Incident Investigation: 5 Whys & PEEPO Field Guide

Key Takeaways

Most investigations stop at the immediate cause and miss the systemic factor that lets the incident repeat.

The 5 Whys, developed at Toyota in the 1950s, drives investigation past symptoms to root cause.

PEEPO (People, Equipment, Environment, Process, Organization) prevents tunnel vision on the most obvious contributing factor.

Used together, they produce both deep and broad investigations. Each one finds something the other misses.

The US recorded 2.8 million nonfatal occupational injuries in private industry in 2022 (BLS). Every avoidable repeat is one too many.

Most incident investigations stop too early. They identify the immediate cause: a worker did not wear PPE, a guard was removed, a procedure was not followed. The investigator assigns a corrective action. Three months later the same incident happens again.

Effective investigation goes deeper. It asks why the immediate cause existed, then asks why again, and again, until it reaches the systemic factors that allowed the incident to happen. This guide walks through the two structured methods that, used together, get investigations there reliably: the 5 Whys and PEEPO.

Why do most incident investigations fail?

Three common failure modes show up across industries.

Stopping at the immediate cause. "The worker did not follow procedure" is not a root cause. Why did they not follow it? Was the procedure unclear? Was it physically impossible to follow while meeting production targets? Was training inadequate? In 2022, the US Bureau of Labor Statistics recorded 2.8 million nonfatal occupational injuries in private industry alone. A meaningful share involve a hazard that was previously observed but never traced to its root cause.

Blame-first culture. If investigations feel like blame exercises, workers stop reporting. Reporting volume drops. Data quality drops. Pattern detection becomes impossible. The same dynamic that kills voice-first observation reporting shows up in investigations: the moment workers feel the system is out to assign blame, the data starts to dry up. Why investing in EHS software matters starts here, because the cultural shift only sticks if the tooling matches the intent.

No structured methodology. Without a framework, investigations depend on the individual investigator's experience. Results are inconsistent. Important contributing factors get missed because the investigator did not happen to ask about them.

What is the 5 Whys method?

The 5 Whys is the simplest structured root-cause method. It was developed by Taiichi Ohno at Toyota in the 1950s, formalized in his 1988 book Toyota Production System: Beyond Large-Scale Production, and is now standard practice across manufacturing, oil and gas, construction, and healthcare.

The method is exactly what the name suggests: starting with the incident, ask "why" repeatedly until you reach a systemic cause. Five iterations is the convention. The point is not the number. The point is to keep asking until the answer stops being a symptom.

A worked example

Incident: Worker slipped on wet floor in warehouse aisle 4
Why 1: Water was pooled on the floor
Why 2: A pipe fitting above the aisle was leaking
Why 3: The fitting was corroded
Why 4: It had not been replaced during the last scheduled maintenance window
Why 5: The maintenance schedule did not include pipe fittings in non-process zones

The root cause is a gap in the maintenance schedule, not "the floor was wet." The corrective action, adding non-process pipe fittings to the inspection schedule, prevents recurrence. Mopping the floor would have prevented the next two days. Fixing the schedule prevents the next two years.

When does the 5 Whys fail?

The method has limits. It can produce a single linear chain that misses parallel contributing factors. An incident often has more than one root cause. The investigator's framing of "why" can also bias the chain toward equipment factors and away from organizational factors. This is where PEEPO becomes essential.

What is the PEEPO framework?

PEEPO is a checklist that ensures investigators examine all five categories of contributing factors before drawing conclusions. Each letter is a lens:

People: Training, competency, fatigue, communication, supervision, motivation
Equipment: Condition, design, maintenance, suitability, availability
Environment: Lighting, noise, weather, workspace layout, housekeeping
Process: Procedures, work instructions, risk assessments, change control
Organization: Management systems, culture, resources, time pressure, leadership

PEEPO does not produce a root cause on its own. It produces a structured list of where to look. By forcing the investigator to consider all five dimensions, it surfaces contributing factors that a 5 Whys chain alone might miss, particularly the organizational and cultural factors that show up across multiple incidents.

The Heinrich Triangle, first published in Industrial Accident Prevention (Heinrich, 1931), describes a 300:29:1 ratio of near-misses to minor injuries to major injuries. The ratio is debated, but the underlying point is universally accepted: systemic factors generate clusters of small events before they cause one large one. PEEPO catches those systemic patterns. The 5 Whys alone often does not.

How do 5 Whys and PEEPO work together?

The most effective investigations use both methods in sequence:

Capture the facts. Time, place, people involved, immediate cause, consequence, witnesses, equipment state.
Run PEEPO. For each of the five categories, list contributing factors. This is structured brainstorming, not yet causation analysis.
Run 5 Whys on each significant contributing factor. For each factor identified through PEEPO, drive down to a root cause using the 5 Whys.
Generate corrective actions. Each root cause maps to one corrective action with an owner, deadline, and verification step.

This combination produces investigations that are both thorough (PEEPO ensures nothing is missed) and deep (5 Whys ensures root cause is reached). It also generates consistent, auditable records that hold up in regulatory reviews.

How does Haloehs support structured investigation?

Haloehs Incident Management builds 5 Whys and PEEPO into the incident workflow, with every finding flowing into Action Management for tracked closure. The system does not run the investigation for the investigator. It makes the investigator faster and more thorough by handling the repetitive parts.

AI assists the structured process:

Similar past incidents surface automatically based on incident type, location, and equipment, giving investigators relevant context from the start.
Suggested focus areas highlight which PEEPO categories are most often contributory for similar incident types.
Auto-generated CAPA plans convert investigation findings into trackable corrective actions, each with owner, deadline, and verification mechanism.
Recurrence detection flags when the current incident's root cause matches one previously closed, pointing directly at a corrective action that failed.

Every investigation feeds Action Management with assigned owners, deadlines, and closure verification. Nothing sits in a spreadsheet. The platform also connects investigation outputs to audit and risk-assessment workflows, so a root cause identified in one report can re-trigger a risk re-evaluation across the operation. The full picture of why purpose-built EHS software matters is on display in this loop.

FAQ

What is the difference between immediate cause and root cause?

The immediate cause is the action or condition that directly preceded the incident, usually the easiest factor to see. The root cause is the underlying systemic factor that allowed the immediate cause to exist. "The worker removed the guard" is an immediate cause. "The procedure required the guard to be removed for routine cleaning and there was no interlock" is a root cause.

How many "whys" are required?

Five is a convention, not a rule. The investigation continues until further "why" answers stop adding information, typically when the chain reaches a management-system or organizational factor that is within the operation's control to change.

When should I use PEEPO instead of 5 Whys?

Use them together, not instead. PEEPO is a coverage check that ensures all contributing-factor categories are considered. The 5 Whys is the depth tool that drives each contributing factor to its root cause. PEEPO without 5 Whys identifies factors but does not explain them. 5 Whys without PEEPO finds depth on one chain but often misses other contributory factors entirely.

Does PEEPO replace the Fishbone (Ishikawa) diagram?

The two are close cousins. Fishbone (Ishikawa) typically uses 6M categories (Man, Machine, Method, Material, Measurement, Environment). PEEPO uses five categories tailored to safety and human-systems contexts. Many EHS programs use PEEPO because the "Organization" category explicitly surfaces management-system factors that 6M leaves implicit.

How long does a structured investigation take?

For a near-miss, 30 to 60 minutes is realistic with templates. For a recordable incident, two to four hours of investigator time plus interviews. The cost is small relative to the cost of a recurrence. The 2024 Liberty Mutual Workplace Safety Index put the direct cost of US disabling workplace injuries at $58.5 billion per year.

What does Haloehs add over a paper or spreadsheet workflow?

Templates, AI-suggested focus areas, automatic surfacing of similar past incidents, CAPA generation, recurrence detection, and a queryable audit trail. The goal is not to replace the investigator's judgment. The goal is to remove the administrative drag so the investigator spends more time on the work that prevents the next incident.

The point of investigation is not to document the incident that happened. It is to prevent the next one. See CAPA effectiveness for how each investigation finding closes the loop.