Patient safety seems irritatingly positive. Its scientific literature and conference proceedings are replete with tales of improvement and stories of success. This is partly understandable. It is difficult to move people and organisations to change when the outcome is uncertain; hospitals and funding organisations do not like to hear that projects in which they have invested have failed; “safety champions”—the individuals who are the driving forces for change—passionately want to succeed; publication is not eagerly sought when high hopes have been deflated; and editors may fear inducing a paralysing “learned helplessness” in readers. Like Cassandra in ancient Troy, the few lonely voices^1,2 cautioning that the road to safer care might be long and hard, that the outcome is in doubt, and that “success” (however we define it) once achieved might be difficult to hold, have largely been marginalised, drowned out by the upbeat chorus. An observer from another planet reviewing safety conferences, newsletters, proceedings, and papers over the last 5–10 years might reasonably wonder why the field still exists since all the problems seem to be so easily solved. There is no sense of what Rochlin³ calls “the continuing expectation of future surprise”.

This rosy view of safety in health care contrasts sharply with other thinking on safety in complex sociotechnical systems.^{3,4,5,6,7,8,9,10} Here it is held that the level of safety in an organisation is the result of a constantly renegotiated set of inevitable tradeoffs; that the organisation is being tossed about in a “safety space”, buffeted by the forces of economics, resource constraints, workload, external demands, technological change, and the perceived boundary of unsafe performance. Safety interventions can tip the negotiated balance in one direction but the forces still remain and, without active and sustained effort, even the interventions themselves can become subverted. Hirschhorn⁵ and Woods¹¹ have expressed this cogently as The Law of Stretched Systems: “Every system operates always at its capacity. As soon as there is some improvement, some new technology, we stretch it.” Thus, safety interventions typically become converted to production; since work is now safer, more work is expected in less time or with fewer resources or under more dangerous conditions, and so on. Striving for safety in this world is analogous to fighting a long guerilla war: there are no clearcut victories; there are occasional disturbing losses; the enemy is invisible, pervasive, avoids our strengths and attacks our weaknesses unexpectedly; and there is no end in sight. The most one can hope for is a sort of “success without victory” where success means reducing but not eliminating the threat.¹²

The paper by Roberts et al in this issue of QSHC¹³ provides a sobering and much needed contrast to the general cheeriness of safety papers in health care. Their case study of how highly safe performance in an organisation was gradually lost due to changes in leadership, personnel, and philosophy underscores the fragility and evanescence of safety in complex systems. It emphasises that, while safe performance can be difficult to attain, it can easily be lost, and that such losses can come as the result of good intentions.

Although there were many dimensions to the organisational changes that were temporally associated with the degradation in performance in this case study, two seem particularly relevant—the reversion to a more hierarchical “command and control” model of organisation and the replacement of contextually sensitive, loop based decision making methods—“sensemaking through action”—by normative rationalised protocols. These two changes are ironic because they were intended to improve care and because they follow the standard medical model of organising; but they had the opposite effect. Worse, the organisation did not seem to be able to break out of this vicious cycle; one can imagine that the response to deteriorating performance might have been still tighter control and ever more detailed protocolisation.

Striving for “success without victory” in patient safety may seem cynical, or at least uninspiring, but it is realistic and avoids false hopes, inflated expectations, and unjustifiable disappointments. Paradoxically, the “high reliability organisations” that we in health care would like so much to emulate have got where they are by finding ways to sustain such an approach; to foster the continuing expectation of future (unpleasant) surprises; and to keep their celebrations short. Such unwelcome views have been punished in other domains¹² but, more often, like Cassandra, they are just ignored. Keep the celebrations short.