Matthew Syed’s Black Box Thinking (2015) is a book about why some fields learn from their mistakes and most do not. The American edition is subtitled Why Most People Never Learn from Their Mistakes—But Some Do; the first British edition was subtitled The Surprising Truth About Success, the British paperback Marginal Gains and the Secrets of High Performance, and the tenth-anniversary edition of 2025 Growth Mindset and the Secrets of High Performance. Syed, a columnist for The Times and a former British table tennis number one, builds the book on a contrast between aviation, which recovers the flight recorders after an accident, investigates, publishes what it finds and changes its procedures, and healthcare, where in his account errors have too often been explained away, settled quietly or never recorded at all. From there he widens the argument to criminal justice, business, politics and sport. People and institutions fail to learn, he argues, less for want of information than because failure threatens the way they see themselves: the psychology of cognitive dissonance, the reflex to blame and cultures that treat error as shameful all close the loop that should run from a mistake to a change. The remedies he describes are independent investigation, protected reporting, trial and error, controlled testing, the breaking of large problems into small improvable parts, and what he calls a growth culture.
For internal auditors the book is close to home in three ways. Every audit finding needs a cause, and the book is an extended case against stopping at the person who made the error. Management’s incident, complaint and loss-event processes are a regular subject of audit work, and the book describes what a system that learns from failure looks like from the inside. And an audit function’s own issue tracking, repeat findings and quality programme are, in the book’s terms, either an open loop or a closed one. This guide summarises the book without reproducing it, sets out its structure from the published contents, checks its real cases against the record and brings them up to 2026, records the criticisms and the later research, maps the argument to audit practice, and ends with a worked example in which a hospital system’s audit function tests how the system learns from harm and then turns the same tests on itself.
In this guide
- The book in one page
- Who Matthew Syed is, and how the book came about
- The structure: six parts and a coda
- The argument: open loops and closed loops
- Why people do not learn: cognitive dissonance and blame
- How organisations learn: testing, marginal gains and a growth culture
- The cases, checked against the record and brought up to date
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: learning from failure as a control
- The criticisms, the later research and what the book leaves out
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Ashgrove Health System audits how it learns from harm
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is the argument? | That progress in any field depends on how it treats failure. Fields that capture failure, investigate it openly and change their practice improve; fields that hide failure, explain it away or punish the people involved repeat it. Aviation is the book’s model and healthcare its main counter-example. |
| What does the title mean? | Black boxes are the flight recorders investigators recover after an accident. In the book the phrase stands for a whole approach: gather the data on what went wrong, examine it independently and without hunting for a scapegoat, publish the lesson and change the system. |
| Why do people not learn? | Because admitting failure threatens self-esteem and reputation. The book uses the psychology of cognitive dissonance to explain why prosecutors, doctors, politicians and executives reinterpret evidence rather than admit error, and it argues that blame drives reporting underground. |
| How do organisations learn? | By building what the book calls open loops, in which feedback is sought and acted on: independent investigation, reporting protected from punishment, trial and error, controlled testing of interventions, small measured improvements and a culture that treats failure as information. |
| What cases does it use? | Among others: the death of Elaine Bromiley after a routine operation in 2005, United Airlines Flight 173 in 1978 and the Hudson River landing of 2009, Virginia Mason hospital in Seattle, wrongful convictions, the Scared Straight programme, the Iraq war, Unilever, Dyson, the Sky cycling team, the Mercedes Formula One team, Dropbox and David Beckham. |
| Who wrote it? | Matthew Syed, a columnist and feature writer for The Times and The Sunday Times and presenter of the BBC Radio 4 series Sideways, who was Britain’s number one table tennis player for almost a decade and played at the Barcelona and Sydney Olympics. |
| What is the current edition? | In the United Kingdom, a tenth-anniversary paperback from John Murray, on sale from 25 September 2025, which the publisher says contains new material from the author. |
| Why read it as an auditor? | Because cause analysis, issue closure, incident review and the audit function’s own quality programme all turn on the question the book asks: does the organisation learn from what went wrong, or explain it away? |
Who Matthew Syed is, and how the book came about
Syed was Britain’s number one table tennis player for almost a decade, won the men’s singles at the Commonwealth Championships three times and represented Great Britain at the Olympic Games in Barcelona in 1992 and Sydney in 2000. He studied philosophy, politics and economics at Balliol College, Oxford, and took a first. He is a columnist and feature writer for The Times and The Sunday Times, has twice been named sports journalist of the year at the British Press Awards, presents the BBC Radio 4 series Sideways, and co-founded Matthew Syed Consulting, which works with organisations on what it calls growth mindset cultures. His books include Bounce, which preceded this one, The Greatest, Rebel Ideas, You Are Awesome and Dare to Be You. His own biography records that he advised the Department of Health in 2016, the year after Black Box Thinking appeared.
We have found no interview or author’s note in which Syed describes how the book began, so this guide says only what the record shows. The book was published in the United Kingdom by John Murray, with the hardback on sale from 10 September 2015, and in the United States by Portfolio, an imprint of Penguin, on 3 November 2015. The American publisher’s description sets out the frame: preventable medical error described as the third-biggest killer in the United States, many errors hidden by settlements with confidentiality terms, and aviation, where every incident’s recorders are analysed, the findings published and the procedures changed. It names David Beckham, the Mercedes Formula One team and Dropbox among the people and organisations the book profiles, and it describes the method as drawing on anthropology, psychology, history and complexity theory. The British paperback followed in April 2016, and in September 2025 John Murray published a tenth-anniversary edition, which its publisher describes as a Sunday Times number one bestseller and says includes brand-new material. We have not seen the new material and do not describe it.
The structure: six parts and a coda
The contents below are taken from a library record of the American first edition (Portfolio, 2015), which lists six parts of two or three chapters each and a coda; the record gives the book as xi and 322 pages, with a bibliography and an index. The third column states the subject each part’s titles name, in our words. The fourth lists only cases that a chapter title names or that a source places in that part; we have not seen the contents of the British or anniversary editions.
| Part | Chapters | The subject, in our words | Cases the titles or sources place here |
|---|---|---|---|
| The Logic of Failure | A Routine Operation; United Airlines 173; The Paradox of Success | Why aviation learns from accidents and healthcare often does not, and why success depends on studying failure | Elaine Bromiley (the book opens with her case); United Airlines Flight 173 |
| Cognitive Dissonance | Wrongful Convictions; Intellectual Contortions; Reforming Criminal Justice | How people protect their beliefs and reputations by reinterpreting evidence, with criminal justice as the extended example | Wrongful convictions, and prosecutors who defended them in the face of new evidence |
| Confronting Complexity | The Nozzle Paradox; Scared Straight? | Why complex problems yield to trial and error and controlled testing rather than to design from theory | Unilever’s detergent nozzle; the Scared Straight programme |
| Small Steps and Giant Leaps | Marginal Gains; How Failure Drives Innovation | Improvement through many small tested changes, and invention as a long series of failures | Marginal gains |
| The Blame Game | Libyan Arab Airlines Flight 114; The Second Victim | How the reflex to blame individuals destroys the information an organisation needs, and harms the people who made the error | Libyan Arab Airlines Flight 114; the “second victim” |
| Creating a Growth Culture | The Beckham Effect; Redefining Failure | How people and organisations come to treat failure as part of learning | David Beckham |
| Coda | The Big Picture | The argument applied to society as a whole | None identified |
The publisher and reviewers name further cases without placing them in particular chapters: Virginia Mason hospital in Seattle, the 2009 landing of a US Airways jet on the Hudson River, the Iraq war and the justifications offered for it, Philip Tetlock’s research on expert prediction, Sydney Finkelstein’s study of why executives fail, James Dyson, the Sky cycling team, the Mercedes team and Dropbox. The guide refers to them where they help without claiming to know which chapter carries them.
The argument: open loops and closed loops
The book opens in an operating theatre. Elaine Bromiley, a 37-year-old mother, went into hospital in 2005 for a routine operation on her sinuses and died after her airway collapsed under anaesthetic and the doctors’ repeated attempts to secure it took too long. Her husband, Martin, was an airline pilot, and the book follows his attempt to find out what had happened and to make sure it did not happen again: he was told, as one reviewer recounts it, that the death was a one-off, and he pressed for an investigation of the kind his own industry would have run as a matter of course. The independent review that followed, as the record shows, described consultants who persisted with repeated attempts to intubate and lost track of time, and the coroner’s verdict recorded that a tracheostomy set was called for but not used. The same pattern, a team fixed on one problem while another grows, appears in the crash of United Airlines Flight 173, which gives the next chapter its title. From that case the book draws its central contrast. In aviation, as Syed describes it, failure is captured by the flight recorders and by reports that pilots can file without fear of punishment, investigated by bodies independent of the airline, published and turned into changes across the industry. In healthcare, as he describes it, failure was for a long time not systematically recorded, often not investigated, described in euphemisms and settled privately, so patterns could not be seen and the same errors could recur.
The book’s name for the difference is the loop. A closed loop is one in which failure produces no change, because nobody collects the data, nobody looks at it, or the people who look explain it away. An open loop is one in which feedback is sought and acted on. The book’s claim is that aviation’s safety record comes from a system built to expect, record and use errors, and that such systems can be built elsewhere. Syed extends the point to science, which in his account advances because theories are tested and discarded when they fail. For an auditor the loop is a familiar idea under another name. It is the difference between an issue log that records actions and one that records whether the problem stopped.
| After something goes wrong | Aviation, as the book presents it | Healthcare, as the book presents it | The audit question |
|---|---|---|---|
| Capture | Flight recorders and a reporting system in which pilots can report their own errors with immunity and anonymity | Data on how accidents happened not routinely collected, so patterns could not be seen | Is every significant failure and near miss recorded, and how would we know if it was not? |
| Investigation | Independent investigators whose job is to find out what happened, not whom to blame | Investigation not routine; Martin Bromiley was told the death was a one-off and, reportedly, that an investigation would follow only if he sued | Who investigates, how independent are they of the people involved, and what do they look for? |
| The people involved | Trained to speak up and to listen; assertiveness and teamwork training after crashes such as United 173 | Hierarchy that silences junior staff; fear of blame | Do junior staff challenge seniors, and what happens when they do? |
| The lesson | Published and turned into procedures across the industry | Kept local, and sometimes hidden by settlements with confidentiality terms | Does the lesson leave the unit where it was learned, and is the change verified? |
Why people do not learn: cognitive dissonance and blame
The second part of the book asks why intelligent people resist evidence that they were wrong. Syed’s answer is cognitive dissonance: when evidence contradicts a belief on which a person’s self-image or reputation depends, the easier course is to reinterpret the evidence rather than revise the belief. The extended example is criminal justice. The book describes prosecutors who continued to defend convictions after new evidence, including DNA, had undermined them, and the record of one such case shows how far the reinterpretation can go. Juan Rivera, convicted in Lake County, Illinois, of the 1992 rape and murder of eleven-year-old Holly Staker, was excluded by DNA testing in 2005; at his third trial in 2009 the prosecution argued that the DNA did not belong to the killer, and he was convicted again. The Illinois Appellate Court overturned the conviction in December 2011, holding that it could not stand, and the charges were dropped in January 2012 after he had spent about twenty years in prison. The book draws the same pattern from politics, tracing the shifting justifications for the Iraq war, from Philip Tetlock’s finding that well-known experts were often poor forecasters, and from Sydney Finkelstein’s research on executives, in which the denial of error grows with seniority because the most senior people have the most to lose.
The fifth part, The Blame Game, turns from the individual mind to the organisation’s response. Across the book Syed argues that the instinct to find a culprit is strong and usually misplaced: observers attribute failures to the character of the person involved rather than to the situation, which is the error psychologists call the fundamental attribution error, and an organisation that punishes the person who reports a mistake teaches everyone else to hide theirs. One chapter takes its title from the idea of the “second victim”, a phrase the physician Albert Wu used in the BMJ in 2000 for the doctor who makes an error and is harmed by it, through blame and isolation. Read with audit in mind, the two parts describe the two barriers an audit function meets when it asks why something went wrong. The first is the auditee who cannot accept that the process failed, and the second is the organisation that already knows whom it blames. The Field Guide to Understanding ‘Human Error’ summary gives the investigator’s method for getting past both, and the Willful Blindness summary covers the related habit of not seeing what is inconvenient.
The book is careful on one point that auditors should keep: dissonance is strongest in people with the most invested in being right, which includes experts and the senior. The guide’s reading is that this applies to auditors as well. A chief audit executive who has told the audit committee that an area is well controlled is the person least able to see the evidence that it is not, and a team that has rated a control effective for three years running is the team least likely to notice it has stopped working. Rotation, second reviews and the professional skepticism the Standards require are the audit function’s own defences against the mechanism the book describes; the professional skepticism guide covers them.
How organisations learn: testing, marginal gains and a growth culture
The remedies in the second half of the book are practical, and most of them are about testing. The third part contrasts two ways of solving a complex problem. One is to design the answer from theory; the other is to try many variations, keep what works and discard what does not. The book’s example of the second is the nozzle of its chapter title, a Unilever production problem solved by iteration rather than by calculation; the logic is the same as the testing of small versions of a product before committing to the whole, set out in the Lean Startup summary. The same part asks whether the Scared Straight programme, which took young offenders and at-risk young people into adult prisons to frighten them away from crime, worked. The controlled evaluations say it did not: the US National Institute of Justice’s CrimeSolutions service rates such juvenile awareness programmes as ineffective, citing a Campbell Collaboration review of eight studies in which participants reoffended more than comparable young people who did not take part. The lesson the book draws from it, in our reading, is that an intervention which feels right has to be tested against a control group before it is trusted.
The fourth part is about improvement in small steps. Its first chapter is titled after marginal gains, the approach that Dave Brailsford, manager of Team Sky, called the aggregation of marginal gains: break performance into its parts, improve each by a small measured amount, and let the improvements add up. A reviewer lists the Sky cycling team among the book’s case studies, and the publisher names the Mercedes Formula One team. The second chapter is about invention; reviewers report that the book cites James Dyson, among others, as someone who learned from his failures. The sixth part, on creating a growth culture, takes its first chapter title from David Beckham and argues that people and organisations who treat ability as something built through practice and failure, rather than something one either has or lacks, learn faster. The tenth-anniversary edition puts the growth mindset in its subtitle. The table reads the book’s remedies as controls, which is the guide’s mapping rather than the book’s.
| Remedy in the book | What it involves | The control it implies | How an auditor tests it |
|---|---|---|---|
| Independent investigation | Finding out what happened, separately from deciding whom to blame | Incident reviews run by people independent of the area, with a remit to find system causes | Read a sample of reviews: who ran them, what causes they found, and whether any stopped at “human error” |
| Protected reporting | Reporting one’s own errors without fear of punishment | A reporting channel and a policy that separate learning from discipline | Compare reporting rates across units; trace whether reporters were disciplined for what they reported |
| Trial and error | Trying variations and keeping what works when the problem is too complex to design | Pilots and prototypes with defined measures before full roll-out | Ask what was tested before a change was scaled, and what the test showed |
| Controlled testing | Comparing an intervention with a control group | Evaluation designs that can tell whether a programme works | For a major programme, ask what evidence other than testimony shows it works |
| Marginal gains | Breaking performance into parts and improving each a little | Decomposed measures with owners and records | Check that each gain is measured and recorded, and that records are kept when performance is the goal |
| Growth culture | Treating failure as part of learning | Leadership behaviour and processes that reward reporting and learning | Interview staff on what happened after the last reported error; read what leaders said about it |
The cases, checked against the record and brought up to date
The book tells its real cases briefly and in the service of its argument. The table sets out the main ones, how the book uses them as sources describe it, what the primary or reputable record shows, and what has happened since. The middle columns rest on investigation reports, court and registry records, official evaluations and reputable journalism, not on the book.
| Case | How the book uses it | What the record shows | What happened next |
|---|---|---|---|
| Elaine Bromiley, 2005 | The opening case: a death after a routine operation, and a pilot husband who pressed for an investigation of the kind aviation would run | The operation, on 29 March 2005, was to straighten the inside of her nose for long-standing sinus problems. Her airway collapsed; three consultants tried repeatedly to intubate; a nurse brought a tracheotomy set, and the doctors did not acknowledge it; the consultant anaesthetist later told the reviewer he had had no idea how much time had passed. She died on 11 April 2005. Professor Michael Harmer led the independent review, which reported in July 2005 | Martin Bromiley founded the Clinical Human Factors Group, a charitable campaign group on human factors in healthcare, and was appointed OBE in the 2016 New Year Honours for his work on patient safety |
| United Airlines Flight 173, 1978 | The aviation counterpart: a crew fixed on one problem while another brought the aircraft down, and an investigation that changed training | On 28 December 1978 a DC-8 ran out of fuel and crashed in suburban Portland, Oregon; 10 of the 189 on board died. The NTSB found the captain had failed to monitor the fuel state while preoccupied with a landing-gear problem, and that the other two flight crew had not grasped the danger or had failed to get their concern across | The NTSB recommended training in flight-deck resource management, with participative management for captains and assertiveness training for other crew; crew resource management grew out of crashes like this one |
| US Airways Flight 1549, 2009 | Success built on earlier failures: the landing on the Hudson drew on lessons learned the hard way | On 15 January 2009 the Airbus lost thrust in both engines after striking birds and ditched on the Hudson River; all 155 people on board survived | The NTSB’s 2010 report listed the crew’s decision-making and crew resource management among the reasons everyone survived |
| Virginia Mason, Seattle | A hospital that tracks and learns from bad outcomes | In 2002, by its own account, Virginia Mason became the first US health care organisation to apply Toyota Production System principles to safety, quality and cost. In November 2004 Mary McClinton, 69, was injected with chlorhexidine, a disinfectant, in place of dye during a procedure, and died 19 days later; the three clear liquids had stood in unlabelled bowls | Its safety work includes a colour-coded Patient Safety Alert system, chlorhexidine was moved onto swabs, and an annual safety award bears her name; in March 2014 the UK health secretary, Jeremy Hunt, chose Virginia Mason as the venue for a speech announcing new NHS patient-safety measures |
| Juan Rivera, Illinois | Prosecutors defending a conviction against DNA evidence | Convicted three times for the 1992 murder of Holly Staker; excluded by DNA in 2005; conviction overturned by the Illinois Appellate Court on 9 December 2011; charges dropped in January 2012 | A $20 million settlement in March 2015, then reported as the largest of its kind in Illinois; the National Registry of Exonerations now lists 3,868 exonerations in the United States since 1989 |
| Scared Straight | An intervention that controlled tests showed to do harm | Juvenile awareness programmes take young people into adult prisons; a Campbell review of eight studies found participants more likely to reoffend | The US National Institute of Justice’s CrimeSolutions service rates the practice ineffective |
| The Sky cycling team | Marginal gains in elite sport | Under Brailsford, Bradley Wiggins became the first British winner of the Tour de France in 2012, and Chris Froome won in 2013 | In 2018 the House of Commons Digital, Culture, Media and Sport Committee found that the team’s medical record-keeping and oversight had failed and said it believed triamcinolone was used to prepare Wiggins for the 2012 Tour, crossing the ethical line Brailsford said he had drawn; it said this was not a breach of the WADA code, and Wiggins and Team Sky rejected the claim |
Two of the updates matter for the argument. Since the book appeared, England has, in our reading, moved some way toward the aviation model it describes: the Healthcare Safety Investigation Branch began work in 2017, and under the Health and Care Act 2022 it was replaced on 1 October 2023 by the Health Services Safety Investigations Body, an independent body whose investigations are designed to learn rather than to assign fault and whose interviewees’ information is protected by law. NHS England’s Patient Safety Incident Response Framework, published in 2022 to replace the Serious Incident Framework of 2015, asks providers for system-based learning, proportionate responses and compassionate engagement with the people affected. In the United States, the Centers for Medicare and Medicaid Services adopted a Patient Safety Structural Measure in August 2024, under which hospitals attest each year to practices in five domains, among them a culture of safety and learning health system and accountability and transparency; the first measurement year was 2025. The Sky update matters for a different reason: an approach built on measuring everything had not kept the medical records its own policy required, which is the kind of gap an auditor is there to find. The Normal Accidents summary and the Meltdown summary give the systems view of the aviation and healthcare failures.
The nine ideas worth keeping
- Failure is information. A failure that is recorded, examined and acted on makes the next one less likely; one that is explained away makes it more likely. The difference is the loop, not the people.
- Investigate the system, not the scapegoat. The Bromiley and United 173 cases show the same pattern, skilled people fixed on one problem and deaf to a junior colleague, and it is invisible to an inquiry that stops at the person.
- Make reporting safe and the lesson public. Aviation’s reporting works, in the book’s account, because pilots can report their own errors without punishment and because the lessons travel across the industry.
- Expect the mind to defend itself. Cognitive dissonance makes people reinterpret evidence that threatens their self-image, and it is strongest in experts and the senior, auditors included.
- Test interventions before trusting them. Controlled evaluations found that Scared Straight programmes increased reoffending. An intervention’s appeal is not evidence that it works.
- Iterate when the problem is too complex to design. Where theory cannot predict the answer, many small tested variations will find it faster than one grand design; the Lean Startup summary covers the method.
- Big results come from small measured gains. Break performance into parts and improve each, and keep the records; the Sky case shows what happens to an approach built on measurement when the records are not kept.
- Blame destroys the data. An organisation that punishes the person who reports a mistake teaches everyone else to hide theirs, and harms the clinician or employee who is the “second victim” of the error.
- Redefine failure as part of the work. A culture that treats failure as a step in learning rather than a verdict on ability learns faster; whether a programme has created such a culture is a question for evidence, not for slogans.
The vocabulary: fourteen terms defined for practitioners
| Term | What it means in the book | What it looks like in an audit |
|---|---|---|
| Black box thinking | Treating failure as data to be recovered, examined independently and turned into change, as air accident investigators treat flight recorders | An incident and issue process judged by whether problems stop recurring |
| Closed loop | A system in which failure produces no change, because it is not recorded, not examined or explained away | Issues closed on the strength of an action taken, not a result achieved |
| Open loop | A system in which feedback is sought and acted on | Validation that tests whether the failure stopped, and trend data on repeats |
| Cognitive dissonance | The discomfort of holding evidence that contradicts a belief one is invested in, resolved by reinterpreting the evidence | Auditees, and auditors, explaining away exceptions that threaten a past assessment |
| Falsification | Testing a theory against evidence that could prove it wrong, the book’s account of how science advances | Designing tests that could fail, not tests that can only confirm |
| Crew resource management | Aviation’s training in teamwork, participative leadership and assertiveness, developed after crashes such as United 173 | Whether junior staff can stop a process; see the Checklist Manifesto summary |
| Fundamental attribution error | Attributing a failure to the character of the person rather than to the situation | Cause statements that read “carelessness” or “lack of attention” |
| Blame game | The reflex to find a culprit, which drives reporting underground | Falling report volumes after a disciplinary case |
| Second victim | The clinician or employee harmed by their own error, through blame and isolation; a term used by Albert Wu in 2000 | Support for staff after serious incidents, and whether they leave |
| Trial and error | Solving complex problems by trying variations and keeping what works | Pilots with defined measures before a change is scaled |
| Randomised controlled trial | Comparing an intervention with a randomly chosen control group, the kind of test under which Scared Straight programmes were found to increase reoffending | Evidence of effect for a major programme, beyond testimony |
| Marginal gains | Improving performance through many small measured changes | Decomposed metrics with owners, and the records behind them |
| Growth culture | An organisation that treats ability as built through practice and failure | What happened, in practice, to the last person who reported an error |
| Redefining failure | Treating failure as a step in learning rather than a verdict | Post-engagement reviews of the audit function’s own misses |
What it means for internal audit: learning from failure as a control
The book’s practical value for an audit function is that it describes, in plain terms, a control that most organisations claim to have and few test: the capacity to learn from what goes wrong. An incident system, a complaints process, a loss-event database, a root cause procedure and an issue tracker are all parts of that control, and each can be an open loop or a closed one. The table maps the book’s argument to audit activities. The root cause guide, the issue validation guide, the incident response audit guide and the operational risk guide carry the surrounding procedures.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Root cause analysis of findings | Failure is a pattern in a system, not a verdict on a person | Reject “human error” and “did not follow procedure” as causes; Standard 14.3 of the Global Internal Audit Standards asks auditors to work with management to identify root causes where possible, and 14.4 asks recommendations to address them; the cause statements guide shows how |
| Issue management and validation | A closed loop records actions; an open loop records whether the problem stopped | Validate effectiveness, not completion; analyse repeat findings by area and cause; the sustainability testing guide covers re-testing after closure |
| Reviewing management’s incident and loss-event processes | Capture, independent investigation and publication of lessons | Test completeness of capture against other sources, the independence of reviews, and whether lessons reached other units |
| Culture and speak-up | Hierarchy and blame silence the person with the answer | Test whether staff challenge seniors and report errors; from 15 December 2026 the IIA’s Organizational Behavior Topical Requirement applies to assurance engagements on the topic; the topical requirement guide and the Fearless Organization summary cover the method |
| Evaluating programmes and pilots | Interventions that feel right can do harm; test against a control | Ask what evidence, other than testimony, shows a programme works before relying on it as a control |
| Key risk indicators | Near misses are the cheapest information an organisation gets | Treat near-miss and report volumes as indicators, and treat a sudden fall as a question, not good news; the KRI programme guide covers design |
| Accountability and discipline | Blame destroys the data, and harms the second victim | Test whether learning reviews and disciplinary processes are separated, and whether reporters were disciplined for what they reported |
| The function’s own quality programme | The audit function is a system that fails too | Run post-engagement reviews of misses; log corrected reports under Standard 11.4 and ask how each error happened; use internal assessments under Standard 12.1 to test the loop; the QAIP playbook gives the structure |
Two cautions follow from the book’s own argument. The first is that an audit function which reports a failure has joined the blame game unless its report says what in the system allowed the failure; a finding that names a person and stops is, in the book’s terms, a closed loop with the auditor’s signature on it. The second is that an audit function’s credibility on this subject depends on its own record. A chief audit executive who asks management to learn from its failures should be able to show the audit committee how the function learns from its own: the findings it missed, the reports it had to correct and the recommendations whose implementation did not stop the problem. The internal self-assessment guide describes how to make that evidence routine.
The criticisms, the later research and what the book leaves out
The reviews we were able to read were favourable, and we could not obtain the major newspaper reviews, so the criticisms below come mainly from later research and from the record since 2015. They do not undermine the book’s central argument, but several of them change how an auditor should use it. The first concerns the headline number. The American publisher’s description presents preventable medical error as killing more than 400,000 Americans a year, a figure one reviewer traces to a 2013 study in the Journal of Patient Safety. Estimates of that kind have been disputed: Shojania and Dixon-Woods argued in BMJ Quality and Safety in 2017 that the extrapolations behind the claim that medical error is the third leading cause of death in the United States did not follow the methods of quantitative synthesis and could not separate deaths caused by care from deaths of very sick patients, and a 2020 review led by Benjamin Rodwin in the Journal of General Internal Medicine, which started from hospital deaths and worked back, put preventable inpatient deaths at about 22,000 a year. Avoidable harm is serious at any of these numbers; the lesson for auditors is not to carry a contested headline figure into a risk assessment when the organisation’s own data are available.
The second concerns the analogy itself. A 2016 comparative review in JRSM Open by Kapur and colleagues found that aviation-based safety methods have had mixed acceptance in healthcare: aviation’s focus on human factors, teamwork training and safety culture is beneficial, but organisations need to allow for what is different about medicine. Aviation’s own record since 2015 is a reminder that the model the book admires can fail too. In January 2021 Boeing entered a deferred prosecution agreement with the US Justice Department, agreeing to pay more than $2.5 billion, after two of its 737 MAX technical pilots deceived the Federal Aviation Administration’s evaluation group about the system known as MCAS; two 737 MAX aircraft had crashed in October 2018 and March 2019, killing 346 people. In November 2025 the charge was dismissed at the department’s request under a later non-prosecution agreement. The guide’s reading is that a learning system is only as good as the information people choose to feed it. The third concerns the psychology of the final part. Later meta-analyses of growth-mindset interventions in education have found small effects: Brooke Macnamara and Alexander Burgoyne reported in Psychological Bulletin in 2023 that the best-designed studies showed no significant effect on academic achievement, while a review led by Jeni Burnette the same year found small effects for the students expected to benefit most when the intervention was delivered faithfully. An audit function should therefore treat a growth-culture programme as an intervention to be evaluated, which is the book’s own lesson from Scared Straight.
| Point | What later work or events showed | What it changes for an auditor |
|---|---|---|
| The scale of preventable deaths | The 400,000 figure and the “third leading cause” claim were disputed in 2017; a 2020 review estimated about 22,000 preventable inpatient deaths a year | Use the organisation’s own harm data, not contested national figures, in risk assessments |
| The aviation analogy | A 2016 review found mixed acceptance of aviation methods in healthcare; the 737 MAX case showed aviation’s own system failing where information was withheld from the regulator | Test whether a learning system is fed accurate information, not only whether it exists |
| Growth mindset | 2023 meta-analyses found small or, in the best-designed studies, no significant effects on achievement | Ask for evidence that a culture programme changed behaviour |
| Marginal gains in sport | A 2018 parliamentary committee found Team Sky’s medical record-keeping had failed and that a practice within the rules had crossed the team’s own ethical line | Performance programmes need records and ethical boundaries as well as measures |
| Blame in law | In 2022 a former Vanderbilt nurse was convicted of criminally negligent homicide for a 2017 medication error; nursing groups warned the prosecution would discourage honest reporting | The blame game can be played by prosecutors and regulators as well as employers; reporting cultures need to be tested against that pressure |
For an audit function the hardest practical questions sit between the book’s chapters. The first is the line between learning and accountability: an organisation that stops blaming individuals for system failures still has to deal with the rare case of reckless or deliberate conduct, and needs a principled way of telling the two apart; the Field Guide summary covers Dekker’s treatment of that problem. The second is proportionality, how an organisation decides which of its thousands of failures deserve a full investigation. The third is the legal setting in which incident information is created, which in American healthcare includes malpractice litigation, which the book discusses, and, as the Vaught case showed after its publication, criminal prosecution. A further criticism, which is ours, is that the book’s success stories are organisations that learned, which leaves open how many tried similar methods without the same result. For an auditor these questions are where the audit work starts: the triage of incidents, the line between learning and discipline, and the evidence that the learning happened.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| UK first edition | John Murray, hardback on sale 10 September 2015, subtitled The Surprising Truth About Success | The original British text |
| US first edition | Portfolio (Penguin), 3 November 2015, subtitled Why Most People Never Learn from Their Mistakes—But Some Do; xi and 322 pages in the library record | American readers; the edition whose contents this guide uses |
| Audiobook | Unabridged, 3 November 2015, read by Simon Slater; 12 hours 14 minutes in the publisher’s listing | Listening; the cases work well as stories |
| UK paperback | John Murray, 7 April 2016, subtitled Marginal Gains and the Secrets of High Performance | The edition many British readers own |
| Tenth-anniversary edition | John Murray paperback, 25 September 2025, subtitled Growth Mindset and the Secrets of High Performance, with new material from the author | The current British edition |
| Reading plan | The Logic of Failure, Cognitive Dissonance and The Blame Game first, for the argument, the psychology and blame; Confronting Complexity for testing; Small Steps and Giant Leaps and Creating a Growth Culture as interest allows | An auditor with two evenings |
| Companion reading | The Field Guide summary for investigation method; the Checklist Manifesto summary for aviation-style tools in medicine; the Fearless Organization summary for speaking up; the Superforecasting summary for Tetlock’s work on prediction | Placing the argument |
Read it with the organisation’s issue log beside you. For each part, ask which of the open findings it explains: the findings whose cause is a person, the issues closed on the evidence of an action, the programmes trusted on testimony. The book’s cases are vivid and the argument moves quickly, which makes it a good choice for a team that does not usually read about method; its main limitation for an auditor, the distance between the aviation model and the messier settings most auditors work in, is easy to correct with the companion reading above.
A one-hour discussion guide for an audit team
- Ten minutes: the loop. Take the function’s issue log and count the issues closed in the last year whose problem has since recurred. Decide whether the log is an open loop or a closed one.
- Fifteen minutes: the causes. Read the cause statements of the last ten findings aloud. Mark each one that names a person or says “did not follow procedure”, and rewrite one of them to name the system condition instead.
- Ten minutes: dissonance. Name an area the function has rated well controlled for three years or more. Ask what evidence would change the rating, and whether anyone has looked for it.
- Fifteen minutes: management’s loop. Pick one incident or complaint process the organisation relies on and trace one serious case from report to verified change, noting where the loop could break.
- Ten minutes: the plan. Decide whether a review of how the organisation learns from failure belongs in the 2027 plan, and whether the function will run a post-engagement review of its own most significant miss; the QAIP playbook covers the second.
Worked example: Ashgrove Health System audits how it learns from harm
Ashgrove Health System is a fictional US nonprofit with five hospitals, $2.1 billion of revenue and an internal audit function of twelve. In its 2027 plan the chief audit executive proposed a review with the book’s question as its objective: when something goes wrong in an Ashgrove hospital, does the system learn? The audit and compliance committee agreed, partly because the hospitals had attested in 2026 to patient safety practices under the CMS Patient Safety Structural Measure for 2025, and the committee wanted to know whether the practices behind the attestations operated. The function scoped the review around the loop: capture of safety events, investigation of serious ones, the actions taken, whether the actions worked, and what happened to the people involved. It then applied the same tests to its own issue log.
| Test | What the function found | Result |
|---|---|---|
| Is failure captured? | The five hospitals logged 16,400 safety event reports in 2026. Reporting per 1,000 patient days ranged from 41 at the highest-reporting hospital to 9 at the lowest, and the lowest-reporting hospital had the highest rate of harm events found by the quality team’s chart reviews | Finding: reporting rates by unit added to the patient safety dashboard, with low reporting treated as a trigger for review rather than as good news |
| Are serious events investigated? | Of 52 serious safety events, 47 had a root cause analysis; the median time to complete was 61 days against the system’s own policy of 45, and 31 of the 47 reviews were led by a manager from the unit where the event occurred | Finding: reviews of serious events led from outside the unit, with completion time reported to the committee |
| Do the actions address causes? | The 47 reviews produced 188 actions; 109 (58 percent) were training, reminders or policy revisions, and 21 (11 percent) changed the system, for example by standardising equipment or removing look-alike products | Finding: an action-strength rating added to the review template, with weak actions requiring a stated reason |
| Did the actions work? | Eight of the 52 serious events (15 percent) repeated a type of event for which a review had been completed in the previous two years; in six of the eight the earlier actions had been closed on the evidence of a training attendance list | Finding (high): closure of actions after serious events to require evidence that the risk changed, tested by the quality team after six months |
| Is reporting protected? | In 9 of the 47 cases, disciplinary action against an individual began before the review was complete; the review policy did not mention discipline. Of 60 reporters sampled, 14 (23 percent) had heard what happened to their report | Finding: learning reviews separated from disciplinary decisions, with a defined test for reckless conduct; feedback to reporters made part of closure |
| Are the people involved supported? | A peer-support programme for staff after serious events existed at one hospital; staff interviewed at the other four did not know of it | Observation: the programme extended system-wide, with uptake reported quarterly |
| Does the function learn? | Of the function’s 58 findings in 2026, 17 (29 percent) repeated a finding from an earlier audit of the same area, and 12 (21 percent) gave the cause as human error, oversight or failure to follow policy. One 2026 report had been reissued to correct a significant error, as Standard 11.4 requires, but nobody had reviewed how the error happened | Internal actions: cause statements reviewed before issue; a repeat-finding analysis added to the annual report to the committee; a post-engagement review of the corrected report |
The review produced five findings and one observation for management and three changes inside the function. Its effect came less from any single finding than from the way it was framed. The chief audit executive presented the results to the committee as a loop with five points at which it could break, and showed for each where Ashgrove’s had broken in 2026: low reporting at one hospital, reviews led by the unit under review, actions that changed paperwork rather than practice, actions closed without evidence, and discipline that started before the learning was done. The committee chair asked for the repeat-event rate and the action-strength mix to become standing measures, and the chief medical officer, who had expected an audit of compliance with the review policy, said it had turned out to be an audit of whether the policy did anything.
The function’s own section was the part the committee discussed longest. Seventeen repeat findings out of fifty-eight meant that, by its own test, the function’s loop was partly closed, and twelve cause statements that stopped at human error meant its reports had sometimes played the blame game the review criticised in others. Reporting both alongside the findings for management gave the function the standing to ask for the changes. The example also carries a caution from the criticisms above: the function did not import a national estimate of avoidable deaths into its risk assessment, but used Ashgrove’s own event, review and chart-review data, which were more useful and could not be disputed. The healthcare internal audit guide covers the wider audit universe of a hospital system, and the culture audit guide covers the speak-up testing.
Frequently asked questions
What does “black box thinking” mean?
It is Syed’s name for treating failure as information: recovering the data on what went wrong, examining it independently and without looking for a scapegoat, and changing the system so that it does not happen again, as air accident investigators do with flight recorders.
Is the book only about aviation and healthcare?
No. Those are its main contrast, but it also uses criminal justice, politics, business, product design and sport, from wrongful convictions and the Iraq war to Unilever, Dyson, Dropbox and the Sky cycling team.
Which edition should I read?
Any of them carries the argument. The tenth-anniversary British edition of September 2025 is the current one and its publisher says it adds new material, which we have not seen; this guide’s structure table follows the American first edition of 2015.
How does it relate to Dekker and Edmondson?
Sidney Dekker’s Field Guide gives the investigator’s method for looking past human error, and Amy Edmondson’s Fearless Organization explains why people speak up or stay silent. Syed’s book makes the popular case for the same change in attitude to failure. The Field Guide summary and the Fearless Organization summary cover both.
Is the 400,000 deaths figure reliable?
It is disputed. Researchers argued in 2017 that such estimates were built on weak extrapolation, and a 2020 review put preventable inpatient deaths in the United States at about 22,000 a year. Avoidable harm is serious at either figure, but an audit should rely on the organisation’s own data.
Where does the book sit in the reading list?
With the books on error, safety and learning from failure; the internal audit reading list organises the books it recommends by theme and career stage.
Related guides
- The Field Guide to Understanding ‘Human Error’ by Sidney Dekker: Summary for Auditors — the investigator’s method for looking past the person
- The Fearless Organization by Amy Edmondson: Summary and Lessons for Auditors — why people report failures or stay silent
- The Checklist Manifesto by Atul Gawande: Summary and Lessons for Auditors — aviation-style tools in medicine
- Root Cause Analysis for Audit Findings: 5 Whys Worked Examples — finding the system cause behind a finding
- Issue Validation in Internal Audit: Evidence and Closure — closing the loop with evidence
- Internal Audit in Healthcare: The Complete Guide for Providers and Payers — the setting of the worked example
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
Leave a Reply