Root Cause Analysis: Why We Often Stop Too Early

In industrial maintenance, there is a familiar moment when everyone wants the investigation to end.

The equipment is running again. Production has recovered. Maintenance has identified a plausible explanation. A corrective action has been registered in the CMMS, and the incident is ready to be closed.

From an immediate operational perspective, the situation appears under control.

But a few days or weeks later, the same failure returns.

The same machine stops. The same discussion between production and maintenance begins again. Another work order is opened. Another explanation is recorded.

And the organization begins to question why Root Cause Analysis (RCA) is not delivering the expected reliability improvement.

Many RCA investigations do not fail because the analytical techniques are inadequate. They fail because organizations stop investigating when they reach an explanation that appears sufficiently plausible, or when production recovery removes the immediate pressure to continue.

Finding a plausible cause is not equivalent to establishing a defensible causal explanation.

And understanding a technical failure does not necessarily mean that the organization has addressed the conditions that allowed it to occur or recur.

When the First Reasonable Explanation Becomes the Final Answer

Consider a recurring failure in an automated conveyor system in an automotive manufacturing plant.

The conveyor stops unexpectedly, interrupting material flow to an assembly area.

Maintenance intervenes, inspects the drive system, resets the protection, and restores operation after the required safety and functional checks.

The initial diagnosis indicates motor overload.

The intervention is documented in the CMMS, the work order is closed, and the equipment returns to production.

At first glance, the response appears reasonable.

However, motor overload may describe the condition that triggered the protective device rather than the underlying failure mechanism.

Why did the motor experience excessive load?

Was mechanical resistance increasing? Was a bearing deteriorating? Was a transfer mechanism operating outside its intended conditions? Had the production load changed? Were the drive parameters appropriate for the application?

Each hypothesis requires examination.

Suppose a deteriorated bearing is eventually identified as a significant contributor.

The investigation should not necessarily end there.

Why did the bearing deteriorate?

Was the lubrication regime appropriate? Was contamination present? Was the installation or alignment correct? Was the actual operating load consistent with the equipment design?

And why was the deterioration not detected or corrected before it caused repeated interruptions?

Perhaps the inspection method was inadequate.

Perhaps the relevant maintenance task had been postponed.

Perhaps condition-monitoring information indicated an emerging problem, but there was no effective escalation or response mechanism.

Or perhaps maintenance had already identified the deterioration, but production priorities repeatedly prevented intervention.

These possibilities represent different causal mechanisms and contributing conditions. They must be assessed through evidence rather than accepted as assumptions.

Identifying the failed component explains where the breakdown occurred. Understanding the physical mechanism explains how it developed. Examining detection and decision-making processes helps explain why the organization did not prevent or contain its consequences.

This distinction is fundamental to sustainable reliability improvement.

The Limits of Asking Why Five Times

The Five Whys technique remains useful because it encourages investigation beyond immediately visible symptoms.

Its simplicity can support productive discussions between maintenance technicians, production personnel, and engineering.

However, repeatedly asking why does not automatically establish a valid causal explanation.

Consider the following sequence:

  • Why did the conveyor stop? Because the motor protection activated.
  • Why did the protection activate? Because the motor was overloaded.
  • Why was the motor overloaded? Because mechanical resistance increased.
  • Why did resistance increase? Because a bearing deteriorated.
  • Why did the bearing deteriorate? Because maintenance was inadequate.

The conclusion sounds plausible.

But what does «maintenance was inadequate» actually mean?

Was the lubrication interval inappropriate? Was the bearing exposed to contamination? Was the equipment operating beyond its design conditions? Was an inspection performed but its findings not acted upon?

More importantly, what evidence supports each step?

Without technical validation, the investigation may have transformed a sequence of assumptions into an apparently definitive explanation.

There is another limitation: industrial failures do not always follow a single linear causal chain.

Several conditions may interact to produce the same event. Increased mechanical load, inadequate lubrication, and delayed intervention may collectively contribute to failure.

Reducing this interaction to one final answer can conceal important dependencies.

The Five Whys technique can therefore be valuable as an initial investigative approach, but its conclusions may require physical examination, operating-data analysis, failure-mode assessment, or more structured causal methods.

The purpose of RCA is not to complete a predetermined number of questions. It is to establish and test causal explanations with sufficient technical confidence to support effective decisions.

Technical Causes and Organizational Causes Are Connected

Industrial reliability problems frequently involve several interacting causal levels.

There may be a physical degradation mechanism responsible for the immediate failure.

There may be a detection weakness that allows deterioration to progress without timely intervention.

And there may be organizational or operational conditions that prevent the identified risk from being addressed.

These levels should be distinguished without treating them as unrelated problems.

Consider the conveyor bearing.

Replacing the failed bearing restores the component.

Correcting a verified misalignment, lubrication defect, or contamination mechanism addresses a potential source of degradation.

Improving inspection or condition-monitoring practices may strengthen the organization’s ability to detect deterioration before functional failure.

Revising maintenance prioritization and intervention authorization may address the conditions that previously prevented timely action.

Each intervention operates at a different level.

Each also requires different resources, technical responsibilities, and decision rights.

This is why serious RCA cannot always remain confined to the maintenance department.

Production, engineering, planning, quality, and procurement may need to participate when their processes influence the failure mechanism, detection capability, or implementation of preventive measures.

However, identifying an organizational weakness does not justify expanding every RCA into an unrestricted examination of management practices.

The investigation should remain proportionate to the consequences, recurrence, and uncertainty associated with the failure.

The objective is to understand the relevant causal system sufficiently well to select defensible and effective risk controls.

Production Pressure Changes the Quality of Investigation

One of the most persistent obstacles to effective RCA is operational pressure.

When a critical production asset fails, the immediate priority is understandable: restore safe and stable operation as quickly as possible.

Maintenance works under time constraints.

Production needs recovery.

Supervisors require information about the interruption.

Management needs to assess the operational consequences.

Under these conditions, an approved temporary repair or restoration measure may be entirely appropriate.

The problem is not necessarily the temporary intervention.

It arises when the organization interprets successful recovery as evidence that the underlying reliability problem has been resolved.

Three activities must therefore remain conceptually distinct:

Restore the equipment. Understand the failure. Prevent recurrence.

They are connected, but they are not interchangeable.

Restoration may require immediate decisions based on limited information, subject to the necessary safety and operational controls.

A credible investigation may require additional inspections, measurements, operating records, failure analysis, and cross-functional participation.

Prevention may require engineering modifications, revised maintenance tasks, new monitoring arrangements, or an authorized production window.

Attempting to complete all three activities under the same emergency conditions is often unrealistic.

A more disciplined approach separates immediate recovery from subsequent investigation without allowing the latter to disappear when production resumes.

For significant failures, the organization needs a defined mechanism for preserving evidence, assigning investigation ownership, establishing priorities, and reviewing unresolved actions after restoration.

This separation is especially important when temporary repairs become repeated practice.

A temporary intervention can be technically justified, but its continued use must remain subject to explicit risk assessment, authorization, and follow-up.

Otherwise, the end of the production emergency also becomes the end of the investigation.

Until the next breakdown.

When RCA Becomes an Administrative Exercise

A mature maintenance organization requires documented investigations.

Traceability matters. Corrective actions need accountable owners. Technical findings must remain available for future analysis.

However, documentation is not equivalent to problem-solving.

An RCA report can be well structured and technically convincing while having little influence on future reliability.

This happens when investigations are evaluated primarily through administrative completion.

Was the report submitted?

Was a root cause recorded?

Were corrective actions assigned?

Were the deadlines respected?

These indicators support governance, but they do not establish technical effectiveness.

A stronger assessment would examine whether the causal explanation is supported by evidence, whether material alternative hypotheses were considered, and whether the approved actions address the mechanisms that produced or enabled the failure.

It would also examine recurrence.

This requires more than counting work orders with identical failure codes.

The same physical failure mechanism may appear under different work-order descriptions, while similar symptoms may arise from unrelated causes.

In many factories, CMMS records contain a substantial history of repeated interventions without providing a reliable classification of failure modes and mechanisms.

A component may be replaced several times, but each replacement is documented as a separate corrective activity.

The system records what maintenance did.

It does not necessarily establish why the asset failed.

Improving RCA therefore also requires disciplined failure reporting, consistent asset identification, sufficiently precise maintenance records, and the ability to relate interventions to operating conditions.

The value of RCA lies not in producing an explanation that satisfies the reporting process, but in reducing causal uncertainty and improving the decisions that govern future reliability.

The Role of Evidence, Data, and Process Discipline

Industrial information systems can significantly strengthen RCA.

CMMS/EAM records can provide maintenance histories, work-order information, recurring interventions, and evidence of deferred activities.

MES/MOM can connect equipment events with production orders, product variants, changeovers, and execution conditions.

Industrial historians and condition-monitoring systems can provide information about equipment behavior before and during failure events.

Process mining may help identify recurring delays, escalation loops, repeated approvals, or deviations within the maintenance management process.

These capabilities can make investigations more systematic.

However, more data does not automatically establish causality.

A correlation between equipment failure and a particular production condition does not demonstrate that the condition caused the failure.

A recurring alarm does not necessarily identify the underlying physical mechanism.

Repeated bearing replacements do not, by themselves, demonstrate that the preventive maintenance interval is inadequate.

And a process-mining model cannot reveal the complete maintenance decision process if important activities, timestamps, or decisions are not recorded consistently.

The completeness and contextual quality of the evidence matter as much as its availability.

An effective RCA combines physical evidence, operating history, technical expertise, and structured causal reasoning.

Experienced technicians may identify mechanical or operational mechanisms that are not visible in digital records.

Engineering can evaluate whether proposed explanations are physically credible.

Production can clarify operating conditions and constraints that may not be apparent in maintenance information.

Reliability specialists can assess the relationship between identified failure mechanisms and existing maintenance strategies.

The purpose of this collaboration is not to generate consensus around the most convenient explanation.

It is to challenge hypotheses, resolve relevant uncertainty, and establish a technically defensible basis for action.

Digital evidence strengthens RCA when it helps validate or reject causal hypotheses. It does not replace the engineering judgment required to interpret them.

Knowing When to Stop an Investigation

Not every equipment failure justifies an extensive RCA.

Maintenance resources are finite, and detailed investigations require time, expertise, and operational support.

A minor isolated failure on a noncritical asset may justify a relatively limited analysis.

A recurring failure affecting personnel safety, product conformity, production continuity, or significant asset value requires greater attention.

The depth of investigation should be determined through risk, criticality, recurrence, and the uncertainty surrounding the failure mechanism.

An investigation may reasonably conclude when:

  • The relevant failure mechanisms have been established with a level of confidence appropriate to the risk.
  • Material alternative explanations have been examined or explicitly documented as unresolved.
  • The principal contributing conditions have been identified sufficiently to select proportionate preventive or corrective measures.
  • The proposed actions have defined ownership, authorization, and effectiveness criteria.

This does not mean that all investigations must identify one uniquely proven root cause.

Some failures result from several interacting conditions. In other cases, physical evidence is incomplete or unavailable.

Recognizing these limitations is preferable to presenting an unsupported conclusion as technical certainty.

It is also essential to distinguish completion of the causal investigation from completion of the improvement process.

An investigation may establish a sufficiently credible explanation before all corrective actions have been implemented.

Similarly, implementing those actions does not immediately demonstrate their effectiveness.

Causal validation, action implementation, and effectiveness verification are three separate achievements.

For a recurring bearing failure, effectiveness may require confirmation that the identified degradation mechanism has been addressed, that the revised maintenance controls operate as intended, and that subsequent equipment behavior is consistent with the expected improvement.

The verification approach must reflect the relevant operating conditions, failure characteristics, and period of exposure.

An absence of recurrence over a short observation period is not necessarily sufficient evidence of effectiveness, particularly for infrequent failure mechanisms.

RCA should therefore end with an explicit understanding of what has been established, what has changed, and what still requires verification.

The Missing Connection Between RCA and Asset Management

Root Cause Analysis should influence decisions beyond the individual equipment failure.

Recurring breakdowns may expose weaknesses in asset strategy, equipment design, maintenance planning, spare-parts management, operational governance, or the way reliability risks are evaluated.

The investigation should therefore create a feedback mechanism between failure evidence and the decisions governing physical assets.

Consider an investigation that identifies lubricant contamination as a major contributor to repeated bearing degradation.

The response should not automatically be limited to increasing inspection frequency.

Depending on the verified mechanism, the appropriate solution may involve improving sealing arrangements, controlling contamination during lubrication, reviewing handling practices, or modifying the equipment design.

Likewise, an investigation showing that degradation was detected but repeatedly left unresolved should lead to examination of maintenance prioritization and intervention governance.

The central question is not simply whether maintenance followed the existing plan.

It is whether the plan, its execution, and the associated decision rules were appropriate for the asset’s operating conditions and risk profile.

RCA findings may therefore justify changes to preventive maintenance tasks, condition-monitoring arrangements, inspection methods, asset criticality assessments, or engineering standards.

They may also reveal that an existing preventive task provides insufficient value and should be redesigned or discontinued through an appropriate technical review.

This is where RCA connects with reliability engineering, Total Productive Maintenance (TPM), Lean Manufacturing, and Asset Management.

The objective is not to maximize maintenance activity.

It is to improve the organization’s ability to manage asset risks and maintain required performance throughout the equipment lifecycle.

An RCA process that does not inform maintenance strategy risks becoming a mechanism for explaining repeated failures rather than preventing them.

The Leadership Responsibility Nobody Can Delegate to a Template

There is a management dimension that no RCA methodology can resolve independently.

If maintenance teams are evaluated primarily on immediate recovery while receiving insufficient time to investigate recurring failures, investigations will tend to remain superficial.

If production and maintenance lack an agreed mechanism for prioritizing reliability risks, corrective actions may be postponed until another breakdown forces intervention.

If recurring problems are automatically attributed to individual technicians or operators, teams may become reluctant to question existing standards or report systemic weaknesses.

These are not failures of the Five Whys technique or any other analytical method.

They are weaknesses in operational governance.

Leadership must establish when formal RCA is required, how investigations are prioritized, who is accountable, what level of evidence is expected, and how findings are translated into authorized actions.

It must also ensure that significant investigations have access to appropriate technical resources and that corrective decisions are reviewed against production and asset-risk requirements.

Most importantly, management must distinguish between identifying a cause and deciding to act on it.

An organization may understand why an asset is failing and still decide not to implement the necessary modification, maintenance intervention, or process change.

In some situations, accepting residual risk may be a legitimate decision within established safety, regulatory, and operational constraints.

But such a decision must be explicit, supported by risk assessment, authorized at the appropriate level, and subject to review.

Allowing a known failure mechanism to persist through repeated postponement without clear accountability is not an effective maintenance strategy.

It is an implicit risk decision.

And implicit risk decisions are particularly dangerous when their consequences are distributed across production, maintenance, quality, and asset management.

Sometimes the unresolved problem is no longer a lack of causal knowledge. It is the absence of effective governance for acting on that knowledge.

The Real Purpose of Root Cause Analysis

The objective of RCA is not to identify someone to blame.

It is not to complete a Five Whys worksheet.

And it is not to assign every breakdown a single, apparently definitive explanation.

Its purpose is to understand relevant failure mechanisms and contributing conditions sufficiently well to support decisions that reduce future operational risk.

That requires technical evidence, structured reasoning, operational context, cross-functional accountability, and disciplined follow-through.

A credible RCA distinguishes symptoms from causes, examines relevant alternatives, and acknowledges uncertainty when the available evidence does not support a definitive conclusion.

An effective RCA goes further.

It translates those findings into appropriate changes to equipment, maintenance strategy, operating standards, or organizational decisions.

And it verifies, with evidence proportionate to the risk, whether those changes have produced the intended improvement.

This leads to an uncomfortable conclusion.

Sometimes the reason a failure keeps returning is not that the organization does not know what is wrong. It is that the organization has not created the conditions to act on what it already knows.

At that point, RCA becomes more than a maintenance investigation technique.

It becomes a test of the organization’s asset-management and reliability maturity.

Because the real measure of a good investigation is not how convincingly it explains yesterday’s failure.

It is whether that understanding changes the conditions under which tomorrow’s failures can develop.

Questions for Further Reflection

  1. Are our RCA investigations establishing evidence-based causal explanations, or merely producing acceptable conclusions for closing maintenance incidents?
  2. How often do recurring failures persist because the organization has identified the relevant causes but has not implemented the necessary actions?
  3. Do our maintenance strategies systematically incorporate RCA findings, and how do we verify that those decisions have reduced operational risk?

#IndustrialMaintenance #RootCauseAnalysis #ReliabilityEngineering #AssetManagement #OperationalExcellence #ManufacturingExcellence #ContinuousImprovement #LeanManufacturing #TPM