Cause analysis: the three levels

Whose accomplishment is actually short?

Whose accomplishment, and what does it feed?

Before any scheme of levels, Gilbert’s question, and it is worth setting his move out properly, because the rest of this series stands on it and it is almost always summarized into meaninglessness.

Gilbert built the discipline on a distinction between behavior and accomplishment. Behavior is what somebody does: the dispatcher works a queue and searches a catalogue, the engineer drives and diagnoses and fits a part. An accomplishment is what is left behind when they stop: a job dispatched with a complete parts list, a fault repaired on the first visit. Gilbert’s claim is that the second is the unit of analysis and the first is not (Gilbert, 1978).

Three consequences follow, and each one does work later. An accomplishment carries a measure and a behavior does not: you can count complete parts lists, and “searching the catalogue properly” is not a quantity. An accomplishment is what the next person actually receives, so it is the unit that can be short. And two people can produce the same accomplishment by entirely different behavior, which is why copying what an exemplary performer does is the wrong instruction and reading what they produce is the right one: the subject of number 07.

And accomplishments nest

That move settles the level question before it is asked, because accomplishments are not free-standing. Each one is somebody’s output and somebody else’s input, and they run in a chain to the number the board reads.

Which link is actually short?

So “where does the cause sit” is not a philosophical question about systems. It is a concrete one: at which accomplishment in the chain does the shortfall first appear?

Ask it at the wrong link and every answer will be plausible and useless. That is what happens when a renewal rate is discussed in a room of dispatchers, and equally when a dispatcher’s output is treated as a problem of strategy. Both conversations can run for an hour and produce sensible-sounding proposals, and neither can move anything, because the accomplishment under discussion is not the one that is short.

The chain also explains why a number can look healthy three links up while something is badly wrong below it. An installed base can keep running on overtime and second visits, so unplanned downtime holds while first-time fix falls, and the cost surfaces somewhere else entirely, in a quarter nobody has connected to it. Following the chain downwards until the measure stops being healthy is the fastest way to find the link that matters.

Three levels, and why the word is not a metaphor

Rummler and Brache put performance on three levels: the organization, the process that runs through it, and the job as one person does it. The distinction sounds like a management diagram. It is closer to a load-bearing wall.

The reason is that an intervention reaches exactly one level. Coaching a handler changes what one person does; it cannot change a queue that sits between two departments. Redesigning a handoff changes the route a file takes; it cannot change a target that was set too high in the first place. Every remedy has a reach, and the reach is a level. Choose the wrong one and the money is spent, the effort is real, and the number does not move, which is the outcome described in number 01, and it is almost always this mistake in another set of clothes.

The idea that a level is a formal property rather than a manner of speaking is not peculiar to this discipline. Organizations are nested: what happens above shapes what is possible below, and what happens below combines into something above that is not simply the sum of it. The consequence that matters here is a plain one: a claim established at one level does not automatically hold at another, and treating it as though it does is how a good finding produces a useless remedy.

What each level looks like from inside

Three levels, three vocabularies. A problem at each one arrives in the room sounding entirely different, and the sound is a usable clue.

One caution before the rest. Levels are not exclusive. A gap can have a cause at the process level and a second one in the job, and the honest finding names both with their shares rather than choosing the more convenient. What the question forbids is the reflex: assuming the lowest level because it is the one you can see, which is the subject of number 04.

The level nobody owns

Rummler and Brache called the space between the boxes on the chart the white space, and argued that most results are lost there. It is the most quoted claim in the discipline and the least tested, so it is worth saying carefully what the evidence supports.

Start with what is structurally true and needs no study. A department has a head, a budget, a report and a meeting. The interface between two departments has none of those. Nobody is appraised on it, nothing measures it end to end, and the work that fails there fails in a place with no owner. That is not a claim about frequency. It is a claim about attention, and it follows from the chart.

The measured evidence is thinner and points the same way. Pooling thirty years of research on how teams manage their boundaries, the activities by which a unit establishes and regulates its links with everything around it, a meta-analysis of 85 studies covering 10,848 teams found a relationship with team performance of ρ = .39, with outward-facing spanning activity doing better than protective buffering (Leicht-Deobald et al., 2025).

That number needs its limits stated in the same breath. It is about teams rather than about processes crossing four departments, it aggregates largely correlational studies, and its effect is strongest for boundaries with the outside world rather than for the internal handoff. It supports the direction of the argument and it does not prove it.

Where the evidence is actually strong

On the interface itself the evidence is not thin at all, and the largest synthesis of it has nothing to do with hospitals.

Eighty independent samples drawn from eighty-six studies, covering 17,467 observations, were pooled to test whether integration across the boundary is related to how a firm performs: integration meaning the deliberate linking of processes, information and decisions, internally between functions and externally with customers and suppliers. The relationship is positive and significant (Leuschner et al., 2013). It is correlational, and it measures integration rather than redesign. But it is manufacturing, distribution and services rather than care, and it says plainly that the boundary is where a large part of firm performance is decided.

For what to do at that boundary, the closest look comes from the setting that has studied it longest, because there the consequences are visible within the hour. A systematic review of systematic reviews associates poor clinical handover with information omissions, errors and delays, and finds that the interventions that work are standardizations of the interface itself: a fixed form, a fixed sequence, a record that travels with the work (Desmedt et al., 2021).

Two consequences follow, and the second is the useful one. First, an interface can be redesigned and the redesign can be shown to work: the white space is not merely a diagnosis, it is an address you can send a remedy to. Second, note what the successful interventions were not. They were not training the people to hand over more carefully. They were changes to the artifact that crosses the boundary. That is a process-level remedy for a process-level cause, and it is the form of almost every fix at this level.

The process as drawn and the process as run

Every organization has two processes with the same name. One is in the quality system, drawn as a flow with seven steps. The other is what actually happens, and nobody has a picture of it.

Safety research gave the distinction its working names, work-as-imagined and work-as-done, and they are worth borrowing. Work-as-imagined is the process as it is planned in advance or reconstructed afterwards, by people who are not doing it at the time. Work-as-done is what people actually do, under the conditions that actually obtain, including the conditions the design did not anticipate.

The gap between the two is not disobedience and it is usually not carelessness. It is what competent people do when the design does not fit the day: the extra spreadsheet that carries the information the system will not, the informal call that skips two steps because the formal route takes three days, the check performed at the end because performing it at the start would stop the line. And the resolution, where anybody attempts one, is almost never enforcement of the written version. It is redesigning the procedure with the people who were working around it, which is a process-level remedy arrived at by asking rather than by instructing.

Which raises the practical problem the discipline lived with for thirty years. Establishing work-as-done meant walking the floor with a notebook: expensive, slow, and a sample of one week in one place. That is the constraint that has now changed.

The instrument that changed

Almost every step of the work now leaves a timestamp somewhere. Process mining reconstructs the process as run from those timestamps, and it does to the middle level what double-entry bookkeeping did to the organization level: it makes it countable.

The field has a settled vocabulary, fixed in its standard text (van der Aalst, 2016). Discovery builds the actual process model from an event log without being told what the process is supposed to be. Conformance checking compares what the log shows against the model the organization believes it runs: this is the one that matters for a performance analysis, and it is the one applied least. Enhancement extends the model with what the log also carries: durations, queues, volumes, who did what.

What that last item makes possible is the point of this section. The performer field in an event log lets you derive who handed work to whom, which turns the handoff, the step with no owner and no report, into a measurable object. The white space acquired an instrument while nobody in this profession was watching.

What the log still cannot tell you

The instrument is genuinely new and it is not an oracle. Four blind spots, and an analyst who does not know them will over-claim within two weeks.

• It shows the route, not the reason. A log can prove that files wait eleven days at one step. It cannot say whether that is capacity, an authorization rule, an incentive that rewards the wrong queue, or a person who is doing four jobs. Number 09 is that question, and it is still answered by talking to people.
• Variation is not automatically waste. Hundreds of distinct pathways through a hospital may be hundreds of appropriate clinical decisions. Counting variants is description; calling them waste is a judgement that needs its own evidence.
• You cannot detect a deviation from a design that was never specified. Where the intended process exists only as folklore, conformance checking has nothing to check against, and the first finding of the analysis is that absence.
• The log records what the system was told, not what happened. A step closed in bulk on Friday afternoon reads as forty completions in one minute. Every event log carries this kind of artifact and it has to be examined before anything is concluded from a duration.

Four tests that locate a level

The level is a finding, not a preference, and it can be established cheaply. Four tests, in the order we run them. None takes longer than a day, the first one is free, and each either settles the question or names the next test to run.

The order is the discipline. In our practice, most proposals for training arrive before the first test has been run, on figures that were already in the room. The case that follows runs all four tests on one measured gap, and the proposal on the table did not survive the first two.

The insurer whose handlers were not slow

A specialty insurer, personal injury claims. Settlement time averaged 26.4 working days over four quarters against a desired 15. Everyone agreed the department was under-performing, and the proposal on the table was a case-management training program for the eighteen handlers.

Note what the analysis did not establish and did not need to. Nobody measured whether the handlers were good at case management. The question was never reached, because the ceiling test settled it: at 3.1 days of working time against a 15-day requirement, even a handler working twice as fast would have moved the total by a day and a half.

What was changed, and what was left standing

Two changes, neither of them a program, and both of them at the level the cause actually sat at.

The first was a triage rule. The claims team and the adviser agreed, in one afternoon, a written test for which files genuinely required a medical opinion: contested causation, an incapacity claim beyond twelve weeks, or a prior condition on file. That took the adviser’s volume from every claim to 41 percent of claims. The second was capacity: the contract went from three days every two weeks to five. Neither change touched a handler.

And the honest ending. The remaining 2.2 days sat in a second queue: a fraud screen that the same analysis had identified and costed, and that nobody funded that year. The department reported the gap as closed, which it was not, and the analysis had said in advance exactly where the residue would sit. That is the most a diagnosis can do: it cannot make the decision, which is the limit number 02 states about the discipline as a whole.

What this does not claim

This paper argues that the middle level is under-examined. That is a claim about attention, and it is worth separating carefully from four claims it does not make.

• No number is being claimed for how often causes sit at each level. There is no study that partitions established causes across organization, process and job. The argument here is about the order of examination, which holds whatever that distribution turns out to be, and section 03 says what research would settle it.
• Neither synthesis is about a process crossing four departments. The boundary-management meta-analysis is about teams; the integration meta-analysis is about firms and is correlational. Together they support the direction of the argument at two different altitudes, and neither of them proves it.
• Process mining is an instrument, not a diagnosis. It establishes where the work goes and where it waits. Everything about why remains to be established by the next question, and a report that stops at the mined picture has produced a very good description of a problem.
• Locating the level does not make the fix easy. A process-level cause requires two departments to change something, which is political work with its own literature and its own failure rate. Number 10 takes the choice of remedy; nothing in this paper makes the negotiation shorter.

Six lines, on the gap in front of you

Half a day, on the gap you established in question two. Line three is the one that cannot be answered from a desk, and line six is the one that changes the budget.

Two problems, one method, sixteen papers

Two models carry the method. Gilbert’s six conditions ask what kind of cause; Rummler and Brache’s three levels ask where it sits. Both are sound and this series uses both, and it leads with Gilbert, because his unit is the accomplishment, which is what an organization already counts, and because his six conditions are the categories an organization can actually change.

Where the method comes from

Two further pieces close the set and carry no number, because each points at all the numbered papers. Before the guide sits Arets L&D Business Models, the destination piece for the people who receive the requests: four models a learning function can run, and the route from HR-driven to business-driven. Last sits Solutions that cannot work, the field guide, ordered by the sentence that lands on your desk: seventeen forms a performance problem arrives in, each with an address in one of the numbered papers. Three orders in all: the destination you choose, the question you are on, and the form that landed on your desk.

Sixteen papers, six parts

Number 01 is the map and number 02 is the foundation. From number 05 on, every number is depth on exactly one step of the method. The filled block is the paper you are holding; the two unnumbered pieces close the set.

Where every claim in this paper comes from

The three books named earlier in this paper are listed in full in number 02, so that they do not recur in every reference list.