# Why 5 Whys keeps failing your investigations — and what to do instead > 5 Whys produces a linear chain that always ends at "human error". Tripod Beta, by contrast, classifies every precondition against eleven General Failure Types so latent organisational weaknesses are impossible to hide. For any incident with regulatory exposure (ISO 45001 §10.2, Seveso III, RIDDOR, OSHA 29 CFR 1904) Tripod Beta — or an equivalent barrier-based methodology — is the defensible choice. Use 5 Whys only for low-severity, single-cause events on a stable system. **URL:** https://riskopilot.com/learn/five-whys-vs-tripod-beta **Last reviewed:** 2026-06-22 **Author:** RiskoPilot Editorial Team (HSESKILLS Ltd) **Reading time:** 12 minutes **License:** CC BY 4.0 — attribute to RiskoPilot --- ## TL;DR | Dimension | 5 Whys | Tripod Beta | |---|---|---| | Origin | Sakichi Toyoda, 1930s — Toyota production system | Shell + University of Leiden, 1990s — process safety | | Reasoning shape | Linear chain | Branched tree of Agent–Hazard–Target (HET) trios | | Stops at | First answer that feels satisfying | Every barrier failure traced back to an organisational General Failure Type | | Hidden in the output | Latent organisational causes | Nothing — every precondition is classified | | Defensibility for ISO 45001 §10.2 | Weak — regulators frequently reject 5 Whys as "insufficient analysis" | Strong — Tripod Beta is named in IOGP Report 456 KPI guidance | | Time to run | 30 minutes | 8–16 hours manually, ~5 minutes with RISKOPILOT | | When it's the right tool | Low-severity, single-cause, stable system | Any reportable incident, any high-hazard industry | If you take one thing from this guide: **5 Whys is a brainstorming aid, not an investigation methodology**. Treating it as one is why the same incidents keep happening on your site. --- ## 1. The seductive failure mode of 5 Whys 5 Whys is the most-taught root cause analysis technique on the planet because it's also the easiest to misuse. The promise is simple: ask "why?" five times and you've found the root cause. The reality, after thirty years of accident reports, is that 5 Whys converges on the most psychologically comfortable answer in the room — almost always a person. Consider a real (anonymised) loss-of-containment event. A flange failed during a routine pipe-up. 5 Whys produced this chain: ```text Q1: Why did the flange fail? A1: The gasket was wrong-spec. Q2: Why was the gasket wrong-spec? A2: The fitter picked it from the wrong bin. Q3: Why did he pick it from the wrong bin? A3: He was rushing. Q4: Why was he rushing? A4: Shift change was approaching. Q5: Why didn't he double-check? A5: He didn't follow the procedure. ROOT CAUSE: Operator failure to follow procedure. CORRECTIVE ACTION: Re-train the operator. ``` The site closed the investigation. Six months later, a different fitter, on a different shift, pulled a wrong-spec gasket from the same bin and the loss-of-containment recurred. Tripod Beta on the second event surfaced what 5 Whys had buried: - The bin layout had been re-organised the previous month without updating the visual guide on the wall (**GFT-7: Communication**) - Gaskets of two different specifications were stored in adjacent bins with near-identical packaging (**GFT-9: Organisation / Design**) - The job-card template did not require spec verification — only "gasket fitted: Y/N" (**GFT-3: Procedures**) - The supervisor walk-around checksheet did not include gasket spec (**GFT-11: Defences**) None of those are "operator failure". All four exist independently of the operator. They are latent organisational failures that will hand-deliver the same incident to a different person on a different shift. **This is exactly what 5 Whys is designed to miss.** ## 2. Where 5 Whys came from — and why it doesn't transfer to safety Sakichi Toyoda invented 5 Whys for manufacturing defects on a deterministic loom. The system was small, the causal links were mechanical, the variables were knowable. Asking "why?" five times on a misaligned shuttle gives you the misalignment, the loose bolt, the dropped maintenance step, the missed training, the missing training programme. Linear reasoning works because the system is linear. Industrial accidents are not linear. James Reason's "Swiss cheese" model and Jens Rasmussen's accimap both demonstrate that catastrophic events emerge from the **alignment** of multiple latent organisational weaknesses — preconditions, communication gaps, decisions made years before by people who never met the operator. Reducing this to a chain produces what investigators call **causal foreshortening**: the analyst stops at the first answer that lets them close the report. | What 5 Whys assumes | What real accidents look like | |---|---| | One linear cause-effect chain | A web of failed barriers across multiple defence layers | | Stopping point is "obvious" | Stopping point is arbitrary unless tied to a classification framework | | Asking 5 questions is enough | A complex incident needs 30–80 HET trios to fully describe | | The interviewee can self-diagnose | Latent organisational causes are invisible to the people inside the organisation | ## 3. What Tripod Beta does differently Tripod Beta — formalised by Shell and the University of Leiden in the early 1990s and now maintained by the Stichting Tripod Foundation — replaces the linear chain with a barrier-based tree. Every leaf of the tree is a HET trio (Hazard, Target, Event) and every barrier failure is classified against eleven General Failure Types (GFTs): ```text GFT-1 Hardware GFT-7 Communication GFT-2 Design GFT-8 Organisation GFT-3 Maintenance Mgmt GFT-9 Training GFT-4 Procedures GFT-10 Incompatible Goals GFT-5 Error-Enforcing GFT-11 Defences GFT-6 Housekeeping ``` The methodology forces three things 5 Whys cannot: 1. **Every barrier failure must be classified.** The analyst cannot stop at "human error" because GFT is not a category. The system pushes back to the organisational layer behind the immediate cause. 2. **Every contributing thread is mapped.** A 5 Whys chain has one branch; a Tripod Beta tree typically has 20–40, each ending at a classified organisational precondition. 3. **The output is auditable.** A regulator reviewing the report sees which barriers were challenged, which preconditions were classified, and which were *not* found — making over-fitting and under-investigation equally visible. The cost of this rigour is time. A competent Tripod Beta investigation takes **8–16 hours of analyst time spread across 3–5 days**. That cost is the reason many organisations default to 5 Whys for everything — and the reason RISKOPILOT exists. ## 4. How RISKOPILOT compresses Tripod Beta into five minutes [RISKOPILOT](https://riskopilot.com) is a Tripod Beta methodology engine that takes a written incident narrative and produces the full set of investigation artefacts in under five minutes: 1. **Tripod Beta tree** with every HET trio mapped and every barrier failure classified to a GFT 2. **[BowTie diagram](https://riskopilot.com/methodology/bowtie)** with preventive and recovery barriers separated 3. **[STEP chart](https://riskopilot.com/methodology/step-chart)** sequencing every actor across the timeline 4. **[GFT organisational profile](https://riskopilot.com/methodology/gft)** across all eleven types 5. **Prioritised recommendations** linked to specific barrier failures 6. **12-section PDF report** ready for ISO 45001 §10.2, IOGP Report 456 and Seveso III submission Every artefact is traceable back to a sentence in the original narrative via the built-in evidence matrix. For high-stakes events, the draft can be routed to a certified Tripod Beta practitioner for 24–72h expert review before release. The engine does not replace investigator judgement — it absorbs the mechanical analysis work so the investigator's time goes to interviews, barrier verification, and recommendation closure tracking. ## 5. When 5 Whys is the right tool 5 Whys is not worthless. It is appropriate when **all four** of these are true: - The event is low-severity (no injury, no environmental release, no production loss above a defined threshold) - The system involved is well-understood and stable - A single causal chain genuinely explains the event - There is no regulatory or contractual reporting obligation Within those bounds 5 Whys is a fast, cheap brainstorming aid that surfaces the immediate cause and points to an obvious corrective action. The mistake is using it for incidents that do not meet *all four* criteria — which, in high-hazard industries, is almost every incident worth investigating. ## 6. The decision tree ```text Was there an injury, environmental release, or production loss above threshold? ├── YES → Tripod Beta (or ICAM / BowTie). 5 Whys is non-defensible. └── NO → Is there a regulatory or contractual investigation obligation? ├── YES → Tripod Beta. 5 Whys is non-defensible. └── NO → Is the system stable and well-understood? ├── NO → Tripod Beta. Complexity is being underestimated. └── YES → 5 Whys is acceptable for the immediate cause. Run a Tripod Beta if the same event recurs. ``` ## 7. Frequently asked questions **Q: Can I use 5 Whys *as part of* a Tripod Beta investigation?** Yes. 5 Whys is useful for individual barrier-failure branches within a Tripod Beta tree to drill into a specific precondition. The error is using 5 Whys *as* the methodology. **Q: How does Tripod Beta compare to ICAM?** ICAM (Incident Cause Analysis Method, BHP Billiton) shares Tripod Beta's barrier-based logic but uses a different precondition taxonomy. Both are defensible. Tripod Beta has stronger uptake in oil & gas and chemicals; ICAM is more common in mining. **Q: How does Tripod Beta compare to BowTie?** [BowTie](https://riskopilot.com/methodology/bowtie) is a **prospective** risk-assessment tool — what could go wrong, which barriers exist, are they healthy. Tripod Beta is a **retrospective** investigation methodology — what did go wrong, which barriers failed, why. The two complement each other: BowTie identifies the barriers, Tripod Beta investigates which ones failed. **Q: Is Tripod Beta certified?** Yes. The Stichting Tripod Foundation maintains a practitioner certification (Tripod Beta Investigator, Tripod Beta Practitioner, Tripod Beta Master). RISKOPILOT-routed expert reviews are performed by certified practitioners with 10+ years HSE field experience. **Q: Does RISKOPILOT replace the need for trained investigators?** No. RISKOPILOT compresses the mechanical analysis. The investigator still owns scene preservation, witness interviewing, barrier walk-down and recommendation closure verification — the parts that require judgement and physical presence. **Q: What does it cost?** £99 per investigation report, £149 for a bilingual (EN+FR/ES/PT) report, £49 for an executive briefing slide deck. Enterprise plans start at £499/month with unlimited investigations. ## Related - [Tripod Beta methodology](https://riskopilot.com/methodology/tripod-beta) - [Tripod Beta vs 5 Whys — detailed comparison](https://riskopilot.com/compare/tripod-beta-vs-5-whys) - [BowTie analysis](https://riskopilot.com/methodology/bowtie) - [GFT — General Failure Types](https://riskopilot.com/methodology/gft) - [Incident Investigation Software](https://riskopilot.com/solutions/incident-investigation-software) - [Accident Investigation guide](https://riskopilot.com/solutions/accident-investigation) - [Root Cause Analysis Software](https://riskopilot.com/solutions/root-cause-analysis-software)