Root Cause Analysis (RCA)

What is Root Cause Analysis?

RCA is the diagnostic engine of your safety management system. When an incident occurs, it's easy to point to the immediate cause—often "human error" or a mechanical failure—and stop there.

However, stopping at the immediate cause leaves the latent hazards that allowed the error to happen in place, guaranteeing that the incident will happen again, likely to a different worker.

Under the Work Health and Safety Act 2011 (WHS Act), your organisation has a primary duty of care to ensure the health and safety of workers. This includes a specific obligation under Regulation 38 to review and revise control measures following a notifiable incident.

RCA is the practical method you use to discharge this duty. By peeling back the layers of an event, you move from asking "who caused this?" to "what in our system allowed this to happen?"

Effective RCA shifts your focus from blaming individuals to improving the "systems of work" that support them. It transforms a reactive event (an accident) into a proactive asset (a safer system), ensuring that your Officer's due diligence obligations are met by actively learning from failure.

How it Works

A robust RCA process follows a structured timeline, moving from chaotic data to structured prevention.

1. Immediate Response and Data Collection

Before analysis begins, you must secure the scene and gather evidence. Data is perishable; physical traces change, and human memories fade or become contaminated by discussion.

Secure the scene: Ensure the site is safe, then preserve it. For notifiable incidents, you must not disturb the site until released by the regulator (e.g., SafeWork NSW or WorkSafe Victoria).

Gather data (PEEPO): Use the PEEPO model to ensure you don't miss critical context:

2. Analysis Methodologies

You need a structured tool to organise the data and identify systemic factors.

5 Whys: Useful for simple, low-risk incidents. You ask "why" repeatedly to drill down to the cause. Limitation: It often forces a single linear path and misses complex interactions.

ICAM (Incident Cause Analysis Method): The industry standard for high-risk Australian industries (mining, rail, construction). It identifies systemic factors by categorizing findings into Absent/Failed Defences, Individual Actions, and Organisational Factors.

Fishbone (Ishikawa): A visual brainstorming tool that groups causes into categories (Man, Machine, Method, Material, Environment).

3. Developing Recommendations

Once the root causes are identified (e.g., "maintenance budget was cut," not just "brake failed"), you must develop controls using the hierarchy of controls:

• Elimination/Substitution (Most Effective): Remove the hazard entirely
• Engineering: Isolate people from the hazard (e.g., guarding, interlocks)
• Administrative: Update procedures or training. Note: These are weak controls and should not be your primary outcome.
• PPE (Least Effective): The last line of defence

Why it Matters

Legal Compliance and Due Diligence

Under Section 27 of the WHS Act, Officers (directors and executives) must exercise due diligence. This requires them to have an up-to-date understanding of hazards and ensuring the PCBU has processes to receive and consider information about incidents.

A shallow investigation that stops at "worker error" leaves Officers exposed to legal liability because it fails to identify or rectify the true risks.

Prevention of Recurrence

If you treat a fever with ice, the patient cools down but the infection remains. Similarly, if you fire a worker for a safety breach without asking why the breach made sense to them at the time, you leave the "infection" (the systemic driver) in your workplace.

The next worker, facing the same time pressure or confusing procedure, will likely make the same error.

Operational Efficiency

Incidents are unplanned operational downtime. The same root causes that trigger safety incidents—poor maintenance, confusing workflows, inadequate training—often cause quality defects and production delays.

Solving the safety root cause often improves overall business performance.

Common Challenges

The "Human Error" Trap

The most common failure in RCA is concluding that "Human Error" is the root cause. As safety expert Sidney Dekker notes, human error is a symptom of a deeper trouble, not the cause.

If your report concludes with "worker failed to follow procedure," you have not finished the investigation. You must ask: Why did they not follow it? Was it unworkable? Were they fatigued? Did supervisors tacitly condone shortcuts?

Hindsight Bias

Investigators already know the bad outcome, which makes the events leading up to it seem obvious and predictable. You might think, "They should have seen that coming." This is hindsight bias.

To do effective RCA, you must try to understand the "local rationality" of the worker—understanding why their actions made sense to them at the time, given what they knew and the pressures they were under.

Legal Professional Privilege (LPP)

There is often tension between open learning and legal protection. While LPP protects investigation reports from being used in court, it can also prevent you from sharing vital safety learnings with your workforce.

You must balance the need for legal protection with the need for a transparent "Just Culture" where workers feel safe to speak up.

Linear Thinking in Complex Systems

Complex incidents rarely have a single root cause. They are usually the result of multiple interacting factors (e.g., a dark rainy night + a new casual worker + a rushing supervisor).

Linear tools like "5 Whys" can oversimplify these events. For serious incidents, ensure you use systemic tools like ICAM or AcciMap that can map these interactions.

Best Practices

Establish a "Just Culture": Move away from a blame culture. If workers fear discipline, they will hide evidence. Focus on whether the behaviour was a reckless violation or an honest mistake driven by system design.

Consult Your Workers: You cannot investigate a process you don't understand. Involve the Health and Safety Representatives (HSRs) and the workers who actually do the job. They know the reality of "Work as Done."

Focus on Hierarchy of Controls: Judge the success of your RCA by the strength of its recommendations. If your action plan is mostly "Retrain worker" and "Toolbox talk," your RCA has failed. Aim for engineering or elimination controls.

Verify Effectiveness: Don't just close the file. Schedule a review (e.g., 6 months later) to verify that the new controls are actually being used and have effectively reduced the risk (Regulation 38).