Lessons from High Reliability Organizations (HROs)
by Julian TalbotSome of the best research in the area of risk management comes from studies in an area known as high reliability organizations (HROs). HROs include organizations such as nuclear power plants, aircraft carriers and air traffic control systems. These organizations are notable, according to Gene Rochlin, because they "have not just failed to fail; they have actively managed to avoid failures in an environment rich with the potential for error." That ability to actively and reliably manage to reduce the chances of mistakes occurring, rather than to avoid the hazards, has been the distinguishing hallmark of most HROs and their experiences offer many lessons for the application of risk management at the enterprise level.
Work by Karl Weick and Kathleen Sutcliffe suggests that five key elements contribute to what they describes as a state of "mindfulness":
- Preoccupation with failure
- Reluctance to simplify interpretations
- Sensitivity to operations
- Commitment to resilience
- Deference to expertise
At first glance, many of these processes appear to be self-defeating on multiple levels. But, as Weick and Sutcliffe explain, the processes are necessary if a high reliability organization is to be successful.
Preoccupation with failureHROs, like most organizations, celebrate their successes, but Weick and Sutcliffe also note "a chronic worry in HROs is that analytic error is embedded in ongoing activities and that unexpected failure modes and limitations of foresight may amplify those analytic errors."
Reluctance to simplify interpretationsMost organizations are happy to handle complex issues by simplifying them and categorizing them, thus ignoring certain aspects. HROs, however take nothing for granted and support cultures that attempt to suppress simplification because it limits their ability to envision all possible undesirable effects as well as the precautions necessary to avoid these effects. HROs pay attention to detail and actively seek to know what they don't know. They endeavor to uncover those things that might disconfirm their intuitions despite being unpleasant, uncertain or disputed. Skepticism is also deemed necessary to counteract the complacency that many typical organizational management systems foster.
Sensitivity to operationsWeick and Sutcliffe describe sensitivity to operations as pointing to "an ongoing concern with the unexpected. Unexpected events usually originate in 'latent failures' which are loopholes in the system's defenses, barriers and safeguards whose potential existed for some time prior to the onset of the accident sequence, though usually without any obvious bad effect."
Management focus at all levels offers opportunities to learn about deficiencies that could signal the development of undesirable or unexpected events before they become incidents. HROs recognize each potential near-miss or "out of course" event as offering a "window on the health of the system" -- if the organization is sensitive to its own operations.
Commitment to resilienceHROs develop capabilities to detect, contain and bounce back from those inevitable errors that are a part of an indeterminate world. The hallmark of an HRO is not that it does not experience incidents but that those incidents don't disable it. Resilience involves a process of improvising workarounds that keep the system functioning and of keeping errors small in the first place.
Deference to expertiseHROs put a premium on experts: personnel with deep experience, skills of recombination and training. They cultivate diversity, not just because it helps them notice more in complex environments, but also because rigid hierarchies have their own special vulnerability to error. As highlighted by the work of James Reason and HFACs, errors at higher levels tend to pick up and combine with errors at lower levels, exposing an organization to further escalation.
HROs consciously evoke the fundamental principle of risk management: that "risk should be managed at the point at which it occurs." That is where you will find the expertise and experience to make the required decisions quickly and correctly, regardless of rank or title.
Unfortunately most organizations do not work at this level, preferring to manage risk through the introduction of standard operating procedures, policy and work instructions. While these undoubtedly have their place, and can help people to make quick and consistent decisions, a significant body of research also indicates that the blanket application of these controls can reduce individuals' "mindfulness" and personal responsibility, thereby contributing indirectly to increased operating risk.
Other lessons from HROsOther lessons from HROs include the strong support and reward for reporting of errors based on recognition that the value of remaining fully informed and aware far outweighs whatever satisfaction might be gained from identifying and punishing an individual.
The Icarus ParadoxMany experiments have shown that people who succeed on tasks are less able to change their approaches even after circumstances change (the hammer and the nail syndrome). W.H. Starbuck and F.J. Milliken, in their analysis of the Challenger space shuttle disaster, said: "Success breeds confidence and fantasy. When an organization succeeds, its managers usually attribute success to themselves or at least to their organization, rather than to luck. The organization's members grow more confident of their own abilities, of their manager's skills, and of their organization's existing programs and procedures. They trust the procedures to keep them apprised of developing problems, in the belief that these procedures focus on the most important events and ignore the least significant ones."
This level of complacency is a breeding ground for inadequate or ineffective organizational risk management and needs to be fully considered when reviewing the internal context and the risk management context.
Julian Talbot is an risk management consultant and lead author of the Security Risk Management Body of Knowledge. He is a Director of SARMA, Fellow of the Risk Management Institution of Australasia and Research Associate with the Australian Homeland Security Research Centre. This article is excerpted from his upcoming book Snapshot Guide to ISO 31000:2009 Risk Management!
which is due for publication later this year. For more sneak previews and risk management tips, go to http://31000risk.blogspot.com/.---
Work Cited:
Rochlin, Gene (1996) "Defining 'High Reliability' Organizations in Practice: A Taxonomic Prologue," p. 15 in Roberts, Karlene,
New Challenges to Understanding Organizations, Macmillan Publishing Company, New York, USA.
Weick, Karl & Sutcliffe, Kathleen (2001),
Managing the Unexpected: Assuring High Performance in an Age of Complexity, Jossey-Bass, New York, USA.
Starbuck, W.H. and Milliken, F.J. (1988) "Challenger: Fine-tuning the odds until something breaks",
Journal of Management Studies, Vol. 25, 319-340, New York, USA.
