Trigger, propagation, failure

process

The three-part structure of a causal chain in an IT incident. The trigger is the event that started it, usually a change or a load condition. Propagation is how the fault travelled through dependencies. Failure is the customer-visible symptom. Writing the chain this way keeps the RCA specific and shows where a control could have interrupted it.