5 Whys examines the causes of a clearly bounded problem through successive why questions. The number five is a reminder. The analysis continues until it reveals an evidenced condition within the team’s influence.

1. 1

   Frame

   Clarify problem and standard

   

   Goal

   Create a shared, observable problem definition with location, timing, scale and expected condition.

   Inputs for this step

   • Incident, quality deviation or process problem
   • Standard or expected condition
   • Timestamp, impact and case boundary

   Actions

   • Describe what happened, when, where and with what impact; remove cause and blame from the opening sentence.
   • Write the expected condition beside the deviation.
   • Clarify scope, decision authority and participants; collect data first when the symptom is unclear or cannot be reproduced.

   Output

   Problem definition

   Observation · standard · deviation · scope

   Quality check

   Could an outside person recognize the case without inheriting a suspected cause from the problem statement?

   Pitfall

   If the problem already says “because the service was misconfigured” or “someone failed to pay attention,” the problem statement already contains a suspected cause. State only observation, timing, impact and standard, and collect suspicions as later hypotheses.

   Timing: 3–5 minutes; narrow the case before starting the chain when the problem is unclear.

2. 2

   Evidence

   Establish the point of occurrence

   

   Goal

   Locate and describe the deviation from facts, observation and expertise so the first why starts at the right point.

   Inputs for this step

   • Problem definition and timeline
   • Logs, metrics, configuration or work observation
   • People with direct process or system knowledge

   Actions

   • Reconstruct the flow up to the point of occurrence and record relevant states.
   • List possible contributing factors and test them against data or observation where possible.
   • Keep evidence, interpretation and open assumption visibly separate.

   Output

   Evidenced starting picture

   Point of occurrence · facts · tested factors · open assumptions

   Quality check

   Can the group show where the deviation occurred and which evidence supports the starting picture?

   Pitfall

   If the group starts with plausible explanations in the meeting room while timeline and logs are missing, the starting picture rests on assumption instead of evidence. Pause the analysis and reconstruct the starting picture from work or system data with evidence.

   Timing: 5–10 minutes; plan a separate observation or evidence-gathering step when data is hard to access.

3. 3

   Trace

   Trace the causal chain

   

   Goal

   Develop a connected cause-and-effect chain whose links are supported by evidence, expertise or clearly marked assumptions.

   Inputs for this step

   • Evidenced starting picture
   • Timeline and contributing factors
   • People with technical or domain detail

   Actions

   • For the current answer, ask which condition enabled it and record that answer as the next starting point.
   • After each link, read the causal direction upward with “therefore” and add evidence or a test action.
   • Branch when multiple plausible paths matter instead of forcing one linear story.

   Output

   Causal chain

   Observation → condition → next cause · evidence status for each link

   Quality check

   Does every link explain how the prior deviation could occur, with a clear distinction between supported, inferred and open?

   Pitfall

   If the chain jumps to statements such as “the process is old” or stops at the first repair, a traceable mechanism between the steps is missing. Ask for a concrete mechanism and continue the chain to an influence boundary or a testable limit.

   Timing: 8–15 minutes; do not limit the work to a fixed question count. Stop on evidence and influence, not arithmetic.

4. 4

   Challenge

   Test the explanation and boundary

   

   Goal

   Narrow the cause or set of causes until it is plausible, testable and actionable for the team.

   Inputs for this step

   • Causal chain with evidence status
   • Alternative hypotheses
   • Knowledge of the actual influence boundary

   Actions

   • Ask for alternative explanations and counter-evidence; do not treat agreement as confirmation.
   • Check whether the lowest condition explains recurrence and can be changed by the team.
   • When the cause is outside the team’s influence, choose an influenceable precursor, investigate further or hand the case to a better-suited analysis.

   Output

   Tested cause statement

   Preferred explanation · counter-evidence · uncertainty · influence boundary

   Quality check

   Are uncertainty, alternatives and influence documented openly instead of claiming unsupported certainty?

   Pitfall

   If the group names the first plausible answer the root cause, it confuses consensus with evidence. Check the chain backward against data, invite counter-hypotheses, and label missing evidence openly.

   Timing: 5–10 minutes; extend or stop when the paths remain branched or weakly supported.

5. 5

   Act

   Set countermeasures and learning

   

   Goal

   Agree on measures that change the investigated condition or protect detection until then, with a checkable effect.

   Inputs for this step

   • Tested cause statement
   • Available options and constraints
   • Owner, due date and suitable effect indicators

   Actions

   • State at least one measure that addresses the cause; name detection, containment and cause removal separately.
   • Set owner, due date, expected effect and review date.
   • After implementation, check whether the deviation recedes and update the analysis when it does not.

   Output

   Countermeasure and learning plan

   Cause measure · containment · owner · due date · evidence of effect

   Quality check

   Does the measure address the tested condition, and is it clear how the team will see its effect and side effects?

   Pitfall

   If the only countermeasure is monitoring, a hotfix, or training, the actual enabling condition remains unchanged. Secure detection and containment separately and add an owned measure for the cause or missing safeguard.

   Timing: 5–10 minutes; scale measures and review timing to risk and influence.