Investigation and evidence | Problem Management: investigate and prevent

Concept and mechanism

A useful investigation starts by separating observations from interpretations. Record when the error appears, which versions and operations it affects, and where expected behavior remains intact. Comparing affected and unaffected flows may expose a difference that distinguishes hypotheses. Develop competing explanations and identify data that could contradict them. If every observation seems to confirm the first idea, check whether only favorable evidence was selected. A change close to failure establishes a temporal relationship without demonstrating the mechanism. A helpful restart may be consistent with a resource leak, stale connections, or transient state; it does not independently select one of these causes.

Guided application

Five Whys is a way to deepen questions rather than an obligation to reach one cause on the fifth answer. Analysis may branch and needs evidence and participation from people who understand the system. A cause-and-effect diagram organizes candidates without proving them. In a fictional exercise, distinguish the deployment that triggered the incident, the missing connection limit, and monitoring that failed to detect saturation. Each factor may require a different improvement. Avoid stopping at human error: investigate available information, permissions, and safeguards. Document gaps and choose low-risk checks before experiments that change production. The conclusion should explain relevant observations and identify what remains uncertain.

IN PRACTICE

The same release may merely trigger a weakness that already existed.

Common pitfalls

Correlation as proof; five mandatory answers; diagram as conclusion; blame as mechanism.

Related topics: Identification and priority · Workarounds and known errors · Correction and accepted risk

Take this idea with you

A strong hypothesis explains facts and withstands proportionate attempts to contradict it.

Create account

Reference: Evidence and competing causal hypotheses · Problem management practices 2026-09; ServiceNow Brazil examples with scoped plugins and properties