Incident Investigation: Five Whys vs Fishbone vs RCA

F3 comparison for incident investigators, EHS managers, and operational leaders

Five Whys, Fishbone, and Root Cause Analysis serve different investigation needs. Five Whys follows a narrow causal chain, Fishbone widens the search for contributing conditions, and RCA organizes evidence into decisions about barriers, ownership, and prevention. The right choice depends on what the incident evidence can support and what leaders must change afterward.

A familiar template can make an investigation look disciplined while leaving the decisive question untouched. If the team starts asking why before establishing what happened, which barriers were available, and where the work differed from the plan, the method becomes a story generator rather than an evidence test.

What should determine the investigation method?

The first criterion is the shape of the event. A single equipment malfunction with a verified sequence may support a focused causal chain. A serious incident involving production pressure, temporary work, weak handover, and incomplete controls needs a wider inquiry because the outcome emerged from interacting conditions.

The second criterion is the decision that must follow. A supervisor may need a fast explanation before restarting a task, while a plant manager may need to decide whether a design, staffing model, permit process, or escalation route must change. One investigation can serve both needs, but the analysis must distinguish immediate containment from systemic correction.

James Reason’s work on active failures and latent conditions is useful here because it prevents investigators from treating the last visible action as the whole explanation. Andreza Araujo makes a related distinction in The Illusion of Compliance, where a documented process is not treated as proof that the intended control operated in the field.

When does Five Whys fit the evidence?

Five Whys fits a narrow problem whose mechanism is observable, whose evidence is reasonably complete, and whose causal chain does not branch into several independent conditions. It is valuable when the team needs to move beyond the immediate error without turning a short review into an unfocused workshop.

For example, if a guard was removed, the removal was confirmed, the task required access behind the guard, and the approval path is documented, the team can ask why the exposure was created and why the control was not restored. Each answer still needs evidence. “The operator was careless” is not a finding because it describes a judgment rather than a condition that can be tested.

The weakness appears when investigators force a complex event into one vertical chain. A falling object may involve equipment condition, storage design, inspection quality, workload, supervision, and a decision to continue after a warning. Choosing one line of why can hide the parallel conditions that made the event possible.

When does a Fishbone diagram widen the search?

A Fishbone diagram helps when the initial account is too narrow and the team needs to organize possible contributors before deciding which ones are real. Its value is not the shape of the diagram. Its value is the deliberate interruption of premature closure.

The categories should match the event rather than follow a ritual list. Depending on the incident, the team may examine equipment, task design, materials, environment, competence, supervision, workload, maintenance, change control, and management decisions. Each branch is a question, not a conclusion.

The team should mark every proposed contributor as observed, supported by records, contradicted, or still unknown. That discipline connects the diagram to evidence triangulation, which tests whether interviews, physical conditions, records, and work methods support the same finding.

When does Root Cause Analysis add decision depth?

RCA is the stronger choice when the investigation must explain how the organization allowed an exposure to persist, how barriers were expected to work, and why earlier signals did not produce a timely decision. It gives leaders a way to connect the event with control ownership rather than stopping at a local correction.

A useful RCA structure separates the event sequence, contributing conditions, failed or absent barriers, decision points, and action ownership. It also records what the evidence cannot prove. A conclusion that cannot identify its evidence base should remain a hypothesis, even when it sounds plausible.

This depth matters after a serious incident because retraining the last person involved can create the appearance of action without changing the exposure. The post-incident review should therefore connect with post-incident action planning and require verification that the control changed in the work, not only in the procedure.

How do the three methods compare?

The table is a decision aid, not a ranking. Five Whys is not inferior because it is simpler, and RCA is not superior because it is longer. A method is appropriate when it matches the uncertainty, consequence, and action required by the event.

What changes after a near miss?

A near miss often deserves a different level of analysis than a serious injury, but the distinction should not be reduced to outcome alone. A high-potential near miss with several failed barriers may require the same depth as an injury because the absence of harm resulted from timing, position, or chance rather than dependable control.

For a contained event with a clear mechanism, Five Whys may be enough to remove the immediate condition and test the relevant work practice. When the near miss exposes a repeated weakness across shifts or sites, a Fishbone review can reveal the wider pattern, while RCA can turn the pattern into a decision about design, staffing, maintenance, or governance.

The team should also compare the event with prior warnings. A near-miss review, incident investigation, and barrier analysis answer different questions, although they can share evidence. The important issue is whether the organization recognizes the signal before a more severe outcome supplies the urgency.

How should leaders protect investigation quality?

Leaders influence the investigation before the team opens its first template. If the restart date, production target, or disciplinary expectation is fixed in advance, investigators may search for a defensible person to blame instead of testing the conditions that shaped the event.

Senior leaders should ask what evidence supports each causal statement, which barrier was supposed to prevent the exposure, who owned that barrier, and how the corrective action will be verified. Those questions keep the review connected to decisions rather than presentation quality.

Andreza Araujo’s safety work emphasizes the distance between declared controls and operated controls. That principle should guide the review of procedures, permits, training, and audits, each of which may exist while the work still contains an uncontrolled exposure.

Which method fits each incident context?

Clear equipment failure with a contained sequence. Start with Five Whys, then confirm that the chain does not conceal a maintenance, design, or change-control issue. Escalate when the evidence branches.

Conflicting accounts and incomplete early evidence. Use a Fishbone diagram to widen the inquiry, label assumptions, and test each branch against scene evidence, records, and the work method that was available.

Serious injury, fatality, or high-potential near miss. Use an RCA structure that examines barriers, decisions, latent conditions, and action verification. Five Whys can still examine one narrow mechanism inside that wider analysis.

Repeated events across teams or sites. Compare individual investigations, then use RCA to identify the common control weakness. A local explanation is not enough when the same exposure survives different supervisors and locations.

What is the practical recommendation?

Do not ask which investigation method is universally best. Ask which method can support the decision that the event now requires. Use Five Whys when the causal path is narrow, Fishbone when the search must widen, and RCA when leaders must change barriers, ownership, or operating conditions.

The strongest investigation may combine all three without confusing their roles. Widen the inquiry, test a specific chain, and then connect verified findings to actions that someone owns and someone else can check. That sequence is more reliable than selecting a fashionable template and treating its output as the truth.

For a broader view of safety culture, risk ownership, and prevention, visit Andreza Araujo and explore the books and learning resources that connect investigation quality with leadership action.