Keywords

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In the previous chapter we set out five levels of care with the levels being defined according to how closely they met expected standards of care. We argued that the care delivered to patients frequently departs from expected standards and that this has important implications for the management of safety. Most safety improvement strategies aim to improve the reliability of care and move more closely to optimal care. We suggest that these strategies need be complemented by strategies that are more concerned with detecting and responding to risk and which assume that care will often be delivered in difficult working conditions.

This argument could be seen simply as an admission of defeat. We might appear to be saying that healthcare will never achieve the safety standards of commercial aviation and we must accept this and manage the imperfections as best we can. Errors will inevitably occur, patients will sometimes be harmed and the best we can hope for is to respond quickly and minimize the damage. We would accept that working conditions and levels of reliability are often unnecessarily poor and that strategies to manage these risks to patients are much needed. However, there are more fundamental reasons for widening our view of safety strategies beyond trying to improve reliability. The more critical point is that different challenges and different types of work require different safety strategies. One safety size does not fit all.

Approaches to Risk and Hazard: Embrace, Manage or Avoid

The metaphor of the climber and the rock face serve as a framework to introduce our discussion of contrasting approaches to safety. Hazards in healthcare are like rock faces for climbers, an inevitable part of daily life. These hazards have to be faced but this can be done in very different ways. One can minimize the risk by refusing to climb unless conditions are perfect (plan A). Alternatively one can accept higher levels of risk but prepare oneself to manage the risk effectively. A climber or team of climbers may attempt a dangerous rock face but only after careful preparation, establishing clear safety procedures and plans for dealing with emergencies. A well prepared and coordinated team can achieve much higher levels of safety than an individual (plan B). Finally, a climber may simply embrace risk and rely on personal skill and resilience to deal with whatever occurs. They may climb without proper equipment, without training or in deteriorating weather conditions; or more dangerous still they may dare to climb unknown rock faces taking massive risks in the spirit of personal challenge and competitive achievement (plan C). All these climbers are concerned with safety but they vary in the risks they are prepared to take and the strategies they adopt (Amalberti 2013).

Some professions, such as fighter pilots, deep sea fishing skippers and professional mountaineers, literally make a living from exposure to risk. In these professions, accepting risk, and even seeking out risk, forms the essence of their work. These professions do, however, still want to improve safety. A number of studies carried out among fighter pilots (Amalberti and Deblon 1992) and sea fishing skippers (Morel et al. 2008, 2009) show that they have a real desire for safety. Fishing skippers, for example, would like to have an intelligent anti-collision system to offer them better protection in high seas and with poor visibility which would give increased mobility for trawling. Fighter pilots would like an electronic safety net to offer them better protection when they are undertaking manoeuvres that may cause them to lose consciousness.

People who rely on their personal skill and resilience are not reckless; a few may be but they are not likely to survive long. They usually have a core set of safety procedures that they take very seriously. The problem is that the constantly changing environment in which they work does not lend itself to managing risk by using rules and procedures. (If they did, one would change to a plan B approach). Instead, the response is necessarily ad-hoc because the environment is constantly changing and because economic considerations often drive people to take greater risks. Plan C solutions are essentially resilient in character: becoming more expert, becoming able to judge the difficulty of the task, being realistic about one’s own skills and acquiring experience which allows adaptation to uncertain or dangerous conditions.

In contrast, the high levels of safety in civil aviation are achieved by very different means. Here, the solution is radically different and frequently involves not exposing crews to the hazardous conditions that increase the risk of accidents. For example, the eruption of the Eyjafjallajökull volcano in Iceland in 2010 led to all European aircraft immediately being grounded based on a simple approach: no unnecessary exposure to risk. Deep sea fishing and commercial aviation reveal contrasting strategies for dealing with risk. The first, typical of very competitive and dangerous activities, involves relying on the intelligence and resilience of frontline operators and giving them aids to deal with risk; the other relies on organisation, control and supervision and ensures that operators are not exposed to risks. Both of these models take safety very seriously but they manage risk in very different ways (Fig. 3.1).

Fig. 3.1
figure 1

Three contrasting approaches to safety

Full size image

Three Approaches to the Management of Risk

We can then distinguish three broad approaches to the management of risk each with its own characteristic approach. Each one has given rise to an authentic way of organising safety with its own characteristic approach and its own possibilities for improvement (Grote 2012; Amalberti 2013). In practice the distinctions may not be that clear cut but the division into three models serves to illustrate the principal dimensions and factors in play (Box 3.1).

Box 3.1 A Note on Terminology

We have chosen three terms to describe contrasting approaches to safety: ‘ultra-adaptive’, high reliability and ‘ultra-safe’. All of these terms, particularly the first two, are associated with a number of theories and concepts. In this book we use these terms in a more descriptive sense. ‘Ultra-adaptive’ simply means that this approach relies heavily on the judgement, adaptability and resilience of individuals; ‘high reliability’ does indeed reflect the literature on high reliability organisations (HROs), but here is mainly meant to indicate a flexible but prepared response of teams in the management of risk; ‘ultra-safe’ refers to the absolute priority safety has in those environments and to the means of achieving such safety.

Embracing Risk: The Ultra-adaptive Model

This approach is associated with professions in which seeking exposure to risk is inherent in the activity and often also embedded in the economic model of that profession. Skilled professionals sell their services on the basis of their expertise and willingness to embrace risk, master new contexts, cope and win through, reaping benefits where others fail or are afraid to go. This is the culture of champions and winners, and there are of course those who fail to meet the challenges or who are injured or die in the attempt. This tends to be explained in personal terms; they did not have the knowledge or skill of the champions; they did not have the ‘right stuff’ to be part of these elite groups (Wolfe 1979). Deep sea fishing skippers, for example, are willing to seek out the riskiest conditions in order to catch the most profitable fish at the best times. Such professions are very dangerous and have appalling accident statistics. They are not, however, insensitive to the risks they run. They have safety and training strategies which are very well thought-out, but they are highly reliant on individual skills and strongly influenced by their own particular culture.

Within the ultra-adaptive model individual autonomy and expertise take precedence over the hierarchical organisation of the group. In many cases the group is very small (consisting of two to eight individuals) and works in a highly competitive environment. The leader is recognised for technical ability, past performance and charisma more than his official status. Everyone involved has to use a high degree of initiative. Skill, courage and accumulated experience combined with a clear-eyed awareness of personal strengths and limitations are the keys to recognition as a good professional. Success is seen in terms of winning and surviving, and only winners have a chance to communicate their safety expertise in the form of champions’ stories.

To summarise, there are a small number of procedures, a very high level of autonomy and a very large number of accidents. Becoming more effective and learning to manage risk are achieved by working alongside experts, learning from experience and increasing one’s own capacity to adapt and respond to even the most difficult situations. The differences between the least safe and the safest operators within a single resilient, skilled trade are of the order of a factor of 10; for instance the rate of fatal accidents in professional deep-sea fishing varies by a factor of 4 between ship owners in France and by a factor of 9 at the global level (Morel et al. 2009). This suggests that that it is certainly possible to make progress through safety interventions within this particular model of safety; there may however be a limit to what can be achieved without moving to a different model of safety which in turn would require a radically different approach to the activities concerned (Amalberti 2013).

Managing Risk: The High Reliability Approach

The term high reliability or high reliability organisation (HRO) is most associated with a series of studies of industries in which highly hazardous activities, such as nuclear power and aircraft carriers, were managed safely and reliably. A very wide variety of characteristics were identified as characterising high reliability organisations but all were underpinned by a disciplined but flexible approach to teamwork (Vincent et al. 2010). This approach also relies heavily on personal skill and resilience but in a more prepared and organized way; individual initiative must not come at the expense of the safety and success of the wider team (Weick and Sutcliffe 2007).

This approach is also associated with hazardous environments but the risks, while not entirely predictable, are known and understood. In these professions risk management is a daily affair, though the primary aim is to manage risk and avoid unnecessary exposure to it. Firefighters, the merchant navy, operating theatre teams, and those operating chemical factories all face hazards and uncertainty on a daily basis and typically rely on a high reliability model.

The HRO approach relies on leadership and an experienced professional team, which usually incorporates several different roles and types of expertise. All members of the group play a part in detecting and monitoring hazards (sense making), bringing them to the attention of the group, adapting procedures if necessary, but only when this makes sense within the group and is communicated to everyone. The HRO model is in fact relatively averse to individual exploits that are outside the usual repertoire of the team. The resilience and flexibility of approach employed is that of a dynamic and well-coordinated team rather than that of an individual acting on their own. All members of the group show solidarity in terms of safety objectives and the team promotes prudent collective decision-making.

The teams who work within this model place great importance on analysing failures and seeking to understand the reasons behind them. The lessons drawn from these analyses primarily concern ways in which similar scenarios could be managed better in future. This is therefore a model which relies firstly on improving detection and recovery from hazardous situations, and secondly on improving prevention – which means avoiding exposure to difficult situations when possible. Training is based on collective acquisition of experience. Once again, the differences between the best operators and those that are less good within a single trade are of the order of a factor of 10.

Avoiding Risk: The Ultra-safe Approach

With this approach we turn radically away from reliance on human skills and ingenuity towards a reliance on standardization, automation and avoidance of risk wherever possible. Professionalism in these contexts still requires very high levels of skill but the skills consists primarily in the execution of known and practiced routines, covering both routine operations and emergencies. Ideally, there is no need to rely on exceptional expertise even when dealing with emergencies, such as an engine fire on a commercial aircraft. Instead comprehensive preparation and training allows all operators to meet the required standards of performance and be skilled to the point that they are interchangeable within their respective roles. This approach relies heavily on external oversight and the control of hazards which makes it possible to avoid situations in which frontline staff are exposed to exceptional risks. By limiting the exposure to a finite list of breakdowns and difficult situations, the industry can become almost completely procedural, both when working under normal conditions and under more difficult conditions. Airlines, the nuclear industry, medical laboratories and radiotherapy are all excellent examples of this category. Accidents are analysed to find and eliminate the causes so that exposure to these risky conditions can be reduced or eliminated in the future. Training of front-line operators is focused on respect for their various roles, the way they work together to implement procedures and how to respond in a prepared manner to any emergency, so that there is minimal need for improvised ad hoc procedures. Once again, the best and the least good operators within a single profession differ by about a factor of 10.Footnote 1

Rules and Adaptation

We commonly assume that safety is achieved by imposing rules and restricting the autonomy of management and workers. We know however that writing a safety plan, specifying rules and compliance to legal requirements, offers no guarantee that the plan will be put into practice. There is a great deal of evidence about the extent of non-compliance to rules and safety standards and a recurring list of reasons for not adhering to the rules – too many, not understood, not known, not applying to non-standard cases, contradictions between rules and so on (Lawton 1998; Carthey et al. 2011). Moreover, workers in many organisations find that it is often necessary to by-pass or flout rules to get the job done in a reasonable time; these are ‘optimising violations’ in James Reason’s memorable phrase (Reason 1997).

The three approaches to safety take radically different approaches to rules and procedures on the one hand and flexibility and adaptation on the other. Each approach has its own approach to training, to learning and improvement and each has its own advantages and its own limitations (Amalberti 2001; Amalberti et al. 2005). They can be plotted along a curve in which there is a trade-of between flexibility and adaptability on the one hand and standardisation and procedures on the other. It is important to acknowledge that while these approaches vary considerably in the way they manage risk all share the same ambition of being as safe as possible in the circumstances in which they operate.

Concrete safety results are therefore the product of apparent contradictory actions: rules and constraints that guide work on the one hand and reliance on the adaptive capacities of staff in scenarios that fall outside guidelines, rules and regulations. Staff sometimes fail to follow rules in a reckless or careless manner (i.e. for no good reason) but equally often the rules are ignored because they impede the actual work itself. In healthcare we have the highly undesirable situation of a vast number of procedures and guidelines (far too many for staff to follow or even know about) which are followed inconsistently (Carthey et al. 2011). One critical task for healthcare in all settings, whether adaptive or standardised, is to identify a core set of procedures which really do have to be reliably followed.

How Many Models for Healthcare?

For the sake of simplicity we have viewed each industry as primarily being associated with one particular model. The reality is more complicated. For instance the activity of drilling for oil necessarily involves embracing risks; oil processing on the other hand, while hazardous, can potentially be managed in a way that minimises risk.

Healthcare is a particular complex environment. We have already alluded to this when commenting that healthcare is ‘twenty different industries’. Consider the hospital environment with multiple types of work, many different professions and varying working conditions across clinical environments. There are areas of highly standardized care which conform very closely to our ultra-safe model. These include pharmacy, radiotherapy, nuclear medicine and much of the process of blood transfusion. All of these are highly standardized and rely heavily on automation and information technology. They are islands of reliability within the much more chaotic wider hospital environment. In contrast much ward care corresponds to our intermediate model of team based care where standards and protocols provide important controls on hazards (such as infection from poor hand hygiene) but where professional judgement and flexibility is essential to providing safe, high quality care.

Other sections of the hospital, such as emergency surgery, deal continually with complex cases and have to work in very difficult conditions. The work may be scheduled but there is considerable hour-to-hour adaptation due to the huge variety of patients, case complexity, and unforeseen perturbations. We should emphasise though that all clinical areas, no matter how adaptive, rely on a bedrock of core procedures; adaptive is a relative term not an invitation to abandon all guidelines and go one’s own way. In addition, much clinical activity could be much more controlled than is often the case. In many hospitals elective and emergency surgery are still carried out by the same teams on the same day which ensures constant disruption to the routine procedures and insufficient focus on emergency patients, moving the whole system to a highly adaptive mode. Separating elective and emergency work and allocating separate teams to deal with each allows both areas to operate in a largely high reliability mode.

All of these professional activities have to adapt to changing staffing patterns and other pressures on the system. On ‘Tuesday morning’ (optimum working conditions) it may be possible for an emergency surgery team to adopt the characteristics of a HRO system. In contrast on ‘Sunday night’ (short staffed, lack of senior staff, lack of laboratory facilities) the team is forced to rely on a more adaptive approach. Healthcare is a wonderful arena for the study of safety, probably much better than any other setting, because the entire range of approaches and strategies can be found within one industry.

Moving Between Models

We sometimes assume that the safety ideal is the ultra-safe model of commercial aviation and other highly standardized processes. In a sense this is correct, in that this model is indeed very safe, but we have argued that this model is only workable with very specific conditions and strong constraints on risky activity. The model may not be appropriate, or even feasible, in other settings. Nevertheless in certain activities we can identify a move between different models according to circumstances.

The case of fighter pilots is a special and interesting case of a dual context: in peacetime, the air force requires them to operate in an essentially ultra-safe mode, but once the aircraft are deployed on active service, the operating model immediately becomes one of adaptation and resilience. The switch between these modes of operation can generate surprises in both directions. After returning from military campaigns pilots can persist in resilient and deviant behaviour as they struggle to return to peace time conditions. Conversely, when pilots are suddenly thrust from peacetime into operational theatre, important opportunities can be missed during the first few days of military engagement due to lack of practice in the resilient model.

Surgery offers similar parallels in that different forms of surgery correspond to different models and the same surgeons may need to adapt to different approaches. Highly innovative surgery, such as early transplant surgery, or surgery conducted in unusual environments such as field hospitals, clearly requires a risk embracing highly adaptive approach. The phrase ‘heroic surgery’ speaks exactly to this kind of intervention with the allusions to the personal qualities of the surgeon that are required, although greater heroism is probably required of the patient. We can see also that patients may also choose strategies which are very risky but yet are justified by the severity of the illness and the potential benefit.

Over time certain kinds of surgery may evolve through different models, beginning as a very high risk experimental procedure, moving towards a stage in which risks can be managed through to a stage of very consistent, safe and highly standardized care. Much surgery relies on team based approaches using the intermediate model, but some types of surgery that are very well understood can now be considered in the category of ultra-safe. Units that focus entirely on a single operation, such as cataract or hernia, achieve very consistent results and high levels of safety, though this may partly be achieved by careful patient selection. We must recognise that this approach cannot be the decision of the team alone; ultra-safe surgery requires a highly stable and controlled environment underpinned by very reliable basic processes.

In unusual circumstances any team, no matter how proceduralised the environment, may have to adapt, respond and recover. Conversely highly adaptive teams still need a core of rock solid procedures which are closely adhered to. A healthcare team might, in one afternoon, work in an ultra-safe manner at some points, such as when a care pathway is clearly defined and entirely appropriate for the patient; they may work in a high-reliability mode for the main part and, for short periods, in an ultra-adaptive mode. Longer term approaches to the underlying approach however require quite substantial adjustment not just within the team but in the wider organisation and possibly also in the regulatory environment.

A move to a new approach to safety is possible in some circumstances but it often only occurs after an event that affects the entire profession and its economy. The industrial chemical industry, for example, which in some cases is still based on adaptive models dating from the 1960s and 1970s, made a definitive switch to an HRO model after the events that occurred in Seveso in Italy in 1976 and the European Directive that followed in 1982. In this case and many others the transition to a new approach is not led from within the industry but forced by regulatory authorities and government. When this happens a prolonged period of adjustment is needed during which the system migrates gradually, loses the benefits of the previous model (a higher level of adaptation and flexibility), but gains the advantages of the new model (mainly in terms of safety). A permanent move to a new approach to safety cannot take place without changing the working conditions imposed by the external environment. A change in model must also be accepted by the front line operators and be consistent with the values and culture of both the team and the wider organisation. If you cannot change these conditions, safety improvements will be modest and restricted to local improvement. If you stay ‘within the model’ then one may improve safety by a factor of 10, whereas if the system can be protected and given stability then it can be moved to a different category with impressive safety gains.

Reflections on the Safety Ideal

The idea of a single ideal model of safety that applies to everything and aims to have zero accidents is too simple. Safety is only ever considered in relation to other objectives and those objectives may be valuable but also risky. We are never in the position of being able to aim for absolute safety but only to be as safe as possible given our objectives and tolerance for risk. Different contexts provoke different approaches safety, each with their own approach, advantages and limitations. The differences between these models lie in the trade-off between the benefits of adaptability and the benefits of control and safety. A different model may be intrinsically more effective, but may not be feasible in the context in question. Many aspects of healthcare for instance primarily rely on a high reliability approach but could move towards an ultra-safe model with additional resources and control of demand. However, while some change could be effected within healthcare, a more substantial adjustment would probably require a radically different approach to managing demand which is currently not politically feasible. Models of safety are ultimately context dependent and will vary by discipline, organization, governance and jurisdiction.

Key Points

  • Safety is approached very differently in different environments. In some environments and professions risk is embraced, in some it is managed and in others it is controlled.

  • We distinguish three classes of safety models: an ultra-adaptive approach associated with embracing risks, the high reliability approach managing risks, and the ultra-safe approach which relies heavily on avoiding risks.

  • The three models reflect the degree to which the environment is unstable and unpredictable. Very high levels of safety can only be achieved in very controlled environments

  • Intervention strategies must be adapted to these models, giving importance to experts in ultra-adaptive contexts, to teamwork in HRO contexts, and to standardisation, oversight and control in ultra-safe contexts.

  • Healthcare has many different types of activity and clinical settings. Areas of highly standardized care, such as radiotherapy, conform to an ultra-safe model. In contrast much ward care corresponds to an intermediate model of team based care, employing a combination of standards and protocols, professional judgement and flexibility.

  • Some clinical activities such as emergency surgery are necessarily more adaptive. The work may be scheduled but there is considerable hour-to-hour adaptation due to the huge variety of patients, case complexity, and unforeseen perturbations.

  • All clinical areas, no matter how adaptive, rely on a bedrock of core procedures; adaptive is a relative term not an invitation to abandon all guidelines and go one’s own way.

  • A permanent move to a new approach to safety cannot take place without a change in working conditions imposed by the external environment. A change in model must also be accepted by front line operators and be consistent with the values and culture of both the team and the wider organisation.

  • Different contexts provoke different approaches to safety, each with their own approach, advantages and limitations. The difference between models lies in the trade-off between the benefits of adaptability and the benefits of control and safety. A different model may be intrinsically safer but not be feasible in a particular context.