Root Cause Analysis – Practical Examples from ISO Audits

A procedure was not followed.

A required inspection was missed.

An employee used an outdated document.

A piece of equipment was overdue for calibration.

When these problems are identified during an audit, organizations often recognize the immediate issue quickly.

The harder question is:

Why did it happen?

This is where root cause analysis becomes important.

A good root cause analysis does not simply restate the nonconformity or identify the person involved. It looks deeper into the conditions that allowed the problem to occur.

The following examples illustrate how seemingly straightforward audit findings can lead to very different root causes.

Example 1: An Outdated Procedure Was Being Used

The Finding

During an internal audit, an employee is found using an obsolete version of a work instruction.

Immediate Correction

The obsolete copy is removed and replaced with the current version.

Problem solved?

Not necessarily.

Looking Deeper

The investigation determines that the employee printed the procedure several months earlier and kept it at the workstation for convenience.

The document control system contains the current revision, but there is no process for controlling printed copies.

The root cause is therefore not simply:

“Employee used the wrong procedure.”

The more useful conclusion is that the document control process did not adequately address uncontrolled printed copies at points of use.

The corrective action can now address the system weakness, rather than only reminding one employee to check revision numbers.

Example 2: Equipment Calibration Was Overdue

The Finding

An auditor identifies a measuring instrument that was used after its calibration due date.

Immediate Correction

The equipment is removed from service and sent for calibration. The organization also evaluates whether previous results may have been affected.

Looking Deeper

Why was calibration missed?

The investigation discovers that calibration dates are maintained in a spreadsheet. One employee is responsible for checking it manually each month.

That employee was on extended leave, and no backup responsibility had been assigned.

The problem was not simply that someone forgot.

The process depended on one person remembering to perform a critical activity, with no secondary control or escalation mechanism.

A stronger corrective action might therefore address responsibilities, reminders, and backup arrangements.

Example 3: An Environmental Inspection Was Not Completed

The Finding

Several required weekly waste-storage inspections are missing.

The initial explanation is:

“The employee responsible was too busy.”

That explains what happened, but it may not be the root cause.

Looking Deeper

Further discussion reveals that the inspection responsibility was added to the employee’s workload several months earlier.

No specific time was allocated for it, supervisors rarely reviewed the records, and missed inspections had occurred previously without follow-up.

The deeper problem may therefore involve workload planning and ineffective oversight rather than an isolated failure by one employee.

This distinction matters.

Simply telling the employee to remember the inspections is unlikely to create a sustainable improvement.

Example 4: Employee Training Records Were Missing

The Finding

An employee performs a technical activity, but the organization cannot provide the required training or competency record.

A common immediate response is:

“We will retrain the employee.”

But what problem does retraining solve?

Looking Deeper

The employee has performed the activity competently for several years.

The investigation finds that training records are maintained independently by department supervisors, with no consistent process for submitting completed records to the central system.

The problem is therefore not necessarily employee competence.

It is the training-record control process.

Retraining the employee would create another record, but it would not address why records were missing in the first place.

Example 5: The Same Nonconformity Keeps Returning

The Finding

An internal audit identifies an issue that appears very similar to a finding closed the previous year.

The earlier corrective action included:

• Updating the procedure
• Retraining employees
• Closing the finding

Yet the problem returned.

Looking Deeper

This time, the organization reviews the earlier investigation.

It discovers that the original root cause was never clearly established. The procedure was revised because that seemed like an appropriate response, but there was little evidence that the procedure itself caused the problem.

The recurring finding may therefore indicate something important:

The previous corrective action addressed the symptom rather than the cause.

Recurring nonconformities should always prompt organizations to review previous investigations and ask why earlier actions failed.

Root Causes Are Often Systemic

These examples have something in common.

The immediate problem may involve an individual employee, but the deeper causes often relate to the management system:

• Unclear responsibilities
• Weak document controls
• Ineffective communication
• Poor workload planning
• Inadequate supervision
• Processes dependent on one individual
• Weak change management
• Ineffective follow-up
• Poorly designed workflows

This does not mean employee accountability never matters.

Sometimes an individual knowingly ignores a clear and reasonable requirement.

But “employee error” should not become the automatic conclusion simply because an employee was involved.

Don’t Force Every Investigation Into the Same Tool

The 5 Whys, fishbone diagrams, process mapping, brainstorming, and other root cause analysis techniques can all be useful.

But the tool is not the objective.

A simple issue may require only a few well-directed questions.

A complex or recurring problem may require a structured investigation involving multiple people and several potential contributing factors.

The goal is to understand the problem well enough to select an effective corrective action.

A beautifully completed fishbone diagram does not compensate for an incorrect root cause.

Questions to Consider

When reviewing your next audit finding, ask:

• Are we describing what happened or explaining why it happened?
• Have we stopped the investigation at “employee error”?
• Could the same problem occur with another employee?
• Does the process rely too heavily on memory?
• Could this issue exist elsewhere?
• Have similar problems occurred before?
• Does the proposed corrective action logically address the identified cause?

These questions often lead to more useful conclusions than simply asking who made the mistake.

Key Takeaway

Root cause analysis is not about making every problem complicated.

It is about looking deep enough.

The immediate cause may explain the event, but the root cause should help explain why the management system allowed the event to occur.

When organizations understand that difference, corrective actions become more targeted, recurring problems become easier to prevent, and audit findings become opportunities for genuine improvement.

Conclusion

An audit finding tells an organization that something went wrong.

Root cause analysis should help explain why.

Whether the problem involves an outdated procedure, overdue calibration, missed inspection, missing record, or recurring nonconformity, the objective is the same: understand the conditions that allowed the problem to occur and determine what should change.

The strongest investigations do not automatically blame employees, rewrite procedures, or prescribe retraining.

They follow the evidence.

And sometimes the most useful question is surprisingly simple:

“If we replace the person involved but change nothing else, could this happen again?”

If the answer is yes, there is probably more to investigate.