Healthcare institutions are complex, tightly coupled systems. Their complexity derives from several factors, but perhaps the most significant is the presence of many defences, barriers, safeguards, and administrative controls designed to protect potential victims from the local hazards. As in all well defended systems, a mishap requires some assistance from chance in order to bring about such a low probability event. The greater the complexity of the system, the more likely it is that some measure of bad luck is involved in achieving the precise conjunction of defensive gaps and weaknesses necessary to permit an adverse event. This view of accident causation has been described elsewhere¹ and is summarised in fig 1.

Notwithstanding this chance element, however, evidence gathered from the analysis of many disasters in a wide range of complex systems—particularly those such as nuclear power plants and modern commercial aircraft in which catastrophes are extensively and publicly investigated—suggests that there is a recurrent cluster of organisational pathologies that render some systems more vulnerable to adverse events than others. We have termed this the “vulnerable system syndrome” (VSS) and will apply it here to the issue of patient safety. Our argument is that there are sufficient similarities between the aetiology of adverse events in different complex systems to offer managers of healthcare institutions the chance to benefit from the organisational and cultural lessons that are being learned in these non-medical domains. The ability to recognise the symptoms of VSS is an essential skill in the progress towards improved patient safety. We conclude with a brief discussion of two kinds of organisational learning: “single loop” learning that fuels and sustains VSS and “double loop” learning that is necessary to start breaking free from it.

Core elements of the “vulnerable system syndrome”

At the heart of VSS lie three pathological entities: blame, denial, and the single minded pursuit of the wrong kind of excellence. Each of these systemic pathologies is deeply rooted in human psychology and, as a consequence, tends to be present in varying degrees in all organisational cultures. Before we can counteract their harmful consequences we need to understand why they have such a widespread influence on the way institutions deal with their hazards. Each core pathology interacts with and potentiates the other two so that, collectively, they form a self-sustaining cycle that will continue to impede and undermine any risk management programme that does not attempt to eradicate, or at least moderate, their malignant influence. They conspire to ensure that those whose business it is to manage the system and preserve patient safety will generally have their eyes firmly fixed on the wrong ball.

Blame

Of the three core pathologies, the very human tendency to blame individuals for bad outcomes—or an excessive adherence to the “person model”²—is the most tenacious and perhaps the most pervasive in its harmful effects upon organisational safety. It has its origins in a quartet of psychological factors: the fundamental attribution error, the illusion of free will, the just world hypothesis, and hindsight bias.

THE FUNDAMENTAL ATTRIBUTION ERROR

The fundamental attribution error³ is one of the main reasons why people are so ready to accept the phrase “human error” as an explanation rather than as something that needs explaining. When we see or hear of someone performing less than adequately, we tend to put it down to the individual's personality or ability. We say that he or she was careless, silly, stupid, thoughtless, irresponsible, incompetent, or reckless. But if you were to ask the people in question why they acted in that way, they would almost certainly describe how the circumstances had constrained their actions. Everyone is capable of a wide range of actions, sometimes ill judged, sometimes inspired, but mostly somewhere in between. One of the basic principles of error management is that the best people can make the worst mistakes.

THE ILLUSION OF FREE WILL

Another reason why we are so inclined to blame people rather than situations stems from the illusion of free will.⁴ People, especially in Western cultures, place great value in the belief that they are, in large part, the controllers of their own destinies. They can even become mentally or physically ill when deprived of this sense of personal freedom. Feeling ourselves to be capable of choice naturally leads us to assume that other people are the same. They, too, are seen as free agents, able to choose between right and wrong and between correct and erroneous courses of action. When people are presented with accident reports and asked to judge which causal factors were the most avoidable, they almost invariably pick out the human actions. These processes act in concert to drive the blame cycle (fig 2).

THE JUST WORLD HYPOTHESIS

Another factor is the just world hypothesis.⁴ This is the belief shared by most children and many adults that bad things only happen to bad people, and conversely. In the safety context, the healthcare professionals implicated in an adverse event are seen as bad by virtue of the unhappy outcome.

HINDSIGHT BIAS

Hindsight bias—or the “knew-it-all-along” effect—is the universal human tendency to see past events as somehow more foreseeable than they actually were.⁵ When we look back at some salient event, our knowledge of the outcome unconsciously colours our perceptions of how and why it occurred. Those blessed with outcome knowledge see all the lines of causality homing in on some clearly defined happening, but those equipped only with foresight do not see this convergence. One of the reasons why (what appear to the retrospective observer to be) obvious signs of an impending tragedy are often ignored is that such warnings are only effective if the participants realise what kind of bad outcome they could have, and this is not always the case.

At the organisational level there are further processes at work that reinforce these psychological tendencies to regard front line practitioners as both the primary cause of mishaps and as the main target for remedial efforts. The first is the principle of least effort. It is usually relatively easy to identify the proximal errors of the individual at the sharp end and to consider these to be the “cause” of the mishap. That being the case, investigation of the adverse event need proceed no further. The second is the principle of administrative convenience. By restricting the search to the actions of those directly in contact with the patient, it is possible to limit the blame accordingly and thus minimise any institutional responsibility. This response is especially compelling when the actions of the individual in question are believed to deviate from some established protocol—a view that equates non-compliance with guilt and overlooks the fact that any pre-programmed procedure can be inappropriate in certain circumstances.

PENALTIES OF A BLAME CULTURE

The attractions of the “person model” are many and obvious, so why is it so wrong? Firstly, the institution fails to learn that errors and non-compliances mark the starting point of an investigation, not its conclusion. As shown in fig 1, adverse events result from a cascade of factors at many levels of the system. Evidence from various hazardous domains shows that the same situations keep provoking the same kind of errors in a wide variety of people.² For example, there have been 13 fatal incidents of intrathecal administration of medication since 1975. Analysis of these incidents has identified common factors including transportation practices between the pharmacy and wards, poor training and risk awareness among junior doctors, and the design and labelling of drug syringes.⁶

Secondly, the organisation also limits its remedial efforts to attempts at changing the behaviour of an individual clinician or nurse by blaming, shaming, naming, and retraining. But the fleeting psychological precursors of fallibility—for example, inattention or forgetting—are the last and the least manageable aspects of the error producing sequence. Despite all the intuitive evidence to the contrary, it is far easier to fix situations than to change people, and this is the only way to achieve institutional resilience in health care.⁷

Finally, in institutions where the focus is on the “person model”, the end result of an investigation into an adverse event is a maladaptive mindset in which the institution lives happily with the illusion that it has improved patient safety. Lacking any reliable information about the true nature of the dangers or the actual manner of their occurrence, those who manage the institution feel safe. There may be the occasional bad apple, they think, but the barrel itself is in good shape. Having identified and “dealt with” the “wrongdoers”, it is then a very short step to the view that it could not happen here again. And this has a corollary: the belief that anyone who says differently is a troublemaker. Blaming thus fosters denial.

The net effect of these processes is illustrated in box 1 which is based on a hypothetical institutional response to a real life incident described by Carlisle et al.⁸

Denial

The American social scientist Ron Westrum distinguished three kinds of safety culture: pathological, bureaucratic, and generative.⁹ The main distinguishing feature is the way in which an organisation handles safety related information. Generative or high reliability organisations “encourage individuals and groups to observe, to inquire, to make their conclusions known and, where observations concern important aspects of the system, actively to bring them to the attention of higher management”.⁹ In sharp contrast, pathological organisations muzzle, malign, or marginalise whistle blowers, shirk collective safety responsibility, punish or cover up failures, and discourage new ideas. In short, they do not want to know. Bureaucratic or calculative organisations (the large majority) lie somewhere in between. They will not necessarily shoot the messenger but new ideas often present problems. Safety management tends to be compartmentalised. Failures are isolated rather than generalised, and are treated by local fixes rather than by systemic reforms.

Having thus dispelled any nagging concerns about the institution's stance on patient safety, the top managers of a pathological—or sometimes even a bureaucratic—organisation are now free to pursue the efficiency and cost saving targets that feature so prominently in the delivery of modern health care. Managing by such objectives is what professional managers have been trained for and, not unreasonably, they feel that their performance will be judged primarily by the extent to which they achieve these goals. This opens the way to the single minded pursuit of the wrong kind of excellence.

The wrong kind of excellence

Even those bureaucratic organisations with their eyes firmly on the “safety ball” can pursue the wrong kind of excellence. In industry there are many companies engaged in hazardous operations that still measure their plant safety by the lost time injury frequency rate. Unfortunately, this relates specifically to personal injury accidents and provides little or no indication of a system's liability to a major disaster. The road to organisational catastrophes is paved with falling or very low lost time injury rates.¹⁰

The corollary in healthcare institutions is a singular focus on critical numerical indices. Hospital managers live by numbers but they do not always appreciate their limitations. A myopic focus on manipulating specific indicators—such as waiting times/lists for clinics and surgery, number of operations carried out, percentage bed occupancy rates, frequency of cancelled procedures—does not readily lead to detection of the subtle interactions of the system that could end up as adverse events.

Dietrich Doerner, a German psychologist, has spent many years studying the strengths and weaknesses of human cognition when managing richly interconnected dynamic systems.¹¹ His findings throw considerable light on the mental origins of this blinkered pursuit of excellence. When dealing with complex systems people have a tendency to think in linear sequences. They reason in causal series rather than in causal networks. They are sensitive to the main effects of their actions upon the progress towards an immediate goal, but frequently remain unaware of their side effects upon the rest of the system. In a highly interactive, tightly coupled system, the knock-on effects of interventions radiate outwards like ripples in a pool, but people can only “see” their influences within the narrow sector of their current concern. Similarly, people are not good at controlling processes that develop in an exponential or a non-linear fashion. They almost invariably underestimate their rate of change and are constantly surprised at the outcomes.

A hypothetical example of how the single minded pursuit of the wrong type of excellence manifests itself in health care is shown in box 2.

Conclusion

If there is one set of characteristics that distinguishes the robust organisation from those more vulnerable, it would be a preoccupation with the possibility of failure, a conviction that today is going to be another bad day, and a shared awareness of all the many and varied ways in which Sod, Murphy, and human fallibility can combine to cause unintended harm. The net result of the three interlinked pathologies described here is quite the opposite. Seriously sick institutions forget to be afraid or they never learn to be afraid; either way, they remain firmly and fatally attached to the comfort zone in the matter of safety.

Recent developments in organisational learning theory also suggest a way of breaking the vicious VSS cycle.¹² Two modes of learning have been distinguished: single loop and double loop learning. These are summarised in fig 3.

When there is a discrepancy between desired and actual results, as in a patient mishap, single loop learners look only to the immediately preceding actions for an explanation and the lesson. Since this usually involves an error on the part of a “sharp end” professional, it leads inexorably to narrowly targeted efforts to change that person's behaviour—blaming, shaming and retraining as shown in the case study summarised in box 1. Such “learning” serves only to drive the VSS cycle. In contrast, double loop learning looks beyond the immediate actions to the basic assumptions and conditions that gave rise to them. Such “deep learning” leads enlightened (or sufficiently frightened) managers to question their core beliefs, and to recognise that errors are almost always systemic consequences rather than isolated causes. They then go on to make global (rather than merely local) reforms of the system as a whole, accepting that a more resilient organisation is better able to achieve financial as well as safety goals.

Finally, a word of encouragement: we know of no organisation involved in hazardous work in any domain that is entirely free from the VSS. Some symptoms are to be expected everywhere: after all, complex systems are designed, built, managed, operated, and maintained by human beings. Nonetheless, the presence within a healthcare institution of the full blown syndrome bodes ill for both its patients and the front line staff. The ability to detect the incipient indicators and the collective will to implement wide ranging corrective measures are essential prerequisites for an effective risk management programme.