Two years after a genuinely good analysis, walk back to the process it fixed and you will often find the fix gone. Not rejected, not overturned in any meeting anyone remembers. Simply evaporated. A staffing change reassigned the person who did the extra check. A software update quietly dropped the alert. The workaround crept back in, one busy shift at a time, and the process drifted home to where it started. The binder is still on the shelf, immaculate and irrelevant.
This is the quietest way a risk analysis fails, and it fails this way more often than through any error in the analysis itself. The work was good. The follow-through was assumed. And an improvement that depends on people remembering that a project once happened decays at exactly the speed of staff turnover.
The counter to it is unglamorous, and that is the whole trick. A fix is safe when it has become boring, when it no longer depends on anyone recalling why it exists. That takes four ordinary things, none of them clever. First, verify that the actions were actually done, on a schedule, until every one is closed, escalated, or consciously abandoned on the record, because an action quietly dropped is a hazard quietly restored. Second, measure whether risk actually fell, with a few small numbers watched over time and a re-score of the hazards six to twelve months on. A faithfully implemented action that moved nothing is not a failure to hide; it is a finding, telling you your model of the process was wrong somewhere.
Third, and most important, embed the change until it survives the people who made it. Into the policy and the order set and the system configuration. Into orientation, so it reaches the staff who will never know there was a project. And onto a short, visible register of the controls the organisation has promised itself not to erode, so that the next reorganisation has to see the safety cost of a change before it makes it, rather than discover it afterward.
The cautionary tale writes itself, and I have watched versions of it more than once. A discharge process is improved with a pharmacist call to high-risk patients at seventy-two hours. It works. Then a staffing reshuffle reassigns the pharmacist, and the call simply stops, because no document anywhere recorded that this phone call was a safety control rather than a nicety. The improvement decayed at the speed of one personnel decision, made by people who never knew what they were switching off.
Signing the action plan feels like the finish line, and it is the least reliable moment in the whole exercise. The real finish is later and duller: the day the fix has become so ordinary that no one could tell you when it started or why. Boring is the goal. Boring is what survives.
The follow-up loop in Before Harm Happens exists for exactly this reason, and the protected-controls register it recommends is the cheapest insurance a safety programme can buy.
This article accompanies the book Before Harm Happens.