enough. For problems with several causes, or for complaints from major clients, you need a more demanding method.
| Method | When | Effort |
|---|---|---|
| 5 whys | Single nonconformity, clear chain of causes | Low |
| Ishikawa diagram | Several possible causes, recurring problem | Medium |
| 8D report | Customer complaint, mainly in automotive and industry | High |
| Bowtie analysis | Serious incident, looking at which barriers failed | Medium to high |
| FMEA | Beforehand: prevent failure modes in design or process | High |
Step by step: root cause analysis in your management system
Record the problem factually
What, where, when, how much. No question of blame, no solution yet.
Take a correction
Limit the damage. Determine whether the same problem occurs elsewhere.
Analyse the cause
Choose the method that fits the seriousness. Involve the people who do the work.
Choose and carry out the measure
Aim the measure at the root cause. Record an owner and a deadline.
Check effectiveness
Schedule a moment to measure whether the problem stays away. Only close the case after that.
Common mistakes in root cause analysis
- “Human error” as the root cause. People make mistakes. The question is why the system did not catch the mistake.
- Stopping at the first why. “The machine was set up wrong” is a symptom, not a cause.
- Measure = training. Re-instructing staff rarely helps when the cause lies in a process.
- No effectiveness check. Without a check you cannot show that the measure works. This often leads to a minor nonconformity.
Root cause analysis per standard
The approach is the same everywhere, but the context differs. Under ISO 45001 you use the cause analysis for incidents and accident investigation. Under ISO 27001 you use it after a security incident. Under ISO 13485 you use it within the CAPA process.