If you put 10 safety managers in a room and asked them what root cause analysis was, they would have ten different answers.
Safety professionals all say that they perform root cause analysis at some time during their risk management process. In their minds, that’s probably true.
But root cause analysis for one safety manager would not necessarily be the root cause analysis for another manager. This is because there is neither a standard and accepted definition of what root cause analysis nor a standard process of performing the root cause analysis, such as doing:
Nor is it necessarily a good thing for there to be a root cause analysis “definition” per se, as boxing in every risk management concept with definitions has the propensity to put a ceiling on performance and thwarts ingenuity. It’s for this same reason that oversight agencies and standards bodies like the FAA, IATA or ICAO will often revert to vague language in compliance requirements in order to keep performance flexible.
Regulatory agencies push out SMS documentation that explains concepts and expectations for compliance. Regulators keep their guidance materials vague for a simple reason. The aviation industry is so complex with the different types of aviation service providers that it would be impossible to write a prescription that applies to all operators in every geographic location. Consequently, it makes sense that regulations don't force an operator to perform a risk management process in only one prescribed way, as there may be multiple solutions that are equally effective in addressing a particular regulatory requirement.
Definitions aside, what is useful to establish are the goals of root cause analysis:
Achieving these goals may be the product of a 2-hour bowtie analysis, or it could be a cup of coffee and a lively brainstorming meeting with the safety team. Root cause analysis is not a “thing” to be defined, it’s a process with clear goals. Your process should be whatever helps you reach these goals.
Like root cause analysis, definitions of proactive and reactive risk management are somewhat elusive. Most safety professionals would accept the following statements about reactive and proactive risk management:
With this understanding, we would call root cause analysis reactive, as it is often performed in response to safety incidents. Corrective, preventative, and detective actions that are implemented in response to safety incidents would likewise be considered reactive.
However, there are other ways of considering proactive and reactive risk management. Though you may not agree, another potentially helpful way of conceptualizing proactive and reactive risk management is:
With this understanding, we would call root cause analysis proactive because it’s designed to prevent a similar future incident by mitigating all expected risks. Corrective actions would be considered reactive, while preventative actions would be considered proactive, just as detective risk controls are proactive.
The takeaway here is that proactive and reactive risk management definitions are simply models to help us understand risk management activities. While definitions are useful in aviation SMS discussions, we can often analyze them to death without receiving additional benefits.
Root cause analysis is often considered reactive because it is usually performed in response to safety incidents. However, there’s no reason to place this limitation on the root cause analysis process. Root cause analysis can be used:
Root cause analysis can be an extremely credible risk management process to use on risks that have not occurred.
Moreover, as said above, considering root cause analysis as only reactive limits potential understanding of what proactive and reactive activities can be. I openly advocate for a more liberal approach to understanding what “proactive” and “reactive” are, so long as your company is clear on its goals and definitions.
Preventing expressions of risk is at the foundation of aviation SMS implementations. You could make a great argument that “risk prevention” is the best definition of “proactive.” Whether this prevention is done by addressing potential risk before it occurs or after it occurs doesn’t matter so much as how effectively risk is cut off at the knees.
Here are the very unsatisfying potential answers:
Whether root cause analysis is a proactive or reactive technique depends on how you conceptualize reactive and proactive. I tend towards understanding root cause analysis as both reactive and proactive because it has elements of both types of risk management – this makes it a truly valuable and unique risk management tool.
However, if you take a more traditional approach to proactive and reactive definitions, then there is no reason you identify root cause analysis as either reactive or proactive, depending on how it is used.
For another risk management technique that will prove extremely helpful in identifying "what went wrong," check out this free walkthrough for SMS Shortfall Analysis:
Last updated December 2023.