Incident Investigation: 4 Myths That Make Root Cause Analysis Look Complete

Most investigation reports fail long before the final approval meeting. They fail when the team accepts an explanation that sounds reasonable, fits the form, and leaves the original work conditions largely untouched.

That is why root cause analysis deserves a harder question than “Who made the mistake?” The useful question is whether the evidence explains how the exposure became possible, why the available controls did not stop it, and what will be different when a comparable task happens again.

Across more than 25 years leading EHS work in multinational operations, Andreza Araujo has seen the same pattern repeat. Organizations invest serious effort in investigating an event, then protect the appearance of completion more carefully than they test the control that was supposed to change.

Why these myths survive the investigation meeting

Investigation teams usually work under pressure from several directions. Operations wants the area released, leaders want a clear explanation, legal and compliance teams want a defensible record, and the affected crew wants to know whether the next shift will face the same condition. A simple story appears to satisfy all four needs.

The problem is that simplicity is not the same as clarity. James Reason's distinction between active and latent failures shows why an event can involve a visible action at the workface and a set of less visible decisions that made that action likely. If the investigation stops at the last action, it may produce a person to coach without producing a control that can hold.

Myth 1: The last unsafe act is the root cause

The first myth treats the final action before the event as the explanation for everything that came before it. An operator bypassed a guard, a technician entered before the isolation was confirmed, or a driver reversed without the expected spotter. The report names the act, adds a retraining action, and moves toward closure.

The act matters, but it is only one piece of evidence. Ask what the person believed the task required, what the written method said, whether the control was available and usable, how the supervisor understood the condition, and what production or maintenance decisions shaped the sequence. The person may have violated a clear control, or the system may have presented a nominal control that was difficult to apply in the actual work.

A better investigation separates the immediate action from the conditions that supported it. It then tests those conditions against interviews, photographs, equipment state, permits, shift records, planning documents, and the physical sequence of the task. The result is not a softer report. It is a more accurate one, because it distinguishes responsibility from causation.

Andreza's book Sorte ou Capacidade, known in English as Luck or Capability, is useful for this distinction. A serious event should not be explained by luck, nor should the person nearest the hazard absorb every explanation that belongs to planning, design, supervision, or authorization.

Myth 2: Five whys automatically finds the deepest cause

Asking “why” several times can expose a weak first answer, but the number of questions does not create causal quality. A team can ask why five times and still produce a neat chain that depends on assumptions, skips competing explanations, or ends with a vague label such as “poor safety culture.”

Root cause analysis is stronger when each link in the chain can be tested. If the report says the worker rushed, what evidence shows that time pressure affected the decision? If the report says training was inadequate, which part of the task could the person not perform, and why was training expected to compensate for a missing engineering or planning control?

Use the method as a questioning aid, not as a proof mechanism. Build more than one plausible causal path, identify what evidence would support or weaken each path, and keep the explanation at the level of decisions and conditions that the organization can actually change. When the team cannot test a link, it should label that link as an assumption rather than promote it to a root cause.

This discipline also protects the investigation from fashionable language. A phrase can sound analytical while saying very little. “Human error,” “lack of awareness,” and “communication failure” describe a problem category, but they do not yet explain the local sequence that leaders need to change.

Myth 3: More corrective actions mean better prevention

A long action list often reassures reviewers because it creates visible movement. The list may include a toolbox talk, a procedure revision, a poster, a training refresher, a leadership communication, and a new audit question. None of those actions is automatically useless, yet quantity can hide the absence of a strong control decision.

Start with the exposure that must no longer be possible or likely. Then ask which action changes the equipment, sequence, authorization, separation, staffing, competence requirement, or supervision that allowed the event to develop. If an action only tells people to be more careful while the same design and schedule remain, it may improve awareness without changing the risk.

Each action should have a clear owner, a defined completion condition, and a verification method that examines the work rather than the paperwork. “Procedure updated” is a document status. “Isolation point redesigned, tested under the maintenance sequence, and accepted by the technicians who use it” is evidence of a control decision.

In Muito Além do Zero, translated as Far Beyond Zero, Andreza Araujo challenges the comfort of targets that make safety look successful while the underlying exposure remains. The same challenge applies to action counts. A report with twelve weak actions is not stronger than a report with three actions that remove the conditions behind the event.

Myth 4: Report approval means the risk is controlled

Approval confirms that the organization has accepted a report. It does not confirm that the field condition changed. This distinction is easy to lose when action tracking systems convert investigation status into a green dashboard and leaders have more closure data than direct evidence.

Verification should occur in a comparable task, under conditions that could recreate the original exposure. If the event happened during a night maintenance window, test the control during that window. If contractor handover was part of the failure, observe the handover with the people and interfaces that normally make it difficult. A demonstration in a quiet office cannot verify a control that must survive operational pressure.

Ask the workers what changed, what remains difficult, and what they would do if the same constraint returned. Compare their answers with the procedure and with what the supervisor can actually authorize. This is where psychological safety has a practical role. People need enough confidence to report that an action is incomplete, while leaders need enough discipline to treat that information as control evidence rather than as resistance.

If the verification fails, reopen the decision. The investigation is not weakened by learning that the first action was insufficient. It is weakened when the organization knows the control did not hold and still keeps the report closed.

What to do instead of accepting a polished explanation

Use a short review before the investigation is approved. The review should be led by someone who can challenge the explanation and ask for field evidence, not only by the people who wrote the report. Keep the questions concrete:

• What evidence supports each important causal link?
• Which conditions made the final action more likely?
• What control is changing, and how will the change be tested?
• What would show that the action failed or only moved the exposure?

The review should also separate three decisions that are often blended together. The first is what happened. The second is why the organization allowed the exposure to exist. The third is what must change before comparable work is accepted as controlled. Keeping those decisions separate makes the report easier to challenge and easier to use.

For a practical companion, the article Incident Evidence: Facts, Interpretations, Assumptions helps investigators distinguish what they know from what they infer. That distinction is the foundation of a credible causal explanation.

FAQ

What makes a root cause analysis look complete when it is not?

A root cause analysis can look complete when it has a finished timeline, an approved report, and several actions, even though the evidence does not support the explanation or the changed control has not been tested in the work. Completion is a verification question, not a formatting question.

Should an incident investigation name the person who made the mistake?

The investigation should identify the decision, action, or omission that preceded the event, but it should also examine the conditions that shaped that choice. James Reason's work on active and latent failures helps investigators avoid treating the last visible action as the whole explanation.

Is the five-whys method enough for root cause analysis?

The five-whys method can help a team keep asking questions, but it does not guarantee a valid causal explanation. Investigators still need evidence from the task, equipment, supervision, planning, interfaces, and management decisions, together with a check that the proposed action addresses the exposed condition.

How can leaders verify that a corrective action worked?

Leaders should observe a comparable task after implementation, confirm that the intended control is present and usable, ask the people performing the work what changed, and check whether the original exposure can still be recreated. A closed action without field evidence is an administrative status, not proof of risk reduction.