James Reason gave safety its most durable picture decades ago, and it has survived every fashion since because it happens to be true. Imagine the defences protecting a patient as a series of slices of Swiss cheese, stacked one behind another. Each slice is a barrier: a check, an alarm, a protocol, a second set of eyes. Each slice also has holes, because no barrier is perfect. On almost every occasion, a hazard that slips through a hole in one slice is stopped by the solid part of the next. Harm happens on the rare occasion when the holes line up, and a trajectory passes cleanly through all of them at once.
The power of the image is not the cheese. It is what the holes represent, and here the model says something that most incident reviews still resist. The holes come in two kinds. There are active failures, the unsafe acts committed by the people at the sharp end, the wrong button, the missed check, the slip of attention. And there are latent conditions, the holes built into the system long before, by decisions made far from the bedside: the confusing interface, the chronic understaffing at a predictable hour, the two drugs stored side by side in look-alike packaging. Active failures are the holes in the last slice. Latent conditions are the holes in all the slices behind it, sitting quietly, waiting for an active failure to line up with them.
This is why “who made the error” is so often the wrong question, and why organisations that ask only that question keep having the same accident. The active failure is real, but it is the least informative hole in the stack. It is the one that happened to be there on the day, and if that particular person had not made it, the latent conditions would have waited patiently for the next person who would. Removing the individual removes one hole from one slice and leaves the rest of the cheese exactly as it was. The next trajectory finds a different route through the same standing holes.
The proactive move the model implies is to go hunting for latent conditions before a trajectory finds them. You do not need an accident to see that two look-alike drugs sit side by side, or that a critical alarm has been defaulted into meaninglessness, or that one hour of every day is reliably understaffed at the exact moment the workload peaks. Those holes are visible in daylight to anyone who looks. Waiting for them to line up with an active failure, and then investigating the active failure, is a way of studying your cheese one puncture at a time, always the wrong puncture, always after the fact.
Reason’s model is old, and the temptation with old models is to assume we have moved past them. We have not moved past this one. Most of the serious harm in complex systems is still holes in the back slices, drilled by decisions nobody thinks of as safety decisions, waiting for an ordinary human slip to complete the line. The work is to find and fill the standing holes, not to keep interviewing the last person who happened to be standing in front of them.
This article accompanies the book Before Harm Happens.