Root Cause Analysis Template for Evidence and Follow-up

Playcode Team
13 min read
#root cause analysis template #corrective action #incident learning

QUICK ANSWER

What should a root cause analysis template include?

A root cause analysis template should capture a bounded problem statement, preserved evidence, an ordered timeline, competing tested hypotheses, causal and contributing factors, root causes, corrective and preventive actions, role-based owners, verification criteria, and follow-up. It should not become bug intake, an incident-response runbook, recovery execution, a complete retrospective or postmortem, blame assignment, or compliance assurance.

A useful root cause analysis preserves the observed problem and evidence before it settles on a cause. It distinguishes the event timeline, tested hypotheses, causal factors, contributing conditions, root causes, corrective actions, preventive actions, owners, verification, and follow-up.

This downloadable pack includes an editable worksheet, two JSON records, a closed JSON Schema, and a dependency-free validator with deterministic tests. The completed example is fictional. The analysis does not replace bug intake, incident response, recovery execution, a broader retrospective or postmortem, compliance review, or an exercise in blame.

Illustrative causal-analysis flow from evidence and timeline through a fictional event to actions and verification
Illustrative causal-analysis flow, not a product screenshot. The flame marks a fictional event and observation junction, not a verified root cause. The corrective and preventive action cards do not prove effectiveness; an actual conclusion depends on evidence, tested hypotheses, reviewer judgment, verification, and follow-up.

Build an evidence-led causal record

Move from observation to conclusion without turning chronology, correlation, or one plausible explanation into an untested root cause.

  1. Bound the problem and preserve evidence

    State expected and observed behavior, impact, scope, detection, and the investigation window. Give every evidence item a stable ID, timestamp, source, digest, and redaction confirmation before interpretation changes the record.

    Sources: [rca-pack], [osha-investigation], [nasa-swe-204]

  2. Order events and test competing hypotheses

    Build a timestamped timeline linked to evidence. Record plausible explanations before testing, then retain supported, rejected, and inconclusive results so the conclusion can be challenged instead of reconstructed from memory.

    Sources: [rca-pack], [nasa-swe-204]

  3. Separate factors from root causes

    Describe causal factors that directly produced the outcome and contributing conditions that increased likelihood or impact. Promote a root cause only when evidence supports an underlying, addressable condition and a recurrence test explains why changing it should matter.

    Sources: [rca-pack], [nasa-swe-204], [nist-rca]

  4. Link actions to factors and verify effectiveness

    Use corrective actions to repair the demonstrated failure and preventive actions to reduce recurrence. Link each action to factors, a role-based owner, dates, dependencies, evidence, a verification method, an expected result, and an observed result.

    Sources: [rca-pack], [nist-actions], [osha-investigation]

  5. Close the loop with follow-up

    Recheck the affected behavior after implementation, retain result evidence, and mark ineffective actions honestly. Implementation alone does not prove effectiveness, and follow-up completion does not certify compliance or every future operating condition.

    Sources: [rca-pack], [nasa-swe-204], [nist-actions]

  6. Validate the portable record

    Run the dependency-free checks before sharing or automating the record. The pack declares JSON Schema Draft 2020-12, closes every object shape, reserves test-domain links for fictional evidence, and rejects broken references, unsafe values, and contradictory states.

    Sources: [rca-pack], [json-schema-2020-12], [rfc-2606]

The root cause analysis boundary

Use this record after an observed problem needs causal learning. It can feed a broader retrospective or postmortem, but it does not own that meeting, its wider decisions, or team-learning record. Keep adjacent intake, response, recovery, assurance, and personnel processes with their accountable owners.

Included

  • Problem, impact, scope, evidence, timeline, hypotheses, causal factors, contributing factors, and evidence-supported root causes
  • Corrective and preventive actions, role owners, dates, dependencies, implementation evidence, verification, and follow-up
  • Editable Markdown, closed JSON records, fictional worked example, JSON Schema, validator, tests, and deterministic archive

Not included

  • Bug intake, reproduction triage, severity routing, incident command, communications, containment, recovery execution, or rollback
  • A complete retrospective or postmortem agenda, facilitation record, team feedback, decision log, release review, or organizational-learning plan
  • Blame, disciplinary findings, legal advice, audit opinion, regulatory interpretation, compliance assurance, or safety certification
  • A guarantee that every cause was found, an action will prevent recurrence, or a system is reliable, secure, safe, or compliant

DOWNLOADABLE RESOURCE

Download the root cause analysis template pack

Start with the Markdown worksheet or draft JSON, inspect the completed fictional example, and run the included dependency-free validator before adapting the record.

Root cause analysis template pack

A fictional evidence-led RCA pack covering the problem, evidence, timeline, tested hypotheses, factors, root causes, actions, verification, and follow-up.

Format: Markdown, JSON, JSON Schema, validator, and tests in one reproducible ZIP archive

Locally reproduced August 1, 2026. SHA-256: ee07e927404b918316a6506ba3dd94c265ea22a79155e4f20ad504b14b1dd036

Download the resource

Included

  • Editable Markdown worksheet plus a valid draft JSON starter
  • Completed fictional example with four evidence items, six timeline events, three tested hypotheses, and two root causes
  • Closed Draft 2020-12 JSON Schema and dependency-free validator
  • Forty-nine deterministic tests for record shape, references, chronology, actions, verification, boundaries, and unsafe content

Verification boundary

Validated the draft and completed records, ran 49 tests, checked the closed object shapes and cross-record references, copied an exact eight-file allowlist, stripped ZIP metadata, and reproduced the same archive hash across two consecutive builds.

Three ways to apply the record

The same evidence-to-verification graph can support different technical investigations while preserving the ownership boundary.

Duplicate export after a worker restart

Use when: A repeatable failure appears after a bounded infrastructure or process event and the team can preserve logs, outputs, and controlled test results.

The included fictional example rejects two alternatives, supports a retry-state hypothesis, identifies causal and contributing factors, and links two corrective actions and one preventive action to explicit verification.

Structure

  • Timestamped evidence and event chronology precede the causal conclusion
  • Action status remains separate from verification and scheduled follow-up

Watch for: The fictional record demonstrates structure only. Its cause and actions are not evidence for another system.

Sources: [rca-pack], [nasa-swe-204]

Recurring access-control regression

Use when: Several releases expose the same unauthorized or incorrectly denied path and the team needs to test code, policy, review, and coverage hypotheses.

Separate the direct behavior from contributing gaps such as missing negative tests or ambiguous ownership, then link fixes and prevention to the factors they address.

Structure

  • Preserve affected version, request, decision, policy, review, and test evidence
  • Verify the correction and the prevention control independently

Watch for: An RCA is not a security assessment or compliance opinion. Route specialist assurance separately.

Sources: [osha-investigation], [nist-rca], [nist-actions]

Recurring data mismatch and detection gap

Use when: A mismatch is corrected repeatedly but returns because the production mechanism or missing detection control remains untested.

Record the observed mismatch, trace its production and detection paths, reject unsupported guesses, and distinguish the corrective repair from preventive monitoring or invariant checks.

Structure

  • Link each factor and root cause to evidence rather than severity alone
  • Schedule follow-up against a recurrence window and retain result evidence

Watch for: A quiet follow-up window is limited evidence, not proof that recurrence is impossible.

Sources: [nasa-swe-204], [nist-actions], [rca-pack]

Decide whether the conclusion is reviewable

Structural validity cannot make the causal judgment for the team, but it can expose missing evidence, orphaned references, and premature closure.

  1. A proposed cause has no linked evidence, tested hypothesis, or recurrence test.

    Choose: Keep it as a hypothesis and collect discriminating evidence before publishing it as a root cause.

    Tradeoff: Closure waits, but plausibility does not become an unsupported organizational fact.

  2. An action has no linked factor, role owner, due date, or verification method.

    Choose: Keep the action planned and repair its ownership and evidence contract before implementation.

    Tradeoff: Execution may start later, but the team can tell what the action is meant to change.

  3. The action was implemented but its verification has not passed.

    Choose: Record implementation evidence without marking the action effective or the follow-up complete.

    Tradeoff: The record stays open, but activity is not confused with demonstrated risk reduction.

  4. The analysis drifts into response, blame, legal, audit, or compliance decisions.

    Choose: Restore the RCA boundary and link the separate accountable process instead of absorbing its verdict.

    Tradeoff: The RCA is narrower, but each decision retains its proper evidence and owner.

  5. The analysis is being treated as the entire retrospective or postmortem.

    Choose: Use the RCA as one evidence-led input, then keep the broader meeting record, decisions, team learning, and follow-through in the process that owns them.

    Tradeoff: The team maintains two bounded records, but causal conclusions are not confused with every lesson or organizational decision.

START WITH THE EVIDENCE

Download the RCA pack and test the record

Open the worksheet and fictional example, inspect the causal links, run the validator, and adapt the draft without erasing rejected hypotheses or unverified action states.

Download the root cause analysis pack

The ZIP is reproduced locally. Public availability and adapted source accuracy require separate verification.

What the template cannot prove

A strict record improves traceability. The conclusion remains limited by evidence quality, system observability, hypothesis design, reviewer judgment, implementation, and follow-up duration.

  • A chronological sequence can suggest where to investigate, but timing alone does not prove causation.
  • Five Whys or another causal technique can organize questions, but it cannot replace evidence or competing-hypothesis tests.
  • A passed verification demonstrates its recorded conditions, not every future workload, dependency, operator, or environment.
  • Role-based ownership does not assign personal blame or establish legal, employment, audit, safety, or compliance findings.
  • The template does not capture every purpose of a retrospective or postmortem, such as facilitation, team feedback, broader decisions, and organizational learning.
  • This ordinary informational article does not grant AI signup credits. The linked product page follows its own current eligibility rules.

Sources and verification record

The pack is the source for its fictional records and tests. The external sources support systems-oriented investigation, causal analysis, corrective action, verification, and the formats used by the pack without certifying this template.

  1. [rca-pack] Playcode:Root cause analysis fictional example

    Checked August 1, 2026. Supports: The locally reviewed fictional record, closed schema, role ownership, validation rules, action states, follow-up model, and deterministic tests. Public availability remains unverified until deployment.

  2. [nasa-swe-204] NASA Software Engineering Handbook:SWE-204 Process Assessments

    Checked August 1, 2026. Supports: NASA guidance for high-severity software nonconformances on timelines, root causes, causal and contributing factors, causal methods, corrective actions, closed-loop follow-up, and verification. It is not a universal certification of this template.

  3. [osha-investigation] Occupational Safety and Health Administration:Incident Investigation

    Checked August 1, 2026. Supports: A systems approach that looks beyond immediate causes and blame toward underlying factors and corrective action.

  4. [nist-rca] National Institute of Standards and Technology:Root Cause Analysis glossary

    Checked August 1, 2026. Supports: The systems-oriented definition of root cause analysis and underlying risk.

  5. [nist-actions] National Institute of Standards and Technology:Corrective and Improvement Actions program

    Checked August 1, 2026. Supports: NIST states that this in-development suborder establishes a process for documenting and implementing corrective and preventive actions for actual and potential Safety Management System nonconformities. It does not certify this template or its effectiveness model.

  6. [json-schema-2020-12] JSON Schema:JSON Schema Draft 2020-12

    Checked August 1, 2026. Supports: The schema dialect declared by the downloadable closed JSON Schema.

  7. [rfc-2606] RFC Editor:RFC 2606 Reserved Top Level DNS Names

    Checked August 1, 2026. Supports: Use of reserved test domains in fictional evidence links.

Root cause analysis template questions

What is included in this root cause analysis template?

It includes problem framing, evidence, timeline, hypotheses, causal and contributing factors, root causes, corrective and preventive actions, role owners, verification, follow-up, boundaries, a fictional example, closed JSON Schema, validator, and deterministic tests.

Is Five Whys enough for root cause analysis?

Five Whys can help continue causal questioning, but it is not proof. Preserve evidence, test competing hypotheses, distinguish factors, and state the recurrence test and limitations before treating an explanation as a root cause.

What is the difference between a root cause and a contributing factor?

A contributing factor increases likelihood, exposure, or impact. A root cause is an evidence-supported underlying condition the analysis concludes is addressable and relevant to recurrence. One problem can have several of each.

What is the difference between corrective and preventive action?

Corrective action repairs or controls the demonstrated failure. Preventive action reduces recurrence by changing an underlying condition, control, or detection gap. Both need factor links, ownership, implementation evidence, and effectiveness verification.

When is a root cause analysis complete?

Not when the document is written or the action is implemented. Completion needs an evidence-supported conclusion, linked actions, performed verification, retained result evidence, and the required follow-up state. Remaining uncertainty should stay visible.

Does this replace a bug report, incident runbook, retrospective, postmortem, or compliance review?

No. Bug intake captures and routes an observed defect. Incident response coordinates containment, communication, and recovery. A retrospective or postmortem can use the RCA as one input while covering wider decisions, team learning, and follow-through. Compliance review applies qualified criteria and evidence. This template owns causal analysis and action effectiveness only.

BUILD THE REVIEWED WORKFLOW

Turn the accepted RCA records into a bounded app

Give Playcode the reviewed record model, role permissions, states, evidence policy, validation rules, and ownership boundaries. Verify authorization, concurrency, retention, audit, integrations, monitoring, recovery, and specialist assurance before operational use.

Build and verify the RCA workflow

This informational article does not grant AI signup credits. No causal completeness, recurrence prevention, reliability, security, safety, compliance, or business outcome is guaranteed.

Have thoughts on this post?

We'd love to hear from you! Chat with us or send us an email.