The 5 Whys is a way of finding the cause of a problem by asking "why?" again and again until you reach something the organisation can fix. The number five is a guide, not a rule: stop when the answer points to a missing or broken process, not just a one-off mistake. Auditors use it to turn a finding into a cause that management can act on.
Last reviewed: 17 October 2026. Facts checked. We ran web searches on the technique and on its use in internal audit, and read the Wikipedia article on the Five Whys and an article from the Chartered IIA (UK) on root cause tools. We did not open Toyota's own writing. Sources differ on who first devised the method, so we do not credit one person. The examples are invented for teaching.
What the 5 Whys is
You start with a clear problem and ask why it happened. Then you ask why about that answer, and again, until the answer is a cause that sits in the process or its controls. The method is linked to Toyota, where it is part of production-system training, and it is now used in lean, Six Sigma and quality work.
It is quick, needs no software and works well for problems with a fairly short chain of causes. That is also its weakness, as the limits section below explains.
How to run it
- State the problem in one factual sentence. Say what, where and when. Avoid blame words.
- Ask "why did this happen?" Answer from evidence, not from guesses. If you do not know, find out before moving on.
- Ask why again about that answer. Keep going.
- Stop at a process cause. A good stopping point is something like "there is no step that checks X". A poor one is "someone forgot".
- Check the chain backwards. Read it from the last answer to the first, saying "therefore" between each. If a link does not follow, the chain is wrong.
- Agree actions that fix the root cause, not only the symptom.
Finance example: duplicate vendor payment
Problem: A vendor was paid twice for the same invoice in the last quarter.
| Why? | Answer | Evidence to ask for |
|---|---|---|
| 1. Why was it paid twice? | Two invoice entries were posted for one invoice | Ledger and payment run |
| 2. Why were two entries posted? | The invoice was keyed once from a scanned copy and again from the emailed original | Source documents |
| 3. Why was the second one not blocked? | The system accepted the same invoice number | System settings |
| 4. Why does the system accept it? | The duplicate-invoice check is switched off for this vendor group | Configuration review |
| 5. Why is it off? | The check was disabled during a data migration and nobody reviewed the setting afterwards | Change log, migration notes |
Root cause: no post-migration review of control settings. Fixing the single payment would not stop the next one. The action is to re-enable the check and add a settings review to the migration checklist.
Audit example: late bank reconciliation
Problem: Bank reconciliations are signed off weeks after month end.
- Why late? The preparer receives statements late.
- Why late? Statements are downloaded by one person who handles it only when free.
- Why only when free? Downloading is not on the month-end checklist.
- Why not on the checklist? The checklist was written before online banking was introduced and never updated.
- Why never updated? Nobody owns the checklist.
The root cause is unclear ownership. A better action than "remind the preparer" is to assign an owner and review the checklist yearly.
Common mistakes
- Blaming a person. "The clerk made a mistake" ends the analysis too soon. Ask what let the mistake through.
- Answering from opinion. Each answer should be backed by a record, a walkthrough or a system report.
- Following only one chain. Real problems often have more than one cause.
- Stopping at a vague label such as "poor culture" or "lack of training". These describe where the problem sits, not why it happened.
- Forcing exactly five. Stop when you reach a fixable process cause, whether that takes three whys or seven.
Limits of the method
Critics note that the depth of five is arbitrary, that investigators can stop at symptoms, that results depend on the investigator's own knowledge, and that different people can reach different answers. A single chain also hides other causes.
The Chartered IIA article suggests a fix often used in internal audit: run the chain twice, once for why the problem was not prevented and once for why it was not detected. That surfaces at least two control failures. For problems with many possible causes, start with a fishbone diagram and then use the 5 Whys on the likely branches.
Turning the answer into a finding
Write the root cause into the "cause" line of your observation, and keep the evidence for each why in the working papers. See writing audit observations for the full structure, and the operational audit guide for where root cause fits in fieldwork.
Frequently Asked Questions
Why is it called the 5 Whys?
Because experience suggested that asking why about five times often gets from a symptom to a process cause. It is a rule of thumb, not a requirement.
Can I stop before five whys?
Yes. Stop when the answer is a cause you can fix and prove with evidence.
Is the 5 Whys enough for audit root cause analysis?
It is a good start for simple problems. For complex ones, use it with a fishbone or the prevention-and-detection two-leg approach, because most issues have more than one cause.
Who should be in the room?
The auditor, the process owner and one or two people who do the work. The people closest to the process know where it breaks.
Is there a 5 Whys template?
A three-column table works: the question number, the answer, and the evidence for it. Add a final row for the root cause and the agreed action.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error