Root Cause Analysis After a Serious Incident

A patient returns to theatre with a deep infection after a primary knee replacement. The investigation concludes that prophylactic antibiotics were given late, that this was a failure by the anaesthetic assistant, and that the recommendation is to remind staff of the antibiotic policy.

That investigation is worthless, and it is roughly what a large proportion of serious incident investigations produce. It identifies the last person in the chain, calls their action the root cause, and recommends education. Six months later the same thing happens, because nothing about the system changed.

This post covers how systems analysis actually works, what has replaced mandated root cause analysis in England, and the cognitive traps that ruin investigations. It sits within our governance series.

The name is the first problem

"Root cause analysis" imports an assumption that is usually false: that there is a root cause, singular, waiting to be found.

Serious incidents in surgery are almost never like that. They are the product of several conditions that were each individually survivable and became harmful in combination — a locum unfamiliar with the list, a checklist done while the patient was being positioned, a consent form that did not specify laterality, an implant rep who was not present, a theatre running late. Remove any one and the harm probably does not occur. None of them is the root cause.

James Reason's model remains the clearest way to hold this. Active failures are the unsafe acts at the sharp end — the wrong syringe, the missed sign. Latent conditions are the properties of the system that made those acts likely and their consequences serious — staffing, design, workload, culture, equipment. Active failures are easy to see and satisfying to blame. Latent conditions are what actually determine how often harm occurs.

What England replaced RCA with

Anyone learning this now should know that the landscape has changed, because a great deal of surgical folklore is still framed around the old system.

The Patient Safety Incident Response Framework (PSIRF) was published on 16 August 2022 and replaced the 2015 Serious Incident Framework, with providers completing the transition through autumn 2023.

What changed:

• No more "serious incident" declarations. PSIRF makes no distinction between patient safety incidents and serious incidents; organisations no longer categorise and declare events against a threshold.
• No automatic RCA with a 60-working-day clock. Under the old framework, crossing the threshold triggered a full RCA on a fixed deadline regardless of the incident or of what the organisation already understood about it.
• Proportionate response instead. Organisations choose a response matched to the learning available — which may be a full systems investigation, but may equally be a swift review, a thematic analysis across several events, or an audit.
• Compassionate engagement of patients, families and staff is built in as a core aim rather than an afterthought.

The reasoning is sound: mandating a heavyweight investigation for every threshold-crossing event produced a large volume of documents, a small volume of learning, and enormous pressure on the people involved. The risk of the new approach is the obvious one — "proportionate" can become an excuse for a thin response — which is why the quality of what follows matters more, not less.

Other jurisdictions retain more prescriptive requirements, and RCA-style investigation remains the norm in much of Australia, Canada and the US. The analytical method below applies whatever the framework you are working under.

Accurate as of July 2026. Incident-response frameworks differ by jurisdiction and are changing; confirm the requirements where you practise.

How the analysis actually works

The most widely used structured method in healthcare is the London Protocol, developed by Charles Vincent and colleagues. Its virtue is that it forces the analysis outward from the individual to the conditions, through a fixed set of contributory factor domains.

The discipline is to work through every domain rather than stopping at the one that produced the immediate act. In the infection example above, "antibiotics given late" is a task/technology and work-environment question long before it is an individual one: was the antibiotic drawn up and available? Was the timing prompt part of the checklist or a separate step? Was the list running so late that the pause happened during positioning?

The techniques, and their limits

Timeline first, always. Establish exactly what happened and when, from records and accounts, before any interpretation. Most weak investigations are weak because the sequence was never firmly established.

Five Whys is popular and genuinely useful for simple, linear problems. Its limit is that it produces a single chain, and complex incidents are not chains — they are meshes. Used alone it reliably terminates at a person.

Fishbone (Ishikawa) diagrams map multiple contributory categories at once, which suits healthcare better.

Barrier analysis asks what defences existed, which failed, and which were absent — a natural fit for surgical safety, where the checklist, the count, the consent and the site mark are all explicit barriers.

The two biases that ruin investigations

These are worth naming explicitly, because everyone believes they are immune and nobody is.

Hindsight bias. Once you know the outcome, the path to it looks obvious and the warning signs look conspicuous. The radiograph that "clearly" shows the fracture was one of forty films seen by a tired registrar at 2am, without the benefit of knowing which one mattered. The investigator's question is not "how was this missed?" but "what did this look like at the time, to someone who did not know what would happen next?"

Outcome bias. We judge the quality of a decision by how it turned out. The same decision, made the same way on the same information, is called reasonable when the patient does well and negligent when they do not. Investigations that grade decisions by outcome teach clinicians nothing except to fear bad luck.

The standard counter is the substitution test: would three peers, of similar experience, in the same circumstances, with the same information, time and pressures, plausibly have done the same thing? If yes, you are looking at a system problem wearing an individual's face.

"Human error" is where the analysis starts

If your investigation concludes "human error", you have identified the beginning of the question, not the answer. Every incident involves human action. The useful question is why that action made sense to that person at that time — because it almost always did.

Systems that rely on people being careful will fail at the rate at which people are not careful, which is a constant of the species. Systems designed so the error is difficult to make fail far less often.

Recommendations that actually change something

This is where most investigations collapse. Ranked by how well they work:

An investigation whose recommendations are all in the top two rows has not done its job. "Remind staff" is the null recommendation — it is what you write when you have not understood the system.

Every recommendation needs a named owner, a date, and a way of knowing whether it happened. Recommendations without those are aspirations, and they belong on the actions register discussed in Running a Useful M&M Meeting.

Just culture, concretely

A just culture is not a no-blame culture — that would be neither honest nor safe. It distinguishes between:

• Human error — a slip or lapse. Response: console, and fix the system that permitted it.
• At-risk behaviour — a drift into an unsafe shortcut, usually because the safe route is impractical. Response: understand why the shortcut exists and remove the reason.
• Reckless behaviour — a conscious disregard of substantial and unjustifiable risk. Response: accountability.

The overwhelming majority of surgical incidents sit in the first two categories, and treating them as the third is how a department stops hearing about its problems. The rare case that genuinely belongs in the third is handled through a separate process — never smuggled into the investigation.

If you are the clinician involved

• Write your own contemporaneous account early, while you remember it. Facts and sequence, not self-justification.
• Contact your indemnity provider before giving a formal statement.
• Engage with the investigation. Defensiveness reads badly and forfeits your chance to explain the conditions you were working under.
• Describe the pressures honestly — the staffing, the interruptions, the time. That is not making excuses; it is the data the investigation needs.
• Get support. Being the person at the centre of this is genuinely harmful, and departments are consistently worse at this than they believe. See Duty of Candour for the parallel obligation to the patient.

The summary

There is rarely one root cause. Establish the timeline before interpreting it. Work outward through every contributory-factor domain rather than stopping at the person nearest the harm. Ask what it looked like at the time, not what it looks like knowing the ending. Apply the substitution test before concluding anything about an individual.

And judge the investigation by its recommendations. If they could be implemented by sending an email, the analysis has not finished.