Skip to content


Harry Cassin
Publisher and Editor

Andy Spalding
Senior Editor

Jessica Tillipman
Senior Editor

Bill Steinman
Senior Editor

Richard L. Cassin
Editor at Large

Elizabeth K. Spahn
Editor Emeritus

Cody Worthington
Contributing Editor

Julie DiMauro
Contributing Editor

Thomas Fox
Contributing Editor

Marc Alain Bohn
Contributing Editor

Bill Waite
Contributing Editor

Shruti J. Shah
Contributing Editor

Russell A. Stamets
Contributing Editor

Richard Bistrong
Contributing Editor

Eric Carlson
Contributing Editor

Root Cause Analysis: Does ‘5 Whys’ work for compliance?

Corporate FCPA defendants hoping for declinations must demonstrate that they’ve performed a root cause analysis and remediated the underlying conduct. The DOJ doesn’t tell companies how to do the root cause analysis, and there are many methods to pick from — Scatter Plot Diagram, Fishbone Diagram, Failure Mode and Effects Analysis (FMEA), and Pareto Chart, among others. But the simplest and perhaps most popular method is the 5 Whys.

It dates from the 1930s when Toyota founder Sakichi Toyoda developed it as a problem-solving technique. In essence, the 5 Whys works by assembling a qualified team to repeatedly ask why something went wrong until they finally come to the root cause. Getting there usually takes at least five whys, but it can take more.

The intention is to avoid treating symptoms of problems and instead treat causes. For example, if a machine stops working, ask:

(1) Why did the machine stop working? The answer might be because the drive belt broke.

(2) Why did the belt break? Because it was old and worn.

(3) Why was it old and worn? Because it had outlived its useful life and not been replaced.

(4) Why had it not been replaced?  Because there was no replacement on hand.

(5) Why wasn’t there a replacement on hand? Because the budget for spare parts doesn’t include replacement belts.

You might stop there and fix the problem by ordering spare belts. Or you might keep asking why. Maybe you’d find out the supervisor in charge of spare parts didn’t understand how critical the belts are and therefore didn’t budget for them. You remediate by giving the supervisor more training or putting someone else in the job.


Let’s try it with a compliance problem. Start by defining the problem. For example, there’s a pattern of questionable payments involving an intermediary in Country X. Then ask why as many times as it takes to uncover the root cause.

Why are we experiencing potential compliance issues involving an intermediary in Country X?

Answer: Because the intermediary doesn’t fully understand our anti-bribery policies or how they apply to third parties.

Why doesn’t the intermediary fully understand our policies or how they apply?

Answer: Because we aren’t providing sufficient training or consistently enforcing our policies.

Why are we not providing sufficient training or consistently enforcing the policies?

Answer: Because we haven’t allocated the necessary resources and expertise to ensure proper training of intermediaries in Country X or to monitor and enforce the policies there.

Why haven’t we allocated the proper resources for training and oversight?

Answer: Because those responsible for operations in Country X aren’t aware of the need for compliance resources there.

Why aren’t they aware of the need?

Answer: Because they aren’t fluent in risk assessments or compliance requirements.

So, the remediation might have several facets in various combinations:

1. Immediately train the intermediary.

2. Assign or hire people with more suitable skills and experience for Country X.

3. Provide more compliance training to those already responsible for Country X’s operations.

4. Involve more people in risk assessments for Country X. Make compliance needs there more widely known and prioritized.


It’s clear where the DOJ is coming from. Root cause analyses such as the 5 Whys force deeper thinking and, when it goes well, meaningful remediation. Ideally, that prevents scapegoating and hiding real causes.

Like all root cause analysis methods, the 5 Whys has strengths and weaknesses and doesn’t always work. A common problem is stopping too soon. Sometimes investigators don’t have the expertise. Or they’re afraid of repercussions for exposing malfeasance.

Wrong assumptions or wrong knowledge can stymie the 5 Whys. When investigators mistakenly conclude that an answer is accurate and complete, that can taint whatever comes next. That’s why the first step in the 5 Whys is to assemble a competent team to define the problem, ask the right whys, and weigh the answers.

Finally, problems with multiple contributing factors can result in ever-expanding question-and-answer trees. Too many branches growing from the 5 Whys template might confuse the outcome and obscure whether there has been appropriate remediation.

Share this post


Comments are closed for this article!