RootCauseAnalysis

Start with the Postmortem workflow: rebuild the timeline forward before theorizing, then run 5 Whys or Fishbone inside it per thread. Record contributors in plural, chart layered-defense holes, and assign owned, dated follow-up actions ordered by remedy strength.

5 Whys walks one causal thread deep, suiting single-thread breaks with a known trigger. Fishbone sweeps wide first, sorting causes into families like the 6 M's, then uses Pareto to prioritize before drilling into the vital few.

Use Kepner-Tregoe IS/IS-NOT for shy, intermittent, or environment-specific defects where something works in one context but not another. It requires a known-good baseline to contrast against; without one, use Fishbone or Apollo-style charting instead.

Fault Tree Analysis fits safety-critical or security-critical systems with redundant defenses and multi-path failures, especially when probability estimates are needed. It is time-intensive (hours to days), so for fast triage use 5 Whys instead.

Halting at a person is a known failure mode: a human slip always stands on a setup that permitted or invited it. The method requires asking one more why to expose the systemic condition, keeping the inquiry blameless and fixable.

5 Whys cannot handle branching causes, cross-service failures, or probability estimation, and it cannot outrun the investigator's domain knowledge. For tangled distributed failures, use evidence-per-node charting or Fault Tree Analysis instead.