Diagnostic Investigation and Root Cause Analysis
Learn to investigate why a figure changed, from describing the change to tracing it across systems, without jumping to an explanation. No coding: you work on the data of Raket Parts, a fictional maker of rocket parts.
You will be able to
- describe a change before you explain it
- tell a real business shift from a data artefact
- reconcile two reports that disagree
- follow one figure across four systems
Describe it before you explain it
State a baseline, onset, size, scope and unknowns without inventing an explanation.
Real change or data artefact?
Distinguish an observed business shift from a data artefact and protect the evidence before a rerun.
Two reports, two answers
Reconcile two report totals with an evidence-backed bridge and a clear statement of open breaks.
One figure, four systems
Follow a figure through four systems, build a bridge with one evidenced step per cause and write a holding position for a difference that is still open.
What changed, and when?
Build one timeline of the changes around an onset, rank candidate causes by mechanism and timing, and rule out coincident changes with evidence.
Testing competing explanations
Find the evidence that tells two explanations apart.
Tracing recurring exceptions to where they start
Follow repeat problems back to the step that creates them.
Mid-Path investigation project
One investigation from first signal to holding position.
Re-deriving a colleague's conclusion
Check another analyst's finding from the source data.
Choosing a fix and recovering safely
Pick a fix, hold a position meanwhile and rerun without losing records.
Revising a conclusion when evidence changes
Update an earlier decision openly when new evidence arrives.
Integration clinics and your own anomaly
Apply the whole method to a change you choose.
Final assessment
A full investigation on an unseen case.
Root Cause Analysis / Module 1
Describe it before you explain it
Mira Dageraad sees a lower on-time delivery share. It is tempting to blame a supplier, but the first job is to describe precisely what changed.
Sections
Root Cause Analysis / Module 1 / Free practice
Try it on your own question
Run it in the practice editor
The practice editors have the Raket Parts tables loaded. Type a query or a formula, run it and change it as often as you like. Nothing is marked.
Root Cause Analysis / Module 2
Real change or data artefact?
Mira sees apparently faster dispatch and more incoming records. Before choosing a business explanation, test whether incomplete orders, replayed batches or late-arriving evidence changed the figure.
This module builds on module 1. If you are new to this, start with module 1.
Sections
Root Cause Analysis / Module 2 / Free practice
Try it on your own question
Run it in the practice editor
The practice editors have the Raket Parts tables loaded. Type a query or a formula, run it and change it as often as you like. Nothing is marked.
Root Cause Analysis / Module 3
Two reports, two answers
Sales and finance report different October 2025 figures. Start with their definitions, prove which earlier months agree, then show the October differences and what remains unresolved.
This module builds on module 2. If you are new to this, start with module 2.
Sections
Root Cause Analysis / Module 3 / Free practice
Try it on your own question
Run it in the practice editor
The practice editors have the Raket Parts tables loaded. Type a query or a formula, run it and change it as often as you like. Nothing is marked.
Root Cause Analysis / Module 4
One figure, four systems
Teun needs one sales figure for the Q3 2025 board pack. Orders, dispatches, invoices and the ledger each give a different number. Mira follows the chain, explains every difference with evidence and says what the pack uses while one stays open.
This module builds on module 3. If you are new to this, start with module 3.
Sections
Root Cause Analysis / Module 4 / Free practice
Try it on your own question
Run it in the practice editor
The practice editors have the Raket Parts tables loaded. Type a query or a formula, run it and change it as often as you like. Nothing is marked.
Root Cause Analysis / Module 5
What changed, and when?
Mira sees a June decline in recorded orders across every channel. Rebuild the timeline before deciding which of the surrounding changes deserves further investigation.
This module builds on module 4. If you are new to this, start with module 4.
Sections
Root Cause Analysis / Module 5 / Free practice
Try it on your own question
Run it in the practice editor
The practice editors have the Raket Parts tables loaded. Type a query or a formula, run it and change it as often as you like. Nothing is marked.
Root Cause Analysis / Module 1 / 1.3
1.3 Size and scope
Section 1.3 complete
Next: 1.4 The anomaly statement
Root Cause Analysis / Module 1 / 1.4
1.4 The anomaly statement
Section 1.4 complete
Next: Module 1 check
Continue to the module check Recap this section Back to module 1
Root Cause Analysis / Module 1 / Check
Module 1 check
Module 1 complete
Next: Module 2, Real change or data artefact?
Continue to module 2 Try it on your own question Recap module 1 Back to module 1
Root Cause Analysis / Module 2 / 2.1
2.1 Too good to be true
Section 2.1 complete
Next: 2.2 More rows is not more business
Root Cause Analysis / Module 2 / 2.2
2.2 More rows is not more business
Section 2.2 complete
Next: 2.3 Late evidence moves old figures
Root Cause Analysis / Module 2 / 2.3
2.3 Late evidence moves old figures
Section 2.3 complete
Next: 2.4 Broken history and what to keep
Root Cause Analysis / Module 2 / 2.4
2.4 Broken history and what to keep
Section 2.4 complete
Next: Module 2 check
Continue to the module check Recap this section Back to module 2
Root Cause Analysis / Module 2 / Check
Module 2 check
Module 2 complete
Next: Module 3, Two reports, two answers
Continue to module 3 Try it on your own question Recap module 2 Back to module 2
Root Cause Analysis / Module 3 / 3.2
3.2 Months that agree
Section 3.2 complete
Next: 3.3 The month that does not
Root Cause Analysis / Module 3 / 3.4
3.4 The bridge
Section 3.4 complete
Next: Module 3 check
Continue to the module check Recap this section Back to module 3
Root Cause Analysis / Module 3 / Check
Module 3 check
Module 3 complete
Next: Module 4, One figure, four systems
Continue to module 4 Try it on your own question Recap module 3 Back to module 3
Root Cause Analysis / Module 4 / 4.1
4.1 Differences that cancel out
Section 4.1 complete
Next: 4.2 Follow orders through the chain
Root Cause Analysis / Module 4 / 4.4
4.4 Holding a position
Section 4.4 complete
Next: Module 4 check
Continue to the module check Recap this section Back to module 4
Root Cause Analysis / Module 4 / Check
Module 4 check
Module 4 complete
Next: Module 5, What changed, and when?
Continue to module 5 Try it on your own question Recap module 4 Back to module 4
Root Cause Analysis / Module 5 / 5.1
5.1 Recent is not the same as responsible
Section 5.1 complete
Next: 5.2 One timeline from many logs
Root Cause Analysis / Module 5 / 5.2
5.2 One timeline from many logs
Section 5.2 complete
Next: 5.3 Mechanism and timing
Root Cause Analysis / Module 5 / 5.3
5.3 Mechanism and timing
Section 5.3 complete
Next: 5.4 Ranking, and changing your mind
Root Cause Analysis / Module 5 / 5.4
5.4 Ranking, and changing your mind
Section 5.4 complete
Next: Module 5 check
Continue to the module check Recap this section Back to module 5
Root Cause Analysis / Module 5 / Check
Module 5 check
Module 5 complete
Next: Module 6, coming later
Back to the Path Try it on your own question Recap module 5 Back to module 5
Root Cause Analysis / Module 1 / Recap
Recap card
1.1 Normal ups and downs
Normal ups and downs
- Confirmed means delivered with an ON_TIME or LATE outcome.
- Share is on-time lines compared with all confirmed lines.
- Check size before treating a swing as unusual.
Common mistake
The mistake. A rate without its group or sample size cannot support a confident story.
Root Cause Analysis / Module 1 / Recap
Recap card
1.2 Baseline and onset
Baseline and onset
- Baseline: a stated recent range, not a target.
- Onset: the first period outside it.
- Points: subtract percentage shares to size the movement.
Common mistake
The mistake. A single lower month does not identify a supplier or any other cause.
Root Cause Analysis / Module 1 / Recap
Recap card
1.3 Size and scope
Size and scope
- Split the same measure by line type.
- Scope includes both affected and relatively unaffected groups.
- Cause remains open until direct evidence connects it.
Common mistake
The mistake. A compelling supplier story is not proof of the cause.
Root Cause Analysis / Module 1 / Recap
Recap card
1.4 The anomaly statement
The anomaly statement
- Baseline, onset, size and scope make the change testable.
- Unknowns separate observed evidence from possible causes.
- Keep the count behind the rate in your note.
Common mistake
The mistake. Leaving unknowns out makes a guess look like a finding.
Root Cause Analysis / Module 1 / Recap
Recap card
Module 1: Describe it before you explain it
Normal ups and downs
- Confirmed means delivered with an ON_TIME or LATE outcome.
- Share is on-time lines compared with all confirmed lines.
- Check size before treating a swing as unusual.
Common mistake
The mistake. A rate without its group or sample size cannot support a confident story.
Baseline and onset
- Baseline: a stated recent range, not a target.
- Onset: the first period outside it.
- Points: subtract percentage shares to size the movement.
Common mistake
The mistake. A single lower month does not identify a supplier or any other cause.
Size and scope
- Split the same measure by line type.
- Scope includes both affected and relatively unaffected groups.
- Cause remains open until direct evidence connects it.
Common mistake
The mistake. A compelling supplier story is not proof of the cause.
The anomaly statement
- Baseline, onset, size and scope make the change testable.
- Unknowns separate observed evidence from possible causes.
- Keep the count behind the rate in your note.
Common mistake
The mistake. Leaving unknowns out makes a guess look like a finding.
Root Cause Analysis / Module 2 / Recap
Recap card
2.1 Too good to be true
Too good to be true
- Average dispatch time includes orders with a recorded first dispatch only.
- ORDERED_ONLY orders have not yet been dispatched.
- Compare completeness before announcing an improvement.
Common mistake
The mistake. Treating a faster average of completed cases as proof about all orders.
Root Cause Analysis / Module 2 / Recap
Recap card
2.2 More rows is not more business
More rows is not more business
- Batch means a system-to-system set of records.
- Replay means a repeated send of earlier records.
- New occurrences are different from received row counts.
Common mistake
The mistake. Adding replay records to new activity silently double counts work.
Root Cause Analysis / Module 2 / Recap
Recap card
2.3 Late evidence moves old figures
Late evidence moves old figures
- Late proof may revise old conclusions.
- UNKNOWN is not a recorded failure.
- Retain versions so someone can reproduce both answers.
Common mistake
The mistake. Reclassifying unknown outcomes as failures makes the measure look precise but wrong.
Root Cause Analysis / Module 2 / Recap
Recap card
2.4 Broken history and what to keep
Broken history and what to keep
- Snapshot the figure, time, filters and counts.
- Rebuilt is not the same as unchanged original history.
- Keep both versions to explain movement in past reports.
Common mistake
The mistake. Refreshing first and preserving the evidence later can destroy the comparison.
Root Cause Analysis / Module 2 / Recap
Recap card
Module 2: Real change or data artefact?
Too good to be true
- Average dispatch time includes orders with a recorded first dispatch only.
- ORDERED_ONLY orders have not yet been dispatched.
- Compare completeness before announcing an improvement.
Common mistake
The mistake. Treating a faster average of completed cases as proof about all orders.
More rows is not more business
- Batch means a system-to-system set of records.
- Replay means a repeated send of earlier records.
- New occurrences are different from received row counts.
Common mistake
The mistake. Adding replay records to new activity silently double counts work.
Late evidence moves old figures
- Late proof may revise old conclusions.
- UNKNOWN is not a recorded failure.
- Retain versions so someone can reproduce both answers.
Common mistake
The mistake. Reclassifying unknown outcomes as failures makes the measure look precise but wrong.
Broken history and what to keep
- Snapshot the figure, time, filters and counts.
- Rebuilt is not the same as unchanged original history.
- Keep both versions to explain movement in past reports.
Common mistake
The mistake. Refreshing first and preserving the evidence later can destroy the comparison.
Root Cause Analysis / Module 3 / Recap
Recap card
3.1 Same name, different question
Same name, different question
- Invoice date is the bill date; posting date is the accounting entry date.
- Ledger groups signed money entries by account and period.
- Compare definitions before deciding which total to use.
Common mistake
The mistake. Choosing the larger amount, or the more senior team, as truth.
Root Cause Analysis / Module 3 / Recap
Recap card
3.2 Months that agree
Months that agree
- Tie-out means checking equivalent totals across sources.
- Gross sales exclude credit-note adjustments.
- Signed entries must be presented on a consistent basis.
Common mistake
The mistake. Comparing invoice gross sales with after-credit net sales and calling any difference an error.
Root Cause Analysis / Module 3 / Recap
Recap card
3.3 The month that does not
The month that does not
- Gross gap is the difference before credits.
- Daily comparison locates the dates with unmatched totals.
- Root cause needs evidence for each ledger-to-invoice mismatch.
Common mistake
The mistake. Naming an unusual amount a duplicate without tracing its source.
Root Cause Analysis / Module 3 / Recap
Recap card
3.4 The bridge
The bridge
- Start with a clearly defined sales figure.
- List daily differences and credit notes separately.
- Keep open causes even if all amounts add up.
Common mistake
The mistake. Netting differences can conceal important unresolved records.
Root Cause Analysis / Module 3 / Recap
Recap card
Module 3: Two reports, two answers
Same name, different question
- Invoice date is the bill date; posting date is the accounting entry date.
- Ledger groups signed money entries by account and period.
- Compare definitions before deciding which total to use.
Common mistake
The mistake. Choosing the larger amount, or the more senior team, as truth.
Months that agree
- Tie-out means checking equivalent totals across sources.
- Gross sales exclude credit-note adjustments.
- Signed entries must be presented on a consistent basis.
Common mistake
The mistake. Comparing invoice gross sales with after-credit net sales and calling any difference an error.
The month that does not
- Gross gap is the difference before credits.
- Daily comparison locates the dates with unmatched totals.
- Root cause needs evidence for each ledger-to-invoice mismatch.
Common mistake
The mistake. Naming an unusual amount a duplicate without tracing its source.
The bridge
- Start with a clearly defined sales figure.
- List daily differences and credit notes separately.
- Keep open causes even if all amounts add up.
Common mistake
The mistake. Netting differences can conceal important unresolved records.
Root Cause Analysis / Module 4 / Recap
Recap card
4.1 Differences that cancel out
Differences that cancel out
- List gross: a €3.84m net gap hides over €19m of moves
- No plug: every step needs its own evidence
Common mistake
Explaining the net only. +€7,583,484.22 and -€11,421,056.30 each need their own evidence.
Root Cause Analysis / Module 4 / Recap
Recap card
4.2 Follow orders through the chain
Follow orders through the chain
- One source per step: order, dispatch, invoice, ledger
- Timing, definition or error: name the kind of each difference
Common mistake
Stopping at the totals. Three uninvoiced October shipments only show up order by order.
Root Cause Analysis / Module 4 / Recap
Recap card
4.3 The quarter bridge
The quarter bridge
- One step per cause, each with evidence and the residual stated
- Practice scale: size sets attention; evidence sets the label
Common mistake
Flagging an explained gap. The €3,837,572.08 Q3 gap is all timing, residual €0.00.
Root Cause Analysis / Module 4 / Recap
Recap card
4.4 Holding a position
Holding a position
- Holding position: figure, warning, until when, who is told
- Open items travel with the figure until they close
Common mistake
Dropping the warning. October's €62,279.15 is outside Q3 but still open.
Root Cause Analysis / Module 4 / Recap
Recap card
Module 4: One figure, four systems
Differences that cancel out
- List gross: a €3.84m net gap hides over €19m of moves
- No plug: every step needs its own evidence
Common mistake
Explaining the net only. +€7,583,484.22 and -€11,421,056.30 each need their own evidence.
Follow orders through the chain
- One source per step: order, dispatch, invoice, ledger
- Timing, definition or error: name the kind of each difference
Common mistake
Stopping at the totals. Three uninvoiced October shipments only show up order by order.
The quarter bridge
- One step per cause, each with evidence and the residual stated
- Practice scale: size sets attention; evidence sets the label
Common mistake
Flagging an explained gap. The €3,837,572.08 Q3 gap is all timing, residual €0.00.
Holding a position
- Holding position: figure, warning, until when, who is told
- Open items travel with the figure until they close
Common mistake
Dropping the warning. October's €62,279.15 is outside Q3 but still open.
Root Cause Analysis / Module 5 / Recap
Recap card
5.1 Recent is not the same as responsible
Recent is not the same as responsible
- Date the onset before ranking: orders were down on 2 June
- Recent is not responsible: the 5 June changes came after
Common mistake
Picking the latest change. The 5 June CRM change is HIGH risk and recent, but orders fell three days earlier.
Root Cause Analysis / Module 5 / Recap
Recap card
5.2 One timeline from many logs
One timeline from many logs
- One timeline: changes, incidents, interface batches and working days
- Unapproved changes still went live: 4 of them
Common mistake
Reading only the approval trail. X-CHG-0033 went live on 24 June with no approver on record.
Root Cause Analysis / Module 5 / Recap
Recap card
5.3 Mechanism and timing
Mechanism and timing
- Mechanism: what could the change break, and in which channel?
- Timing: did it come before the onset?
Common mistake
A coincident event as cause. The 2 June replay carried production confirmations, not orders.
Root Cause Analysis / Module 5 / Recap
Recap card
5.4 Ranking, and changing your mind
Ranking, and changing your mind
- Rank survivors by mechanism and timing
- Say the cause is open and what evidence would close it
Common mistake
Forcing a cause. No logged change before 2 June reaches order intake, so the cause stays open.
Root Cause Analysis / Module 5 / Recap
Recap card
Module 5: What changed, and when?
Recent is not the same as responsible
- Date the onset before ranking: orders were down on 2 June
- Recent is not responsible: the 5 June changes came after
Common mistake
Picking the latest change. The 5 June CRM change is HIGH risk and recent, but orders fell three days earlier.
One timeline from many logs
- One timeline: changes, incidents, interface batches and working days
- Unapproved changes still went live: 4 of them
Common mistake
Reading only the approval trail. X-CHG-0033 went live on 24 June with no approver on record.
Mechanism and timing
- Mechanism: what could the change break, and in which channel?
- Timing: did it come before the onset?
Common mistake
A coincident event as cause. The 2 June replay carried production confirmations, not orders.
Ranking, and changing your mind
- Rank survivors by mechanism and timing
- Say the cause is open and what evidence would close it
Common mistake
Forcing a cause. No logged change before 2 June reaches order intake, so the cause stays open.