Root Cause Analysis in Adult Social Care: A Step-by-Step Guide to Investigating Incidents

When something goes wrong in a care setting, the instinct is often to fix the immediate problem and move on. But root cause analysis in adult social care asks a harder question: not just what happened, but why the conditions existed for it to happen at all. Done properly, it turns a single incident into a system-wide improvement. Done badly, it produces a file note that says "staff reminded to be vigilant" and nothing changes.

This guide sets out a practical, CQC-aligned process for investigating incidents in a care home or domiciliary care service, from the moment something happens to the point where you can evidence, with confidence, that you've learned from it.

Why root cause analysis in adult social care matters for CQC compliance

Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Good governance, requires providers to have systems in place that assess, monitor and mitigate risks to people using the service, and to continually evaluate and improve the quality and safety of care. Crucially, this isn't satisfied by simply recording that an incident happened. Providers must show they've analysed it, identified what needs to change, and acted on that without delay.

This is where a lot of services fall short, not because they don't investigate incidents, but because the investigation stops at the symptom. A fall gets logged as "resident forgot to use walking frame." A missed medication gets logged as "staff error." Neither answers the question CQC actually cares about: what in your systems, staffing, environment or processes allowed that to happen, and what have you changed as a result?

Step 1: Respond immediately and safeguard first

Before any analysis begins, the priority is the person's safety and wellbeing. This includes:

• Providing immediate first aid or medical attention

• Making the environment safe (removing hazards, securing equipment)

• Considering whether a safeguarding referral is needed

• Assessing whether the incident meets the threshold for a notifiable safety incident under Regulation 20, the duty of candour

Regulation 20 requires registered providers to act in an open and transparent way with the person affected (or their representative) whenever an unintended or unexpected incident has resulted in death, or severe or moderate harm. This means notifying them as soon as reasonably practicable, providing a truthful account of what's known so far, offering an apology, and giving reasonable support. An apology under this regulation is not an admission of liability, and delaying it until the investigation is "finished" is not compliant.

Step 2: Build the timeline before you analyse

Before jumping to conclusions, gather the facts. This means:

• A clear, chronological timeline of events, built from care records, rotas, medication charts and any relevant equipment or maintenance logs

• Statements from everyone involved, taken as close to the event as possible while memories are fresh

• Physical evidence where relevant (for example, equipment condition, room layout, lighting)

Regulation 17 requires records relating to care and treatment to be accurate, complete and contemporaneous. An investigation built on vague recollections weeks later won't hold up, either analytically or at inspection.

Step 3: Separate immediate causes from root causes

This is the step most investigations skip. The immediate cause is the direct trigger for the incident. The root cause is the underlying system failure that allowed the immediate cause to occur.

A simple way to get there is the "5 Whys" technique: keep asking why until you reach something you can actually change at a system level, rather than something you can only address by telling an individual to be more careful.

Worked example: an unwitnessed fall

• What happened? A resident was found on the floor of their bedroom, having fallen while mobilising unassisted.

• Why did they mobilise unassisted? Their care plan said they needed supervision when walking, but the plan hadn't been updated after a recent decline in mobility.

• Why hadn't the care plan been updated? The change in mobility was flagged in a handover note but never carried across into the written care plan.

• Why did that gap exist? There's no fixed process for turning verbal handover observations into care plan updates, so it depends on individual staff remembering to do it.

• Root cause: the service has no reliable system for translating day-to-day observations into updated risk assessments and care plans.

Notice that the root cause here isn't "staff didn't supervise the resident." It's a gap in the process that meant staff didn't know supervision was needed. That distinction changes the whole action plan.

Step 4: Map the contributing factors

Root causes rarely sit alone. Alongside the primary system failure, look systematically across these categories for anything that made the incident more likely or more severe:

• Staffing – levels, skill mix, agency use, fatigue

• Environment – lighting, flooring, equipment condition, layout

• Communication – handovers, documentation, escalation routes

• Training and competency – was relevant training up to date and applied

• Culture – did staff feel able to raise concerns before the incident happened

This wider view stops the investigation defaulting to "human error" as the explanation, which Regulation 17's emphasis on system-level governance is specifically designed to move providers away from.

Step 5: Write actions that fix the system, not the person

The test for a good action is simple: would it still work if a different member of staff were on duty tomorrow? "Staff reminded to check care plans" fails this test. "Handover template amended to include a mandatory mobility-change field, reviewed weekly by the senior carer" passes it.

Each action should have an owner, a deadline and a way of confirming it's actually been embedded, not just written down. Regulation 17 specifically requires providers to monitor progress against improvement plans and take action without delay if progress stalls.

Not sure your incident investigations would stand up to scrutiny at inspection? Try our CQC Readiness Assessment to see exactly where your governance evidence has gaps before an inspector finds them for you.

Step 6: Know your reporting obligations

A root cause analysis doesn't replace statutory reporting, it sits alongside it. Depending on the nature of the incident, you may also need to:

• Notify CQC directly, where the incident meets a statutory notification requirement (for example, certain safeguarding concerns or applications relating to deprivation of liberty)

• Report to the Health and Safety Executive under RIDDOR, where the incident arose out of or in connection with work activity and meets the threshold for a reportable injury, dangerous occurrence or work-related disease. Many incidents involving residents, such as an unwitnessed fall with no clear link to a work activity, are not RIDDOR-reportable, but this doesn't remove the general duty to investigate under health and safety law

• Make a safeguarding referral to the local authority, where appropriate

• Follow the Patient Safety Incident Response Framework (PSIRF), if you deliver care under an NHS Standard Contract, which sets out a proportionate, system-based approach to responding to patient safety incidents rather than relying on a fixed severity threshold

Getting the reporting route wrong, or missing it altogether, is one of the more common gaps CQC finds during inspection.

Step 7: Keep the evidence trail CQC will look for

Regulation 17 allows CQC to ask for a written report at any time on how you assess, monitor and improve safety, and providers must be able to show this within 28 days of a request. In practice, that means your RCA process needs to leave a clear trail from finding, to action, to evidence that the action actually changed something, whether that's an updated audit result, a reduction in repeat incidents, or confirmation that a new process is being followed consistently.

Want to check whether your last few incident investigations would leave that kind of trail? Run our Evidence Gap Assessment to see which records CQC inspectors would flag as missing before they do it for you.

Common root cause analysis methods

You don't need to use every method for every incident, but it helps to know the options:

• 5 Whys – simple, fast, and effective for most day-to-day incidents in a care setting

• Timeline analysis – reconstructing the sequence of events to spot where a decision point or checkpoint was missed

• Category-based factor mapping (similar to a fishbone approach) grouping contributing factors under staffing, environment, communication, training and culture, to avoid tunnel vision on one explanation

For low-harm, high-frequency incidents like minor falls, a straightforward 5 Whys is often proportionate. For anything involving death, serious harm, or a pattern of repeat incidents, a more thorough, multi-method investigation is warranted.

Frequently asked questions

What is root cause analysis in adult social care?

It's a structured way of investigating an incident to identify the underlying system failure that allowed it to happen, rather than stopping at the immediate, surface-level cause.

What's the difference between a root cause and a contributing factor?

The root cause is the fundamental system gap that, if fixed, would prevent recurrence. Contributing factors are conditions that made the incident more likely or more severe but wouldn't, on their own, have caused it.

Does CQC expect care providers to carry out root cause analysis?

CQC doesn't mandate a named methodology, but Regulation 17 requires providers to have effective systems for assessing, monitoring and improving safety, which in practice means demonstrating that incidents are analysed and learned from, not just recorded.

When does an incident need to be reported under RIDDOR rather than just recorded internally?

RIDDOR reporting to the Health and Safety Executive applies when an incident arises out of or in connection with work activity and meets the threshold for a reportable death, specified injury, over-seven-day injury or dangerous occurrence. Many resident incidents don't meet this threshold, but should still be investigated and recorded under your own governance processes.

Verified sources

• Care Quality Commission, Regulation 17: Good governance

• Care Quality Commission, Regulation 20: Duty of candour

• Health and Safety Executive, RIDDOR in health and social care

• NHS England, Patient Safety Incident Response Framework (PSIRF)