The 5 Whys method is taught in almost every HSE induction, referenced in most investigation templates, and written into countless incident reports across Malaysia. It is fast, simple, and familiar.
It is also not an investigation.
The 5 whys incident investigation technique finds the first plausible answer to each “why” question — and accepts it. It does not verify that the answer is correct. It does not ask whether other causes were operating simultaneously. It does not continue until a management system failure has been identified. It stops when the investigator runs out of “whys” — or, more commonly, when they reach something that can be written as a corrective action.
That stopping point is rarely the root cause. It is usually a symptom.
How the 5 Whys Actually Works in Practice
Here is a typical 5 whys incident investigation outcome from a real-world scenario:
A worker is injured during a maintenance task. The investigation team applies the 5 Whys:
- Why was the worker injured? — Because they contacted an energised component.
- Why did they contact an energised component? — Because the equipment was not isolated.
- Why was the equipment not isolated? — Because they did not follow the isolation procedure.
- Why did they not follow the isolation procedure? — Because they were not trained on it.
- Why were they not trained? — Because there was no training schedule in place.
Corrective action: develop a training schedule.
This investigation took less than thirty minutes. It produced a corrective action that is easy to implement and easy to close. And it told the organisation almost nothing about why this incident actually occurred.
The investigation stopped at the absence of a training schedule. But it should have continued: Why was there no training schedule? Who was responsible for ensuring one existed? What management system should have produced it — and what caused that system to fail? For how long did the failure exist before this incident occurred?
The 5 whys incident investigation method does not ask these questions. It is designed to find the first actionable answer, not the true root cause.
The Structural Limitations of 5 Whys
The 5 whys incident investigation technique has three structural limitations that make it inadequate for serious incident investigation.
It is linear. Real incidents rarely have a single chain of causes. Most significant incidents are the product of multiple contributing factors operating simultaneously — organisational decisions, equipment conditions, environmental factors, and human performance all interacting in a complex system. The 5 Whys traces one path through this complexity and ignores the rest.
It stops at the wrong level. The question “why was there no training schedule?” has an answer at the management system level — someone was responsible, a system should have existed, that system failed. The 5 Whys is designed to produce corrective actions, and corrective actions are easiest to write for specific, concrete failures. Management system failures are harder to fix — so the investigation rarely reaches that level.
It does not distinguish between correlation and causation. When an investigator asks “why did they not follow the procedure?” and receives the answer “they were not trained,” the 5 Whys accepts this as a causal relationship. But was inadequate training actually the cause? The 5 Whys does not verify the causal claim — it records it and moves on.
What a Proper Investigation Looks Like
A proper incident investigation — whether it uses the 5W/4P framework, Fishbone (Ishikawa) analysis, or the Tripod Beta methodology — asks not just what happened, but what management condition allowed it to happen.
In the same isolation scenario, a proper investigation would trace the failure beyond the absent training schedule. It would ask: what competency management system should have ensured workers were trained before being assigned to this task? Why did that system fail? What management review mechanism should have detected the gap?
These questions lead to corrective actions that change something at the system level — a redesigned competency management process, a revised work assignment procedure, a management review mechanism with real accountability. These corrective actions are harder to implement. They are also the ones that prevent the next incident.
For guidance on incident investigation requirements in Malaysia, the DOSH Malaysia website provides reference material on notification and investigation obligations under the relevant regulations.
The Test for a Proper Corrective Action
One practical way to assess whether your investigation has reached the system level is to apply a simple test to each corrective action: if we implement this, what management system failure does it address?
If the corrective action is “retrain the worker” — the answer is unclear. Retraining addresses the symptom but not the system failure.
If the corrective action is “redesign the competency verification process to require documented sign-off before assignment to high-risk tasks” — the answer is clear. It addresses the management system that failed to ensure competency was verified before exposure.
A corrective action that cannot answer this question is not a root cause correction. It is a response to the symptom that the 5 whys incident investigation found on its way to stopping early.
Is your team’s incident investigation reaching the system level? Cikgu Barrier’s Incident Investigation Basics program covers the full investigation process — from scene preservation through root cause analysis to corrective action development — using the 5W/4P and Fishbone frameworks with real case study practice. Contact us to discuss in-house delivery for your HSE team.