Nevertheless, the person approach has serious shortcomings and is ill suited to the medical domain. Indeed, continued adherence to this approach is likely to thwart the development of safer healthcare institutions.

Although some unsafe acts in any sphere are egregious, the vast majority are not. In aviation maintenance—a hands-on activity similar to medical practice in many respects—some 90% of quality lapses were judged as blameless.² Effective risk management depends crucially on establishing a reporting culture.³ Without a detailed analysis of mishaps, incidents, near misses, and “free lessons,” we have no way of uncovering recurrent error traps or of knowing where the “edge” is until we fall over it. The complete absence of such a reporting culture within the Soviet Union contributed crucially to the Chernobyl disaster.⁴ Trust is a key element of a reporting culture and this, in turn, requires the existence of a just culture—one possessing a collective understanding of where the line should be drawn between blameless and blameworthy actions.⁵ Engineering a just culture is an essential early step in creating a safe culture.

In an ideal world each defensive layer would be intact. In reality, however, they are more like slices of Swiss cheese, having many holes—though unlike in the cheese, these holes are continually opening, shutting, and shifting their location. The presence of holes in any one “slice” does not normally cause a bad outcome. Usually, this can happen only when the holes in many layers momentarily line up to permit a trajectory of accident opportunity—bringing hazards into damaging contact with victims (figure).

The holes in the defences arise for two reasons: active failures and latent conditions. Nearly all adverse events involve a combination of these two sets of factors.

Active failures are the unsafe acts committed by people who are in direct contact with the patient or system. They take a variety of forms: slips, lapses, fumbles, mistakes, and procedural violations.⁶ Active failures have a direct and usually shortlived impact on the integrity of the defences. At Chernobyl, for example, the operators wrongly violated plant procedures and switched off successive safety systems, thus creating the immediate trigger for the catastrophic explosion in the core. Followers of the person approach often look no further for the causes of an adverse event once they have identified these proximal unsafe acts. But, as discussed below, virtually all such acts have a causal history that extends back in time and up through the levels of the system.

Latent conditions are the inevitable “resident pathogens” within the system. They arise from decisions made by designers, builders, procedure writers, and top level management. Such decisions may be mistaken, but they need not be. All such strategic decisions have the potential for introducing pathogens into the system. Latent conditions have two kinds of adverse effect: they can translate into error provoking conditions within the local workplace (for example, time pressure, understaffing, inadequate equipment, fatigue, and inexperience) and they can create longlasting holes or weaknesses in the defences (untrustworthy alarms and indicators, unworkable procedures, design and construction deficiencies, etc). Latent conditions—as the term suggests—may lie dormant within the system for many years before they combine with active failures and local triggers to create an accident opportunity. Unlike active failures, whose specific forms are often hard to foresee, latent conditions can be identified and remedied before an adverse event occurs. Understanding this leads to proactive rather than reactive risk management.

Most managers of traditional systems attribute human unreliability to unwanted variability and strive to eliminate it as far as possible. In high reliability organisations, on the other hand, it is recognised that human variability in the shape of compensations and adaptations to changing events represents one of the system's most important safeguards. Reliability is “a dynamic non-event.”⁷ It is dynamic because safety is preserved by timely human adjustments; it is a non-event because successful outcomes rarely call attention to themselves.

High reliability organisations can reconfigure themselves to suit local circumstances. In their routine mode, they are controlled in the conventional hierarchical manner. But in high tempo or emergency situations, control shifts to the experts on the spot—as it often does in the medical domain. The organisation reverts seamlessly to the routine control mode once the crisis has passed. Paradoxically, this flexibility arises in part from a military tradition—even civilian high reliability organisations have a large proportion of ex-military staff. Military organisations tend to define their goals in an unambiguous way and, for these bursts of semiautonomous activity to be successful, it is essential that all the participants clearly understand and share these aspirations. Although high reliability organisations expect and encourage variability of human action, they also work very hard to maintain a consistent mindset of intelligent wariness.⁸