Sidney Dekker’s The Field Guide to Understanding ‘Human Error’ is a practitioner’s handbook for anyone who has to explain why something went wrong in an organisation and decide what to do about it. Its third edition, published at the end of 2014, is built on a contrast between two ways of looking at failure. In what Dekker calls the Old View, human error is the cause: a basically safe system is let down by a few unreliable people, and the response is to find them and then retrain them, discipline them or write another procedure. In the New View, human error is a symptom: people’s actions make sense once the conditions they were working in are understood, and the investigation starts at the point where the Old View stops. The book turns that argument into a method, with chapters on containing one’s own reactions to a failure, on running an investigation, on explaining the patterns behind breakdowns, on the accident model an organisation holds without realising it, and on safety departments, safety culture and the temptation of the quick fix. For an internal auditor the book is closer to home than its aviation and healthcare examples suggest. Every audit finding needs a cause, and a cause statement that reads ‘human error’ or ‘staff did not follow the procedure’ is exactly the Old View conclusion the book takes apart. Management’s incident investigations are a regular subject of audit review. And the reactions Dekker describes in people who look back at a failure are the reactions an audit team has when it finds a control that did not work. This guide summarises the book without reproducing it, sets out its method, maps it to audit practice, and ends with a worked example of a water authority’s audit function reviewing an operational incident investigation.
In this guide
- The book in one page
- Who Sidney Dekker is, and how the book came about
- The structure: eight chapters and an epilogue
- The two views of human error
- Reactions to failure and the six steps of an investigation
- Patterns, accident models, safety departments and culture
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: a practice-by-practice map
- The criticisms, and what the book leaves out
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Millbrook Regional Water Authority reviews an incident investigation
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is the book? | A compact practical guide to investigating failures and responding to them without stopping at the people closest to the event. It first appeared in 2002 under a different title; the third edition of 2014 has eight chapters and an epilogue across 248 pages. |
| What is the central argument? | That there are two views of “human error”. The Old View, which Dekker also calls the Bad Apple Theory, treats it as the cause of trouble in an otherwise safe system. The New View treats it as a symptom of conditions deeper inside the system, and as the point at which an investigation begins rather than ends. |
| Why is the Old View so natural? | Because of four reactions that anyone looking back at a failure tends to have: judging with knowledge of the outcome that the people involved did not have, describing what they should have done instead, condemning them for not doing it, and concentrating on whoever was nearest to the event. |
| What is the method? | Six steps: gather data on the tools, tasks and situation of the people involved; build a timeline; put the data in context; leave a trace that others can check; construct causes from the evidence; and make recommendations that follow from it. |
| What does it say about organisations? | That an organisation’s safety work follows from the accident model it holds; that a safety department can become a bureaucracy that takes safety away from the people who do the work; that “safety culture” means different things depending on whether one believes a culture can be built; and that discipline, retraining, a new procedure and more technology are quick fixes that leave the conditions in place. |
| Why read it as an auditor? | Because audit findings need causes, because management’s incident reviews and post-mortems are audit subjects, because an audit team’s own reactions to a failed control are the reactions the book describes, and because its treatment of accountability applies to how findings are written, rated and followed up. |
| Reading time | 248 pages; O’Reilly’s platform puts the reading time at just under seven hours. The first three chapters carry the method and are the ones to read slowly. |
Who Sidney Dekker is, and how the book came about
Dekker is a human factors specialist. He took his doctorate at Ohio State University in 1996 and was professor of human factors and system safety at Lund University in Sweden before moving to Griffith University in Brisbane, where he is professor and director of the Safety Science Innovation Lab. After becoming a full professor he trained on the Boeing 737 and flew part-time as an airline pilot based in Copenhagen, and his own website now describes him as a professor, author, pilot and chaplain. He has written widely on the same ground: his publisher lists Drift into Failure (2011), Patient Safety (2011), Just Culture (2012), Second Victim (2013) and Safety Differently (2014) among his books, and his other titles include Foundations of Safety Science, Stop Blaming and Restorative Just Culture in Practice. The Field Guide is the practical end of that body of work: the book a safety manager, investigator or supervisor can use on Monday morning.
The book has been through three versions. It began in 2002 as The Field Guide to Human Error Investigations, a short book in two parts: the first on human error as a cause of mishaps, the second on human error as a symptom of trouble deeper inside the system, with the second part showing how to reconstruct the circumstances that shaped people’s assessments and actions. In 2006 Ashgate published a revised edition under a new title, The Field Guide to Understanding Human Error, laid out as twenty-one short chapters running from the Bad Apple Theory to a set of reminders for investigators. The third edition of 2014 put “human error” in quotation marks in the title and reorganised the material into eight longer chapters and an epilogue, with new chapters on safety culture and on improving the investigation process. Dekker notes in the epilogue that the Field Guide has been promoting its process-tracing approach since the 2002 edition. Ashgate published the third edition in Farnham and Burlington; it is now listed by CRC Press, which released the ebook in 2017. On the guide’s reading, the quotation marks in the title are the thesis in punctuation: “human error” is a label someone attaches after the event, not a thing an investigator finds.
The structure: eight chapters and an epilogue
| Chapter (start page) | What it covers | What it contributes |
|---|---|---|
| 1. Two Views of ‘Human Error’ (p. 1) | The Old View, or Bad Apple Theory, and the New View; the idea of accident-prone workers; what accountability means under the New View, including confidential reporting, implementing a just culture and moving from backward-looking to forward-looking accountability | The frame for everything else |
| 2. Containing Your Reactions to Failure (p. 27) | The four reactions to failure (retrospective, counterfactual, judgmental and proximal), followed at once by the 2001 collision between a US Navy submarine and a Japanese fishing vessel off Hawaii | Why investigators reach the Old View without meaning to |
| 3. Doing a ‘Human Error’ Investigation (p. 45) | Six steps from gathering human factors data to making recommendations; what investigations are for | The method |
| 4. Explaining the Patterns of Breakdown (p. 89) | Six recurring patterns, among them cognitive fixation, plan continuation and procedural adaptation; why “loss of situation awareness” and “complacency” are best avoided as explanations | A vocabulary for causes that is not blame |
| 5. Understanding Your Accident Model (p. 123) | Four models or families of models: chain of events, barriers, systems and drift; also the “triangle” idea and the threat-and-error model | Why an organisation’s safety work follows from where it thinks risk comes from |
| 6. Creating an Effective Safety Department (p. 143) | What a safety function should do and where it should sit; the risks of a small department and of a bureaucratic one; bureaucratic accountability | The design of the function that investigates |
| 7. Building a Safety Culture (p. 161) | Two views of safety culture, the interpretivist and the functionalist; safety culture understood as an absence of negative events | Whether culture can be built, and what is being measured when it is |
| 8. Abandoning the Fallacy of a Quick Fix (p. 191) | Why pressure for fast closure leads to discipline, retraining, a new procedure or more technology | The test for recommendations |
| Epilogue: Speaking for the Dead (p. 209) | Whether the reasoning of practitioners can be reconstructed when they cannot be interviewed | The limits of the method |
One practical note for readers who look the book up: the publisher’s web page for the third edition displays the twenty-one chapter headings of the 2006 edition. The eight chapters above are the third edition’s contents as listed by Google Books and by O’Reilly, which carries the CRC Press ebook. Readers working from a second-hand 2006 copy will find most of the same ideas, but in a different order and without the safety culture chapter.
The two views of human error
The first chapter states the Old View in its strongest form. Complex systems would be safe, it holds, if it were not for a minority of unreliable people inside them; human error causes most accidents; failures are surprises that enter an otherwise sound system through people’s inherent unreliability; and the bad apples are the ones who do not follow the rules or pay enough attention. The response follows from the diagnosis. People are treated as a problem to be controlled, and their behaviour is shaped by posters, campaigns and sanctions, which the preface lists as the Old View’s usual tools. Its appeal, on the guide’s reading, is that it is cheap, quick and satisfying: once the person is found, the system is exonerated and the investigation can close.
The New View reverses each step. Human error is a symptom of trouble deeper inside the system, connected to the tools people were given, the tasks they were asked to do and the environment in which they did them. It is the starting point of an investigation. The question changes from who was responsible to what was responsible. And safety is understood differently: it is not a property of a well-designed system that people threaten, but something people create in their daily work by balancing safety against other goals with the resources they have. One review of the third edition singles out the local rationality principle: people do what makes sense to them given their goals, their focus of attention and their knowledge at the time, so that an action which looks inexplicable afterwards is a sign that the investigator has not yet understood the situation. The same review notes the book’s distinction between the sharp end, where people are closest to the event, and the blunt end, the wider organisation behind them, which in an audit means the people who set budgets, targets, staffing and system design.
| Question | The Old View | The New View | What it means for an audit finding |
|---|---|---|---|
| What is the error? | The cause of the failure | A symptom of conditions in the system | A cause statement cannot stop at the person |
| Who or what is responsible? | Who: the person who erred | What: the tools, tasks, pressures and environment | The finding names the condition as well as the role |
| Where does safety come from? | From a basically safe system protected against unreliable people | From people making the system work under competing goals and limited resources | A control that “works” may depend on undocumented workarounds |
| When does the investigation end? | When the error is found | It starts there, and asks why the action made sense | Fieldwork continues past the first exception |
| What is the response? | Posters, campaigns, sanctions, more rules | Change the conditions that shaped the action | Recommendations address conditions, not only people |
The first chapter also sets out the book’s position on accountability. Its index shows the ground covered: the idea of accident-prone workers, the mismatch between accountability and responsibility, a systems approach to accountability, new models of accountability, storytelling, confidential reporting systems, the practical implementation of a just culture, and a move from backward-looking accountability, broadly the question of who is to blame for what happened, to forward-looking accountability, the question of who will do what so that it is less likely to happen again. Dekker’s books on just culture and restorative approaches develop the theme at length; the Field Guide gives the investigator enough of it to resist the demand for a culprit. The culture audit guide and the guide to the organisational culture topical requirement are the places to start for an audit function that wants to test whether a stated just culture survives contact with the disciplinary process.
Reactions to failure and the six steps of an investigation
The second chapter begins by naming the four reactions that anyone looking back at a failure is prone to, and argues that understanding failure begins with recognising them in oneself. It then turns to the February 2001 collision off Oahu between the US Navy submarine USS Greeneville and the Ehime Maru, a Japanese fishing vessel used as a high-school training ship, in which nine people died; the National Transportation Safety Board later placed the probable cause in inadequate interaction and communication among the submarine’s senior combat systems team and in the commanding officer’s decision to order an emergency surfacing manoeuvre. The reactions are not, on this account, the faults of bad investigators but what knowing the outcome does to anyone, and an auditor reading a failed reconciliation in a sample has all four.
| Reaction | What it is | How it shows in audit work | The discipline that contains it |
|---|---|---|---|
| Retrospective | Looking back at a sequence of events knowing how it ended, which the people involved did not know | The exception is obvious in the sample; it was not obvious in the queue of work that day | Reconstruct what was visible at the time from the system, the logs and the records of that day |
| Counterfactual | Setting out what people could or should have done to avoid the outcome | Conditions written as “the reviewer should have identified…” | Replace “should have” with what the person saw, did and why it made sense |
| Judgmental | Judging people for not doing what now seems necessary, or not noticing what now seems important | Evaluative words in the finding: careless, inadequate, failed to | Strip adjectives from the condition; the guide to writing conditions sets out the discipline |
| Proximal | Concentrating on the people closest in time and place to the event | The finding stops at the preparer and the reviewer | Ask what the blunt end contributed: staffing, targets, system design, the budget for the fix |
The third chapter is the method, and its value for auditors is that it is written as a primer rather than a specialist text. It sets out six steps intended to turn “human error” from something vague and speculative into something gathered and verifiable, with conclusions and recommendations that follow. The first is to gather human factors data, looking at how the people’s tools and tasks shaped what they did rather than only at the people. The second is to build a timeline. The third is to put the data in context, so that each action is read against what the person could see and was trying to achieve at that moment. The fourth is to leave a trace: to record the reasoning so that others can follow and check it. The fifth is to construct causes from the evidence; the 2006 edition had a chapter titled to the same effect, that cause is something the investigator constructs rather than finds. The sixth is to make recommendations that follow from those causes. The chapter also discusses what investigations are for, a question that matters when an organisation uses the same report to learn, to discipline and to satisfy a regulator.
| Step | What the step asks for | The audit equivalent |
|---|---|---|
| Gather human factors data | How tools, tasks and the situation shaped people’s actions | Walkthrough evidence about the system screens, queues, volumes and workarounds, not only the policy; see the walkthrough guide |
| Build a timeline | A sequence of what happened, what people knew and what they did | A dated reconstruction of the exception from logs, emails and system records |
| Put data in context | Each action read against what was visible and what the person was trying to do | Interview questions about what the screen showed and what else was happening that day |
| Leave a trace | Reasoning recorded so that others can follow and check it | Workpapers that let a reviewer re-perform the reasoning; see the workpaper practices guide |
| Construct causes | Causes built from the evidence, stated as conditions | The cause statement in the finding; see the cause statement guide |
| Make recommendations | Changes that follow from the causes | Recommendations that change the conditions; see the recommendations guide |
The fit with audit methodology is close but not exact. The root cause guide and its five whys ask the auditor to keep asking until a process cause is reached; Dekker’s method puts the reconstruction first: the situation as it looked from inside is rebuilt before causes are constructed, because a why asked from outside, with the outcome known, is the retrospective reaction the second chapter warns against. The Global Internal Audit Standards define root cause in their glossary as the core issue or underlying reason for the difference between criteria and condition, a definition that leaves room for exactly the inquiry the book describes, and the guide to Domain V sets out what the Standards require of engagement work and findings.
Patterns, accident models, safety departments and culture
The fourth chapter gives investigators a vocabulary for explaining what went wrong without moralising. It describes six patterns that recur in breakdowns: cognitive fixation, in which people lock onto one interpretation of a situation; plan continuation, in which they carry on with a plan after conditions have changed; fatigue; buggy or inert knowledge, which is either wrong or present but not available when needed; new technology and computerisation, and the way automated tools reshape work; and procedural adaptations, the ways people modify written procedures in practice. It then takes on two popular explanations, “loss of situation awareness” and “complacency”, and advises investigators not to rely on them as explanations. It also accepts that the results of such an analysis can remain open to interpretation, since the data about what people were doing and thinking is limited. An audit report that attributes a control failure to “lack of attention” has made the same move as an accident report that blames complacency, and the remedy is the same: describe what drew the person’s attention elsewhere.
The fifth chapter is the one an audit function should read before its annual planning. Its premise is that the kind of safety work an organisation does depends on where it locates its biggest sources of risk, and that this in turn depends on its accident model, usually held without being stated. The chapter presents four models, or families of models. The table describes them in outline, in the guide’s words, with the audit plan each tends to produce.
| Model family | In outline | Where it tells you to look | The audit plan it tends to produce |
|---|---|---|---|
| Chain of events | Dating from the 1930s, the accident as a linear sequence of errors, failures and violations | The broken link, often the last human act before the loss | Findings that end at the person; root cause work that stops at the first why |
| Barrier models | Hazards become losses when protective barriers are breached; defences are layered (the family that includes James Reason’s “Swiss cheese” picture) | The defences and the holes in them | Control-by-control testing; the question is whether layered controls are independent or share a weakness |
| Systems models | The accident as a product of interactions across the system, including its organisation, rather than of one failed part | Interactions, goal conflicts and feedback between parts | Process-level and entity-level work; assurance mapping across the three lines |
| Drift | A gradual movement towards the boundary of safe operation through small adaptations, each sensible at the time | How normal work has changed over months and years | Trend analysis, repeat findings, and the exception that is “how it has always been done” |
An audit function that has never asked which model it holds can usually find the answer in its reports. A function whose findings read as lists of failed controls with named owners holds a barrier model at best and a chain-of-events model at worst; one that reports trends, interactions between processes and the slow erosion of a control’s design is using the later families whether or not it calls them by name. The Normal Accidents summary covers Charles Perrow’s systems argument, which belongs to the third family, and the Three Lines Model guide covers how assurance is divided across the organisation.
The last three chapters move from the investigation to the organisation that commissions it. The sixth asks what a safety department should do and where it should sit, noting that the answers differ by industry, that many hospitals until recently had little meaningful safety function, and that Dekker’s own airline ran its safety department with one person. A lean department, he argues, guards against bureaucratic safety, in which people assume that safety belongs to the safety staff and can be left out of their operational work; but it can leave the organisation short of knowledge and unable to respond when incidents happen. The parallel with the second and third lines is direct: a risk function or an audit function that grows large enough to own the subject can teach management that the subject belongs to someone else. The seventh chapter applies the two-views idea to safety culture, contrasting an interpretivist view with a functionalist one and showing that which of them a reader holds decides whether a safety culture can be built, or even identified as a distinct thing at all; it also examines the idea of safety culture as an absence of negative events. The eighth names the quick fixes that pressure for fast closure produces: disciplining the people involved, retraining them, writing a new procedure and adding a little more technology. Each is, in the book’s terms, an Old View countermeasure, and none of them, on the guide’s reading, changes the conditions that produced the event.
The nine ideas worth keeping
- “Human error” is where an investigation starts. A finding that ends with a person has stopped at the point where the useful work begins.
- People do what makes sense to them at the time. If an action looks inexplicable, the investigator has not yet understood the situation; the job is to find out why it made sense.
- Knowing the outcome distorts the view. The retrospective, counterfactual, judgmental and proximal reactions are universal; the defence is to recognise them in oneself before writing.
- “Should have” describes what did not happen. Counterfactuals say nothing about why what did happen happened; they belong in the recommendation, not the cause.
- Look at the blunt end. Budgets, staffing, targets, design and the backlog of known problems shape the sharp end; a cause analysis that never reaches them is incomplete.
- Labels are not explanations. “Complacency”, “loss of situation awareness” and, in audit, “lack of attention” relabel the event; describe what the person was attending to instead.
- The accident model decides the safety work. Where an organisation thinks risk comes from determines what it monitors, and the same is true of an audit plan.
- Quick fixes leave the conditions in place. Discipline, retraining, another procedure and more technology are the four the book names; each is cheap to propose and rarely changes what produced the event.
- Accountability can look forward. Asking who will do what so that the event is less likely to recur produces more learning, and more reporting, than asking who is to blame.
The vocabulary: fourteen terms defined for practitioners
| Term | What Dekker means | What it looks like in an audit |
|---|---|---|
| Old View | Human error as the cause of failure in an otherwise safe system | A finding whose cause is a person or a role |
| Bad Apple Theory | Dekker’s other name for the Old View: remove the unreliable few and the system is safe | A recommendation to “remind staff” or take disciplinary action |
| New View | Human error as a symptom of conditions in the system and the start of an investigation | A cause statement that names the condition behind the action |
| Local rationality | People do what makes sense given their goals, attention and knowledge at the time | The interview question: what did you see, and what were you trying to do? |
| Retrospective reaction | Judging events with knowledge of the outcome | Hindsight in the workpaper; the exception that was not visible on the day |
| Counterfactual | An account of what should have happened instead | “Should have” in a condition statement |
| Judgmental reaction | Condemning people for not doing what now seems necessary | Evaluative adjectives in a finding |
| Proximal reaction | Concentrating on those nearest to the event | Findings that stop at the preparer and reviewer |
| Sharp end and blunt end | Those closest to the event, and the organisation that sets their conditions | Process owners versus the managers who fund, staff and design the process |
| Cognitive fixation | Locking onto one interpretation of a situation | A reviewer who checks the expected error and misses a different one |
| Plan continuation | Carrying on with a plan after conditions have changed | A project that keeps its go-live date after its testing has slipped |
| Procedural adaptation | The ways people modify written procedures in practice | The gap between the walkthrough and the policy |
| Drift | Gradual movement towards failure through locally sensible adaptations | A control whose design has eroded over years without a decision to change it |
| Just culture | An approach to accountability designed to keep people reporting and learning while still dealing with unacceptable conduct | Whether people report near misses, and what happens when they do; see the culture topical requirement guide |
What it means for internal audit: a practice-by-practice map
The book was written for safety investigators, but internal audit does a version of their work in almost every engagement: it finds that something did not happen as it should, explains why, and recommends what should change. The table maps the method to the audit activities where it changes practice. In May 2018 Joshua Rosenberg, then chief risk officer of the Federal Reserve Bank of New York, made the same case to a risk conference in terms an audit committee would recognise: root cause analysis should not stop at human error, investigations should look at organisational factors, and organisations should study why processes succeed as well as why they fail. The root cause guide, the operational risk guide and the incident response audit guide carry the surrounding procedures.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Writing the cause of a finding | Human error is a symptom; the cause is the condition that made the action sensible | No cause statement may end at “human error”, “oversight” or “failure to follow procedure” without stating the conditions; see the cause statement guide |
| Reviewing management’s incident investigations | A good investigation reconstructs the situation, builds a timeline and leaves a trace | Test the report against the six steps: is there a timeline, is the reasoning recorded, do the recommendations follow from the causes? |
| Root cause analysis | A why asked from outside, with the outcome known, stops at the person | Reconstruct what was visible at the time before running the five whys |
| Testing controls that failed | Procedural adaptation is normal work, not deviance | Compare the walkthrough with the written control and record the adaptations before testing the exceptions |
| Evaluating recommendations and action plans | Discipline, retraining, a new procedure and more technology are quick fixes | Challenge action plans that consist only of these; the guide to evaluating management responses gives the method |
| Assessing culture and reporting | Forward-looking accountability produces reporting; blame suppresses it | Compare near-miss reporting rates with disciplinary outcomes; read three closed investigations for how accountability was handled |
| Evaluating the second line | A safety or risk department can make safety someone else’s job | Ask whether operational managers own their risk work or have handed it to the risk function; the guide to auditing the operational risk function covers the review |
| The function’s own quality programme | Auditors have the same four reactions as investigators | Add a review-note check for counterfactual and judgmental language in draft findings; see the QAIP playbook |
Two cautions keep the map honest. The first is that the New View does not make every exception a system problem. Some people do act recklessly or in bad faith, and an audit function that has absorbed the book still has to find them; the difference is that it reaches that conclusion after reconstructing the situation, not instead of doing so. The fraud risk guide describes the cases in which intent is the explanation. The second is that the method takes time. A full timeline and reconstruction is proportionate for a significant finding or an incident with real consequences, and excessive for a missing signature in a sample of forty; the function has to decide, as the finding severity guide does for ratings, where the threshold sits.
The criticisms, and what the book leaves out
The obvious objection to the New View is that it lets people off. Dekker’s answer, developed in the first chapter’s treatment of accountability and in his books on just culture, is that the New View changes what accountability means rather than abolishing it, and that an organisation which punishes people for honest mistakes stops hearing about them. The answer is persuasive for errors made in good faith inside a system that shaped them; it is less complete for regulated environments in which individual accountability is written into law or supervisory rules, and an auditor in such an environment has to hold both ideas at once.
A second limitation, which one reviewer of the third edition notes, is that the book is written for high-stakes industries such as aviation and healthcare, where investigations follow events that are visible and often tragic. Most audit findings are smaller and quieter, and the reader has to translate. A third, on the guide’s reading, is that the method is built for explaining an event, and an audit function that wants to weigh many small failures, to judge whether a pattern is signal or noise, will need other tools, which is where the KRI programme guide and audit analytics take over. A fourth is that the six steps assume access to the people involved and to records of what they saw; the epilogue itself takes up the case in which the people cannot be interviewed, and in many organisations the records of what was on a screen at a given moment do not exist unless someone decided in advance to keep them. None of these weakens the book’s central argument. They mark where the auditor has to supply the rest.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| First edition (2002) | The Field Guide to Human Error Investigations, in two parts: human error as a cause, and human error as a symptom | The origin of the method; superseded |
| Second edition (2006) | The Field Guide to Understanding Human Error, Ashgate, Aldershot; xv plus 236 pages; twenty-one short chapters | Readers with an older copy; most ideas are there in a different order |
| Third edition (2014) | The Field Guide to Understanding ‘Human Error’, Ashgate, Farnham and Burlington; 248 pages; eight chapters and an epilogue; now listed by CRC Press, ebook 2017 | The edition to buy |
| Reading time | O’Reilly’s platform estimates just under seven hours for the third edition | Two or three evenings |
| Reading plan | Chapters 1 to 3 slowly and in order; chapter 5 before the annual plan; chapters 6 to 8 for audit leaders; the epilogue last | An audit manager who writes or reviews findings |
| Companion reading | The Normal Accidents summary for the systems argument; the Checklist Manifesto summary for procedure design; the Thinking, Fast and Slow summary for the psychology of hindsight | Placing the method |
A one-hour discussion guide for an audit team
- Ten minutes: the last ten causes. Pull the cause statements from the function’s last ten issued findings. Count how many end at a person, a role or “failure to follow procedure”.
- Fifteen minutes: the four reactions. Take one draft finding and mark every retrospective, counterfactual, judgmental and proximal phrase. Rewrite the condition without them and compare the two versions.
- Ten minutes: the model we hold. Decide which of the four accident models the function’s reports imply. Name one area of the plan where a different model would change what is tested.
- Fifteen minutes: an investigation we rely on. Choose one management incident investigation the function has relied on in the last year and test it against the six steps. Was there a timeline? Was the reasoning recorded? Did the recommendations follow from the causes?
- Ten minutes: the change. Agree one change to the finding template or the review checklist, and one engagement in the next plan where the method will be applied in full; the risk assessment guide describes how to record the reasoning.
Worked example: Millbrook Regional Water Authority reviews an incident investigation
Millbrook Regional Water Authority is a fictional statutory water body serving 1.4 million people, with an internal audit function of four: the chief audit executive and three auditors. Late in 2026 a chemical dosing error at one of its treatment works sent treated water out of the works outside the authority’s own operating limits for about four hours during a night shift, and the operations directorate’s investigation, completed in three weeks, concluded that the night-shift operator had failed to follow the dosing procedure. It recommended retraining, a written warning and a second sign-off for any change to a dose setting. The audit committee asked for assurance on how the authority investigates operational incidents, and in the 2027 plan the function scheduled a review that used this investigation as its main case and tested it against the six steps.
| Test | What the function found | Result |
|---|---|---|
| Is there a timeline? | The report had none. The function rebuilt one from the control-system logs, the shift log and the alarm history: 41 alarms in the four hours before the dose change, 36 of them from a turbidity meter reported faulty six weeks earlier and still awaiting repair | Finding: investigations of significant incidents to include a timeline reconstructed from system records |
| Is the data in context? | At handover the operator had been told the turbidity meter was unreliable. A 2026 control-system upgrade had changed how dose units were displayed on the dosing screen; the written procedure predated the upgrade and described the old screen | Finding: procedures for plant affected by a control-system change to be reviewed before the change goes live |
| Does the cause reach the blunt end? | The works had run with one operator on nights since two vacancies in 2026; the procedure assumed a second person for checks. The recommended second sign-off could not be performed on a night shift with one operator | Finding: the cause restated as conditions (alarm backlog, screen change, single staffing); the second sign-off withdrawn as unworkable |
| Has the organisation seen this before? | The incident log held two similar dose-setting events at other works in 2026, both logged as “no harm” and closed without investigation | Finding: near misses involving dose settings to be reviewed monthly by the operations safety lead |
| Do the recommendations follow from the causes? | Retraining and a warning addressed the person; none of the three recommendations addressed the meter, the screen, the procedure or the staffing | Observation: recommendations to be traced to stated causes in every investigation report |
| Is the investigator independent? | The investigation was led by the works manager responsible for the staffing plan and the repair backlog | Observation: significant incidents to be investigated by someone outside the line management of the works concerned |
The review produced four findings and two observations. The operations director agreed to reopen the investigation under an investigator from another region, and the disciplinary decision, which is a matter for management rather than audit, was set aside pending the new report. The reopened investigation confirmed the function’s timeline, added a finding about the alarm backlog across three other works, and replaced the original recommendations with a meter repair standard, a procedure review step in the control-system change process, a staffing rule for nights and a monthly near-miss review. The authority adopted an incident investigation standard that requires a timeline, a reconstruction of what was visible to the people involved, cause statements expressed as conditions and recommendations traced to those causes.
The function changed its own practice as well. Its finding template now asks the auditor to state the conditions behind any action described as an error, its review checklist flags “should have” and evaluative adjectives in conditions, and the chief audit executive briefed the audit committee on why the authority’s most recent incident report had moved from one cause to four. The audit committee chair’s comment was that the first report had told the committee who to blame and the second had told it what to fix, which is the difference between the two views in one sentence. The example is fictional; the lesson it carries is that a fast investigation and a useful one are not always the same thing, and that an audit function is well placed to say so.
Frequently asked questions
Is the book only for aviation and healthcare?
No. Its examples come mostly from safety-critical industries, but its method applies wherever an organisation investigates something that went wrong and decides what to do, which includes control failures, operational incidents, regulatory breaches and IT outages. An auditor has to translate the examples; the reasoning travels without change.
Which edition should an auditor read?
The third edition of 2014, now published by CRC Press. It reorganises the material into eight chapters and an epilogue and adds chapters on safety culture and on improving investigations. The 2006 edition has most of the same ideas in twenty-one shorter chapters.
Does the New View mean nobody is accountable?
No. It changes what accountability means, from a search for someone to blame to a forward-looking question about who will do what so that the event is less likely to recur. People who act recklessly or in bad faith still have to be identified; the New View insists that the conclusion comes after the situation has been reconstructed, not before.
What is the local rationality principle?
The idea that people do what makes sense to them given their goals, their attention and their knowledge at the moment of acting. If an action looks inexplicable afterwards, the investigator has not yet understood the situation the person was in. In an audit it becomes an interview question: what did you see, and what were you trying to do?
How does the book relate to the five whys?
They are complementary. The five whys push the analysis past the first cause; the Field Guide asks the investigator first to reconstruct the situation as it looked from inside, so that the whys are asked with the right information. The root cause guide shows the five whys in audit findings.
What should an auditor read alongside it?
Normal Accidents for the systems argument and The Checklist Manifesto for the design of procedures; the internal audit reading list sets out the wider library by theme.
Related guides
- Root Cause Analysis for Audit Findings: 5 Whys Worked Examples — the site’s root cause method
- Writing Cause Statements That Point to the Fix — cause statements that go past “human error”
- How to Audit Incident Response: Detection to Post-Mortem — the post-incident review as an audit subject
- Operational Risk Guide for Internal Auditors (2026) — where incident investigation sits in operational risk
- How to Audit Corporate Culture: A Topical Requirement Method — testing whether a just culture is real
- Normal Accidents by Charles Perrow: Summary and Lessons for Auditors — the systems argument behind the New View
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- Meltdown by Clearfield and Tilcsik: Summary and Lessons for Auditors — complexity, coupling and how systems fail
- The Fearless Organization by Amy Edmondson: Summary and Lessons for Auditors — psychological safety and speaking up
- Black Box Thinking by Matthew Syed: Summary and Lessons for Auditors — learning from failure, as aviation does.
Leave a Reply