Organisational Influences - Part 2

In our next step towards understanding the role of Organizations in causing, and preventing, Human Factors Accidents, let us explore the model put forth by Prof James Reason. This is the most widely accepted model of Organizational Accidents and is also the basis of ICAOs Safety Management System Regulations.

Industry-wide acceptance of the concept of the organizational accident was made possible by a simple, yet graphically powerful, model developed by Professor James Reason, which provided a means for understanding how aviation (or any other production system) operates successfully or drifts into failure. According to this model, accidents require the coming together of a number of enabling factors — each one necessary, but in itself not sufficient to breach system defenses. Because complex systems such as aviation are extremely well-defended by layers of defenses in depth, single-point failures are rarely consequential in the aviation system. Equipment failures or operational errors are never the cause of breaches in safety defenses, but rather the triggers. Breaches in safety defenses are a delayed consequence of decisions made at the highest levels of the system, which remain dormant until their effects or damaging potential are activated by specific sets of operational circumstances. Under such specific circumstances, human failures or active failures at the operational level act as triggers of latent conditions conducive to facilitating a breach of the system’s inherent safety defenses. In the concept advanced by the Reason model, all accidents include a combination of both active and latent conditions.

Active failures are actions or in actions, including errors and violations, which have an immediate adverse effect. They are generally viewed, with the benefit of hindsight, as unsafe acts. Active failures are generally associated with front-line personnel (pilots, air traffic controllers, aircraft mechanical engineers, etc.) and may result in a damaging outcome. They hold the potential to penetrate the defenses put in place by the organization, regulatory authorities, etc. to protect the aviation system. Active failures may be the result of normal errors, or they may result from deviations from prescribed procedures and practices. The Reason model recognizes that there are many error- and violation–producing conditions in any operational context that may affect individual or team performance.

Active failures by operational personnel take place in an operational context which includes latent conditions. Latent conditions are conditions present in the system well before a damaging outcome is experienced, and made evident by local triggering factors. The consequences of latent conditions may remain dormant for a long time. Individually, these latent conditions are usually not perceived as harmful, since they are not perceived as being failures in the first place.

Latent conditions become evident once the system’s defenses have been breached. These conditions are generally created by people far removed in time and space from the event. Front-line operational personnel inherit latent conditions in the system, such as those created by poor equipment or task design; conflicting goals (e.g. service that is on time versus safety); defective organizations (e.g. poor internal communications); or management decisions (e.g. deferral of a maintenance item). The perspective underlying the organizational accident aims to identify and mitigate these latent conditions on a system-wide basis, rather than by localized efforts to minimize active failures by individuals. Active failures are only symptoms of safety problems, not causes.

Even in the best-run organizations, most latent conditions start with the decision-makers. These decision makers are subject to normal human biases and limitations, as well as to real constraints such as time, budgets, and politics. Since downsides in managerial decisions cannot always be prevented, steps must be taken to detect them and to reduce their adverse consequences.

Decisions by line management may result in inadequate training, scheduling conflicts or neglect of workplace precautions. They may lead to inadequate knowledge and skills or inappropriate operating procedures. How well line management and the organization as a whole perform their functions sets the scene for error- or violation-producing conditions. For example: How effective is management with respect to setting attainable work goals, organizing tasks and resources, managing day-to-day affairs, and communicating internally and externally? The decisions made by company management and regulatory authorities are too often the consequence of inadequate resources. However, avoiding the initial cost of strengthening the safety of the system can facilitate the pathway to the organizational accident. 

Figure below portrays the Reason model in a way that assists in understanding the interplay of organizational and management factors (i.e. system factors) in accident causation. Various defenses are built deep into the aviation system to protect against fluctuations in human performance or decisions with a downside at all levels of the system (i.e. the front-line workplace, supervisory levels and senior management). Defenses are resources provided by the system to protect against the safety risks that organizations involved in production activities generate and must control. This model shows that while organizational factors, including management decisions, can create latent conditions that could lead to breaches in the system’s defenses, they also contribute to the robustness of the system’s defenses.

A Concept of Accident Causation

 The notion of the organizational accident underlying the Reason model can be best understood through a building-block approach, consisting of five blocks as represented in the figure below:

The Reason Model of Accident causation

The top block represents the organizational processes. These are activities over which any organization has a reasonable degree of direct control. Typical examples include: policy making, planning, communication, allocation of resources, supervision and so forth. Unquestionably, the two fundamental organizational processes as far as safety is concerned are allocation of resources and communication. Downsides or deficiencies in these organizational processes are the breeding grounds for a dual pathway towards failure.

Organizational Processes

One pathway is the latent conditions pathway. Examples of latent conditions may include: deficiencies in equipment design, incomplete/incorrect standard operating procedures, and training deficiencies. In generic terms, latent conditions can be grouped into two large clusters. One cluster is inadequate hazard identification and safety risk management, whereby the safety risks of the consequences of hazards are not kept under control, but roam freely in the system to eventually become active through operational triggers.

Latent Conditions

The second cluster is known as normalization of deviance, a notion that, simply put, is indicative of operational contexts where the exception becomes the rule. The allocation of resources in this case is flawed to the extreme. As a consequence of the lack of resources, the only way that operational personnel, who are directly responsible for the actual performance of the production activities, can successfully achieve these activities is by adopting shortcuts that involve constant violation of the rules and procedures.

Latent conditions have all the potential to breach aviation system defenses. Typically, defenses in aviation can be grouped under three large headings: technology, training and regulations. These MUST be applied in this order to be successful. For example, Regulation applied before addressing the issues with Technology or Training will never succeed. Defenses are usually the last safety net to contain latent conditions, as well as the consequences of lapses in human performance. Most, if not all, mitigation strategies against the safety risks of the consequences of hazards are based upon the strengthening of existing defenses or the development of new ones.

Defenses

 The other pathway originating from organizational processes is the workplace conditions pathway. Workplace conditions are factors that directly influence the efficiency of people in aviation workplaces. Workplace conditions are largely intuitive in that all those with operational experience have experienced them to varying degrees, and include: workforce stability, qualifications and experience, morale, management credibility, and traditional ergonomics factors such as lighting, heating and cooling.

Workplace Conditions

Less-than-optimum workplace conditions foster active failures by operational personnel. Active failures can be considered as either errors or violations. The difference between errors and violations is the motivational component. A person trying to do the best possible to accomplish a task, following the rules and procedures as per the training received, but failing to meet the objective of the task at hand commits an error. A person who willingly deviates from rules, procedures or training received while accomplishing a task commits a violation. Thus, the basic difference between errors and violation is intent.

Active Failures

From the perspective of the organizational accident, safety endeavors should monitor organizational processes in order to identify latent conditions and thus reinforce defenses. Safety endeavors should also improve workplace conditions to contain active failures, because it is the concatenation of all these factors that produces safety breakdowns.

The Reason Model of Organizational Accident

While you absorb this concept, I will prepare for you a case study to make understanding of this concept a bit easier. As always, feel free to post or mail me your questions.

Until next week,

The Erring Human