What has Rudyard Kipling got to do with IT Incident Investigation success?

Blog Post • Best Practice Insights, Trainer Experience • [read_meter]

Rudyard Kipling lived more than 150 years ago and he used his “six honest men” as the basis for describing incidents and problem situations most accurately. Here is his quote:

“I keep six honest serving men (they taught me all I knew); their names are What and Why and When and How and Where and Who.”

Today we recognize these as the factor analysis elements required for investigating an incident.

Kipling introduced a robust factor analysis framework for problem-solving purposes. Not many ITSM professionals and investigators are using this method today because they are immediately getting involved in the “content” of the deviation. This normally leads to “trial and error” replications and investigations costing the company lots of time, money and resources. Just think about how much time a scarce SME is spending daily in meetings where they have endless discussions without any significant outcome.


We simply use these factor analysis elements in the following framework order:

  • What happened? – We look at WHAT is the object and fault, WHO is affected, WHERE it is happening and WHEN it happened. Once we have the specific information that answers these questions we are in a very good position to execute an incident restoration. As strange and as impossible it might sound, having the answers to these questions would enable you to use SME intuition to generate and implement an effective restoration of a critical service.
  • How did it happen? – We look at the “how” by interpreting the other factors above in terms of the incident that took place. We suggest looking at the flipside of the factor’s coin. We have generated the factual data around the questions of WHAT, WHO, WHERE, and WHEN and now we are going to look at the BUT NOT side of the incident (coin). We simply ask the question “what it could be, but is not; where but is not; when but is not and who could have been affected but is not?” This discipline will lead us to the Technical Cause. We will be able to determine what happened technically that broke the camel’s back.
  • Why did it happen? – We look at both the WHAT and HOW described above to generate theories that could explain WHY the incident happened in the first place. This would normally be the “curious contrast” between the IS and the BUT NOT that would provide the SME with an insight to enable them to theorize the most probable Root Cause.

About the author

Mat-Thys Fourie
Professional Problem Solver [IPPS] and Founder Thinking Dimensions Global & KEPNERandFOURIE.

Dr. Matt Fourie is a Professional Problem Solver as accredited by the Institute of Professional Problem Solvers (IPPS). He is an author of several books on Root Cause Analysis, Project Management, Problem Solving and is the co-author of the KEPNERandFOURIE® Thinking methodologies.

He has over 35 years of Problem Solving and Decision Making transformational experience helping organizations across the world solve some of their most vexing and seemingly unsolvable problems. He has worked across a wide spectrum of industries from Automotive, Financial, Manufacturing, Medical Devices, Pharmaceutical, Nuclear, Insurance, Airline, Technology, and Telecommunications.

Discover More

Customizable dashboard ITP

New in Talent Academy for February: Self-discovery, Messaging UI Improvements, Archive State and Customizable Dashboard

Learners report

New in Talent Academy for November: Assignment Content Type, Learner Progress Report, UI Track Navigation Optimization

How to Apply Different Teaching Models in an Online World

How to Apply Different Teaching Models in an Online World