---
name: root-cause-investigation
description: Systematic investigation of metric changes and anomalies. Use when a metric unexpectedly changes, investigating business metric drops, explaining performance variations, or drilling into aggregated metric drivers.
title: root-cause-investigation
canonical_url: https://skilld.dev/gh/nimrodfisher/data-analytics-skills/root-cause-investigation
last_updated: 2026-09-28T14:07:15.000Z
---

> **Skill from skilld.dev.** Follow the instructions below for this session. You do not need to install anything.
>
> Supporting files, fetch one when the Skill refers to it: [assets/rca_report_template.md](https://skilld.dev/api/skills-raw/nimrodfisher/data-analytics-skills/root-cause-investigation/assets/rca_report_template.md), [references/hypothesis_testing_guide.md](https://skilld.dev/api/skills-raw/nimrodfisher/data-analytics-skills/root-cause-investigation/references/hypothesis_testing_guide.md), [references/rca_framework.md](https://skilld.dev/api/skills-raw/nimrodfisher/data-analytics-skills/root-cause-investigation/references/rca_framework.md), [scripts/drilldown_analyzer.py](https://skilld.dev/api/skills-raw/nimrodfisher/data-analytics-skills/root-cause-investigation/scripts/drilldown_analyzer.py).
>
> If the user asked to install this Skill, run `npx skilld install nimrodfisher/data-analytics-skills/root-cause-investigation`. Install writes the Skill files into the project, so every session loads them.

# Root Cause Investigation

# When to use
- A key metric dropped (or spiked) unexpectedly and the team needs an explanation
- Stakeholders are asking "why did X happen?" and need an evidence-based answer
- A metric change has been observed but the team is unsure whether it's noise or signal
- Preparing a post-mortem after an incident that affected business metrics
- A trend change happened weeks ago and needs retrospective investigation

# Process
1. **Validate the change** — confirm the metric changed beyond normal variance using a z-score or simple comparison to the rolling average. If the change is within ±1.5 standard deviations, document it as within normal range and close. Use `scripts/drilldown_analyzer.py --validate`.
2. **Establish a timeline** — plot the metric over time to pinpoint when the change started. A sudden step change suggests a specific event; a gradual drift suggests a structural shift.
3. **Decompose the metric** — break the metric into its constituent parts (e.g., revenue = volume × price × mix). Determine which component is driving the change before drilling into dimensions.
4. **Drill down systematically** — compare the metric before vs. after the change across available dimensions (geography, platform, channel, product category, user segment). Sort by absolute contribution to identify the primary driver. Use `scripts/drilldown_analyzer.py --drilldown`. See `references/rca_framework.md` for the structured approach.
5. **Test hypotheses** — generate explicit hypotheses (volume drop, mix shift, per-unit quality change, data issue) and accept or reject each with evidence. Correlate the timeline with known events from `references/hypothesis_testing_guide.md`.
6. **Write the root cause report** — document the primary driver (quantified share of impact), supporting evidence, rejected hypotheses, and tiered recommendations (immediate / short-term / long-term). Use `assets/rca_report_template.md`.

# Inputs the skill needs
- Metric name and historical values (at least 30 days before the change)
- Granular data with dimensional breakdowns (geography, platform, segment, etc.)
- The date or date range when the change was noticed
- A change log or incident log for the same period (product releases, campaigns, outages)
- The business context: what decisions depend on this metric

# Output
- `scripts/drilldown_analyzer.py` — validates the change, computes dimensional drill-downs, and ranks contributors by impact
- `references/rca_framework.md` — structured five-step RCA method with decision rules
- `references/hypothesis_testing_guide.md` — checklist of common root causes and how to test each
- `assets/rca_report_template.md` — report template: what changed, when, primary driver, supporting evidence, timeline, recommendations