Safety-I and Safety-II

Arising from linear, mechanistic models of accidents, Safety-I views safety as the absence of failure, or the state in which the fewest number of things go wrong. The pursuit of safety within this paradigm involves specifying an ideal design for work (‘Work-as-Imagined’) and ensuring the conduct of work in the real world (‘Work-as-Done’) deviates as little as possible from that design. To achieve this, Safety-I relies on familiar tools: incident reporting (to identify failures), root cause analysis (to identify the deviations and malfunctions that led to failures) and interventions based on standardisation, regulation and bureaucratic oversight (to maximise compliance with Work-as-Imagined and minimise performance variation).8 12

This approach is well suited for tractable, well-understood challenges. Indeed, Safety-I logic and strategies have advanced the state of safety and quality within healthcare substantially.14 However, as healthcare grows more complex, its challenges are increasingly intractable, incompletely understood and unpredictable.7 12–14 This is a significant limitation for Safety-I when it comes to addressing the demands of healthcare.12–14

Arising in response to the limitations of Safety-I, Safety-II views safety as the dynamic creation of success amidst variable conditions. Based on concepts from complexity science, Safety-II is part of an evolution that includes Perrow’s description of the dangers of complex systems,16 Tucker and Edmondson’s examination of organisational learning in hospitals,17 high reliability theory18 and resilience engineering.19 It recognises that static, protocolised performance is not what produces success amidst dynamic, unpredictable circumstances. Success in complex systems requires front-line workers to adapt to dynamic circumstances and vary their behaviour to match their conditions. Safe, high-quality outcomes occur not by ensuring everything goes according to design (which is impossible in complex systems), but by optimising workers’ ability to adapt and achieve success when the unexpected inevitably occurs. Where Safety-I investigates adverse events to identify how real work deviated from ideal work and prevent such deviations in the future, the Safety-II paradigm urges us to study the things that go right in order to identify—and optimise—the adaptations and improvisations that clinicians make to create the successes of everyday work.8 12

A well-functioning system requires both of these perspectives, and Safety-I and Safety-II are meant to complement each other. However, they should coexist in a balance appropriate to the system.8 12 In simple systems, Safety-I logic is often sufficient. Systems as complex as those in healthcare require a greater proportion of Safety-II logic.

Healthcare lacks an appropriate balance, with Safety-I remaining the dominant perspective despite growing complexity.12–14 20 As a result, healthcare continues to underestimate the learning available in its successes (ie, in normal, daily work). This is significant, as a predominant focus on adverse events and deficiencies creates a skewed perspective on front-line work. For example, through the lens of hindsight, adaptations by front-line clinicians appear as ‘errors’, ‘deviations’ and ‘malfunctions’ on the path to an adverse event.9 21 With only this perspective, front-line workers can appear as liabilities that the system must restrain to achieve safety.8 15

Skewed focus

This misreading of how safety emerges within a complex system9 has problematic consequences relevant to clinician wellness. Intentionally or not, this logic elevates the importance of those who design and regulate work (ie, administrators, managers, bureaucrats), and prioritises their knowledge over the knowledge of the clinicians doing the work.14 This can marginalise the hard-earned practical expertise of clinicians (an effect observed in other industries)22 and leave them feeling that following orders is their sole means of contributing positively to safe, high-quality care.15 We would do well to consider how this message affects the collective sense of self-efficacy, self-esteem and personal accomplishment (which all contribute to the sense of meaning central to the burnout syndrome)23 24 that clinicians derive from work.

Furthermore, marginalising front-line, practical expertise is an ominous effect of a worldview dominated by Safety-I logic. Unrestrained Safety-I (with its focus on specification, regulation and compliance) begins to resemble an ideology known as authoritarian high modernism—a trumped-up form of modernism with strongly held beliefs in the power of rational design, technical and scientific knowledge, order and legibility, and centralised oversight.13 15 25 The fingerprints of this ideology are evident throughout healthcare, in efforts to enhance quality and safety (eg, standardised care pathways based on clinical practice guidelines, performance targets mandated by centralised administrations, an emphasis on automation and technological solutions), and beyond (eg, the legibility provided by information from electronic medical records).13 14

While appearing logical and satisfying on the surface, the high-modernist approach tends to overlook the non-codified work, local expertise and tacit, practical knowledge that allow front-line workers to deal with emergent challenges at a complex system’s sharp end.13 25 As complex systems cannot be fully specified, this non-codified work and practical expertise are essential to compensate for the gaps and imperfections in our designs (ie, in Work-as-Imagined).8 12 Thus, the results of high modernism are often disappointing—if not disastrous—when applied to complex systems.25

With too much confidence in our ability to specify, design and control our systems, high modernism and unrestrained Safety-I logic neglect the ways that front-line workers use their practical, tacit expertise to recognise unpredictable events unfolding around them, make sense of these events and respond in the most appropriate manner. These efforts convert static, lifeless infrastructures into dynamic, adaptive entities capable of achieving success amidst the demands of complexity. However, with our focus elsewhere, we fail to recognise how much of normal, everyday work consists of these cognitively demanding efforts.

We must remember that, despite the pervasiveness of adverse outcomes, there is far more that goes right in healthcare than goes wrong.7 12 In focusing on failures, we risk neglecting the majority of challenges clinicians encounter, yet successfully overcome through their adaptations and improvisations. The challenges depleting the emotional reserves of clinicians may reside predominantly in this successful, normal work (ie, not just in adverse events and failures). In failing to appreciate or examine the dynamic creation of success, the Safety-I paradigm may blind us to the exhausting demands clinicians overcome in creating ‘normal work’.

Vicious cycle

Faced with challenging circumstances (eg, surges in patient volumes, staff shortages or any situation where conditions defy expectations), altruistic clinicians do not idly accept suboptimal outcomes. They proactively adapt to find ways to succeed. In doing so, clinicians can compensate for a variety of systemic problems (eg, insufficient capacity, protocols and technology poorly aligned with clinical tasks) through their dedication, expertise and creativity.9 Unfortunately, these adaptations and successes often come at a cost to clinician well-being (eg, working longer, more intense hours). This is all especially true in a high-stakes field filled with altruistic clinicians willing to self-sacrifice.

A vicious cycle can emerge here. Clinicians are often so successful that these extra efforts and adaptations go unnoticed (ie, their self-sacrifice becomes ‘normal work’).12 26 So long as clinicians can adapt to challenges and avoid failure, managers and regulators may be reassured by the ‘normal’ performance of the system, and assume operations are going according to plan (ie, according to Work-as-Imagined). As a result, they fail to recognise the vulnerabilities clinicians compensate for, the challenges they overcome or the emotional toll ‘normal work’ imposes on clinicians. As the demands of front-line work inevitably increase (via larger patient volumes, more complicated technologies, new niches of specialisation), these demands accumulate on clinicians if the systemic problems are not addressed. The system can become increasingly dependent on the dedication and self-sacrificing behaviours of clinicians, leading to an emotionally exhausted workforce.

This is where a Safety-II perspective can help front-line wellness. A system preoccupied with its failures may be blind to how it achieves its successes. If we were to pay greater attention to the things that go right, we could recognise the messy, stressful nature of normal work and how creating success in this environment taxes the emotional reserves of clinicians. We could see the vulnerabilities they compensate for through their adaptations, the trade-offs they navigate, and the actions, decisions and sense-making that contribute to their success. This is not information that necessarily emerges from investigations of failure, but is vital to recognising how work is done, what our improvement efforts should seek to enhance (eg, successful decision-making, sense-making and improvisation) and how to enhance it (eg, creating ‘slack’ in the system).27 Compared with efforts informed by Safety-I, identifying how to better support and improve this ‘normal work’ is more in line with how safety is created in complex systems, and more likely to address the emotional and cognitive demands accumulating on clinicians within their daily work.

By investigating the mechanisms of success, we might properly appreciate the necessity of clinician expertise, ingenuity, and dedication in creating safety and maintaining the overall function of the system. Without these attributes, we would have brittle systems unable to handle the unexpected. As the adaptable, aware, expert agents in the system, clinicians provide a resiliency the system would not have without them.9 This perspective affords clinicians the esteem they deserve, as it casts them not as hazards that we must restrain, but as essential ingredients whose strengths we must enable to attain safe, high-quality care.8 15

A modernist crisis?

Focusing on normal work and everyday successes may seem an unlikely pathway to achieving safety, quality and wellness, given how we have been conditioned to think about these issues. However, other industries have already recognised the potential of such an approach, and the organisational development literature provides an illustrative example: Appreciative Inquiry.

Appreciative inquiry (AI) is a framework for organisational improvement and action research that proposes a focus on the positive elements within an organisation.28 Its advocates believe that building on strengths and working towards positive, aspirational goals can both drive improvement and create meaningful engagement for workers more effectively than strategies based on identifying deficits and addressing failures.28–31 AI has become influential since its origin in the 1980s, being incorporated into numerous, prominent organisational development efforts, and garnering an extensive network of scholars.29 30

On the surface, AI and Safety-II share similarities (eg, a focus on amplifying strengths, an understanding that true improvement requires bottom-up improvisation more than top-down implementation) even if Safety-II has a more operational focus than AI.8 However, their most telling similarity may be at a deeper level.

AI arose in response to organisational development and action research models rooted in modernism,28 32 models that “increasingly rationalized”28 organisational science to the point it risked becoming “…imprisoned in a deficiency mode of thought”.28 In developing AI, Cooperrider and Srivastva recognised these models were increasingly untenable in the face of complex, sociotechnical systems and sought to supplement them with a framework compatible with complexity.28 In this regard, AI was part of a movement within organisational science recognising the insufficiency of modernist approaches for understanding (and transforming) complex organisations.32 33

Similarly, Safety-II arose in response to the limitations of Safety-I (with its (high) modernist foundation of formal rationality, order and regulation) in the face of increasing complexity. Though it does not explicitly embrace the postmodern, social constructionist stance of AI, Safety-II does seek to create a more balanced approach to safety and quality by supplementing an existing, deficiency-focused, modernist paradigm.

AI and Safety-II both force us to confront an unsettling idea: our dominant, modernist paradigms may no longer be sufficient to address the complexity of contemporary systems. The foundations of formal rationality, order, legibility and centralised oversight no longer provide solid footing amidst today’s complex systems, and healthcare’s front lines are one interface where this discordance between modernism and complexity is playing out.34 35 Unfortunately, it is producing emotionally exhausted clinicians—burnt-out from supporting a system constructed on an increasingly tenuous foundation.

This is why we need complexity science. It can counterbalance the modernism that leads us to focus too much attention on specifying, predicting and controlling systems that are inherently unspecifiable, unpredictable and uncontrollable. What complexity science and Safety-II offer is a deeper understanding of how to leverage the variation, self-organising properties and natural resonances of complex systems, and how to use the expertise of front-line clinicians working within them. Fortunately, the means to translate these ideas into practice are arriving (eg, Hollnagel’s resilience potentials and Functional Resonance Analysis Method).36 While this work is still evolving, it may provide the methods to ensure front-line work upholds the standards of safety and quality, while sparing clinicians from burnout.

This is not to suggest that the absence of complexity science is solely responsible for the prevalence of burnout in healthcare. However, complexity science does provide a novel perspective on the phenomenon, and can stimulate new ideas and debate on how to best address burnout. Critiques of wellness initiatives rightly point out that, while the burnout phenomenon is well documented, its underlying causes are not.5 Complexity science reveals drivers of burnout previously hidden to us, both at a micro-level (clinicians exhausted from compensating for gaps in underspecified Work-as-Imagined) and macro-level (modernist paradigms no longer sufficient to address the demands of complex systems). Most importantly, in the form of Safety-II, it may provide a path forward that rebuilds meaningful, fulfilling professional experiences for clinicians.