Improving risk management: From lame excuses to principled practice

Abstract

Three classic pillars of risk analysis are risk assessment (how big is the risk and how sure can we be?), risk management (what shall we do about it?), and risk communication (what shall we say about it, to whom, when and how?). Chapter 1 proposed two complements to these: risk attribution (who or what addressable conditions actually caused an accident or loss?) and learning from experience about risk reduction (what works, how well, and how sure can we be?) Failures in complex systems usually evoke blame, often with insufficient attention to root causes of failure, including some aspects of the situation, design decisions, or social norms and culture. Focusing on blame, however, can inhibit effective learning, instead eliciting excuses to deflect attention and perceived culpability. Productive understanding of what went wrong, and how to do better, thus requires moving past recrimination and excuses.