A team fixes the problem in front of it, closes the ticket and moves on. Then the same problem returns, because whatever caused it was never touched. Safety regulators in the UK and the US both separate the cause you can see from the cause behind it, and treat the second as the one worth finding.

What is root cause analysis?

Root cause analysis is a structured way of investigating an incident, near miss or failure to find the underlying, system-related reason it happened so the same problem does not happen again.

The US Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA) define the term in their joint fact sheet, The Importance of Root Cause Analysis During Incident Investigation: “A root cause is a fundamental, underlying, system-related reason why an incident occurred that identifies one or more correctable system failures.”

In plain English, a root cause is the reason behind the reason. Three examples show the difference:

  • A pipe splits open when a vehicle strikes it. The impact is the immediate cause. The UK Health and Safety Executive (HSE) lists lack of driver training and inadequate vehicle maintenance among the underlying causes.
  • A support team keeps missing response deadlines. Adding staff treats the symptom. The cause might be a routing rule that sends tickets to the wrong queue.
  • A fatal overfill and fire is first blamed on operator error. OSHA and the EPA describe how a deeper look can show that funding cuts left a deficient mechanical integrity program and malfunctioning instrumentation, a situation operators could not have prevented.

Root cause analysis combines several tools rather than relying on one technique. A root cause sits in a system, such as a missing inspection program, and one incident often has more than one. OSHA and the EPA say the approach may substantially or completely prevent a repeat, and their fact sheet is guidance only.

Why it matters: preventing repeat incidents, avoiding costs and protecting people

  • It targets the real failure, meaning an employer stops paying to correct immediate causes of incidents that could have been prevented.
  • It reduces repeat incidents, meaning fewer risks of death or injury to workers or the community and less environmental damage.
  • It avoids costs, meaning less business interruption, clean-up, regulation, audits and fines. OSHA and the EPA add that litigation costs can often substantially exceed fines.

The six tools OSHA and the EPA list, from brainstorming and checklists to logic and event trees

OSHA and the EPA say the tools are not meant to be used exclusively and that, ideally, a combination will be used.

Tool Incident complexity Role in the investigation
Brainstorming Simpler incidents May be sufficient on its own to identify root causes
Checklists Simpler incidents May be sufficient on its own to identify root causes
Logic and event trees More complicated incidents Should be considered in addition to brainstorming and checklists
Timelines More complicated incidents Often used to support the logic and event tree
Sequence diagrams More complicated incidents Often used to support the logic and event tree
Causal factor determination More complicated incidents Often used to support the logic and event tree

Whichever combination an employer chooses, OSHA and the EPA say it should answer four questions: what happened, how did it happen, why did it happen and what needs to be corrected. Interviews and document reviews such as maintenance logs supply the facts.

Worked example: an oil spill on a plant floor and what sat behind it

OSHA and the EPA use this scenario in their fact sheet. A worker slips on a puddle of oil and falls. A traditional investigation may find the cause to be spilled oil, with a remedy limited to cleaning up and telling the worker to be more careful.

A root cause analysis keeps asking why. Where did the oil come from, why did it remain on the floor and why was it not cleaned up? In the fact sheet, the root cause may have been the lack of an effective mechanical integrity program, one that includes inspection and repair and would prevent or detect oil leaks. Stopping at the failure to clean up would not have prevented future incidents, because no system existed to prevent, identify and correct leaks.

How root cause, immediate cause, lessons learned and remedial action differ

HSE’s investigation procedure, which sets objectives for HSE’s own investigators and was last updated on July 10, 2026, defines these terms.

Term What it is Example or who acts
Immediate (or direct) cause The unsafe acts or conditions that initiated the undesired event under investigation A vehicle strikes a pipe and fractures it
Underlying (or root) cause The failings that allowed the unsafe acts or conditions to arise Lack of driver training, inadequate vehicle maintenance and unsuitable pipework location
Lessons learned Findings about the measures needed to prevent further similar incidents, based on what went wrong and why The basis of any recommendations for remedial action
Remedial action The action taken to prevent a recurrence Dutyholders normally act at the incident site and at other sites they operate, and wider action can involve sharing learning across sectors

What UK and US regulators say about root cause analysis

HSG245 and the Management of Health and Safety at Work Regulations 1999 in the UK

The regulator is the Health and Safety Executive. Its workbook, Investigating accidents and incidents (HSG245), published in 2004, is written for employers, unions, safety representatives and safety professionals. It defines a root cause as “an initiating event or failing from which all other causes or failings spring” and says root causes are generally management, planning or organizational failings.

HSG245 separates three levels of cause: immediate (a missing guard), underlying (supervisors not carrying out pre-start machinery checks) and root (failures remote in time and space from the event). HSE says risk control measures must address all three, and that investigations concluding operator error was the sole cause are rarely acceptable.

The workbook links investigation to the Management of Health and Safety at Work Regulations 1999. Regulation 5 requires employers to plan, organize, control, monitor and review their health and safety arrangements, and HSE says investigations form an essential part of that process. HSE also says failing to review relevant risk assessments after an adverse event could mean contravening regulation 3(3). The workbook is guidance and describes its approach as only one of a number of possible approaches.

OSHA and EPA expectations under PSM and RMP in the US

Employers covered by OSHA’s Process Safety Management (PSM) standard, 29 CFR 1910.119, must investigate incidents that resulted in or could reasonably have resulted in catastrophic releases of highly hazardous chemicals. Owners and operators of facilities regulated under the EPA’s Risk Management Program (RMP) regulations, 40 CFR 68, must also conduct incident investigations.

Both agencies encourage employers to go beyond the minimum and conduct a root cause analysis after an incident or near miss. The fact sheet imposes no legally binding requirements.

Limitations of root cause analysis and how to check it worked

An analysis can stop too early, as in the overfill example where the first answer was operator error. It can stop at one cause when OSHA and the EPA say a successful analysis identifies all root causes. And because the fact sheet is guidance, the right mix of tools depends on the incident.

To check an investigation worked, ask four questions:

  • Is each root cause a correctable system failure, as the OSHA and EPA definition requires?
  • Do the actions address underlying and root causes, not only immediate ones?
  • Is it clear exactly what is to be achieved and by whom?
  • Does the same or a similar incident recur?

Findings often feed corrective and preventive action, covered in Ideagen’s What is CAPA? and its corrective plan of action for safety risks.

What a root cause finding should change, from the spill on the floor to the system behind it

Every example here follows the same arc. The visible cause is real and the quick fix aimed at it is easy, but the incident returns because the failing behind it, a missing inspection program or an unassured competency, was left alone. A good investigation keeps asking why until it reaches something a system can correct, changes that system and checks whether the event returns. The practical test is whether the system changed.

Frequently asked questions

Does root cause analysis apply to near misses?

Yes. OSHA and the EPA urge employers to conduct a root cause analysis following an incident or near miss. HSG245 adds that investigating near misses is as useful as investigating accidents and very much easier, because no one has been harmed and witnesses are more likely to be helpful. A near miss exposes system failures before they cause harm.

Who should be involved and what evidence do investigators use?

Employees should be involved. OSHA and the EPA say involving them and sharing the results goes a long way toward preventing similar events. Evidence comes from interviews and document reviews such as maintenance logs. HSG245 adds that the investigation team should be led by, or report directly to, someone with the authority to act on its recommendations.

Should findings be shared beyond the site where the incident happened?

Often, yes. HSG245 asks whether similar risks exist elsewhere in the organization, on the same site or at another location, and what steps would avoid the same event there. HSE’s investigation procedure adds that lessons may have wider implications beyond the dutyholder involved. A cause found at one location may exist at others.