# How to Conduct a Root Cause Analysis After a Biosafety Incident A root cause analysis (RCA) after a biosafety incident is a structured, evidence-based investigation that traces an unwanted event, such as a spill outside containment, a needlestick during culture manipulation, or a failure of a biological safety cabinet, back to the underlying system failures that allowed it. The goal is not to assign blame. The goal is to find and fix the conditions that made the incident possible, so the same event cannot recur with a different person, a different reagent, or a different day of the week. Use an RCA whenever a worker is exposed, when an infectious agent escapes primary or secondary containment, when a physical containment device fails during use, or when a near miss involves a high-consequence agent such as Mycobacterium tuberculosis or a filovirus. Many institutions also require an RCA for near misses with lower-consequence agents, because near misses are free lessons. Time commitment. Immediate scene control and notification take minutes to hours on the day of the event. A complete RCA for a typical BSL-2 incident takes roughly 10 to 20 hours of team time spread over 2 to 6 weeks of elapsed time. Incidents involving high-consequence agents, animal facilities, or multiple departments take longer, usually 6 to 12 weeks, because of additional interviews, occupational health follow-up, and regulatory reporting. ## Principle and Scope of the Investigation An RCA rests on two assumptions. First, competent people working under a functioning system rarely cause serious incidents through carelessness alone. Second, every visible error sits on top of latent conditions, such as an ambiguous standard operating procedure (SOP), a cracked gasket nobody logged, a training gap, or a workload pattern that pushed a technologist to skip a step. The investigation therefore works in layers. The proximate cause is what directly produced the harm, for example a tube slipped and broke. Contributing factors are the conditions that made the proximate cause likely, for example a tube type that was not compatible with the centrifuge rotor in use. The root cause is the system-level failure underneath, for example no process for validating tube and rotor combinations when a new specimen type was added to the test menu. This layered view matches the way risk management is described in the broader preparedness literature. A qualitative study of risk management for CBRNE (chemical, biological, radiological, nuclear, and explosive) events in military hospitals mapped the risk management cycle into four phases, prevention, preparedness, response, and recovery, and identified post-event review and ongoing training as explicit components of that cycle [1]. An RCA is the post-event review made rigorous. It feeds the recovery phase and resets the prevention phase. Scope discipline matters. The RCA covers the incident itself, the conditions that produced it, and the corrective and preventive actions (CAPA) that follow. It does not expand into a general audit of the laboratory unless the evidence points there. A focused investigation that finishes is worth more than an exhaustive one that stalls. ## When to Trigger a Root Cause Analysis After a Biosafety Incident Trigger a full RCA for any of the following. 1. An actual exposure. Sharps injury, mucocutaneous splash, inhalation event, or dermal contact with a confirmed or suspected infectious material. 2. A release outside primary containment. Spill of liquid culture or specimen outside a biological safety cabinet, breakage inside a centrifuge without sealed cups, or release during waste handling. 3. Engineering control failure during use. Biological safety cabinet alarm or airflow failure while infectious work was in progress, autoclave cycle failure with processed infectious waste, or seal failure on a rotor or cup. 4. Loss or discrepancy of an agent. A vial that cannot be located, an unexplained discrepancy in inventory, or a shipment received with broken packaging. 5. A near miss involving a high-consequence agent. Any event that would have caused exposure under slightly different timing, involving agents such as M. tuberculosis, Brucella species, Francisella tularensis, Coccidioides species, or filoviruses. 6. Repeated minor events with the same pattern. Three small同类 events within a quarter indicate a system problem even if each one alone seemed trivial. Skip the full RCA only for trivial events with no exposure potential and no pattern, such as a sealed, leak-free specimen bag arriving with an external smudge handled with gloves. Document even those briefly, because pattern recognition across events depends on consistent logging. ## Materials and Preparation Gather these before the first team meeting. Nothing here is exotic, but having it ready prevents the most common delay, which is reconstructing facts days later from memory. | Item | Specification or working preparation | Purpose | |--|--|--| | Incident report form | Institutional template, completed within 24 hours | Captures date, time, people, location, agent, immediate actions before memories drift | | Exposure response plan | Current institutional version, printed copy | Confirms first aid, medical evaluation, and notification steps were followed correctly | | Timeline worksheet | Blank grid with columns for time, event, evidence source | Reconstructs the event sequence from objective records | | 5 Whys worksheet | One page per causal chain | Drills each causal factor down to a system-level failure | | Cause-and-effect (fishbone) worksheet | Standard categories: people, procedure, equipment, environment, materials, management | Organizes brainstormed factors into testable categories | | Fault tree template | Top event written as a question, logic gates below | Works well for equipment-related incidents with clear binary branches | | Corrective action tracker | Columns for action, owner, due date, verification method, status | Prevents CAPA items from evaporating after the report | | Camera or phone with camera | Any available device | Documents the scene before cleanup changes it | | Chain-of-custody labels and evidence bags | Standard laboratory stock | Preserves physical items such as the failed tube, torn glove, or broken seal | | Disinfectant for re-entry | 1:10 dilution of household bleach, approximately 0.5 percent sodium hypochlorite, prepared fresh daily, or 70 percent ethanol where bleach corrodes equipment | Makes the scene safe for evidence gathering after a spill | | Appropriate PPE for re-entry | At minimum the PPE specified in the SOP for the agent involved | Protects investigators entering the scene | | Incident database or LIMS quality module | Institutional system of record | Log the event for trend analysis across months and years | **Safety note.** Do not re-enter a spill area for evidence gathering until the scene has been disinfected and the required contact time has elapsed, and never collect physical evidence without the PPE specified for the agent. If the incident involved a high-consequence agent, re-entry for investigation is itself a planned work activity that needs its own risk assessment and supervisor approval. ## Conducting a Root Cause Analysis After a Biosafety Incident Step by Step The sequence below assumes a BSL-2 exposure or release event in a diagnostic or research microbiology laboratory. Adapt the depth, not the order, for other event types. ### Step 1. Stop work, secure the scene, and deliver immediate care The affected worker follows the exposure response plan immediately. For a sharps injury, wash with soap and water. For a splash to eyes or mucous membranes, flush at an eyewash station for the duration specified in the institutional plan. For a spill, cover the area with absorbent material, apply disinfectant from the perimeter inward, and allow the required contact time before cleanup. Reason. The first hour determines whether an event becomes an exposure and whether any evidence survives. Immediate care also establishes the medical baseline that occupational health will use later. ### Step 2. Notify according to the escalation plan Notify the supervisor, the biosafety officer (BSO), and occupational health within the timeframe set by institutional policy, typically the same day. Events involving select agents, reportable diseases, or environmental release carry external notification duties that the BSO owns. Reason. Late notification forecloses both medical options and regulatory obligations, and it signals to staff that reporting has no consequences they can rely on. ### Step 3. Preserve the scene and evidence Photograph the area from at least two angles before anything is moved. Bag and label physical items, the broken tube, the torn glove, the failed cabinet filter indicator, with date, time, and collector initials. Download instrument logs the same day, because centrifuge cycle logs, autoclave printouts, and building management system records are frequently overwritten on short cycles. Reason. Physical and electronic evidence is objective. Testimony is not. Every claim you cannot anchor to evidence will need corroboration later. ### Step 4. Interview involved and nearby staff within 24 to 48 hours Interview the affected worker first, in a supportive setting, using open questions. Ask what happened, what they saw, what they expected to happen, and what usually happens on other days. Then interview witnesses and anyone whose work touched the materials involved. Record interviews with consent or take verbatim notes. Reason. Human memory degrades fast and conforms to retellings. Early interviews capture the true state of the bench, including improvisations staff would never write down. ### Step 5. Build the timeline Assemble every documented data point onto one chronological grid, from the last time the system was known good to the point of harm and through the response. Pull from instrument logs, access control records, sign-in sheets, SOP revision dates, training records, and maintenance histories. Reason. The timeline exposes the causal sequence and, just as often, exposes the gaps in the record. A gap in the record is itself a finding. ### Step 6. Convene the RCA team The team needs four to six people. Include the BSO or designee as facilitator, the supervisor of the affected area, a subject matter expert on the procedure involved who does not work in that section, and a quality or safety professional. Invite the affected worker as a full member, not as a subject. Exclude anyone with disciplinary authority over the affected worker from the analytical sessions. Reason. Hierarchy in the room kills candor, and candor is the raw material of an RCA. The outside expert prevents the team from treating local practice as normal practice. ### Step 7. Identify causal factors with a structured method Pick one primary method and use it consistently. - **5 Whys.** Start from the event and ask why repeatedly until the answer is a system property rather than a person's action. Five is a guideline, not a quota. Stop when the answer is a process you can change or an absence of a process. - **Cause-and-effect (fishbone) diagram.** Brainstorm factors under the six standard categories, people, procedure, equipment, environment, materials, management, then test each candidate factor against the evidence. - **Fault tree analysis.** Start with the top event phrased as a binary question, for example "aerosol released outside the cabinet," and decompose with AND and OR logic gates. Best for equipment and process failures with clear step logic. **Worked example.** A technologist sustained a needlestick while manipulating a needle and syringe containing a positive blood culture under a biological safety cabinet. The 5 Whys chain ran as follows. Why did the stick occur. The needle moved unexpectedly while she transferred the aliquot. Why. She was stabilizing the tube with one hand and the syringe with the other, with no holder. Why. The bench did not have a needle-to-tube transfer device at the cabinet. Why. The device existed in the storeroom but was not listed on the setup checklist for the blood culture bench. Why. The checklist had been written before the transfer device was introduced and had not been revised when the procedure changed. Root cause. No review trigger existed to update bench setup checklists when procedures change. CAPA. Add a change-control rule that any SOP revision requires review of the linked bench setup checklist within one week, with the BSO added as reviewer for procedures involving sharps and infectious material. Reason. A structured method forces the team past the first plausible answer, which is almost always a person, and down to the process layer where durable fixes live. ### Step 8. Verify each causal factor against evidence For every candidate cause, ask three questions. Is there evidence this condition existed at the time of the event. Would the event have occurred if this condition had been absent. Would removing this condition have prevented the event or reduced its severity. A causal factor must pass at least the first two. Reason. RCA teams routinely list factors nobody can support, usually drawn from memory of previous complaints. Unverified factors dilute the report and invite pushback. ### Step 9. Separate root causes from contributing factors and rank them Classify each verified factor as a root cause, a contributing factor, or a condition worth monitoring. Rank by two axes, the likelihood of recurrence if nothing changes and the potential severity if it recurs. Reason. CAPA resources are finite. The ranking decides what gets fixed this month and what goes into the risk register. ### Step 10. Develop and assign corrective and preventive actions For each root cause, write at least one action that changes the system, a revised checklist, a redesigned workstation, an engineered substitute for a manual step, an added control point in the workflow. For each contributing factor, decide whether to act now or monitor. Assign one named owner and one due date per action, and specify how completion will be verified, for example by direct observation of three subsequent procedures or by a scheduled internal audit. Hierarchy of controls applies, elimination and engineering controls outrank administrative controls and PPE. Reason. Actions without owners, dates, and verification methods have a well-known fate. They appear in the report and nowhere else. **Safety note.** Interim controls go in place before the team finishes the analysis. If the root cause implicates an engineering control, that equipment stays out of service for infectious work until repaired and requalified, regardless of workload pressure. ### Step 11. Report, share lessons, and close the loop Write the report in a standard format, summary, timeline, findings by causal factor with evidence, root cause statement, CAPA table, and residual risk statement. Circulate to the affected team and to leadership. Deliver a short lessons-learned briefing to adjacent sections where the same failure mode could exist. Log the event in the incident database. Schedule the effectiveness check at 60 to 90 days. Reason. An RCA that stays in one department is an RCA for one department. Most laboratories that investigate a transfer-device needlestick find the same latent gap in three other sections. ## Occupational Health Follow-Up and Monitoring Exposure follow-up is part of the RCA record even though clinical management belongs to occupational health. Document what baseline specimens were collected, what the medical plan is, and what follow-up schedule applies. For agents with prolonged incubation or persistence, structured longitudinal monitoring is the model used in contemporary outbreak science. The PREMAV protocol in Rwanda, initiated after the 2024 Marburg virus disease outbreak, enrolled survivors, antibody-positive individuals, and contacts for serial sampling of blood, urine, semen, and other specimens over 24 months after recovery, combined with continuous clinical assessment [2]. The design principle transfers directly. An exposed worker deserves a defined, pre-agreed monitoring schedule, not an ad hoc arrangement improvised after the fact. For tuberculosis laboratories, post-exposure follow-up follows the logic of contact investigation, in which exposed individuals are actively screened for latent infection with an interferon-gamma release assay or tuberculin skin test before any decision on preventive therapy. A cluster randomized trial in China of an ultrashort 1-month regimen of isoniazid plus rifapentine among close contacts illustrates how such screening programs are structured around systematic identification of exposed persons and defined follow-up intervals [3]. The RCA should confirm that the laboratory's own exposure plan for M. tuberculosis specifies the baseline test, the testing interval, and the decision points. ## How to Read the Results A finished RCA produces four readable outputs. 1. **The root cause statement.** One or two sentences naming a system-level failure, written so that a person outside the laboratory can understand it. Weak statement. "Technologist failed to follow the SOP." Strong statement. "The SOP revision process had no mechanism to update bench setup checklists when procedures changed, leaving the sharps transfer setup without its engineered control." 2. **The causal factor table.** Each factor with its evidence citation, classification, and rank. If a factor has no evidence citation, it does not belong in the table. 3. **The CAPA table.** Every action with an owner, a due date, and a verification method. Actions should map one-to-one onto the ranked causes, with engineering and elimination controls favored for the top-ranked items. 4. **The residual risk statement.** An honest sentence about what risk remains after the actions, and who accepts it. The event is not closed when the report is written. It is closed when the effectiveness check confirms the actions work. If the same failure mode recurs within a year, the original RCA missed a layer, and the new investigation starts from the old report. ## Verification Checks and Controls Borrow the control mindset from bench work and apply it to the analysis itself. - **Inter-reviewer agreement.** Have two team members independently draft the causal factor list before the group session, then reconcile. Large divergence means the evidence base is thin and more interviews or records are needed. - **Evidence audit.** Before the report is issued, verify that every finding traces to a document, a log, a photograph, or a recorded interview. Mark unsupported findings as hypotheses, not conclusions. - **Counterfactual test.** For each root cause, confirm the team can state specifically how the event would have unfolded differently had the factor been absent. Vague counterfactuals signal a contributing factor, not a root cause. - **Blame check.** Read the draft report and count how many actions target a person versus a process. If person-targeted actions dominate, the analysis stopped too shallow. - **Effectiveness check as the positive control.** The direct observation of three subsequent procedures, or the scheduled audit, is the control that proves the fix works in real conditions. ## Troubleshooting the Analysis Itself | Symptom | Likely cause | Fix | |--|--|--| | Interviews produce conflicting accounts | Memories formed after discussion, or fear of discipline | Reinterview separately, anchor on documents and logs, restate the no-blame purpose in writing | | Timeline has unexplained gaps | Records not captured on day one | Pull instrument logs and access records immediately, treat each gap as a documented finding | | 5 Whys terminates at "human error" | Team stopped at the first person-level answer | Ask "why did the system permit that error" and continue the chain | | CAPA list has 20 items and no owners | Brainstorming was mistaken for action planning | Cap the list at the top-ranked causes, assign one named owner and date per item | | Root cause blames staffing shortages only | Real factor but too shallow, staffing pressure usually interacts with a process weakness | Ask which steps were compressed and redesign those steps to tolerate time pressure | | Report drafted by one person and rubber-stamped | Facilitator skipped independent drafting | Reinstate the two-drafter reconciliation step | | Effectiveness check never happens | No owner or date assigned in step 10 | Enter the check into the audit schedule at the time the CAPA is assigned, not later | | Staff stop reporting near misses | A previous RCA led to discipline or public blame | Leadership states and enforces the just-culture boundary, discipline reserved for deliberate violation | ## Variations **Small laboratories.** With two or three staff, the team is smaller and the outside expert may come from a neighboring institution or the institutional biosafety committee. Keep the method and the record. A one-page RCA done honestly beats a template nobody fills. **High-consequence agent laboratories.** For work with M. tuberculosis, filoviruses, or other agents handled at higher containment levels, add external reviewers and expect regulator involvement. Tuberculosis remains the leading global cause of death from a single infectious agent, a burden documented across 204 countries and territories in the GBD 2023 analysis [4], which is one reason MDR-TB isolate handling sits under stringent containment expectations in most institutional biosafety programs. For filoviruses, the response literature emphasizes rapid workforce mobilization, expansion of molecular testing capacity, and coordinated multisectoral structures as the pillars that kept case fatality unusually low during Rwanda's first Marburg virus disease outbreak in 2024 [5]. Those pillars translate into laboratory practice as drills, surge-capacity planning for testing, and pre-agreed escalation chains, all of which an RCA should examine after any high-consequence event. **Equipment-centered incidents.** Fault tree analysis replaces fishbone diagramming. Include the manufacturer's technical documentation and the maintenance history as primary evidence. **Animal facility incidents.** Add a veterinarian or animal care specialist to the team. Bite and scratch events include an animal behavior dimension that bench-only teams handle poorly. ## Linking the RCA to the Biosafety Risk Assessment The biosafety risk assessment is the living document that describes, for each agent and procedure, what can go wrong, how likely it is, how severe it would be, and what controls reduce those numbers. An RCA is the risk assessment's reality check. Every verified causal factor from an RCA should be checked against the current risk assessment for that agent and procedure. If the assessment already identified the failure mode, the controls failed or were absent, and the control layer needs redesign. If the assessment never considered the failure mode, the assessment was incomplete, and the new failure mode enters it with a likelihood estimate informed by the event. This closes the cycle described in the CBRNE risk management framework, where post-event review feeds directly back into prevention and preparedness [1]. Run the reverse direction as well. When the risk assessment is next revised, review the incident log first. Patterns across three or more minor events frequently reveal a latent condition that no single RCA surfaced. ## Building Capability Through Microbiology Biosafety Training RCA quality depends on the competency of the people conducting it, and that competency is built before the incident. An effective microbiology biosafety training program includes annual competency assessment for exposures and spill response, scenario-based drills that simulate an incident from first aid through notification, and specific training in at least one RCA method for supervisors and BSO designees. The CBRNE risk management study identified ongoing training as a core component of the preparedness phase, alongside response planning and exercises, precisely because trained teams respond faster and coordinate better under stress [1]. Drills also surface procedural ambiguities while the cost of fixing them is a paragraph in an SOP rather than a lesson learned in a report. After each real RCA, feed the findings back into training. If the root cause was a knowledge gap, revise the training module. If the root cause was a skill gap, add a direct observation step to competency assessment. If the root cause was a system gap that no amount of training would fix, say so explicitly in the report, so the training program is not used as a catch-all corrective action. ## Common Mistakes and Limitations The following mistakes account for most failed RCAs in laboratories. Each is avoidable with the procedure above. - **Stopping at human error.** Naming the person as the root cause guarantees recurrence, because the conditions that produced the error remain. If your causal chain ends at a person, ask one more why. - **Investigating from the office.** Team members who never see the bench, the cabinet layout, or the storeroom miss environmental factors. At least two team members should visit the actual scene. - **Anchoring on the first plausible story.** The first coherent narrative is often the one told loudest. The timeline and the evidence audit exist to break that anchor. - **Corrective actions that only retrain.** Retraining is the weakest control in the hierarchy. If every CAPA is "retrain staff on the SOP," the analysis has not reached the root. - **Confusing near misses with luck.** A near miss is a full rehearsal of an incident with the outcome removed. Skipping the RCA on near misses with high-consequence agents wastes the cheapest warning you will ever get. - **Late interviews.** Waiting a week to interview witnesses converts recollection into reconstruction. Interview within 48 hours. - **Writing the report for regulators instead of for the bench.** A report that reads like a legal defense will not change practice. Write it so a technologist can read it in ten minutes and know exactly what will be different on Monday. - **No effectiveness check.** Declaring closure when the report is filed is the most common single failure. The event closes when verified observation shows the fix holds. - **Punitive framing.** If staff believe an RCA can cost them their job, the information flow that RCAs depend on dries up within one event. Leadership must enforce the just-culture boundary visibly. - **Overgeneralizing from one event.** One incident justifies fixing the identified causes. Sweeping redesign of a whole workflow based on one event usually introduces new failure modes. Scale the response to the rank of the causes. Limitations of the method itself. RCA depends on the quality of records and the candor of interviews, both of which can be incomplete. Causal chains in complex systems are rarely singular, and different teams applying different methods to the same event may identify different valid root causes. The analysis tells you what system conditions permitted this event, not everything that could ever go wrong in the workflow. Individual exposure cases need clinical management by occupational health or a physician, which no RCA replaces. ## Practical Tips From the Bench - Start the timeline the same day, even if it only has three entries. A partial timeline today beats a complete one next week. - Keep a standing RCA kit, worksheets, camera card, evidence bags, in the same drawer as the spill kit. - Record the interview in the affected worker's own words where possible. Paraphrase loses the detail that matters, for example "the cap was slick" versus "the cap was difficult to remove." - Bring the actual SOP to the team meeting and walk it step by step against the timeline. Divergence between the paper and the practice is where most causal factors hide. - Invite someone from a different section who does the same class of work. They will ask the question everyone local has stopped asking. - Put the CAPA table on the section's regular meeting agenda until every line closes. Visibility is what keeps owners honest. - Share the root cause statement, stripped of identifying details, with the wider laboratory network. Failures in one laboratory are rarely unique to it. ## Frequently Asked Questions ### How soon after a biosafety incident should the root cause analysis start? Immediate actions and notifications start within minutes to hours, and the analytical work should begin within 24 to 48 hours while evidence and memories are fresh. The full analysis can run 2 to 6 weeks, but delay the interviews or the evidence capture and you will lose the facts. ### Who should be on the root cause analysis team? Four to six people, including the biosafety officer or designee as facilitator, the area supervisor, an outside subject matter expert, a quality or safety professional, and the affected worker as a full participant. Exclude anyone with disciplinary authority over the involved staff from the analytical sessions. ### What is the difference between a root cause and a contributing factor? A root cause is a system-level failure such that, if it had been absent, the event would not have occurred. A contributing factor made the event more likely or more severe but was not sufficient by itself. Rank both, but direct corrective action primarily at root causes. ### Do near misses need a root cause analysis? Near misses with high-consequence agents always warrant a full RCA. Near misses with lower-consequence agents need at least a documented screening, and any pattern of repeated near misses triggers the full process. ### Which RCA method works best for laboratory incidents? The 5 Whys works well for most procedural and exposure events because it is fast and forces depth. Fishbone diagramming suits complex events with many parallel factors. Fault tree analysis suits equipment and process failures with clear binary logic. Pick one primary method per event and stay consistent. ### How do you prove corrective actions actually worked? Assign each action a verification method at the time it is assigned, typically direct observation of three subsequent procedures or a scheduled internal audit at 60 to 90 days. The event closes when the verification confirms the fix holds in real working conditions, not when the report is filed. ### What should the final report contain and who receives it? The report contains a summary, the timeline, causal factors with their evidence, the root cause statement, the CAPA table with owners and dates, and a residual risk statement. Distribute it to the affected team, laboratory leadership, and sections where the same failure mode could exist. ### How does the RCA feed back into the biosafety risk assessment? Every verified causal factor is checked against the current risk assessment for that agent and procedure. Known failure modes indicate that controls failed and need redesign. Unrecognized failure modes are added to the assessment with a likelihood estimate informed by the event. ## Further Reading - [Curcumin-loaded pH-responsive hybrid nanovesicles from Bergenia purpurascens root exosomes for synergistic lung cancer treatment.](https://pubmed.ncbi.nlm.nih.gov/42854457/) ## Sources 1. [Strategic Dimensions of Risk Management in Dealing with CBRNE Events in Military Hospitals: A Qualitative Analysis with a Policy Approach from the Perspective of Experts.](https://pubmed.ncbi.nlm.nih.gov/41878664/) 2. [Marburg virus persistence and clinical complications among recovered persons in Rwanda: a longitudinal study protocol.](https://pubmed.ncbi.nlm.nih.gov/42744376/) 3. [A Novel Therapy With a One-Month Ultrashort Regimen to Halt Progression From Latent Infection to Active Tuberculosis Among Close Contacts (The TB-YOUTH Study): Protocol for a Cluster Randomized Controlled Trial.](https://pubmed.ncbi.nlm.nih.gov/42247627/) 4. [Global, regional, and national burden of tuberculosis and multidrug-resistant tuberculosis by HIV status, 1990-2023: a systematic analysis for the Global Burden of Disease Study 2023.](https://pubmed.ncbi.nlm.nih.gov/42385762/) 5. [Rwanda's lessons for strengthening Africa's response to current Marburg virus disease outbreaks.](https://pubmed.ncbi.nlm.nih.gov/42119583/)