The Swiss cheese model of accident causation developed by James Reason provides an excellent visual representation of how a high severity problem is comprised of a system of breakdowns within an organization. It has gained popularity as a tool in the area of root cause analysis and incident investigation. However, we must remember that as a model that attempts to imitate a real world system, there are going to be inherent strengths and weaknesses. The model provides a conceptual framework and its value lies in its ability to communicate that a problem is composed of a system of causes that must come together and align. In this post I will highlight and show you how to leverage the strengths and weaknesses of the model when applying on real world incidents.
Strength #1 – Great Conceptual Model for Communicating our Ability to Mitigate Risk
Within the model, the slices of cheese are meant to represent organizational defenses. The holes in the slices of cheese represent weaknesses and opportunities to breach the defense. The model demonstrates that organizations already have systems and processes in place that are designed to prevent large, high-severity problems. When such an event does occur, it happens because of a breakdown within each of the defenses; visually represented when the holes align. From a problem solving approach, by revealing these gaps or breaches, the model highlights that there are many ways (potential solutions) to prevent recurrence. The more opportunities that are revealed, the more effective the organization becomes at preventing problems.
Strength #2 – Demonstrates two Ways to Mitigate Risk… Consequence or Probability?
Another strength of the Swiss cheese model is its ability to demonstrate two ways to reduce risk. As a quick refresher, risk = probability x consequence.
To reduce risk, solutions can focus on reducing the probability or focus on reducing consequences in spite of probability. Take the example of a driver injured in a car accident. Ideally, we would avoid the injury by reducing the probability of getting into the accident itself. An example of a slice of Swiss cheese as a barrier would be safe driving practices. A hole in the cheese could be distracted driving such as texting on a cell phone. Clearly, a solution to the incident would be to avoid using a cell phone while operating a vehicle. However, even if the person is in the accident, it is possible to still reduce the risk of injury with personal protective devices. Wearing a seat belt for example doesn’t reduce the probability of an accident but it does reduce the consequence. As you can see in figure 2, personal protective devices (such as a seat belt) would be an example of another layer of cheese.
Here we are visually demonstrating two ways to reduce risk, improving your process for safe driving by restricting cell phone usage is the equivalent of making the hole smaller in the slice of cheese and therefore reducing the probability of an accident. Adding another slice of cheese as a barrier focuses on reducing risk by reducing the consequence of the accident. By the way, this simple takeaway also illustrates one of the characteristics cited by High Reliability Organizations (HRO)… a commitment to resilience.
Weakness #1 – Differentiating Causes by Imposing Labels/Terminology Causes Confusion and can Lead to Missed Opportunities to Mitigate Risk
As we often find, any time methodologies and models impose terminology, they create opportunities for confusion and disagreement. Within the Swiss cheese model as presented by James Reason, accidents are the combination of real-time actions (active failures) at the time of the incident and latent conditions. They are represented as holes on the slice of cheese. An active failure is described as the “unsafe” act that is often directly linked to the incident and tends to garner the most intense focus during the investigation. A latent condition is something that can lie dormant and is present before the accident occurs. It is often designed or built that way within the system. In the driving example above, most would agree that texting would be an example of an active failure. However, what would the “seat belt not worn” represent? Some would argue that it is a latent condition since it was removed from the accident having taken place in advance and is only a contributing factor (another label). Others would argue that it is an unsafe act and therefore qualifies as an active failure. This is a prime example that shows when we attempt to differentiate the relevance of the causes, we generate unnecessary arguments and debates. I say unnecessary in the fact that from the perspective of risk mitigation, it does not matter whether we label it as an active or latent condition… if we implement a solution that controls the cause, we mitigate risk.
Weakness #2 – The Ambiguity of “the Hazard” and the Fact That its Existence is Taken for Granted
The ambiguity of the “hazard” label reveals another weakness of the model in terms of application. Once again, the fact that we are labeling poses inherent challenges. In the driving example, why did I list the road hazard as the starting point? Why didn’t I start with “driving” as the hazard and, instead, represent road conditions as another slice of cheese? What if there are multiple hazards (heavy rain, nighttime driving, and a pothole)? And even if you get consensus on the “hazard”, why not challenge its existence. If the pothole is indeed listed as the hazard, the model doesn’t really drive us into challenging its existence which would reveal the potential for solutions around road maintenance. All of this leads us to weakness #3…
Weakness #3 – In Application, the Model Doesn’t Account for the Specific Relationships Necessary to Drive Specific Actionable Solutions
The final weakness highlighted is a common challenge we see regardless of which model or problem solving methodology is used. The Swiss cheese model is not very effective at representing the detailed interrelationships among the causes. Without these distinct links, the results prove to be somewhat vague and don’t provide specific solutions for implementation. This is where a Cause Map™ diagram can visually demonstrate these important relationships and exposes missed opportunities to thoroughly analyze the problem. The Cause Map diagram in figure 3 visually shows all of the causes required to produce the injury. Like the Swiss cheese model it leverages the systems approach to mitigating risk, but without labels and with the addition of the actual causal relationships.
Notice how the Cause Map diagram also begs more questions to be answered. Why was the seat belt not worn? Why did the driver feel the need to text while driving in a heavy rainstorm? Why is there a pothole in the road? The answers to these questions can be visually captured as additional cause-and-effect relationships on the Cause Map diagram. More causes are revealed, equating to more opportunities to solve and prevent the problem, which is the ultimate objective of your investigation.
If you are interested in learning more about the real value of the Swiss cheese model, please check out our free recorded webinar “Where do you slice the cheese? Leveraging the real value of the Swiss Cheese Model to drive down risk.”
