My org has recently started using the Toyota Five Whys to analyze incidents.
The way we use it, it looks something like this:
- Q1: Why did we see A?
- A1: Because B.
- Q2: Why did B?
- A2: Because C.
- Q3: Why did C?
- A3: Because D.
- Q4: Why did D?
- A4: Because E.
- Q5: Why did E?
- A5: Because F.
The idea is that you get deeper into the process failures that lie behind a problem when you dig in like this.
But every time I write an RCA document, I find that the Five Whys is inadequate.
Why the Five Whys is inadequate
It is inadequate because it presumes a basically linear causality.
Almost all interesting incidents have multiple causality. Meaning that there isn’t just a straight line between A and F. There is a cluster of issues.
When I have to fill out this document, I usually hack the format by listing several causes under A2. And I put several causes under A3. And so on.
In this way, you can respect the form of the Five Whys while also having the intellectual integrity to acknowledge that causality is almost always multiple and incidents happen at the junction between multiple causal flows.
Alternative approaches
I’m not the first to criticize the Five Whys; see the criticism section in the Wikipedia article.
It turns out that researchers have already invented better forms of analysis that represent multiple forces better.
One approach is the “fishbone diagram”: it shows multiple forces that collectively caused an incident.
The idea is that lots of things had to collectively go wrong to cause an incident, and you diagram them in layers.
An even better approach is described in Alan J. Card’s 2013 paper, A new tool for hazard analysis and force field analysis: The Lovebug Diagram. A “lovebug diagram” is basically two fishbone diagrams that represent opposing directions. The name comes from “a mating pair of Plecia nearctica, commonly known as lovebugs.”
(Published version here, but I don’t have access anymore because I’m not in academia :/)
It’s a great visualization because it shows multiple forces that caused an incident and also multiple forces that tried to prevent an incident. And this, in my mind, is a more realistic image of how things actually happen. We do have safety controls. In an incident, it’s just that they weren’t enough.
I wish I could use these diagrams in our RCAs instead of Five Whys. But I guess the Five Whys is better than no methodology whatsoever, or just letting people write down that an incident happened because of one single reason. Methodology is better when it provides a lower bound for our inquiries, but it doesn’t have to be an upper bound.
Anyway, causality is always multiple in complex systems. I won’t stop insisting on this.