Root Cause Analysis Template

Copy this template to create a new RCA document.

RCA-YYYY-MM-DD - Brief Title

Executive Summary

One paragraph summary: What happened, why, and what was done.

Timeline

Time Event

YYYY-MM-DD HH:MM

Initial observation / symptom noticed

YYYY-MM-DD HH:MM

Investigation started

YYYY-MM-DD HH:MM

Root cause identified

YYYY-MM-DD HH:MM

Fix implemented

YYYY-MM-DD HH:MM

Verification complete

Problem Statement

Symptoms

  • What was observed?

  • What failed or didn’t work as expected?

  • Who/what was impacted?

Expected Behavior

What should have happened?

Actual Behavior

What actually happened?

Root Cause

5 Whys Analysis

Why # Question and Answer

1

Why did [symptom] occur?
Because: [immediate cause]

2

Why did [immediate cause] occur?
Because: [deeper cause]

3

Why did [deeper cause] occur?
Because: [even deeper cause]

4

Why did [even deeper cause] occur?
Because: [systemic cause]

5

Why did [systemic cause] occur?
Because: [root cause]

Root Cause Statement

Clear, single-sentence root cause statement.

Example: "Documentation assumed Raft storage backend, but production system uses file storage backend."

Contributing Factors

Factor Description Preventable?

Factor 1

How it contributed

Yes/No

Factor 2

How it contributed

Yes/No

Impact

Severity

Metric Value

Severity

P0/P1/P2/P3

Duration

X hours/days

Users/Systems Affected

Count or description

Data Loss

Yes/No - details

Business Impact

  • Revenue impact?

  • Productivity impact?

  • Reputation impact?

Resolution

Immediate Actions (What was done)

  1. Step 1

  2. Step 2

  3. Step 3

Verification

How was the fix verified?

# Verification command

Preventive Measures

Short-term (This week)

Action Owner Status

Action item 1

Name

[ ] Pending

Action item 2

Name

[ ] Pending

Long-term (This quarter)

Action Owner Status

Systemic improvement 1

Name

[ ] Pending

Process change 1

Name

[ ] Pending

Detection

How was it detected?

  • Manual observation

  • Monitoring alert

  • User report

  • Automated test

Detection Gap

Could this have been detected earlier? How?

Lessons Learned

What went well

  • Item 1

  • Item 2

What could be improved

  • Item 1

  • Item 2

Key Takeaways

  1. Takeaway 1

  2. Takeaway 2

  3. Takeaway 3

Related

  • Link to incident ticket

  • Link to related documentation

  • Link to similar past RCAs

Metadata

Field Value

RCA ID

RCA-YYYY-MM-DD-XXX

Author

Name

Date Created

YYYY-MM-DD

Last Updated

YYYY-MM-DD

Status

Draft / In Review / Final

Review Date

YYYY-MM-DD (30 days from incident)