Method 01 · Define
Is / Is-not
In an Is/Is-not analysis you set out side by side where a problem does occur and where it could just as easily have occurred but did not. The difference between the two columns narrows the possible causes sharply and points you in a direction.
The method comes from the work of Charles Kepner and Benjamin Tregoe in the 1960s. It is less well known than the fishbone or 5 Whys, which is a shame, because it solves a problem those two do not: you have ten plausible explanations and no way at all to strike nine of them off.
The idea is simple and strict. A workable hypothesis explains two things. Not only why it went wrong where it went wrong, but also why it did not go wrong everywhere you would reasonably have expected it to. An explanation that only does the first one fits the facts; an explanation that does both usually survives being tested.
Kepner and Tregoe put it more carefully than most summaries do: differences suggest possible causes. The method does not point one out, it strikes the others off. What you are left with is a short list you can go and check.
When to use it, and when not
| A good fit when | A poor fit when |
|---|---|
| Something used to work and now does not, or works here and not there. | It has never worked. There is no good situation to compare against. |
| You have several suspects and no way to choose between them. | The cause is already known and you are only looking for a fix. |
| Facts are available: logs, counts, timestamps, locations. | You only have impressions and opinions. Go and gather first. |
| The problem is sharp enough to fit in one sentence. | You have three problems at once. Split them and take one. |
What you need
- Facts. Timestamps, counts, locations, version numbers. This method stands or falls on the difference between what you know and what you suspect.
- Someone who knows the territory. Filling the is-not column takes a person who can say: this could just as easily have gone wrong. You cannot get that judgement out of a log file.
- Time. Forty minutes to an hour and a half, depending on how much has already been worked out.
How to run it
-
Put the deviation in one sentence
An object and a deviation: “uploads larger than 8 MB fail with a 502”. Not two deviations, not a consequence, and not a hunch.
-
Fill the is column across four dimensions
What, where, when and extent. Write down only what you can point at. A blank line beats an assumption that will look like a fact an hour from now.
-
Fill the is-not column
This is where the whole method lives. The question is not “what else is there?” but: where would I reasonably have expected this too, and why did it stay away there? See the trap below.
-
Work out the distinction for each line
What is different about the is side compared to the is-not side? Not everything, but the one thing that separates them.
-
Find the change behind each distinction
What changed in or around that difference, and when? A distinction that has been there for years rarely explains something that started last week. Rarely is not never: an old condition can start to matter because something else changed. Record that combination as the change.
-
Test every hypothesis against both columns
If this cause is true, does it also explain why nothing happened to everything in the is-not column? No? Then it is at best part of the story.
The trap almost everyone falls into
The is-not column is not a leftovers bin. For “where does it not occur”, the canteen is also a correct answer, and so is the moon, and the finance department. None of that gets you anywhere.
What you are looking for is the near miss: the situation that resembles the problem situation closely enough that you would reasonably have expected the problem there too, and where it nevertheless stayed away. If line 4 runs the same product from the same raw material, then line 4 belongs in the is-not column and that is valuable information. If line 4 runs something else entirely, it tells you nothing and you leave it out.
If you cannot come up with a good is-not for a line, that is a finding in itself: you do not yet know the territory well enough to say what should have come along.
A worked example
Deviation: since Tuesday morning, uploads of files larger than roughly 8 MB in the customer portal fail with a 502.
| Dimension | Is | Is not | Distinction |
|---|---|---|---|
| Which object | The upload screen in the customer portal | The same upload screen in the admin environment, same code | The route to it, not the code |
| Which deviation | A 502 after roughly thirty seconds | Not a clean error message, not a client-side time-out | Something between client and application cuts the connection |
| Where on the object | Only with files above roughly 8 MB | Not with smaller files | There is a boundary around 8 MB |
| Where geographically | Customers arriving through the new cluster | Office users, who bypass it entirely | The new cluster |
| When first seen | Tuesday around 07:40 | Not on Monday, when large files were uploaded too | Something changed on Tuesday morning |
| Extent | Every attempt by every customer on that cluster | Not a single attempt on the old cluster | The difference is the cluster, not the customer |
Change: the new cluster went live on Tuesday at 07:30, with a fresh configuration.
Hypothesis: the request size limit on the new cluster is set lower than it was on the old one.
Test: it explains the is (large files fail, from Tuesday, on that cluster) and it explains the is-not (office users do not pass through it, small files stay under the limit, and on Monday the cluster did not exist yet). That is a hypothesis worth going and checking.
Note that “the application is slow” also fits the is column, but fails to explain why office users have no trouble. That is exactly the kind of explanation the is-not column throws out.
Common mistakes
- Filling the is-not column with everything that is not the problem. Without the near miss the method yields nothing and you are left with a completed form.
- Putting hunches in the is column. An hour later nobody can tell which line was a fact and which was a guess.
- Taking several deviations at once. Two problems in one grid produce distinctions that point nowhere. Split them.
- Stopping after the specification. Filling in the grid feels finished, but without the distinction and change columns you have only written down neatly what you already knew.
- Accepting a hypothesis that only explains the is. That is the mistake the whole method exists to prevent, and still the most common one.
Combining it with the other methods
- 5 Whys comes after this. Is/Is-not narrows the suspects to a set you can test; 5 Whys keeps asking about the suspect that survives, until you reach something you can remove. On the worksheet you can send a tested hypothesis straight across.
- Pareto comes before it when you have many separate incidents. Pick the category that does the most damage first and run the Is/Is-not on that.
- Ishikawa is the alternative when you cannot get the is-not column filled. That means you do not know the territory well enough yet and need to widen first.
Frequently asked questions
Do I have to fill in every line?
No. Fill in what you know. A blank line is honest; an invented one costs you half a day later.
What if I cannot think of an is-not for a line?
Leave it blank and record it as an open point. It usually means you are missing someone who knows the territory well enough.
Is this like a differential diagnosis?
Yes, and that is no accident. A doctor also asks why these symptoms are present and why the other symptoms that usually come with them are absent. The ruling out does the work, not the guessing.
What if no hypothesis explains everything?
Then there are probably two causes acting together, or your specification is wrong. Check the facts in the is column before you go looking for a more complicated explanation.
How long does an analysis take?
Forty minutes to an hour and a half. If it takes longer, the problem was probably scoped too broadly.