5 The Swiss Cheese model of safety incident causation

In the previous chapter, we learned that PCBUs are responsible for the health and safety of workers, wherever they undertake this work.  Occupational health was identified as a specialist field requiring PCBUs to stay engaged with public health, WHS regulators, and to hire occupational health expertise as needed, ranging from consulting ergonomists through to occupational therapists.  We also learned the difference between accidents, which we cannot control, and incidents which we, as HR managers involved in WHS management, seek to control to a reasonably practicable level.  This chapter will specifically focus on incidents and their potential prevention through adopting James Reason’s theorical Swiss Cheese Model of safety incident causation.

A WHS incident is “an unplanned event or chain of events that results in losses such as fatalities or injuries” (Wolters Kluwer, n.d., para. 1), however, incidents (lost time injuries/disease events) are only one of three types of potential WHS events:

• Lost time injuries/diseases: Those occurrences that resulted in a fatality, permanent disability or time lost from work of one day/shift or more.
• Injuries without lost time: Those occurrences that were not lost time injuries and for which first aid and/or medical treatment was administered.
• Near-misses: Unplanned incidents that occurred at the workplace that, although not resulting in any injury or disease, had the potential to do so.(Archer et al., 2015, p. 86)

Injuries without lost time and near misses, as we will learn across this chapter, can be useful indicators of the functionality and effectiveness of WHS management in your business.

Notably, most WHS theory has emerged from in-depth analysis of large-scale WHS incidents.  These critical incidents may be defined as a “sudden, unexpected and overwhelming event, that is out of the range of expected experiences” (UNHCR, 2019, para. 1); these are low probability–high risk events that unfold rapidly across a specific point of time (Reason, 1997a).

James Reason is a preeminent WHS scholar who has examined the role of human factors in large-scale WHS incidents.  He noted that most WHS managers were focused on human errors, the “errors and violations committed at the ‘sharp-end’ of the system…likely to have a direct impact on the safety of the system and, because of the immediacy of their adverse effects, these acts are termed active failures” (Reason, 1997a, p. 10).  Reason, and other scholars such as Hopkins & Palser (1987) and Hudson (2007), identified that critical incidents were never just one person’s fault, there were different issues in and around organisations that affected the people involved and led to the incident. Reason wanted to prove that we really should not blame-the-victim for system failures.

Reason then observed that every workplace has hazards, but they are not injuring workers all the time or at the same rate – some organisations have catastrophes while others have low rates of injury even when workers are doing the very same job with exposure to the same hazards.

Reason concluded that it depends on the effectiveness of the organisation to identify the hazard, assess its risk—the actual potential for injury to occur to a worker—and undertake measures to reduce the risk to the workers through hazard control (Reason, 1997a).  This led him to him conceptualising the Swiss Cheese Model of safety incident causation to explain this phenomenon (Figure 5.1).

Figure 5.1: Swiss Cheese Model of safety incident causation (after Reason,1997a)

Source: “Swiss Cheese Model” by Ben Aveling, Wikimedia Commons, CC BY-SA 4.0

Reason proposes that safety in a workplace may be conceptualised as a block of cheese comprised of slices that act as layers of defence against hazards.  Given the internal and external factors putting pressure on organisations and their workers, weaknesses will develop in these defence layers.  These weaknesses, ‘holes’, are not always predictable or static; they pop up when safety issues arise and disappear when safety issues are resolved.  Weaknesses can occur in different defence layers, within different parts of the organisation.  As such, Reason argues, work safety looks more like Swiss cheese (Reason, 1997a).

In the model, we can visualise a hazard as an arrow.  If the arrow is able to pass through holes in all the safety defence layers, an incident occurs leading to worker injury or harm. Essentially, when multiple layers of safety defences are weak, there are more holes in the cheese and a greater probability that the hazard arrow can shoot straight through to cause more incidents (Reason, 2000).  In contrast, a near miss, “an event that could have potentially resulted in…losses, but the chain of events stopped in time to prevent this” (Wolters Kluwer, n.d., para. 1), is when at least one of the safety defence layers stops the hazard passing through, therefore preventing the hazard from having contact with worker or at least minimising the harm. Ideally, as depicted in Figure 5.1, most hazards would be stopped and losses prevented.

Returning to consider Archer’s definition of WHS events (Archer et al., 2015), injuries without lost time and near misses can then be re-conceptualised as key performance indicators (KPIs) measuring the effectiveness of an organisation’s safety defence system.  Reason’s Swiss Cheese Model infers that the more incidents you have, the weaker your safety defences, and that the more near misses you have, the greater the likelihood of an incident occurring, unless interventions are adopted to strengthen the safety defences (Reason, 1997a).  Measuring WHS events, even the low impact ones, then becomes useful to effectively managing WHS (National Safety Council, 2013).  Notably, organisations striving for good safety management would try to repair the holes in the Swiss cheese as promptly as possible to minimise the probability of all the holes lining up and the hazard arrow shooting through.

What comprises the defence layers?  Reason (1997a, p. 7) states that the defences in the model are designed to:

• create understanding and awareness of the local hazards
• give clear guidance on how to operate safely
• provide alarms and warnings when danger is imminent
• restore the system to a safe state in an off-normal situation
• interpose safety barriers between the hazards and the potential losses
• contain and eliminate the hazards should they escape this barrier
• provide the means of escape and rescue should hazard containment fail.

Clearly this model is based on a blame-the-system, rather than a blame-the-victim, approach as the defence layers are comprised of more than solely addressing the errors made by individual workers.

A key assumption of the Swiss Cheese Model of safety incident causation is that:

Fallibility is an inescapable part of the human condition, it is now recognized that people working in complex systems make errors or violate procedures for reasons that generally go beyond the scope of individual psychology….poor design, gaps in supervision, undetected manufacturing defects or maintenance failures, unworkable procedures, clumsy automation, shortfalls in training, less than adequate tools and equipment…may be present for many years before they combine with local circumstances and active failures to penetrate the system’s many layers of defences. (Reason, 1997, p. 10)

Workers are not to blame, according to Reason, because it is the latent conditions that fail to protect workers and lead to incidents.

So perhaps we could consider managing active failures, the human errors, as only one layer of safety defences—a people layer—whereas the majority of safety defence layers may seek to uncover and resolve the latent conditions, issues that otherwise would lay dormant in the system until the active error occurs.  If we reconsider Reason’s (1997) latent conditions, these might cluster around engineering (poor design, clumsy automation, less than adequate tools and equipment), procedural (gaps in supervision, unworkable procedures) and administrative (shortfalls in training).  For our purposes, in an HR context, we might reconfigure these to think about an organisation’s internal systems as potential overarching safety defence layers:

• A people layer – safety focused workers with relevant values, behaviours and safe decision making (we will discuss safety culture in Chapter 6).
• An engineering layer – with alarms, physical barriers and automatic shutdowns.
• A procedural layer – with instructions on safe work practices.
• An administrative layer – ensuring people are hired with the right skills and provided the right training to perform tasks safely and are also, for example, given a safe work uniform.

Avoiding human error then only corresponds to only one layer of safety defences because, as Reason observed via his investigations of large-scale WHS disasters, you cannot blame-the-victim and achieve better organisational safety outcomes (Reason, 1997a).  His Swiss Cheese Model illustrates that when there are weaknesses (latent conditions) in the safety defences layers (such as the engineering, procedural and administrative systems within an organisation) and these converge with human error, an incident will occur.   Taking this view means that the Swiss Cheese Model of safety incident causation can see that it can be used two different ways:

• After an incident has occurred to help understand what went wrong, to learn from mistakes and improve the health and safety defences.
• Before an incident occurs to help us identify any weaknesses in our safety defences, to intervene and fix these before an incident occurs.

For example, we can now understand the preceding discussions of occupational health (Chapter 4)—particularly health monitoring—as being situated in the people safety defence layer and striving to reduce the risk of human errors (active failures), but clearly there are many other safety imperatives in our organisations that require a blame-the-system philosophy in order to manage them.

When used proactively, the Swiss Cheese Model presents opportunities to examine the unique latent conditions that exist within our workplaces that, if we simply blamed the victim, we would not be able to identify, learn from and address in order to reduce the risk of  hazards inflicting harm on workers.  The following Contemporary WHS challenge, considers a culture of care leading to aged care staff incurring injuries.  This was only discoverable by adopting a blame-the-system approach to understand why care workers were deliberately putting themselves at risk of harm when undertaking their duties of care towards the elderly.

In conclusion, active failures are complex human-centric factors which makes them difficult to predict and control. However, latent conditions can be identified and fixed before an incident occurs.  It is here that HR managers have a pivotal role to play in WHS management; in supporting all the policies, procedures, training and performance management that leads to effective identification of the pre-determinable hazards and the fortification of safety defences that prevent the occurrence of incidents.  Keeping latent conditions under control is key to effective safety management.  To achieve this, most organisations will come to choose a coordinated, cyclical, approach; they will adopt a safety management system —and these are the focus of the next chapter.