What has Rudyard Kipling got to do with IT Incident Investigation success?

Mat-Thys Fourie / 15 March 2019

What has Rudyard Kipling got to do with IT Incident Investigation success

Rudyard Kipling lived more than 150 years ago and he used his “six honest men” as the basis for describing incidents and problem situations most accurately. Here is his quote:

“I keep six honest serving men (they taught me all I knew); their names are What and Why and When and How and Where and Who.”

Today we recognize this as the factor analysis elements for investigating an incident.

Kipling introduced a robust factor analysis framework for problem-solving purposes. Not many ITSM professionals and investigators are using this method today because they are immediately getting involved in the “content” of the deviation. This normally leads to “trial and error” replications and investigations costing the company lots of time, money and resources. Just think about how much time a scarce SME is spending daily in meetings where they have endless discussions without any significant outcome.


We simply use these factor analysis elements in the following framework order:

  • What happened? – We look at WHAT is the object and fault, WHO is affected, WHERE it is happening and WHEN it happened. Once we have the specific information that answers these questions we are in a very good position to execute an incident restoration. As strange and as impossible it might sound, having the answers to these questions would enable you to use SME intuition to generate and implement an effective restoration of a critical service.
  • How it happened? – We look at the “how” by interpreting the other factors above in terms of the incident that took place. We suggest looking at the flipside of the factor’s coin. We have generated the factual data around the questions of WHAT, WHO, WHERE, and WHEN and now we are going to look at the BUT NOT side of the incident (coin). We simply ask the question “what it could be, but is not; where but is not; when but is not and who could have been affected but is not?” This discipline will lead us to the Technical Cause. We will be able to determine what happened technically that broke the camel’s back.
  • Why it happened? – We look at both the WHAT and HOW described above to generate theories that could explain WHY the incident happened in the first place. This would normally be the “curious contrast” between the IS and the BUT NOT that would provide the SME with an insight to enable them to theorize the most probable Root Cause.