As pernicious as basic failures can be, complex failures, described in chapter 4, are the real monsters that loom large in our work, lives, organizations, and societies. Complex failures have not one but multiple causes and often include a pinch of bad luck, too. These unfortunate breakdowns will always be with us due to the inherent uncertainty and interdependence we face in our day-to-day lives. This is why catching small problems before they spiral out of control to cause a more substantial complex failure becomes a crucial capability in the modern world.

My engineering background had made me a fan of Perrow’s groundbreaking book Normal Accidents, first published in 1984, which had a lasting influence on experts’ thinking about safety and risk. Perrow focused on how systems, rather than individuals, produce consequential failures. The importance of that distinction cannot be underestimated. Understanding how systems produce failures—and especially which kinds of systems are especially failure-prone—helps take blame out of the equation. It also helps us to focus on reducing failure by changing the system rather than by changing or replacing an individual who works in a faulty system.

I turned to Perrow’s work to help me figure out the persistence of medical accidents. Perrow described a normal accident—a term intended to provoke—as a predictable (that is, normal) consequence of a system with interactive complexity and tight coupling. Interactive complexity means multiple parts interact in ways that make the consequences of actions difficult to predict. For instance, slightly altering his ship’s course put Captain Rugiati on a path where the sudden appearance of two lobster boats required a subsequent sudden and difficult-to-execute turn, culminating in a fatal accident. Tight coupling, a term borrowed from engineering, means that an action in one part of the system leads inexorably to a reaction in another part; it’s not possible to interrupt the chain of events.

To aim for zero harm in complex systems such as hospitals is not the same as aiming to erase human error. To err is human. Error will always be with us. But we can design social systems that make everyone aware of the inevitability of error and poised to catch and correct it before it causes harm. That means understanding that Swiss cheese holes sometimes line up—despite being separated by time or distance—to create a tunnel through which complex failure flows unimpeded.

The problem with Perrow’s idea that organizations could not safely function with interactive complexity and tight coupling was that so many such organizations did in fact function without mishap for years, even decades. Nuclear power plants operated without incident nearly all the time. So did air traffic control systems, nuclear aircraft carriers, and a host of other inherently risky operations. A small group of researchers led by Karlene Roberts at the University of California, Berkeley, set out to study how they did it. What they discovered was more behavioral than technical. The term high reliability organization, or HRO, captures the essence of the theory. HROs are reliably safe because of how they make everyone in them feel accountable to one another for practices that consistently catch and correct

deviations to prevent major harm. Vigilance is one word for it. But it’s more than that. To me the most interesting part of HRO research is the observation that rather than downplaying failure, people in HROs are obsessed with failure. My colleagues Karl Weick, Kathie Sutcliffe, and David Obstfeld wrote a seminal paper highlighting the culture of HROs as preoccupied with failure, reluctant to simplify, acutely sensitive to ongoing operations (quick to detect subtle unexpected changes), committed to resilience (catching and correcting error,

rather than expecting error-free operations), and valuing expertise over rank. In other words, HROs are weird places. Rather than holding back to see what the boss is thinking, people there don’t hesitate to speak up immediately. A frontline associate, to avert a crisis, can tell the CEO what to do. Failure is clearly seen as an ever-present risk that can nonetheless be consistently averted.