Most incident investigations in adult social care stop at the same place: a member of staff didn't follow the procedure.
Once it feels like an answer, it automatically closes the form. And it explains almost nothing.
Two areas of CQC regulation are particularly relevant when you're investigating incidents: Regulation 17, Good Governance, and Regulation 20, Duty of Candour.
Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires providers to have systems and processes to monitor quality and safety, assess and manage risks, maintain accurate records, and make improvements.
Regulation 20 requires registered persons to act openly and transparently with people receiving care. Where an incident meets the definition of a notifiable safety incident, specific duties apply, including informing the relevant person, providing an account of what is known, offering an apology and explaining what further enquiries will take place.
Root cause analysis (RCA) is a structured approach to investigating incidents that goes beyond the first obvious explanation. Instead of asking only who was involved or what went wrong, RCA looks at the conditions surrounding an incident, including the systems, processes, environment, and organisational factors that allowed it to happen.
The difference matters.
An incident report only records what happened.
For Registered Managers and Clinical Leads, this isn't optional. It sits directly underneath two regulatory duties: the requirement for effective governance and learning, and the statutory duty of candour.
So, how do you actually carry out a useful root cause analysis? And what do you do when you still can't figure out why something went wrong?
We’ll be uncovering that in this article, alongside why root cause analysis matters in adult social care, the tools you can use, where the duty of candour fits in, and how to turn investigation findings into lasting improvements.
Let's get into it!
How to Carry Out a Root Cause Analysis
Root cause analysis is not about sitting down after an incident and trying to decide who was at fault.
The aim is to understand what happened, why it happened, and what factors made the incident possible. That means working through the incident in a structured way rather than jumping straight to a conclusion. To carry out a good RCA, you must:
Start With What Happened
Begin with the facts.
What happened? When and where did it happen? Who was involved? Who was affected? What was the actual or potential harm?
At this stage, avoid assumptions about why it happened. Record what you know and separate confirmed information from anything that still needs to be established.
Involve the Right People
Who needs to be involved will depend on the incident. This could include the Registered Manager, Clinical Lead, senior care staff, the staff member involved, or other people who understand the process or circumstances being investigated.
The aim isn't to involve everyone.
It's to make sure the people carrying out the RCA have the right knowledge, evidence, and perspective to understand what happened properly.
Gather the Relevant Information
Don't rely on one person's account of what happened.
Review the records and information that can help you understand the incident, such as care plans, medication records, handover notes, policies, training records, staff rotas, communication records, equipment information or previous related concerns.
It may be easy to say:
“The care worker did not follow the procedure.”
But what happened around that decision?
Was the procedure clear? Has the person been trained? Was the correct information available? Was there adequate supervision? Was the staff member working under pressure? Had the process changed without everyone being made aware?
The WHO RCA approach encourages investigators to consider wider factors that may have influenced what happened.
Keep Asking Why
One of the simplest ways to do this is the 5 Whys.
Start with the problem and ask why it happened. Then take the answer and ask why again. Continue until you reach an underlying process, system, or organisational factor that can actually be addressed.
The exact number of questions does not matter. Sometimes you may need fewer than five, and sometimes you may need more. The point is to keep asking questions until you have explored the underlying factors that contributed to the incident.
Other effective investigation methods include:
- Fishbone or Ishikawa Diagram
Groups contribute factors such as people, processes, equipment, and environment to show how different issues may have combined.
- Contributory Factors Framework
Look at wider influences such as communication, staffing, training, supervision, environment and organisational factors.
For many adult social care services, the 5 Whys is a practical place to start because it is simple, flexible and can be used without specialist software.
What Makes a Root Cause Analysis Effective
A completed incident form is not the same thing as evidence of learning.
CQC may look at how your service responds when something goes wrong, including whether incidents are properly investigated, whether action is taken, and whether learning leads to improvement.
Under Regulation 12, incidents affecting people's health, safety and welfare should be reviewed and thoroughly investigated by competent staff, with action taken to remedy the situation, prevent recurrence and improve practice. Regulation 17 also requires providers to have effective systems for monitoring quality and safety and using information to drive improvement.
During an assessment, CQC may therefore look for evidence that:
- Incidents are investigated promptly and proportionately: The response should reflect the seriousness and complexity of what happened.
- Investigations look beyond the immediate cause: Where appropriate, providers should consider the wider factors that contributed to the incident.
- People are kept informed and supported: The person affected and, where appropriate, their family, carers or advocates should be involved and supported.
- Duty of candour requirements are followed: Where a notifiable safety incident has occurred, the relevant Regulation 20 requirements should be met.
- Actions are followed through: There should be a clear record of what needs to change, who is responsible, and whether the action actually worked.
- Learning is shared: Relevant staff should understand what happened and what needs to be done differently.
- Recurring themes are identified: Similar issues across incidents, complaints, audits, or other sources should not be treated as isolated events.
- Learning feeds into governance: Findings should lead to meaningful improvements in how the service operates.
A good investigation should also be fair, but there is an important distinction here.
Fair does not mean blame-free.
If someone deliberately ignored a clear safety procedure, that may need to be addressed.
But even then, the investigation should ask whether there were other factors involved.
- Was the procedure clear?
- Had the person been trained?
- Was the training understood?
- Was there adequate supervision?
- Was the correct information available at the time?
- Were there previous concerns that had not been acted on?
Still finding yourself thinking, “Okay, but why did they do that?”
Good. Let’s keep going.
Role of Duty of Candour in Root Cause Analysis
Root cause analysis and duty of candour are connected, but they are not the same thing.
The duty of candour is about being open and transparent with the person affected. RCA is about understanding what happened and learning from it.
For a notifiable safety incident, Regulation 20 sets out specific requirements. The provider must act openly and transparently, tell the relevant person in person as soon as reasonably practicable, provide an accurate account of what is known, explain what further enquiries will take place, offer an apology and provide reasonable support.
Importantly, CQC states that saying sorry is not an admission of liability.
When communicating with the person affected and their family or representative, where appropriate:
- Explain what is known: Give an accurate account based on the information available at that point.
- Be clear about what is not yet known: Don't speculate simply to provide an immediate answer.
- Explain what happens next: Tell them what further enquiries or investigation will take place.
- Offer a genuine apology: Apologising for the harm caused is part of the statutory duty where it applies.
- Provide appropriate support: Consider what practical or emotional support the person and their representatives may need.
- Keep a proper record: Document the steps taken to meet the duty of candour.
The investigation may continue after the initial conversation. You do not need to wait until every question has been answered before meeting your duty of candour obligations.
Check This Out!
CQC can take enforcement action, including prosecution, where it believes the statutory duty of candour has not been followed. Regulation 20 also allows CQC to move directly to criminal enforcement action.
What Happens Once RCA Is Complete
An investigation only adds value if its findings lead to action.
This is where many RCA processes fall.
A report can identify a perfectly reasonable recommendation, but if nobody owns it, nobody checks it, and nothing changes, the investigation hasn't reduced the risk.
Make learning stick by:
- Assigning every action to someone: There should be clear ownership rather than a general instruction for “management” to address an issue.
- Setting realistic deadlines: Actions should have a clear timeframe for completion.
- Sharing relevant learning: Where appropriate, communicate lessons across the wider staff team rather than keeping them with the people involved.
- Checking that actions happened: Don't treat an action as complete simply because it has been added to a tracker.
- Testing whether the change worked: Review the evidence later to see whether the action actually reduced the identified risk.
- Looking for wider themes: Similar findings across incidents, complaints, audits or safeguarding concerns may point to a larger governance issue.
Remember to start with the facts. Look beyond the immediate mistake. Involve the people who need to be involved. Be open with the person affected. And when you identify a problem, make sure someone owns the action that follows.
Compliance Reminder
CQC expects providers to investigate incidents thoroughly, take action to remedy problems, prevent further occurrences, and make improvements as a result.
If the same issue keeps appearing and the same corrective actions keep being recorded without producing a meaningful change, that can raise questions about whether the service's governance arrangements are actually effective.
The goal isn't simply to close the action.
It's to reduce the risk.
Turn Your Root Cause Analysis (RCA) to Better Care
A good RCA isn't about proving that nobody was at fault or finding someone to blame.
It's about understanding the incident properly before deciding what needs to change.
Because knowing what went wrong is useful, but knowing what to change because of it is where the real value is.
Need practical support beyond incident investigations?
👉 Access and Download Free Care Compliance Resources