Chapter 43: Questions About Root Cause Analysis and the 8D Process

How deep should a 5-Why analysis go? When is it deep enough?

A 5-Why root cause analysis should answer the question: "If we remove this cause, will the nonconformance stop recurring?" If you ask five whys and the answer is "we were sloppy," you haven't gone deep enough.

You need to ask why the person was sloppy—was training incomplete? Was the work instruction unclear? Was the supervisor absent? Was the station understaffed? Each answer reveals a system-level cause you can actually control.

For most ISO 9001 CARs in small to mid-sized manufacturing, three to five whys is typical. For critical failures (safety, regulatory, or repeat issues), go deeper. The auditor's test is simple: they'll read your 5-Why and ask, "If we address this cause, will we prevent recurrence?" If you stumble, your RCA went too shallow.

Is the 8D process required for ISO 9001, or only for IATF 16949?

ISO 9001 does not mandate 8D. It requires root cause analysis and corrective action; it does not prescribe the method. The 8D (eight disciplines) process is a formal Ford/automotive standard, required under IATF 16949 for automotive suppliers.

If you sell to OEMs like Ford, GM, or Toyota, your customer SCAR (supplier corrective action request) often demands 8D. If you're a standalone ISO 9001 manufacturer in food processing, specialty manufacturing, or non-automotive sectors, a structured 5-Why, fishbone diagram, or fault tree analysis is sufficient.

The best practice: adopt one formal RCA method, document it in your corrective action procedure, and train your team on it. Auditors care that you use a method consistently, not which method you choose. Our PinnacleQMS corrective action module supports both 5-Why and 8D templates to match your sector.

What do I do if the root cause is the supplier? Do I open a CAR against them?

No—you open a corrective action request (CAR) against your own process. Your process failure is that you didn't catch the supplier issue in receiving inspection or incoming material verification (clause 8.4.1).

Your corrective action is to tighten your receiving controls, re-audit the supplier, or increase inspection frequency. You simultaneously issue a SCAR (supplier corrective action request) to the supplier asking them to fix their process.

Your CAR closes when you've fixed your control; the supplier SCAR is their responsibility. Track both: your CAR ensures you never miss it again; the supplier SCAR ensures they stop making it. This separation of responsibility is critical in an audit. Never close your CAR saying "supplier fixed it"—that's not a corrective action, that's hope.

Corrective action vs. preventive action—what's the actual difference, and when do I need each?

This is the most misunderstood question in ISO 9001. Corrective action responds to a nonconformance that already happened—you found a defect, a process step failed, or a customer complained. Preventive action addresses a risk or potential failure before it happens.

ISO 9001:2015 merged these into one clause (8.5.3 for control of changes and planning), but the distinction remains operational. If you spot a trend (three units this month had assembly errors), you open a CAR to fix the root cause. If you're introducing a new supplier or new equipment, and the risk assessment says "material variation could affect fit," you open a preventive action to qualify the supplier or tighten specifications.

In practice, your nonconformance procedure should trigger CARs; your risk management process (clause 6.1) should trigger preventive actions. Many manufacturers use a single form for both—label the section "Nonconformance or Risk Reason" and check a box. The auditor will review both your reactive CARs and your proactive risk controls, so don't skip preventive thinking.