CAPA Root Cause Analysis: Methods, Evidence, and Audit Defense

Root cause analysis is one section in the broader CAPA process, but it controls the quality of every section after it. If the RCA is wrong, the corrective action is wrong, the effectiveness criteria are wrong, and the read-across goes nowhere. For the methods themselves see root cause analysis; this page focuses on RCA as it lives inside CAPA.

What RCA does inside CAPA

Inside CAPA, RCA does three things. It produces a verified statement of cause that the action plan can target. It identifies both the occurrence path (why the defect was produced) and the detection path (why the existing controls did not catch it). And it generates the read-across scope — every other part, process, or plant where the same cause exists.

Choosing the method

Match method to severity and complexity.

• 5 Whys — lighter-severity issues, single failure mode, when a quick team huddle is appropriate. Strong when the chain is documented and reverse-tested at the bottom. Weak when used for multi-factor problems — the linear chain misses contributors.
• Fishbone (Ishikawa) — multi-factor problems, early in an investigation when you need to surface and organize possible causes. The 6M structure (Man, Machine, Method, Material, Measurement, Environment) covers most manufacturing failure modes. Pair with data to confirm which branches are real.
• 8D — customer complaints, supplier escapes, automotive OEM-driven CAPAs. The D1-D8 structure maps onto the CAPA process directly; D4 holds the RCA. Most automotive OEMs require 8D format for any complaint-driven CAPA.
• Fault Tree Analysis (FTA) — safety-critical, aerospace, medical device class II/III failures. Top-down logical decomposition of how a top-level event can occur. More rigorous than 5 Whys but heavier to execute.
• Pareto — not an RCA method by itself but the right input when you have a recurring family of defects and need to prioritize which root cause to chase first.

Occurrence and detection — always both

Every CAPA RCA needs two separate cause statements:

• Occurrence root cause — why the defect was produced in the first place. Treated with process, equipment, material, or control changes.
• Detection root cause — why the existing inspection, monitoring, or audit did not catch it. Treated with detection-system changes (added inspection, automated check, poka-yoke).

Collapsing the two into one cause is the single most common CAPA RCA weakness. The fix usually addresses occurrence and leaves the detection gap intact. The next variation in the process slips through the same hole — which is why the same CAPA reopens 90 days later as a different record on a different shift.

Evidence standards

Auditors expect:

• The RCA worksheet itself in the CAPA record — not summarized in prose, the actual chain or diagram.
• Data supporting the cause statement (defect rate, capability, log entries, photos of the failure mode, dimensional measurements).
• A reverse test for 5 Whys: starting from the root cause, the chain should logically produce the symptom. If it does not, the chain is wrong.
• For Fishbone, identification of which branch was confirmed as the probable cause and why others were ruled out.
• For 8D D4, the team members, the analysis date, and the data attached.
• Occurrence and detection causes in distinct, labeled fields.

Audit traps

• Symptom as cause. "Operator error," "wrong part used," "out of spec." All restated problem statements.
• Single 5 Whys for a multi-factor problem. A linear chain can miss two parallel contributors that both have to be present.
• Cause statement with no data. An auditor will ask "how do you know?" and the evidence has to exist.
• Detection cause missing. The most common finding on CAPA RCA in IATF 16949 and AS9100 surveillance.
• Action plan that does not match the cause. If the cause is a tool program error and the action is operator retraining, the two are not connected.
• No reverse test. The 5 Whys chain should reproduce the symptom when read forward. If it does not, the chain is wrong.

Examples

5 Whys done well (machining)

Symptom: burr on seal land causes leak test failure. Why? Tool worn beyond limit. Why? Tool life target too long. Why? Tool life set assuming nominal coolant concentration. Why? Coolant concentration not maintained in spec. Why? Manual refractometer check skipped. Occurrence root cause: coolant concentration drift caused by manual-check gap. Detection root cause: in-process surface check sampling-based, missed the wear window.

5 Whys done poorly (same case)

Symptom: leak test failure. Why? Surface finish bad. Why? Operator did not catch it. Why? Inattention. Why? Lack of training. Why? Training matrix not current. Root cause: "operator training gap." This goes nowhere — it misses the coolant and the inspection-system causes entirely.

FAQ

Which RCA method is best for CAPA?

There is no single best method. Match severity: 5 Whys for lighter cases, Fishbone for multi-factor problems, 8D for customer or supplier complaints, FTA for safety- or regulatory-critical failures.

Does CAPA require both occurrence and detection root causes?

Yes — that is the expected practice across IATF 16949, AS9100, ISO 13485, and FDA-regulated systems. Collapsing the two into one cause is the most common audit finding on CAPA RCA.

What evidence does an auditor expect for CAPA RCA?

The completed worksheet (5 Whys chain, Fishbone diagram, or 8D D4 section), the data that supports the cause statement, both occurrence and detection causes stated separately, and a reverse test that confirms the chain.

Can I use 5 Whys for an FDA-regulated CAPA?

Yes, when the failure is single-factor and the chain is documented with supporting data. For class II/III device failures with safety implications, FTA or a formal 8D is more defensible.