One bounded situation
Define impact, frequency, occurrence and previous attempts. The exact scope is agreed together; unrestricted access to internal systems is not presumed.
Evidence before assumptions
Separate confirmed observations from hypotheses. Depending on the available data, use suitable methods such as 5 Whys, cause-and-effect diagrams, timelines or case comparisons.
An actionable next decision
Identify missing evidence, proposed ownership and testable next steps. Full corrective-action implementation is a separate decision.