5 Whys Alternatives for Safety Investigations

The 5 Whys is one of the best-known tools in incident investigation.

Its appeal is obvious. Something happened. Ask why. Then ask why again. Continue until you reach a deeper explanation.

Used well, the method can move an investigation beyond immediate conclusions such as:

• the employee made a mistake,
• the procedure was not followed,
• the equipment failed, or
• someone was not paying attention.

That is useful. OSHA's current incident-investigation guidance likewise encourages investigators to keep asking why when they encounter an immediate explanation and warns against stopping at worker error or a procedure violation. OSHA also notes that incidents often involve multiple underlying factors rather than a single cause.

But the 5 Whys has a limitation:

Real events do not always develop in a straight line.

What Is the 5 Whys Method?

The method usually starts with an event or problem.

For example:

A machine unexpectedly stopped during production.

Why?

A protective device activated.

Why?

A component overheated.

Why?

Lubrication was inadequate.

Why?

The lubrication interval had not been completed.

Why?

The preventive-maintenance schedule did not include the revised equipment requirement.

The questioning has moved from an immediate equipment failure to a deeper maintenance-system issue. That is the strength of the method. It encourages continued questioning.

The Problem With a Single Chain

Now consider a more complex event. A forklift strikes a pedestrian.

Why?

The operator did not see the pedestrian.

Why?

Visibility was restricted by the load.

Why?

The load blocked the operator's forward view.

This is a reasonable line of investigation. But it may be only one line.

The same event may also involve:

• pedestrians and forklifts sharing the same route,
• changing traffic patterns,
• noise,
• inadequate physical separation,
• work scheduling,
• blind intersections,
• lighting,
• communication practices,
• delivery activity,
• supervision, and
• normal adaptations workers make to complete the job.

Which chain should the investigator follow?

Potentially several. A single 5 Whys chain can unintentionally turn a network of interacting conditions into one neat story.

The 5 Whys Is a Questioning Technique, Not Proof

This distinction is important. Asking why does not establish that the answer is true.

Suppose an investigator writes:

Why did the worker miss the warning?

Because the worker was distracted.

Why was the worker distracted?

Because production pressure caused the worker to rush. That may sound plausible.

But what evidence shows the worker was distracted?

What evidence demonstrates production pressure?

Was the worker actually rushing?

Were other conditions present?

A chain of plausible answers is not the same as a supported explanation. Every important link should be tested against evidence.

When the 5 Whys Works Well

The technique can be particularly useful when:

• the problem is relatively bounded,
• the sequence is reasonably clear,
• investigators need help getting beyond an immediate cause,
• the questions are treated as prompts rather than proof, and
• investigators remain willing to branch into additional lines of inquiry.

It can be a good starting tool. It simply should not become a rule that every event must fit into five questions or one causal path. There is nothing special about the number five. Sometimes two questions are enough. Sometimes twenty are not.

Alternative #1: Event and Causal Factor Analysis

Event and causal factor analysis begins with the sequence of the event.

Instead of immediately asking for the root cause, reconstruct:

What happened, and in what order?

A simple timeline might include:

• normal work,
• preparation,
• changes in conditions,
• decisions,
• equipment states,
• communications,
• control actions,
• the event, and
• the response.

Then identify factors associated with important points in that sequence. This is useful because chronology can expose relationships that disappear when investigators jump directly from outcome to cause.

Example

Suppose an employee is injured while clearing jammed material.

A timeline may show:

1. Material begins feeding inconsistently.
2. Operator adjusts settings.
3. Condition continues.
4. Production backs up.
5. Operator opens an access point.
6. Material is manually repositioned.
7. Equipment movement occurs.
8. Employee is injured.

Now investigators can examine multiple points rather than only asking:

Why did the employee reach into the machine?

Alternative #2: Barrier or Control Analysis

Barrier analysis asks:

What was supposed to prevent this event?

This can be one of the most useful approaches in safety investigations.

Controls may include:

• elimination,
• physical separation,
• guarding,
• interlocks,
• alarms,
• engineering safeguards,
• procedures,
• permits,
• inspections,
• supervision,
• training, and
• personal protective equipment.

For each important control, ask:

• Was it present?
• Was it available?
• Was it functioning?
• Was it understood?
• Was it reliable?
• Could it be bypassed?
• Was it actually used?
• Did it prevent part of the event?
• Why did the remaining controls not stop the event?

This shifts attention from merely identifying what someone did to understanding how the protective system performed.

Alternative #3: Change Analysis

Sometimes the most revealing question is:

What was different?

Compare the event with normal successful work.

Look for changes in:

• equipment,
• materials,
• people,
• staffing,
• environment,
• workload,
• schedule,
• procedure,
• supervision,
• layout,
• software,
• maintenance,
• weather, or
• simultaneous operations.

Suppose a task has been completed safely hundreds of times but fails on one particular day.

Change analysis asks:

What was different about that day?

The answer may reveal conditions that are difficult to see when examining the incident in isolation.

Alternative #4: Cause Mapping

A cause map represents multiple contributing conditions rather than forcing them into one chain. Start with the event. Then ask what conditions were necessary or relevant to its development. Those conditions can branch.

For example:

Pedestrian struck by mobile equipment

might connect to:

Restricted operator visibility

and:

Pedestrian entered equipment travel area

and:

No physical separation

and:

Traffic increased during delivery period.

Each branch can then be investigated further. This makes it easier to represent an event as a network. The map should still be evidence-based. A large diagram full of unsupported causes is no better than an unsupported 5 Whys chain.

Alternative #5: Bow-Tie Analysis

Bow-tie analysis is particularly useful when you want to understand both prevention and consequence reduction. At the center is the unwanted event.

On the left:

What could lead to it?

On the right:

What could happen afterward?

Between the threats and the event are preventive controls. Between the event and consequences are mitigating controls.

For example:

Central event: Vehicle enters a pedestrian work area.

Preventive controls might include:

• route separation,
• barriers,
• traffic planning,
• controlled access, or
• equipment detection systems.

Mitigating controls might include:

• low vehicle speed,
• warning systems,
• emergency stopping capability, or
• protective refuge areas.

Bow-tie thinking is useful because prevention and consequence reduction are not always the same thing.

Alternative #6: Fault Tree Analysis

Fault Tree Analysis works backward from an unwanted event and asks what combinations of failures or conditions could produce it. It can be especially valuable in technically complex systems.

The investigator may examine whether the event required:

Condition A AND Condition B

or whether:

Condition A OR Condition B

could independently produce the event. That distinction can be important. Some incidents require several defenses to fail simultaneously. Others can occur when any one of several paths develops. Fault tree analysis can make those relationships explicit. For everyday workplace investigations, a full formal fault tree may be unnecessary.

But the underlying logic is useful:

What combination of conditions had to exist for this outcome to become possible?

Alternative #7: Learning Teams

Sometimes the investigation establishes the event sequence but exposes a bigger question:

How does this work normally happen?

A Learning Team can help explore that.

Bring together people who understand the work and ask about:

• how the task is normally performed,
• where it varies,
• what makes it difficult,
• what workers must adapt,
• what normally helps it succeed,
• where formal procedures differ from actual practice, and
• what changes could make the work more resilient.

A Learning Team does not need to wait for an incident. It can also be used proactively. This makes it different from a traditional causal-analysis technique. It is less about finding a cause and more about understanding the work system.

Alternative #8: Work-as-Done Comparison

A closely related method is comparing formal work with actual work.

Start with:

How is this task supposed to happen?

Then ask:

How does it normally happen?

Compare:

• procedures,
• training,
• equipment assumptions,
• staffing assumptions,
• scheduling assumptions, and
• control expectations

with what workers actually encounter. Differences are not automatically violations. They are information. Sometimes workers have developed effective adaptations. Sometimes they are compensating for weaknesses. Sometimes the procedure describes conditions that no longer exist. Understanding that gap can reveal important contributors to an event.

Alternative #9: Control Effectiveness Review

A control may exist on paper and still provide little protection.

Instead of recording:

Training provided

or:

Procedure exists

ask how effective the control actually is.

Consider:

• reliability,
• availability,
• dependency on human attention,
• ease of bypass,
• ability to detect failure,
• maintenance needs,
• environmental limitations, and
• consequences if the control fails.

For example:

“Workers are trained to watch for forklifts”

is a control.

So is:

“Pedestrians and forklifts are physically separated.”

They do not provide the same level of protection. A control-effectiveness review helps distinguish the existence of a control from the strength of that control.

You Do Not Have to Pick Only One Method

This may be the most important point. Investigation tools are not competing religions. You can combine them.

A practical investigation might use:

Timeline analysis
to establish what happened.

Then:

5 Whys
to explore several important conditions more deeply.

Then:

Barrier analysis
to examine control performance.

Then:

Change analysis
to understand what was different.

Then:

A Learning Team
to understand how the work normally happens.

The method should serve the investigation. The investigation should not be forced to serve the method.

A Practical Combined Approach

For many workplace events, this sequence works well.

1. Establish the event

Define what happened without embedding a causal conclusion.

2. Preserve the evidence

Collect information before it changes.

3. Build the timeline

Understand the sequence.

4. Identify important conditions

Where did the event develop or change direction?

5. Ask why

Use repeated questioning—but allow multiple branches.

6. Examine the controls

What was supposed to prevent or limit the event?

7. Compare normal work

What usually happens differently?

8. Look for changes

What was unusual this time?

9. Test competing explanations

What else could reasonably explain the evidence?

10. Develop corrective actions

Connect actions to supported conditions. That process uses the strengths of multiple techniques.

Beware of Tool-Driven Conclusions

Every investigation tool influences what investigators see. If your only tool is the 5 Whys, every event may begin to look like a chain.

If your form contains only one box labeled Root Cause, every investigation may somehow discover exactly one root cause.

If your system contains only categories such as:

• employee,
• equipment,
• environment, and
• procedure,

investigators may begin forcing evidence into those categories. Tools should help organize thinking. They should not predetermine the answer.

Evidence Comes Before the Diagram

A beautiful cause map does not make an explanation true.

Neither does:

• a five-level why chain,
• a fault tree,
• a bow-tie diagram,
• a timeline, or
• a polished investigation report.

The analysis is only as strong as the evidence supporting it.

For every important conclusion, ask:

What evidence supports this?

What evidence contradicts it?

What are we assuming?

What remains unknown?

What reasonable alternative explanations exist?

Those questions matter more than the name of the investigation method.

When Should You Use the 5 Whys?

Use it when it helps you think. Do not use it because the form says there must be exactly five answers. The technique is useful when it encourages the investigation to go deeper.

It becomes limiting when it:

• forces one causal path,
• encourages unsupported assumptions,
• implies every event has one root cause,
• ignores interactions,
• or becomes a substitute for collecting evidence.

The better question is not:

Did we complete the 5 Whys?

It is:

Do we understand the event well enough to make a supported improvement?

The Goal Is Learning, Not Method Compliance

Safety professionals have many investigative tools available. 5 Whys. Timelines. Barrier analysis. Change analysis. Cause mapping. Bow-ties. Fault trees. Learning Teams. Control reviews. Each can reveal something different. None should become the investigation itself. The purpose of an investigation is to understand what the evidence supports, how the event developed, how the controls performed, and what can be improved.

Use whichever tools help you do that. And when one tool stops helping—

use another one.

Supporting resources

Related commercial publications are disclosed under Authorship & disclosures below.

• interviews