Which fixed defects earn a root-cause investigation, and why do blanket always-or-never rules fail?

## The decision that comes after the fix A defect is reproduced, fixed, verified and closed. A separate decision follows, and it is the one this question is about: does anyone now spend further effort explaining **how the defect came to exist and how it survived every check between the change and the customer**? That effort is not free. It costs an hour or more from the people who hold the evidence, and it usually ends in a change that costs more again. Everything has a cause, so *is there a cause to find* is never the question. The question is whether **this** cause is worth the hour, and for most defects the honest answer is no. Teams get this wrong in two symmetrical ways, and both are wrong for the same reason - which is the second half of the question. ## The facts that select a defect No single fact decides it. A short list, checked when the defect record is closed, does: - **How far it escaped.** A defect a customer met passed every stage that was meant to stop it. That escape route is a fact about the team's own checks rather than about the defect, and it is the most reusable thing an investigation can produce. - **Repetition.** The third defect of the same shape is evidence of a standing weakness. One is an event; three is a pattern with an address. - **What the escape cost.** Corrupted data, money moved wrongly, a safety-relevant behaviour, a large affected population. The economics of finding defects late are a subject of their own; here the cost only supplies the motive for spending the hour. - **Severity, strictly as an input.** A recorded severity is a signal, not the decision. A crash on a path almost nobody reaches may teach less than a quietly wrong figure in a report thousands of people trust. - **Detection blindness.** Nobody can name the check that should have caught it. This is usually the most valuable investigation available, because its output is a check that does not yet exist. | Fact about the defect | Selects it? | Why | | --- | --- | --- | | The fix was a single line | No, by itself | Fix size measures the code, not the lesson | | A customer found it first | Yes | Every internal stage passed it unnoticed | | Third of this shape this quarter | Yes | A repeated weakness has one address | | It was hard to reproduce | Weak signal | Difficulty is interesting, not consequential | | Recorded at the top severity | Input only | Severity ranks the harm, not the learning | ## Why "investigate everything" fails Attention is finite and roughly constant. A rule that investigates every closed defect spreads that fixed pool evenly across defects carrying no lesson and defects carrying a large one, so the instructive escape gets the same shallow pass as a misspelled label caught in review. The consequences are predictable: the write-up becomes a form; the cause field fills with restatements of the symptom; nobody reads the output because most of it is empty; and the practice acquires a bad name, so the one investigation that mattered is resented along with the rest. Volume also destroys the signal - a hundred recorded causes a month cannot be compared, grouped or acted on by anyone. ## Why "investigate nothing" fails the same way The mirror rule looks efficient. Each defect closes the moment the symptom stops, and nobody asks how it escaped. The same weakness then fires again, and the team pays the fix cost repeatedly plus the escape cost each time. Nothing accumulates: the checks never grow, and the team's knowledge of its own blind spots stays exactly where it was. The two failures are one failure. **Both replace a decision with a constant.** One spends a fixed amount on every defect regardless of what could be learned; the other spends zero on every defect regardless of what could be learned. Effort should track expected learning, which varies enormously between defects, and neither rule lets it vary at all. That is why the interviewer usually asks the two halves together: a candidate who only attacks the lazy end has not noticed that diligence fails identically. ## Making the rule cheap enough to actually apply 1. **Write the conditions down** - four or five of them, in one place, in plain language. A rule that lives in someone's head is re-argued from scratch on every defect. 2. **Check them when the defect closes**, not when it is filed. At closing time the escape route and the size of the change are both known; at filing time neither is. 3. **Allow an override with a recorded reason**, in both directions. Judgement beats a checklist, but an unrecorded override is indistinguishable from drift. 4. **Cap the investigations running at once.** Two open and finished beats ten open and abandoned. 5. **Revisit the conditions periodically.** If nothing has been selected in three months they are too tight; if almost everything is selected, they are too loose.