5 Whys
Investigate a specific event through successive causal questions, keeping each explanation tied to evidence.
Start with an observable incident when you have records or direct observations to investigate. Use an issue tree first if the problem has several distinct investigation paths.
A bounded problem, the affected cases and time period, and records that can support or challenge each proposed explanation.
A causal investigation showing supported links, unresolved hypotheses, and the next evidence to collect.
How to use it
- Describe what happened, to whom, and during which period.
- Ask why the event occurred and record the evidence for the answer.
- Ask why again within the supported scope. If an answer explains only a subset, keep the other cases open.
- Stop or branch when needed. Define the observation or check that could confirm or challenge the next explanation.
Keep its limits in mind
Five is not a required number of questions. Stop when evidence runs out, and branch when there are multiple causes. A plausible chain is not proof of a root cause.
Investigating stock confirmation in delayed orders
In this fictional case, 20 of 100 orders missed their promised dispatch date. Stock confirmation was the first recorded blocker for 8 of the late orders. This investigation follows that branch only.
On a small screen, scroll across the diagram to read it.
Preserve the scope: The six-order explanation does not account for the other two orders in the stock branch, or for the other late orders.
Next check: Compare update timestamps, reserved stock, and warehouse counts before treating either hypothesis as a cause.
Next step: Keep the unexplained orders visible. Do not fill the fifth answer just to complete the diagram.
Three points where another “why” makes the record worse
A useful investigation begins with an event that another person could locate: the order, promised dispatch date, actual dispatch record and first recorded blocker. “The team is careless” is already an interpretation. Write the observable gap first, then ask which records would support the proposed explanation. The goal is a defensible next check, not five completed answer boxes.
Stop when the next answer is unsupported. An empty fifth answer is preferable to a fluent story about training or motivation. Branch when an answer explains only some cases; the cases left outside the explanation still belong in the investigation. Finally, pause a blame-focused interview. Ask what information and conditions were available at the time, rather than asking someone to admit a personality defect. Record an interview statement as a statement until another source supports it.
Containment and explanation are different work. You can propose contacting customers about delayed orders while the stock question remains unresolved. That communication does not validate a stock-system hypothesis, and a plausible hypothesis does not authorize a production change. Keep immediate protection, evidence collection and longer-term changes in separate lines of the action record.
Choose the shape of the investigation
Use the smallest structure that preserves the uncertainty. If several explanations remain independent, one long chain can hide them. If the event itself is vague, clarify the problem before asking for deeper causes.
| Method | Start with | Stop or hand off when |
|---|---|---|
| 5 Whys | One bounded incident branch | A link lacks evidence or splits into distinct explanations |
| Logic tree | Several investigation paths with a shared parent question | A branch is specific enough to inspect its event records |
| Process flowchart | Unclear handoffs, decisions or exception routes | The actual path and missing records are visible |
| Problem definition worksheet | Disagreement about what happened or matters | Scope, observable gap and impact are agreed |
Worked continuation: eight orders are not twenty
Return to the fictional dispatch example above. Of 100 orders, 20 missed their promised dispatch date. Eight have stock confirmation as their first recorded blocker. Six of those eight required a manual lookup in another stock record and showed a difference between displayed stock and warehouse availability. The other two remain unexplained. These are stipulated teaching records, not evidence about a real retailer.
For a traceable practice ledger, label the six supported records S01–S06 and the unresolved pair S07–S08. These labels only identify the groups already supplied; they do not add timestamps or new causes. Keep the other 12 late orders outside this chain. The diagram does not say that every stock mismatch had the same origin, or that stock was the only obstacle encountered by an order.
Read each link aloud with its scope. “Why were these eight orders late?” leads to stock not being confirmed before cutoff. “Why was confirmation pending?” leads to a manual lookup for six, with two open. “Why did those six need another lookup?” points to differing stock records. The next proposed explanations, update timing and reservations, remain competing hypotheses. Nothing supplied chooses between them.
| Group or link | Supported statement | Evidence still needed |
|---|---|---|
| 100 orders → 20 late | Dispatch gap is 20/100 = 20% in this case | Comparable promised and actual dispatch records in real use |
| 20 late → 8 stock-first | This branch covers 8/20 = 40% of late orders | Other 12 remain in their own investigation paths |
| 8 stock-first → 6 manual lookups | Six records support this narrower explanation | S07–S08: why confirmation was pending |
| S01–S06: differing stock records | A difference is recorded; its origin is not established | Update times, reservations, warehouse count and cutoff sequence |
| Hypothesis: update timing or reservations | A question for investigation, not a root-cause finding | A record that distinguishes the alternatives for each order |
Write a finding that can survive counterevidence
A sound finding is: “Six late orders in the eight-order stock branch involved a manual lookup and differing stock records. Update timing and reservations need checking; two stock-branch orders and the other 12 late orders remain outside this explanation.” The six records represent 30% of the 20 late orders, not 30% of all orders. Relative to all 100 orders they represent 6%. Keep those denominators beside any percentage used in a report.
Propose a record comparison for S01–S06: list the last displayed update, reservation changes, count record and dispatch cutoff on a common timeline. Leave unavailable values missing. A timestamp after cutoff could challenge a timing explanation rather than support it; the reviewer needs the sequence, not just a screenshot that two numbers differed. Define who can retrieve the records and request access through the normal process.
At review, append what supports, contradicts or fails to resolve each link. If the records disagree, preserve that disagreement. If a later fix is tried, check both whether it was implemented and what happened to comparable dispatch outcomes. A lower late rate alone does not isolate the fix from order mix or other changes. Close only the supported scope and keep the unresolved cases visible.
Check your work
- Each answer explains the previous question.
- Facts, assessments, and hypotheses remain distinguishable.
- The investigation does not turn a subset explanation into a claim about every case.
- The next step describes evidence to inspect, not simply another opinion to collect.
Framework references
References explain the framework and its scope; they do not validate the fictional example's results.
Put the framework to work
Copy the outline and add your question, evidence, and open questions.
Read a practical guide →Practice with an example
Trace the scope of explanations through fictional late orders, retain unexplained cases, and leave with evidence status and a next investigation step.
The cause is unclear. What should you check first? →