​


SHIFTING PARADIGMS:

Embracing Learning and Risk Reduction in Event Investigations 
 Mark Alston
Director, Investigations Differently

​LINKAGE Q4 (2024) - HUMAN FACTORS

T raditionally, the goal of an investigation is to prevent a recurrence of an incident or event.
The common wisdom is that by investigating an event, we will learn what caused it, and by addressing the root causes, we can prevent it from happening again. While this sounds reasonable, it leads organisations to overlook how work comes about and miss opportunities to create benefit. 


Like Zero Harm, preventing recurrence suggests that we can eliminate risks and take steps towards a perfect world without accidents. We all know that this world does not exist, or we do not expect to reach it. Where the idea becomes problematic is that it creates a very black-and-white worldview that misses relevant background information. 


The idea of preventing recurrence has driven the community to analyse events using root cause analysis, the idea that one or a handful of aspects are sufficient or necessary to explain and prevent that event. When organisations complete a root cause analysis, findings usually come back that are person-focused, often stressing training and policy reinforcement—not something that inspires confidence. 


Many organisations use root cause analysis tools, such as the “5 Whys” or a drop list of predetermined root causes.  


Root cause analysis, predetermined lists, and the 5 Whys are helpful because they can drive investigators beyond the surface, but they are also built on misleading causation models.  The term “root cause” suggests there are some factors more fundamental than others in causing the event, and in turn, these are the factors that should be addressed.  In reality, many factors constantly come together, and none have to be sufficient or necessary by themselves (Dekker et al., 2011).  In addition, the most fundamental factors, like the laws of gravity, will often be silly to list, as they are so fundamental that they cannot be changed. 


The 5 Whys method goes even further in misdirecting attention.  Even in its shining moment, investigating the deterioration of the Washington Monument – the case heralded by its proponents –did not lead to a desirable solution (Card, 2017).  Asking “why” 5 times led to the finger pointing to the statue’s lights, as they attracted bugs.  This cause was real, influential, and counterintuitive.  However, the solution was short-lived, as the lamps were soon turned back on.  While turning off the lights had stopped the monument’s deterioration, people started complaining.  Without the lights, tourists could not see the monument anymore, defeating the purpose of having the monument in the first place.  The method’s simplification of the problem had pushed the monument’s purpose out of consideration. 


The specifics of these lists may vary, with many leaning towards ICAM categories or variations of it.  The inherent limitation of pre-determined lists is that they limit the possible conclusions. In turn, this instructs investigators on what is worthwhile to investigate. The limitation of the conclusions gets in the way of the opportunity to discover and learn something new. Surprising results are ruled out.


Some might point out that this limitation is a deliberate trade-off. The limitation comes from standardisation, which facilitates aggregation and trend analysis. However, this raises a crucial question: What exactly are organisations trending here?  Events always include many factors coming together, which means it comes down to subjectivity when only one ‘root cause’ must be chosen. Individual investigators have their biases, preferring some explanations over others.  Since investigators tend to have their own domains or areas, their biases can create trends for departments or locations.  Even more concerning are the organisation-wide biases. Some causes might be preferred by most, for example, because they require less evidence or follow-up work. 


The ever-intriguing 'human error' serves as a prime example, raising questions about whether its increased frequency indicates a change in operator behaviour or a shift in the social acceptability of attributing events to this cause. It's a reminder that trends can emerge just as easily from the biases in identification as from the inherent characteristics of the incidents investigated.


On the surface, pre-determined lists appear as a practical, lightweight tool that helps to get some level of learning from each event. However, their true contribution to risk management, whether on a per-event analysis basis or in the aggregate, is questionable. These lists do more to provide a façade of orderliness than inform safety decisions.


Curious and caring investigators will find some worthwhile solutions with any method, but instructing them to look for root causes is certainly giving them a handicap. It sends them down the path of explaining the accident in terms of linear cause and effect, ignoring the complexity of how work comes about.   People constantly adjust, make do with what they have, rely on past experiences, and try to predict what others are doing. The reality of limited resources, time constraints, and conflicting goals means people must make trade-offs between competing risks. It does not look or feel like moving closer to perfection and eliminating risk. It often involves navigation between concerns, discovering unforeseen consequences of previous actions, and seeking better trade-offs, calibration, and information. Things that are undoubtedly helpful but do not guarantee risk elimination.


If we want to make the investigation of events relevant to risk management, we need to start by acknowledging that they happen in relation to a task. It is not about risks in isolation. 


Tasks are why people, tools, and risks came together in the first place. By understanding the task and the systems surrounding it, we can see how things played out, including both good and bad outcomes.  


When we start looking at the task and how work comes about, we can discover more than just root causes. For example, we might discover how people are learning to undertake a task, such as that people learn how to do things by advice-sharing during lunch breaks. Teams help other teams, but only if they know about each other’s struggles and have upcoming spare capacity. While people may technically have access to necessary information, their challenge is making sense of all that information and knowing what to pay attention to. These findings do not translate to root causes, as they don’t present necessary or sufficient conditions to explain the failure. However, they give insight into how work comes about and provide leverage points to manage risks. For example, the timing and space provided for lunch may influence how much people share advice. Teams may be given more insight into upcoming work and be brought into contact with other teams. 


Learning about how work gets done leads to seeing more opportunities to manage risk and support difficult work. 


This is not just true for some conveniently chosen examples. Academic safety models that are sensitive to the context of work also abandon root causes. Rasmussen’s dynamic risk model provides a visualisation that challenges the idea of simple causes.  The model pictures operations as constantly being influenced by economic, fatigue, and safety forces, moving operations further or closer to boundaries, like bankruptcy, exhaustion, or accidents. If an organisation moves outside a safe space, it stops having the capacity to handle the situation safely. In this view, there is no one factor that caused the accident; the last push did not make more of a difference than the first. The existence of economic pressure is not a ‘cause’; it is an everyday reality that is generally well-managed. It’s similar to hiking. You do not attribute reaching the destination to only the last step.  Each step and every factor, including tools, preparation, the environment, and personal experience, lead the hiker to reach the destination in the state that they did.


When we are in the process of explaining how work comes about, the idea of a root cause becomes illogical. There are always things going on that come together in complex and sometimes unpredictable ways. 


No single factor is the sole difference between success and failure. 


The purpose of investigations is to identify factors that are more meaningful or make better leverage points to manage and reduce risk. This does not have to coincide with (what looks like) eliminating risks. Investigations can do this by providing a better understanding of how work comes about. 
Without understanding, we cannot manage work and the risks that come with it.


Rather than trying to prevent the last incident, we can enable event investigations to inform management of risks and improve safety overall. By changing the objective of event investigations from ‘prevent recurrence’ to ‘learn and reduce risk,’ this can be achieved.


Any safety tradition urges an organisation to learn about itself, whether you believe accidents come from unsafe behaviour, holes in Swiss cheese, failures in information management, or cultural concerns. Whether safety is created through organisational mindfulness or sustained adaptive capacity, an organisation needs to understand its operations, including the possible risks and incidents

REFERENCES

Dekker, S. (2016). Drift into failure: From hunting broken components to understanding complex systems. CRC Press.

Hollnagel, E. (2018). Safety-I and safety-II: the past and future of safety management. CRC press.

Rasmussen, J. (1997). Risk management in a dynamic society: a modelling problem. Safety science, 27(2-3), 183-213.

 

ABOUT THE AUTHOR

Mark Alston is the Director at Investigations Differently