Incident Investigation & Root Cause Analysis in 2026: 7 Techniques

A serious incident investigation that stops at "operator error" is a wasted incident. In 2026, regulators, insurers and ISO 45001 auditors expect a defensible root cause analysis (RCA) that traces the failure back to systemic causes — and a CAPA loop that proves it won't happen again.

This guide compares the 7 most-used RCA techniques in QHSE programs, with worked examples and a decision tree for when to use which.

Reading time: ~10 minutes. Audience: QHSE managers, HSE leads, plant supervisors and continuous-improvement teams.

---

Why RCA matters more in 2026

Three forces are reshaping incident investigation:

1. ISO 45001 audits explicitly require systemic cause analysis under Clause 10.2 — surface findings get a non-conformance.
2. Insurance underwriters now request RCA samples in renewal questionnaires; weak analysis raises premiums.
3. Modern QHSE platforms (Incident Management software) embed 5-Why, Fishbone and CAPA templates directly into the incident workflow — no excuse for paper-based investigations.

A good RCA pays for itself the first time it stops a repeat LTI ($45k–$170k loaded cost in 2026 US benchmarks).

---

The 7 RCA techniques compared

1. 5-Why

The simplest technique: ask "why?" five times to drill from symptom to systemic cause.

Worked example (warehouse near-miss):

1. Why did the operator slip? → Spilled oil on the floor.
2. Why was there oil? → Forklift hydraulic leak.
3. Why the leak? → Hose past service life.
4. Why still in service? → No preventive maintenance schedule for hoses.
5. Why no schedule? → Maintenance plan didn't list consumables.

→ Root cause: maintenance plan gap. → CAPA: add consumables to maintenance plan, audit quarterly.

2. Fishbone (Ishikawa) diagram

Group causes into 6 M's: Man, Machine, Method, Material, Measurement, Mother Nature. Best when multiple contributing factors exist. Pairs well with a CAPA software workflow.

3. TapRooT®

A proprietary structured method with a "Root Cause Tree" and human-performance categories. Required by some regulators (US chemical, rail). Time-intensive but defensible.

4. Bowtie analysis

Visualises a top event in the middle, threats on the left and consequences on the right, with preventive and mitigative barriers between. Standard for major-hazard industries — see Process Safety Management software.

5. Fault Tree Analysis (FTA)

Top-down deductive method using Boolean logic to calculate probability of failure. Used in nuclear, aerospace and high-reliability manufacturing.

6. ICAM (Incident Cause Analysis Method)

Developed for the mining industry; classifies causes into absent/failed defences, individual/team actions, task/environmental conditions, organisational factors. Excellent for multi-causal incidents.

7. Apollo RCA

Evidence-based cause-and-effect charts. Every cause must have evidence; every "why" branches into actions and conditions. Strong for legal-grade investigations.

---

How to pick the right technique

                ┌─ Simple, single cause? ────────→ 5-Why
                │
                ├─ Multi-factor brainstorm? ─────→ Fishbone
                │
Incident ──┬────┼─ Serious, regulator scrutiny? ─→ TapRooT or Apollo
            │   │
            │   ├─ Major hazard, barriers? ──────→ Bowtie
            │   │
            │   ├─ Quantitative reliability? ────→ FTA
            │   │
            │   └─ Multi-causal, ops + culture? ─→ ICAM

Most QHSE programs standardise on 5-Why for near-misses, Fishbone for recordables, ICAM/TapRooT for LTIs and serious injuries.

---

The CAPA loop (Corrective & Preventive Actions)

RCA without CAPA closure is theatre. Modern QHSE platforms enforce the loop:

1. Identify corrective actions (immediate fix) and preventive actions (systemic fix).
2. Assign owners with SMART deadlines.
3. Verify effectiveness after 30/60/90 days.
4. Close with evidence — and ensure the lesson is shared across sites.

See the ISO 45001 internal audit checklist for clause-by-clause CAPA evidence requirements.

---

Worked example — manufacturing LTI

Incident: Operator's hand caught between conveyor and guard during cleaning. 7-day LTI.

Technique: ICAM (multi-causal, regulatory exposure).

Findings:

• Absent/failed defences: interlock bypassed for productivity, LOTO procedure not enforced for cleaning task.
• Individual actions: operator skipped step 4 of cleaning SOP under shift-end time pressure.
• Task/environmental: poor lighting, awkward access angle.
• Organisational: cleaning task missing from LOTO procedure list; shift-end production pressure rewarded over safety.

CAPA:

1. Add cleaning to LOTO procedure register (30 days). See LOTO software.
2. Engineering review of guard interlock bypass capability (60 days).
3. Revise shift-end KPIs to weigh safety equally with throughput (90 days).
4. Cross-site lesson-learned bulletin and toolbox talk (14 days). See Toolbox Talks software.

---

Common RCA pitfalls

• Stopping at human error. "Operator didn't follow the procedure" is a symptom, not a cause.
• Single-technique dogma. Use the right tool for the incident; don't 5-Why a major hazard.
• No evidence. Every causal claim needs witness statements, photos, machine logs or training records.
• CAPA without verification. 30-day actions that nobody checks at day 60 don't prevent recurrence.
• Investigation team bias. Include someone outside the affected department.

---

How software automates the workflow

In 2026, leading platforms (Tekmon, SafetyCulture, Intelex, Cority) ship:

• Mobile incident capture with photo, GPS, witness, machine ID.
• Built-in 5-Why and Fishbone templates linked to the incident.
• CAPA workflow with owners, deadlines, escalations and verification.
• Trend dashboards that surface repeat root causes across sites.
• Lessons-learned distribution to other sites and contractors.

For manufacturing-specific RCA depth see the EHS Software for Manufacturing 2026 guide.

---

FAQ

Which RCA technique do auditors prefer?
ISO 45001 auditors care less about which technique you use, more about whether you used one consistently and whether CAPA closed the loop with evidence.

Can I combine techniques?
Yes — many investigations start with 5-Why for scoping, then Fishbone for breadth, then ICAM for systemic analysis. The combination is fine if documented.

How long should an investigation take?
Near-miss: 1–3 days. Recordable injury: 5–10 days. LTI/serious injury: 14–30 days. Regulator-notifiable incident: as long as needed, with interim reports.

Who should lead the investigation?
A trained investigator from outside the affected department, with the supervisor as a participant — not the lead. Avoid having the line manager investigate their own team's incident.

Do I need separate software for RCA?
No. RCA should live inside your Incident Management and CAPA Management workflow. Standalone RCA tools create reconciliation work.

What's the difference between TapRooT and Apollo?
TapRooT uses a fixed root-cause tree taxonomy; Apollo builds an evidence-based cause-and-effect chart per incident. TapRooT is faster for trained users; Apollo is more flexible for unusual incidents.

Should contractors do their own RCA?
Yes for their own incidents, but you should review their RCA and CAPA as the principal contractor. Many platforms support contractor portals for this.

How does RCA feed continuous improvement?
Trended root causes across 6–12 months reveal systemic gaps — culture, design, training, procurement — that single incidents don't surface. This is the most valuable QHSE data you produce.

---

Next steps

• Shortlist platforms: Incident Management Software and CAPA Management Software.
• Map clause-by-clause: ISO 45001 Internal Audit Checklist.
• Industry deep-dive: EHS Software for Manufacturing 2026.

Curated and expert-reviewed by The QHSE Standard. Last updated May 2026.