---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Probable Root Cause Analysis (RCA)

# Probable Root Cause Analysis (RCA) {#ariaid-title1}

Release version: Australia  
Updated June 25, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Probable Root Cause Analysis (RCA)

Probable Root Cause Analysis (RCA) in ServiceNow Australia release helps reduce mean time to repair (MTTR) by identifying the likely root causes of alerts.
It leverages existing IT Service Management data, including alerts, configuration item (CI) topology, and change requests, to analyze and highlight probable causes behind issues.
Show full answer Show less  

## Key Features

* **Data Integration:** RCA extracts CIs from alerts or alert groups and examines their relationships within the CMDB topology.
* **Change Request Correlation:** It applies configurable filters to identify relevant change requests associated with CIs, application services, or installed software that might explain alerts.
* **Root Cause Scoring:** RCA calculates a root cause score prioritizing changes on topology-originating CIs and related elements, enabling sorted lists of probable root causes.
* **Probable Root Cause List:** Displays the top five probable root causes, with explanations on how alerts correlate to change requests, including direct or indirect impacts through related CIs, services, or software.
* **Topology Analysis for Alert Groups:** Identifies upstream CIs to detect cascading failures and prioritize changes affecting those key nodes.
* **Customization:** RCA behavior and scoring criteria can be adjusted to fit organizational needs.
* **Disable Option:** RCA can be disabled by setting the system property *saanalytics.disableprc* to true.

## Key Outcomes

* Faster identification of probable root causes for alerts, enabling more efficient issue resolution.
* Improved visibility into how change requests impact the IT environment and contribute to incidents.
* Prioritization of investigation efforts based on a logical scoring system aligned with CI topology and change impact.
* Enhanced ability to understand cascading failures within alert groups through topology analysis.
* Flexibility to tailor RCA to specific operational contexts and disable it if necessary.  
Shorten the mean time to repair (MTTR) by discovering the root cause of an
alert.
Probable root cause analysis (RCA) provides a list of probable root causes for alerts. This capability uses existing data in IT Service Management to help you determine the root cause of an issue.

RCA takes three factors into consideration: Alerts, configuration item (CI) topology, and change requests on the CIs. It extracts CIs from alerts or alert groups and analyzes the CI relationships in the CMDB. It then uses a set
of configurable filters to consider relevant change requests on the CIs as possible root causes.

Change requests can be related to a time frame or to a CI, the application service it belongs to, or the software installed on it. For example, a CI must be upgraded or a security patch installed on it. A change request on one
CI can affect other CIs.

RCA maps the alerts and change requests to the CIs. It proceeds to calculate the root cause score, a logical score used for sorting probable root causes. The calculation of this score is based on change requests on CIs, and on
alerts on a crucial CI called the Topology Origin CI. The root cause score determines how RCA populates the probable root causes list.  
Figure 1. Probable root cause analysis list   

By default, the list shows the five probable root causes with the highest score. It lists the CIs related to each alert, and the reason RCA identified them as probable root causes.

Each probable root cause includes an explanation on how RCA correlated the alert with the change request. The reason can indicate that the change request was applied directly to the CI that generated the alert. It can also indicate changes to a CI in the affected CIs list, to a related CI, to an application service, or to software installed on the CI. RCA identifies installed software by using the `cmdb_software_instance` table.

For alert groups, RCA uses topology analysis to identify upstream CIs that might explain cascading failures in the group. Changes on these topology origin CIs receive higher priority in the probable root cause score.

Scoring for probable root causes is determined by the following criteria, in the indicated order (lower number = higher priority):

1. Change on a CI that originates from topology.
2. Change on a related CI originates from topology.
3. Change on a CI.
4. Change on a related CI/change on an application service/change on software.
5. Alert on the CI that originates from topology.

{#probable-rca__ol_nm4_bm4_bsb}

To disable the Probable Root Cause Analysis feature, you must create the property sa_analytics.disable_prc and set the value to `true`. For more information on how to create a property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).
* **[Customize RCA settings](https://www.servicenow.com/docs/0lH_pZWt4bIqe1kcPea5nA)**   
  Modify default settings that determine RCA behavior.