Page "Root cause analysis" Paragraph 29

# Gather data and evidence, classifying it along a timeline of events to the final failure or crisis.

For every behavior, condition, action, and inaction specify in the " timeline " what should have been done when it differs from what was done.