Define problem, impact, period, and system boundary; preserve evidence and record immediate containment separately.
Root Cause Analysis
A practical method guide: clarify prerequisites and materials, understand the complete process, and look up outputs, pitfalls, and stop criteria.
Prerequisite
What needs to be finished first
Precise problem definition, event and measurement data, timeline, cause evidence register, and control/action plan
Preparation
What needs to be ready before start
Precise problem definition, event and measurement data, timeline, cause evidence register, and control/action plan
Investigation lead · process and system experts · evidence owner · independent challenger · action owners
Define problem, impact, period, and system boundary; preserve evidence and record immediate containment separately.
One to five working days depending on evidence access and impact; 90–180 minutes for joint analysis.
Prepare a workspace with Problem · Evidence · Causal chain · Root causes · Actions; separate example from live data.
Core question
The one question this method answers
Which evidenced system causes must change so this or a similar event does not recur?
Flow
Phases with goal, actions, output and pitfall
Observations, measurements, and patterns over time become hypotheses that are tested against evidence. The search narrows from many possibilities to causes with the strongest explanatory value. Subsequent actions address the underlying mechanism rather than the visible symptom.
Root Cause Analysis · working structure
Fictional example
Fictional values show the actual method fields.
Testable problem statement
Describe the undesired outcome with deviation, impact, time, and boundary; keep containment separate.
On 14 May from 09:12–09:47, 38% of checkouts failed; 214 customers affected; scope EU production.
Evidence-backed timeline
Reconstruct chronology from logs, measures, documents, and accounts; mark conflicts and gaps.
09:08 batch starts; 09:12 pool 95%; 09:18 restart; 09:31 batch paused; 09:47 stable.
Tested causal chain
Connect direct and contributing factors; name mechanism and countercheck for each link.
Batch and checkout shared a pool; batch held 72 connections; checkout exceeded timeout. Staging reproduction confirms it.
Justified root causes
Test candidates for recurrence prevention, feasibility, and absence of harmful side effects.
RC1 no pool separation; RC2 monitoring excluded batch connections. Restart is a response, not a root cause.
Effectiveness plan
Target controls at root causes; set owner, date, effect signal, and review.
Separate pools by 21 May; alert total use at 70%; load test shows checkout failures below 1%; review 28 May.
All values are fictional.
- 1
Problem
Testable problem statement

Goal
Testable problem statement: Describe the undesired outcome with deviation, impact, time, and boundary; keep containment separate.
Inputs for this step
- Define problem, impact, period, and system boundary; preserve evidence and record immediate containment separately.
- Precise problem definition, event and measurement data, timeline, cause evidence register, and control/action plan
Actions
- Describe the undesired outcome with deviation, impact, time, and boundary; keep containment separate.
Output
Testable problem statement
Describe the undesired outcome with deviation, impact, time, and boundary; keep containment separate.
Quality check
Does it state what, when, where, and how much without presuming a cause?
Pitfall
Database failure caused by bad configuration presumes cause and solution. State only observed outcome, target, magnitude, time, and boundary.
Timing: 30–45 minutes
- 2
Evidence
Evidence-backed timeline

Goal
Evidence-backed timeline: Reconstruct chronology from logs, measures, documents, and accounts; mark conflicts and gaps.
Inputs for this step
- Testable problem statement
Actions
- Reconstruct chronology from logs, measures, documents, and accounts; mark conflicts and gaps.
Output
Evidence-backed timeline
Reconstruct chronology from logs, measures, documents, and accounts; mark conflicts and gaps.
Quality check
Does every event have time, source, and evidence status, with conflicts visible?
Pitfall
Memories become an exact timeline without corroboration. Label every statement by source and check against technical or documentary traces.
Timing: 2–8 hours
- 3
Causal chain
Tested causal chain

Goal
Tested causal chain: Connect direct and contributing factors; name mechanism and countercheck for each link.
Inputs for this step
- Evidence-backed timeline
Actions
- Connect direct and contributing factors; name mechanism and countercheck for each link.
Output
Tested causal chain
Connect direct and contributing factors; name mechanism and countercheck for each link.
Quality check
Is every causal link supported by mechanism and evidence rather than temporal proximity?
Pitfall
An event shortly before failure is automatically called causal. Describe the mechanism and test it by reproduction, comparison, or counterexample.
Timing: 60–120 minutes
- 4
Root causes
Justified root causes

Goal
Justified root causes: Test candidates for recurrence prevention, feasibility, and absence of harmful side effects.
Inputs for this step
- Tested causal chain
Actions
- Test candidates for recurrence prevention, feasibility, and absence of harmful side effects.
Output
Justified root causes
Test candidates for recurrence prevention, feasibility, and absence of harmful side effects.
Quality check
Does each root cause pass prevention, feasibility, and side-effect tests?
Pitfall
Analysis stops at operator error or failed component. Ask which technical or organisational control failed and apply the criteria explicitly.
Timing: 45–90 minutes
- 5
Actions
Effectiveness plan

Goal
Effectiveness plan: Target controls at root causes; set owner, date, effect signal, and review.
Inputs for this step
- Justified root causes
Actions
- Target controls at root causes; set owner, date, effect signal, and review.
Output
Effectiveness plan
Target controls at root causes; set owner, date, effect signal, and review.
Quality check
Does every action address a cause and have an observable effectiveness signal?
Pitfall
Actions say retrain the team without changing a control. Define a technical or organisational control with measure and verification.
Timing: 45–75 minutes
Artifact
What comes out at the end
Sketch: what the artifact looks like
Traceable RCA report with timeline, direct and contributing causes, justified root causes, and effectiveness-checked actions.
Record date, owner, source state, and review date; preserve prior versions.
- Evidence and source register
- Event and causal timeline
- Cause and action register
root-cause-analysis-working-template.md
Set subject, evidence, roles, flow, and review.
Root Cause Analysis: Worksheet
Question
To be confirmed
Desired outcome
To be confirmed
Scope
Whole initiative Time: One to five working days depending on evidence access and impact; 90–180 minutes for joint analysis.
Complete this worksheet on paper or in your own document during the work.
Preparation for this scope
Method setup
- Materials: Precise problem definition, event and measurement data, timeline, cause evidence register, and control/action plan
- Roles: Investigation lead · process and system experts · evidence owner · independent challenger · action owners
- Advance information: Define problem, impact, period, and system boundary; preserve evidence and record immediate containment separately.
- Overall time needed: One to five working days depending on evidence access and impact; 90–180 minutes for joint analysis.
- Setup: Prepare a workspace with Problem · Evidence · Causal chain · Root causes · Actions; separate example from live data.
Prepare for the work steps
Problem: Testable problem statement
- Define problem, impact, period, and system boundary; preserve evidence and record immediate containment separately.
- Precise problem definition, event and measurement data, timeline, cause evidence register, and control/action plan
Evidence: Evidence-backed timeline
- Testable problem statement
Causal chain: Tested causal chain
- Evidence-backed timeline
Root causes: Justified root causes
- Tested causal chain
Actions: Effectiveness plan
- Justified root causes
Root Cause Analysis · working structure
Testable problem statement
Describe the undesired outcome with deviation, impact, time, and boundary; keep containment separate.
...
Evidence-backed timeline
Reconstruct chronology from logs, measures, documents, and accounts; mark conflicts and gaps.
...
Tested causal chain
Connect direct and contributing factors; name mechanism and countercheck for each link.
...
Justified root causes
Test candidates for recurrence prevention, feasibility, and absence of harmful side effects.
...
Effectiveness plan
Target controls at root causes; set owner, date, effect signal, and review.
...
The blank worksheet contains prompts only.
Reference · original teaching example
Problem: Testable problem statement
Expected artifact: Testable problem statement
Describe the undesired outcome with deviation, impact, time, and boundary; keep containment separate.
Entry:
...
- Does it state what, when, where, and how much without presuming a cause?
Evidence: Evidence-backed timeline
Expected artifact: Evidence-backed timeline
Reconstruct chronology from logs, measures, documents, and accounts; mark conflicts and gaps.
Entry:
...
- Does every event have time, source, and evidence status, with conflicts visible?
Causal chain: Tested causal chain
Expected artifact: Tested causal chain
Connect direct and contributing factors; name mechanism and countercheck for each link.
Entry:
...
- Is every causal link supported by mechanism and evidence rather than temporal proximity?
Root causes: Justified root causes
Expected artifact: Justified root causes
Test candidates for recurrence prevention, feasibility, and absence of harmful side effects.
Entry:
...
- Does each root cause pass prevention, feasibility, and side-effect tests?
Actions: Effectiveness plan
Expected artifact: Effectiveness plan
Target controls at root causes; set owner, date, effect signal, and review.
Entry:
...
- Does every action address a cause and have an observable effectiveness signal?
Open questions and next steps
...
Method guide: https://methodatlas.meierhoff-systems.de/en/methods/root-cause-analysis/run-sheet
Example output
Concrete filled scenario, fictional example
Fictional example for orientation. Counts and timings describe this case and are not universal requirements.
root-cause-analysis-beispiel.md
Concrete filled scenario, fictional example
Fictional teaching example: Root Cause Analysis · working structure
Testable problem statement
On 14 May from 09:12–09:47, 38% of checkouts failed; 214 customers affected; scope EU production.
Evidence-backed timeline
09:08 batch starts; 09:12 pool 95%; 09:18 restart; 09:31 batch paused; 09:47 stable.
Tested causal chain
Batch and checkout shared a pool; batch held 72 connections; checkout exceeded timeout. Staging reproduction confirms it.
Justified root causes
RC1 no pool separation; RC2 monitoring excluded batch connections. Restart is a response, not a root cause.
Effectiveness plan
Separate pools by 21 May; alert total use at 70%; load test shows checkout failures below 1%; review 28 May.
Pitfalls
Recognize symptoms and steer against them
Quick overview, the full text is in the matching phase in the flow
- Testable problem statementDatabase failure caused by bad configuration presumes cause and solution.View in phase
- Evidence-backed timelineMemories become an exact timeline without corroboration.View in phase
- Tested causal chainAn event shortly before failure is automatically called causal.View in phase
- Justified root causesAnalysis stops at operator error or failed component.View in phase
- Effectiveness planActions say retrain the team without changing a control.View in phase
Testable problem statement
Database failure caused by bad configuration presumes cause and solution.
State only observed outcome, target, magnitude, time, and boundary.
Evidence-backed timeline
Memories become an exact timeline without corroboration.
Label every statement by source and check against technical or documentary traces.
Tested causal chain
An event shortly before failure is automatically called causal.
Describe the mechanism and test it by reproduction, comparison, or counterexample.
Justified root causes
Analysis stops at operator error or failed component.
Ask which technical or organisational control failed and apply the criteria explicitly.
Effectiveness plan
Actions say retrain the team without changing a control.
Define a technical or organisational control with measure and verification.
Stop criteria
When to pause, resolve prerequisites, or choose another approach
Finished the method guide?
Go to the profile for purpose, similar methods, and sources or continue to the next method in the catalog.

