Complex failures rarely have one cause; naming a root cause conceals the conditions that permitted it.
Dekker's argument. Naming a root cause supplies a stopping point for the investigation and an individual to hold responsible, which is why organisations reach it before the conditions have been examined.
In practice
- A near-miss report concludes that a nurse misread a label, and the label, the lighting and the shift length are all unchanged the following week.
- An outage attributed to "human error" has closed the inquiry precisely where the interesting question — why the system permitted it — begins.
- Subject
- Risk & Reliability
- Essay
- How accidents actually happen