Barry’s attack hits home. I had once been an engineer, and I know an engineer doesn’t design a bridge that might hold its load. An engineer starts with complexity and crafts certainty. I knew what it was like to be careful, to balance literally thousands of considerations in making a system work.

Idiosyncratic failures in complex technology. But as before, look more closely and you will see some of the usual culprits defining complex failure: multiple causes in a reasonably familiar setting, with its false sense of security; missed signals; and interactive complexity in a shifting business environment. At times I simply cannot bear the frequency of this recurring story. My research has shed light on why it happens—on the cognitive, interpersonal, and organizational causes that make complex failures so thorny. This multiplicity of factors also means you have many levers with which to interrupt the otherwise inexorable flow toward failure. It means that any one of us can become a complex-failure preventer.

My engineering background had made me a fan of Perrow’s groundbreaking book Normal Accidents, first published in 1984, which had a lasting influence on experts’ thinking about safety and risk. Perrow focused on how systems, rather than individuals, produce consequential failures. The importance of that distinction cannot be underestimated. Understanding how systems produce failures—and especially which kinds of systems are especially failure-prone—helps take blame out of the equation. It also helps us to focus on reducing failure by changing the system rather than by changing or replacing an individual who works in a faulty system.

For Perrow, calling an accident normal meant that certain systems function as accidents waiting to happen. Their design makes them dangerous. It is simply a matter of time before such systems fail. In contrast, a system with low interactive complexity and loose coupling—say, an elementary school—would not be prone to normal accidents. If a system had high complexity but lacked tight coupling (say, a large university with many academic departments that operate relatively independently), things could go wrong in one part without automatically triggering a major failure in the whole system.

The problem with Perrow’s idea that organizations could not safely function with interactive complexity and tight coupling was that so many such organizations did in fact function without mishap for years, even decades. Nuclear power plants operated without incident nearly all the time. So did air traffic control systems, nuclear aircraft carriers, and a host of other inherently risky operations. A small group of researchers led by Karlene Roberts at the University of California, Berkeley, set out to study how they did it. What they discovered was more behavioral than technical. The term high reliability organization, or HRO, captures the essence of the theory. HROs are reliably safe because of how they make everyone in them feel accountable to one another for practices that consistently catch and correct

deviations to prevent major harm. Vigilance is one word for it. But it’s more than that. To me the most interesting part of HRO research is the observation that rather than downplaying failure, people in HROs are obsessed with failure. My colleagues Karl Weick, Kathie Sutcliffe, and David Obstfeld wrote a seminal paper highlighting the culture of HROs as preoccupied with failure, reluctant to simplify, acutely sensitive to ongoing operations (quick to detect subtle unexpected changes), committed to resilience (catching and correcting error,

rather than expecting error-free operations), and valuing expertise over rank. In other words, HROs are weird places. Rather than holding back to see what the boss is thinking, people there don’t hesitate to speak up immediately. A frontline associate, to avert a crisis, can tell the CEO what to do. Failure is clearly seen as an ever-present risk that can nonetheless be consistently averted.