1. The seductive failure mode of 5 Whys
5 Whys is the most-taught root cause analysis technique on the planet because it's also the easiest to misuse. The promise is simple: ask "why?" five times and you've found the root cause. The reality, after thirty years of accident reports, is that 5 Whys converges on the most psychologically comfortable answer in the room — almost always a person.
Consider a real (anonymised) loss-of-containment event. A flange failed during a routine pipe-up. A 5 Whys session closed at "Operator failure to follow procedure" and prescribed re-training. Six months later, a different fitter, on a different shift, pulled a wrong-spec gasket from the same bin and the loss-of-containment recurred. A Tripod Beta investigation on the second event surfaced four latent organisational causes that 5 Whys had buried — a bin re-layout without an updated visual guide (GFT-7 Communication), near-identical packaging on adjacent bins (GFT-9 Design), a job-card template that did not require spec verification (GFT-3 Procedures), and a supervisor checksheet missing the gasket spec field (GFT-11 Defences). None of those are "operator failure". All four hand-deliver the same incident to the next person on the next shift. This is exactly what 5 Whys is designed to miss.
2. Where 5 Whys came from — and why it doesn't transfer to safety
Sakichi Toyoda invented 5 Whys in the 1930s for manufacturing defects on a deterministic loom. The system was small, the causal links were mechanical, the variables were knowable. Linear reasoning works when the system is linear. Industrial accidents are not linear. James Reason's Swiss cheese model and Jens Rasmussen's accimap both demonstrate that catastrophic events emerge from the alignment of multiple latent organisational weaknesses — preconditions, communication gaps, decisions made years before by people who never met the operator. Reducing this to a chain produces causal foreshortening: the analyst stops at the first answer that lets them close the report.
3. What Tripod Beta does differently
Tripod Beta — formalised by Shell and the University of Leiden in the 1990s and maintained by the Stichting Tripod Foundation — replaces the linear chain with a barrier-based tree. Every leaf is an Agent–Hazard–Target (HET) trio, and every barrier failure is classified against eleven General Failure Types (GFTs):
GFT-1 Hardware GFT-7 Communication GFT-2 Design GFT-8 Organisation GFT-3 Maintenance Mgmt GFT-9 Training GFT-4 Procedures GFT-10 Incompatible Goals GFT-5 Error-Enforcing GFT-11 Defences GFT-6 Housekeeping
The methodology forces three things 5 Whys cannot: every barrier failure must be classified (the analyst cannot stop at "human error" because GFT is not a category); every contributing thread is mapped (typically 20–40 branches per incident, not one); and the output is auditable (a regulator sees which barriers were challenged, which preconditions were classified, and which were not found). The cost is time — a competent Tripod Beta investigation takes 8–16 hours of analyst time across 3–5 days. That cost is the reason many organisations default to 5 Whys for everything, and the reason RISKOPILOT exists.
4. How RISKOPILOT compresses Tripod Beta into five minutes
RISKOPILOT is a Tripod Beta methodology engine that takes a written incident narrative and produces the full set of investigation artefacts in under five minutes: a Tripod Beta tree with every HET trio mapped, a BowTie diagram with preventive and recovery barriers separated, a STEP chart sequencing every actor across the timeline, a GFT organisational profile across all eleven types, prioritised recommendations linked to specific barrier failures, and a 12-section PDF report ready for ISO 45001 §10.2, IOGP Report 456 and Seveso III submission. Every artefact is traceable back to a sentence in the original narrative via the built-in evidence matrix.
5. When 5 Whys is the right tool
5 Whys is not worthless. It is appropriate when all four of these are true: the event is low-severity (no injury, no environmental release, no production loss above a defined threshold); the system involved is well-understood and stable; a single causal chain genuinely explains the event; and there is no regulatory or contractual reporting obligation. Within those bounds 5 Whys is a fast, cheap brainstorming aid. The mistake is using it for incidents that do not meet all four criteria — which, in high-hazard industries, is almost every incident worth investigating.
6. The decision tree
Injury, environmental release or production loss above threshold?
├── YES → Tripod Beta (or ICAM / BowTie). 5 Whys is non-defensible.
└── NO → Regulatory or contractual investigation obligation?
├── YES → Tripod Beta. 5 Whys is non-defensible.
└── NO → System stable and well-understood?
├── NO → Tripod Beta. Complexity is being underestimated.
└── YES → 5 Whys is acceptable for the immediate cause.
Re-investigate with Tripod Beta if recurrence.