Over the past two weeks, I’ve been sharing conversations I once had with Bob, a top operations manager in a chemical company where we both worked. It all started with an argument about how much senior management really knows about workplace injuries––and my assertion that we were only aware of about 10% of the incidents that occurred.

Once it became clear to Bob that I might actually be right, I told him why the cover-ups and general silence were happening. With that foundation laid, Bob was finally ready to have the conversation I’d been wanting to have all along. It’s a talk I wish I could have with every manager who is held accountable for safety. Here’s how it went:

“Cort, I see why our people might not report injuries,” Bob said, his tone even. I could see he was trying to remain calm. “But what can we do about it? We’re obligated to investigate every incident by law. The government requires it.”

“Actually, all the government requires is that we document, analyze, and apply any lessons learned, and report to them the more serious accidents,” I said. “An hour-long meeting between the supervisor and people involved can accomplish that. No one requires anything near the lengths we take in our investigations.” I paused, then before Bob could reply, I added, “Bob, the lack of incident reporting is not our biggest problem. It’s just a symptom of the disease that infects everything we do here in safety.”

“Disease?” Bob said. “What disease?”

The Father of Safety

I explained that our current safety paradigm was almost 100 years old. “Where else in business is this the case?” I asked. It’s a framework created by a man named H.W. Heinrich back in the early 1930s. Heinrich wrote a book called Industrial Accident Prevention, which laid out the approach to safety we still practice. “I happen to have a copy with me,” I said, and handed the book to Bob.

“And you feel that Heinrich’s paradigm is wrong?” Bob asked.

“I feel its day came and went a long time ago,” I said. “But it is important to understand that Heinrich made an enormous contribution to safety. All paradigms have their day and need to be replaced when they no longer serve us. I don’t want to diminish Heinrich’s work. It’s saved thousands of lives over the years. He is the father of what we call safety.

“That said, doesn’t it make sense that the way we approach safety would evolve over time? Surely we’ve learned a few things in the last century.”

I told Bob the book he held was an early edition. In later editions, even Heinrich revised some of his own models and ideas. “Unfortunately, no one seems to have read the later editions,” I said. “We’re using a paradigm based on 90-year-old models, some of which Heinrich himself later recounted.”

“Okay, so what is wrong with Heinrich’s original framework? What models are you talking about?” Bob asked.

Heinrich’s Accident Sequence

“Look at the model on page 11,” I said, pointing to the book. “Heinrich calls it the Accident Sequence. Read that short section, and tell me what you notice.”

Bob studied the page. “It’s almost all about the employee,” he said.

“Bingo!” I shouted, thrilled that Bob picked up on the issue so quickly. “Basically, that model says injuries can be traced to shortcomings in the injured person’s ancestry and social environment, which engender in him personal faults, which then drive him to commit unsafe acts, which can interact with hazards, which can lead to accidents, which can result in injury. The entire focus is on the injured person and injuries, and excludes everything else.”

“That’s it? That’s our disease?” Bob said.

“Yes,” I said. “When it comes to safety, we focus on the employee and injuries, and exclude just about everything else. It’s one of two major flaws I see in our current paradigm.”

“But safety is all about incidents and employee injuries. We have to focus on them,” Bob said. “They’re what we are trying to prevent.”

“They are in our safety paradigm, to be sure,” I said. “But there is another paradigm––one that is much more effective––where they’re not.” I paused. “It’s too early to have that conversation. I need to help you understand your paradigm first, and to help you see its limitations before we move on to new frameworks.”

I pointed out that in Heinrich’s model, there is no mention of the system in which management has placed the injured person. There’s nothing about the supervision, training, or tools management has or has not provided; nothing about the work environment or culture that management has fostered.

“Is there anything in that model that captures the role leadership plays in safety?” I asked him.

“No, it’s all about the injured person,” Bob said. “So, you’re suggesting that because we embrace this paradigm, we focus on the worker and injuries when we think about safety. When someone is injured, it’s all about what she did wrong and what’s wrong out there in the workplace that led to her doing what she did. There’s very little, if any, looking at ourselves––at the leaders’ contribution––or at any other factors.”

“Yes, Bob, that’s exactly it,” I said. “What most people call a root cause, I call a symptom of insufficient leadership. If an employee reaches into a container and the lid falls and smashes her hand, the root cause is not ‘the lid falling,’ ‘pinch point,’ ‘unsafe actions of the injured party,’ or anything else that happened when and where the incident occurred. The root cause of everything that goes on in the workplace is leadership. Everything out there is a reflection of us. Knowing that the employee put her hand somewhere she shouldn’t have is not of much use unless we know exactly why she thought it was the right thing to do.”

“The right thing to do?” Bob asked.

“Of course,” I said. “Everything we do, we do because at that moment, we believed it was appropriate––even if we know it violates a rule or policy.

“When I was a young supervisor, I found myself doing something I never could have imagined myself doing: searching for the amputated fingers of one of our mechanics,” I said. “He had been working on an air conditioning unit that cooled the computers in my unit, and his hand came in contact with a rubber belt moving at extremely high velocity. All four of his fingers were amputated. I was looking through the air conditioner in the hope I could find his fingers and rush them to the hospital to be reattached. I did find them, but the doctors were unable to reattach them.

“Several days later, I was listening to the investigation team’s report to management. They declared the root cause was ‘failure to lock out the air conditioner’s motor before beginning work.’ Now, part of that statement was true. Tommy did fail to follow procedure. But that was not the cause of the incident. The investigation team’s primary recommendation was to give all our mechanics refresher training on electrical lockout procedures. And boom, it hit me.

“Afterwards, I was alone in the room with my manager, and I told him what I’d realized. ‘The root cause was not that Tommy failed to follow procedure,’ I said. ‘It was my approaching him four times that morning asking how much longer the air conditioner would be out of service. And it was me reminding him that when the air conditioner is down, the computers are down, and when the computers are down, the unit is down, and when the unit is down, the company loses about $100,000 per hour. That’s why he didn’t follow procedures. I don’t need to retrain Tommy. I need to take a good look at myself and start doing a better job of managing what I say to my people.’ I paused. ‘And you need to do the same.’

“My manager was offended. ‘Me? What’d I have to do with this?’ he said.

“‘Why do you think I approached Tommy four times that morning?’ I asked. ‘Because you called me four times asking how much longer my unit would be down. And my guess is your boss did the same to you, and her boss did the same to her. Tommy did exactly what he thought we wanted him to do––whatever it took to get that unit back up so we’d avoid losing all that money.’

“I didn’t win that argument with my manager,” I told Bob. “Like Heinrich, he believed that faults in employees that lead to unsafe acts were the source of accidents, and therefore, ‘the employee is always the root cause of an accident.’ I didn’t win that day, but I’ve never forgotten what I learned. I haven’t put the focus of safety on the individual employee since then.”

“Alright,” Bob said. “I can see that we’re making a mistake focusing so much on the employee. We need to look at the bigger picture and include ourselves in the conversation. But you mentioned this is just one of two major flaws. What is the other?”

Stop Investigating

“Before I answer that, I want to get back to accident investigations,” I said. “Can you see now that the focus of our investigations is all wrong? It’s not just the employee we need to understand, but what we’ve done––all of us, including the employee––to generate the conditions that prompted him to put himself at risk. In fact, that’s all we really need to glean from any incident or injury: what is it that created the employee’s perceptions that he should do what he did? Anything else is a waste of effort.”

Our accident investigations are based on an incorrect assumption: that when an incident or injury occurs, something unique has occurred––that the injured person did something different.

“What injuries really tell us is that that is the way things are done around here,” I said. “Think about the laws of probability. It’s highly likely that what took place has happened many times before, and random chance finally caught up with us. Some experts estimate that an at-risk behavior occurs thousands of times before an accident earns the attention of management. The only thing that’s different and unique about the person being investigated is that he was lucky enough to get hurt doing what the rest of us have done many times.”

A single injury is one data point. No meaningful analysis can be made of one data point. “You can’t paint a picture with one pixel,” I told Bob. “One data point does not make a trend. No conclusions can be made from a trend of one.”

I explained to Bob that our accident investigation approach was grounded in the criminal investigation paradigm, which revolves around five points:

  1. A suspect is identified. For us, that’s the injured person.
  2. Evident is gathered. In safety, that’s a description of what happened.
  3. A charge is made. We call it the “root cause.”
  4. A trial is held. That’s our report presentation.
  5. A jury decides guilt and punishment. Our jury is management.

“Okay, enough already. I get it,” Bob said, frustrated. “But what do we do if we don’t do investigations?”

“Exactly what the government requires us to do and no more,” I said. “We document the event. We analyze it. We apply any immediate lessons learned. Then we report the more serious injuries.” I stopped and smiled. “But, I have some good news and bad news when it comes to analyzing incidents and injuries, Bob.”

“Give me the good news first,” Bob said.

“The good news is that there are ways to glean perceptions and behaviors from incidents, and then collate and analyze that data to paint a true picture of what’s going on so that we can learn the true source of why employees are putting themselves at risk. Even better: that approach takes a lot less time and resources than accident investigations, and it yields much better information.”

“Excellent,” Bob said, clearly relieved. “But what’s the bad news?”

“The bad news really is good news,” I said. “The bad news is we don’t injure enough people or have enough incidents to really make this approach feasible. Fortunately, our locations average reporting about a dozen incidents each year; and even if they removed all the barriers to reporting, they’d still only experience a handful each month. You can’t manage something as complex as safety with a handful of data points a month. That’s why I say we should do the minimum the government requires and focus our energies somewhere other than on attempting to prevent incidents and injuries and doing investigations when they occur.”

“And where might that be?” Bob asked tentatively.

Our time together for that week was ending. We agreed to continue our discussion the following week––just like we’ll do here. Next week, I’ll share the next part of what Bob and I covered: the second major flaw in our safety paradigm, and the entirely new framework I asked him to consider instead.

Let’s go All-In.