Table of Contents
Part I: The Compliance Trap: My Life as a Safety Mechanic
Chapter 1: The Weight of the Binder
For the first fifteen years of my career as an Environmental, Health, and Safety (EHS) Director, I saw myself as a master mechanic.
My domain wasn’t a garage filled with engines and tools, but a sprawling manufacturing plant.
My job, as I understood it, was to build and maintain the perfect “safety machine.” This machine was a magnificent feat of engineering, constructed not from steel and wire, but from paper and ink.
It was a complex assembly of rules, procedures, checklists, training logs, and regulatory statutes, all meticulously organized in three-ring binders that lined my office shelves like monuments to order and control.
I took immense pride in this machine.
When a new piece of equipment arrived on the floor, my team and I would descend upon it, armed with clipboards and regulation books.
We would deconstruct its every function, identify every potential pinch point, and write a procedure so detailed, so prescriptive, that we believed we had engineered out any possibility of human error.
We designed lock-out/tag-out protocols, created color-coded signage, and mandated specific personal protective equipment (PPE) for every conceivable task.
Our training sessions were rigorous, our documentation was flawless.
The binders grew heavier, the shelves sagged, and I slept soundly, convinced I was protecting my people.
This approach was the orthodoxy of the era.
Traditional workplace safety management was built on a foundation of manual processes, paper-based documentation, and in-person oversight.1
The core philosophy was simple and, on its face, logical: control the environment and control the worker.2
If we could write a rule for every risk and train every employee to follow that rule, accidents would become a mathematical impossibility.
Safety was a problem of engineering, and I was its chief architect.
The reality, however, was that this architectural work was consuming.
The sheer administrative burden of the safety machine was staggering.
My team and I became experts in data entry, form processing, and spreadsheet management.
We were masters of documenting observations, managing incident reports, and tracking compliance requirements.1
But this mastery came at a steep price.
We were, as one safety manager aptly described it, “trapped behind desks, buried in paperwork”.1
Instead of walking the floor, observing the real rhythm of work, and talking to the people who operated the machinery every day, we were managing the
idea of safety from the remove of our office.
The very processes designed to ensure safety were creating an ever-widening gap between us and the reality of the work we were supposed to be protecting.
The machine was humming along beautifully, but I was slowly losing touch with the factory it was meant to serve.
Chapter 2: The Plateau of Pain
For a while, the machine seemed to work.
Our Total Recordable Incident Rate (TRIR) dropped steadily for the first few years.
Management was pleased, our insurance premiums reflected the improvement, and we were held up as a model of safety excellence within the company.
I believed we were on a trajectory to “zero harm,” that mythical destination where perfect compliance would yield perfect safety.
But then, something frustrating happened: we hit a plateau.
The numbers stopped improving.
Despite our best efforts, despite adding more rules, more training, and more audits, our incident rate stubbornly refused to budge.
We’d have a few good months, and then a cluster of minor injuries would erase our progress.
The injuries were never the spectacular catastrophes we had designed our machine to prevent; they were the maddeningly mundane slips, strains, and lacerations that seemed to defy our carefully crafted procedures.
According to the U.S. Bureau of Labor Statistics, over 2.8 million nonfatal workplace injuries and illnesses were reported by private industry employers in 2021 alone, and I felt like we were single-handedly trying to hold that tide back with paper binders.3
Looking closer, I started to see the cracks in my beautiful machine.
The system was creating symptoms I hadn’t anticipated.
Employee engagement, a metric we didn’t formally track but could feel in the air, was abysmal.3
To the people on the floor, safety wasn’t a shared value; it was a series of hoops to jump through, a “checkbox exercise” to be completed so they could get on with their real work.5
Pre-shift safety forms were “pencil-whipped”—filled out with identical checks day after day without a moment’s thought.
We had achieved compliance, but we had lost commitment.
Worse, a subtle culture of fear had taken root.
Because our system was designed around rules and enforcement, the implicit message was that any failure was a personal one.
If an accident happened, the first question was never “What was wrong with the system?” but “Who broke the rule?” This created a powerful disincentive to speak up.
Near-misses went unreported.
Minor issues were hidden.
People developed clever but unauthorized workarounds to deal with poorly designed processes, but they kept these innovations to themselves for fear of being disciplined for deviating from the official procedure.
This lack of open communication meant we were blind to the real risks bubbling just beneath the surface.3
Our system, designed to find and fix problems, was actively driving information underground.
My experience, I would later learn, was the textbook definition of a compliance-driven safety program hitting its limits.
These programs are inherently reactive; they address hazards only after an incident or an inspection brings them to light.4
They focus on meeting the minimum legal requirements, which can foster a false sense of security and lead to employees doing just enough to comply rather than striving for excellence.7
Management, seeing the green checkmarks of compliance, often fails to prioritize safety in a meaningful way, viewing it as a cost to be managed rather than a value to be integrated into operations.3
We had built a system that was excellent at passing audits but mediocre at protecting people.
The plateau wasn’t a temporary stall; it was the machine’s design limit.
And we were about to crash into it.
Chapter 3: The Day the Machine Broke: A Failure of 100% Compliance
The day my faith in the safety machine shattered began like any other Tuesday.
The call came over my radio just before the lunch break.
There had been an incident at Press No. 7.
A serious one.
When I arrived, the scene was a controlled chaos of paramedics and concerned supervisors.
A veteran operator, a man I’d known for a decade named Frank, had suffered a severe crush injury to his left hand.
As they wheeled him out, his face pale with shock, I felt a familiar sickness in my stomach—the cold dread that every safety professional knows.
My first thought, conditioned by years of mechanical thinking, was: What broke? What rule was violated?
The investigation began immediately.
My team and I sequestered the area, pulled the maintenance logs, and started interviewing the witnesses.
We reviewed the procedure for operating Press No. 7, a document I had personally signed off on.
We pulled Frank’s training records—all up to date, with perfect scores on his annual recertification.
We confirmed the machine’s safety interlocks and physical guards were in place and functioning exactly as designed.
For three days, we searched for the broken part, the human error, the single unsafe act that had caused this tragedy.
And we found nothing.
The devastating, mind-bending conclusion of our investigation was that everyone had followed the rules perfectly.
Frank had performed the task exactly as outlined in the procedure.
The machine had functioned exactly as it was designed to.
The safety systems had all been active.
My machine, the one I had spent my career building and perfecting, had operated with 100% compliance.
And it had produced a catastrophic failure.
This was my breaking point.
It was the moment I realized that my entire philosophy was built on a flawed foundation.
For years, I had been operating under the shadow of H.W.
Heinrich’s 1941 “Domino Theory,” which famously (and incorrectly) concluded that 88 percent of industrial accidents were caused by the unsafe acts of workers.2
Though his methodology was deeply flawed—he cherry-picked data to support his conclusions—his work became gospel for generations of managers.
It was an attractive theory because it was simple and it placed the burden of safety on the worker, absolving management of the need to invest in more complex and expensive changes to the work environment or the system itself.2
My entire approach—find the unsafe act, fix the worker—was a direct descendant of this “blame the victim” lineage.
The incident with Frank was a painful, real-world demonstration of this model’s failure.
It starkly revealed the dangerous gap between “work-as-imagined”—the neat, linear process described in my binder—and “work-as-done”—the messy, dynamic, and variable reality of the factory floor.10
Our procedure didn’t account for a slight variation in the raw material that day, which required Frank to adjust his position in a way that was subtly, but critically, different from the norm.
It didn’t account for the ambient noise that made it hard to hear the machine’s tell-tale shift in rhythm.
It didn’t account for the dozens of tiny, human adaptations that workers make every single day to bridge the gap between the sterile procedure and the real world.
Our compliance-only approach had completely neglected these crucial human factors.7
The investigation, which began as a hunt for a scapegoat, became a mirror.
It showed me that the problem wasn’t a broken component.
The problem was the machine itself.
Its very design, focused on rigid compliance and the punishment of deviation, was blind to the complexities of real work.
It was brittle, inflexible, and ultimately, ineffective.
I had spent fifteen years trying to build a fortress of rules, and in a single moment, I saw that all I had built was a beautifully decorated prison that offered only the illusion of safety.
The machine was broken, and I had no idea how to fix it.
This realization led to a deeper understanding of the system’s inherent flaws.
The immense administrative burden wasn’t just an inefficiency; it was a primary driver of the system’s failure.
The constant demand for paperwork, reports, and documentation chained safety professionals to their desks, creating a physical and psychological distance from the very work they were meant to understand.1
This separation prevented the development of trust and the firsthand observation necessary to see how work was actually performed.
The tools of compliance—the binders and spreadsheets—were actively creating a barrier to the human connection and deep operational knowledge that are the true foundations of a safe workplace.
The system’s design was, in a cruel irony, undermining its own purpose.
Furthermore, I saw how our relentless focus on compliance had bred a dangerous false sense of security.
By encouraging the organization to do just the “minimal effort” required by law, we created an environment where a green compliance dashboard was mistaken for genuine safety.7
Leaders and employees alike looked at our perfect audit scores and assumed all was well, which stifled any deeper inquiry into the underlying, systemic risks.
Our obsession with lagging indicators, like compliance percentages and incident rates, had blinded us to the leading indicators of systemic fragility that were present every single day in the form of workarounds, near-misses, and operational pressures.
The incident with Frank wasn’t an anomaly; it was an inevitability.
It was a profound shock only because we had allowed the illusion of compliance to convince us we were doing everything right.
Part II: The Epiphany: Seeing the Forest for the Trees
Chapter 4: An Unlikely Teacher: Wildfires and a New Way of Seeing
Burned out and adrift, I took a leave of absence.
I needed to get away from the scent of hydraulic fluid and the hum of machinery.
I needed silence.
I retreated to a small cabin in the mountains, and with nothing else to do, I started to read.
I read novels, history, whatever I could find on the dusty shelves.
One afternoon, I picked up a book on forest ecology and the science of wildfire management.
I expected a dry, academic text.
Instead, I found an epiphany.
The book described how, for decades, the prevailing strategy for managing forests was total fire suppression.
The goal, much like my own “zero harm” objective, was to prevent every single fire from starting.
The result was catastrophic.
By preventing the small, natural ground fires that clear out underbrush, forest managers had allowed decades of fuel to accumulate.
When a fire inevitably did start—ignited by lightning or a careless camper—it didn’t stay on the ground.
It exploded into an uncontrollable crown fire, a monster that sterilized the soil and destroyed the entire forest.
Then the book introduced a concept that struck me like a bolt of lightning: ecological resilience.
A resilient ecosystem, I learned, is not one that avoids disturbance.
It is one that has the capacity to absorb disturbances—whether a fire, a drought, or an insect infestation—while maintaining its essential functions, structure, and identity.11
It persists
through change, not by building walls against it.
I reread that sentence a dozen times.
I had spent my entire career trying to build a static, unchanging safety machine, a system designed for a world that didn’t exist.
A factory, like a forest, is not a static place.
It is a dynamic, complex, and ever-changing system.
I devoured the principles of resilience, and with each page, the analogy to my broken safety paradigm became clearer and more powerful.
- Diversity and Heterogeneity: A resilient forest is not a monoculture plantation of identical trees. It is a rich tapestry of different species, different ages of trees, and varied landscape features like rocky outcrops and wetlands.12 This diversity means that a disease or pest that targets one species won’t wipe out the entire forest. The heterogeneity of the landscape creates natural firebreaks that contain the spread of a blaze.13 My safety system, in contrast, demanded rigid standardization, treating every worker and every situation as identical.
- Redundancy: Ecologists call this “niche overlap”.13 In a resilient ecosystem, multiple species can perform similar critical functions. If a key pollinator disappears, other insects can step in to fill the role. If the American chestnut is wiped out by a blight, oaks and hickories can expand to fill the canopy, maintaining the forest’s structure and function.13 My system had no redundancy. If a single person was the only one trained on a critical procedure, or if a single communication channel failed, the system broke down.
- Modularity: A resilient system is not a single, hyper-connected entity. It is composed of modules, or patches, that are connected but also have a degree of separation.13 A fire might destroy one patch of forest, but the modular structure prevents it from cascading into a system-wide inferno. The surrounding, healthy modules then provide the seeds and resources for the burned patch to recover. My factory, optimized for lean efficiency, was a tightly coupled system where a small failure in one area could trigger a domino effect across the entire production line.
- Adaptive Capacity: This was the most crucial concept. A resilient ecosystem has the ability to learn and change. It can reorganize itself in response to new pressures.14 The humans who are part of these “socio-ecological systems” learn from observation and alter their interactions to deal with change.14 My system punished adaptation. It demanded that people follow the rules, even when the rules were no longer fit for the changing conditions on the ground.
I closed the book and looked out the window at the forest, but I was seeing the factory floor.
I saw the operators, maintenance crews, and supervisors not as cogs in a machine, but as the diverse species of an ecosystem.
I saw their unauthorized workarounds and clever shortcuts not as violations, but as adaptations—the system’s attempt to be resilient.
I had been trying to build a brittle, fire-suppressed plantation when I should have been cultivating a living, breathing, resilient forest.
This shift in perspective was profound.
It moved me away from the impossible goal of creating a system that never fails and toward the much more practical and powerful goal of building a system that is resilient to failure.
Traditional safety, or what is now often called Safety-I, operates on the assumption that if you design a system perfectly and ensure everyone complies, you can eliminate failure.15
This is the worldview of the mechanic.
But ecology, along with complexity science, teaches us that in any complex, dynamic system, variation, disturbance, and surprise are not just possible, they are inevitable.10
A resilient ecosystem doesn’t pretend it can stop all fires or prevent all droughts.
Instead, it develops intrinsic capabilities—diversity, redundancy, modularity—to withstand these shocks, recover from them, and even learn from them.11
This completely reframed the purpose of my job.
I was not a policeman tasked with stamping out every error.
I was a gardener, a steward, whose role was to cultivate the conditions for organizational resilience.
Part III: The Resilient Safety Ecosystem: A New Framework for Work
When I returned to the plant, I didn’t come back with a new set of rules.
I came back with a new way of seeing.
I came back with a framework I called the “Resilient Safety Ecosystem.” This wasn’t just a feel-good metaphor; it was a practical management philosophy grounded in the principles of Systems Thinking.
Systems Thinking is a profound departure from traditional analysis.
Instead of breaking an organization down into its separate parts—operations, maintenance, safety, HR—it focuses on the whole and, most importantly, on the relationships and dynamic interactions between those parts.16
It recognizes that a workplace is a complex system of people, technology, processes, and culture, all constantly influencing one another.18
From this perspective, safety is not a component you can bolt onto the system, like a new guard on a machine.
Safety is an emergent property—a result that arises from the countless interactions within the system itself.19
Just as a car’s ability to transport you is an emergent property of the interaction of its engine, wheels, and steering, an organization’s safety performance emerges from the interplay of leadership decisions, production pressures, communication patterns, and worker expertise.
This directly contradicts the traditional approach, which focuses its interventions almost exclusively on the individual worker, ignoring the complex system that shapes their choices and actions.18
The history of major accidents, particularly in complex industries like aviation, is a testament to this truth.
The tragic 1987 capsizing of the Herald of Free Enterprise ferry wasn’t caused by a single broken part.
The bow doors were left open, yes, but this happened because of a confluence of factors: the ship was on an unfamiliar route with an incompatible dock; the crew member responsible was asleep after being exhausted from other duties; the captain couldn’t see the doors from the bridge and had no indicator light to confirm their status; and the ship’s open car-deck design allowed water to flood the vessel catastrophically.21
Multiple people and components, all functioning as they were “supposed to” within their own limited context, interacted in a way that created a disaster.
Safety, and the lack of it, emerged from the system.
To make this new paradigm clear to my leadership team, who were used to thinking in terms of spreadsheets and org charts, I created a simple table to contrast the old world with the new.
Table 1: The Two Paradigms of Safety: Machine vs. Ecosystem
| Dimension | The Safety Machine (Old Paradigm) | The Resilient Safety Ecosystem (New Paradigm) |
| Core Metaphor | A predictable, engineered machine. | A dynamic, adaptive ecosystem. |
| View of People | A potential source of error; a component to be controlled. | A source of resilience and adaptation; a valuable resource. |
| Primary Goal | Prevent things from going wrong (Zero Harm via control). | Ensure things go right (Success under varying conditions). |
| Key Metrics | Lagging indicators (incidents, injuries, compliance rates). | Leading indicators (proactive reporting, learning, adaptive capacity). |
| Response to Failure | Find the broken part/person and fix/blame them (Root Cause Analysis). | Understand why the failure made sense in context; improve the system. |
| Leadership Role | Commander and Enforcer of rules. | Gardener and Cultivator of the system. |
This table became our Rosetta Stone.
It translated the abstract philosophy of resilience into the concrete language of business.
It showed that we weren’t just changing a few procedures; we were fundamentally changing our view of people, our goals, our metrics, and the very role of leadership.
It provided a cognitive map for the journey ahead, a framework for understanding the four pillars upon which we would build our new, resilient safety ecosystem.
Chapter 5: Pillar 1: Cultivating Diversity and Redundancy – The System’s Immune Response
The first and most jarring shift in my thinking was to abandon the altar of standardization.
In the world of the safety machine, uniformity was a virtue.
We wanted every worker to perform the same task in exactly the same way, every single time.
It was an attempt to stamp out variability, which we saw as the primary source of risk.
The forest, however, taught me that uniformity is fragility.
A plantation of genetically identical trees is exquisitely vulnerable to a single blight.
A diverse, old-growth forest, with its rich mix of species, can weather plagues, fires, and storms.
I realized that in our quest for standardization, we had been clear-cutting our organization’s natural resilience.
This led to the first pillar of our new ecosystem: actively cultivating Diversity and Redundancy.
In ecological terms, these concepts are the system’s immune response.
Diversity provides a wide portfolio of potential solutions to unforeseen problems, while redundancy ensures that the failure of one component does not lead to the failure of a critical system function.13
Translating this to the factory floor was a practical, not just a philosophical, exercise.
We started by dismantling our siloed approach to expertise.
Previously, if we had a problem with a machine, we would call an engineer.
Now, we created diverse problem-solving teams.
When a new process was being designed, the team included not just the engineers who imagined it, but the operators who would run it, the maintenance technicians who would fix it, and even the logistics staff who would supply it.
This brought a rich diversity of perspectives, uncovering risks and opportunities that no single expert could have seen alone.
Next, we tackled redundancy, the organizational equivalent of “niche overlap”.13
Our old system created single points of failure everywhere.
Only one supervisor knew the intricacies of the weekend shift startup.
Only two technicians were certified to repair our most critical piece of equipment.
We had optimized for efficiency, but we had created a system that was incredibly brittle.
Our solution was a deliberate and strategic investment in cross-training.
We identified critical tasks and knowledge centers across the plant and developed a program to ensure that multiple people were proficient in those areas.
This wasn’t just about vacation coverage; it was about building systemic resilience.
When our lead programmer for the CNC machines had an unexpected family emergency, the line didn’t shut down for three days as it would have in the past.
A cross-trained machinist was able to step in, diagnose the coding error, and get the system back online within an hour.
We had built organizational redundancy.
Just as oaks and hickories expanded to fill the void left by the American chestnut, our machinist stepped in to maintain the function of the production system.13
We also applied this thinking to our communication systems.
We moved away from relying solely on a rigid, top-down chain of command.
We established multiple, redundant channels for information to flow: daily cross-functional huddles on the floor, a digital dashboard accessible to everyone, and an anonymous reporting system for sensitive concerns.
If one channel became blocked or ineffective, others were there to ensure critical information still got through.
We were no longer a single, vulnerable nerve trunk; we were becoming a distributed and resilient neural network.
Chapter 6: Pillar 2: Designing for Modularity – Building Firebreaks Against Failure
My second pillar was inspired by the image of a wildfire crew digging a firebreak.
They don’t try to stop the fire with a bucket of water.
They change the landscape, creating a gap that contains the fire’s spread, allowing it to burn itself out in one section of the forest without consuming the whole.13
This is the principle of
Modularity: designing a system in interconnected but separable parts, so that a failure in one module is contained and does not cascade into a system-wide catastrophe.13
The “safety machine” I had built was the opposite of modular.
In the name of lean manufacturing and efficiency, we had created a “tightly coupled” system.21
Every process was directly and immediately linked to the next.
A small delay at the start of the production line would ripple downstream, causing frantic efforts to catch up, which in turn increased the risk of errors and accidents everywhere.
A single failure could bring the entire plant to a halt.
A devastating example of this from the world of technology was the loss of the Mars Polar Lander.
The spacecraft crashed because spurious signals generated during the normal deployment of its landing legs were misinterpreted by the software as an indication that the craft had already landed.
The software, following its programming, shut down the descent engines prematurely.21
The landing leg system worked perfectly.
The software worked perfectly according to its flawed requirements.
But the unmanaged interaction—the tight coupling—between these two reliable components led to total system failure.
The failure was not in the parts; it was in the connections.
To build firebreaks in our factory, we had to start thinking differently about workflow and layout.
We began looking for ways to decouple processes, even if it meant sacrificing a small amount of theoretical efficiency.
We added small buffer zones for inventory between major production stages.
This meant that a 15-minute stoppage in one department no longer created an immediate crisis in the next.
It gave the downstream team time to breathe, assess, and prepare, rather than rush.
It acted as a shock absorber, dampening the ripple effect of small disruptions.
We also applied modularity to our teams and their responsibilities.
We moved away from a model where a central engineering group was responsible for all process improvements and toward a model of localized ownership.
We empowered the teams running specific production cells to manage, troubleshoot, and improve their own module.
This not only increased engagement and innovation, but it also contained problems.
A challenge within one cell became a learning opportunity for that team to solve, rather than a system-wide problem that required a top-down intervention.
We even re-evaluated our physical plant layout with modularity in mind.
When planning a new production line, we didn’t just consider the most efficient path for materials to flow.
We also considered how we could physically separate high-risk processes from others, how we could design utility feeds (like power and compressed air) so that an issue with one line wouldn’t shut down an entire section of the plant.
We were consciously building firebreaks into the very concrete and steel of our facility.
We were designing a system that could fail gracefully in small, contained ways, rather than one that worked perfectly until it failed catastrophically.
Chapter 7: Pillar 3: Nurturing Rich Feedback Loops – From Lagging Rules to Leading Intelligence
This was the pillar that required the biggest personal transformation.
For fifteen years, my job had been defined by what went wrong.
I was an expert in failure.
My days were spent investigating incidents, analyzing near-misses, and auditing for non-compliance.
The forest taught me to look at things differently.
An ecologist doesn’t just study burned-out forests; they spend most of their time studying healthy, thriving ones to understand what makes them resilient.
I realized I had been ignoring my most valuable source of data: success.
This is the core of the philosophy known as Safety-II.
Traditional safety, or Safety-I, defines safety as the absence of negative events—fewer accidents, fewer injuries.15
Its focus is reactive, studying the rare moments of failure to prevent their recurrence.22
Safety-II offers a revolutionary reframe: it defines safety as the presence of positive capacities—the ability of a system and its people to succeed under varying and challenging conditions.22
The surprise, from a Safety-II perspective, is not that things occasionally go wrong in a complex workplace, but that they go right so incredibly often.24
This pillar was about shifting my focus from the 1 time in 10,000 that something went wrong to the 9,999 times it went right, and asking, “Why? How?”.25
It was about transforming myself from a “safety cop” enforcing rules to a “safety researcher” seeking to understand performance.6
The key to this was understanding the vast and often invisible gap between “work-as-imagined” (the official procedure in the binder) and “work-as-done” (what people actually do to navigate the complexities of their job).10
Workers are not robots executing a program; they are a constant source of resilience and flexibility, making countless micro-adjustments and adaptations to handle unexpected variations, resource constraints, and production pressures.26
These adaptations are the very reason the system works as well as it does.
In my old paradigm, I saw these adaptations as violations to be stamped O.T. In the new paradigm, I saw them as a rich source of intelligence to be understood and harnessed.
The most powerful tool we implemented to do this was the Learning Team.27
A Learning Team is not an incident investigation.
It’s a facilitated, blame-free conversation with frontline workers, often held after a successful but difficult shift or task.
The goal isn’t to find fault; it’s to uncover how they succeeded.
I’ll never forget our first one.
We had just completed a record-breaking production run, meeting a tight deadline for a critical customer.
In the old days, we would have sent out a congratulatory email and moved on.
Instead, I gathered the team from the line and asked a simple question: “That was tough.
How did you do it?”
The floodgates opened.
They talked about how the official parts sequencing in the computer was wrong for this specific product variant, so the line lead had developed a new sequence on the fly and communicated it verbally.
They described how a sensor on one machine was acting up, so a veteran operator, recognizing the subtle change in the machine’s sound, had coached a newer colleague on how to manually compensate.
They explained how they had reorganized their workstation, deviating from the “standard” layout, to reduce unnecessary movement and prevent fatigue during the long shift.
Every story was, technically, a description of a rule being broken.
But together, they painted a picture of a resilient, adaptive, and brilliant human system at work.
These were not violations; they were life-saving, production-saving adaptations.
This was the “work-as-done,” and it was infinitely more sophisticated than the “work-as-imagined” in my procedures.
By studying these successes, we gained powerful leading indicators.8
We learned where our official procedures were brittle and needed updating.
We identified our true experts and created opportunities for them to mentor others.
We discovered hidden single points of failure and sources of operational friction.
We were no longer just reacting to the loud signal of accidents; we were proactively listening to the quiet, constant signal of successful adaptation.
We were learning from our system’s strengths, not just its weaknesses.
Chapter 8: Pillar 4: The Soil of the Ecosystem – A Foundation of Just Culture
The first three pillars—Diversity & Redundancy, Modularity, and Rich Feedback Loops—were the structures of our new ecosystem.
But none of them could take root and grow without the fourth and most foundational pillar: the soil.
That soil is a Just Culture.
A Just Culture is an environment of trust, learning, and shared accountability where people feel safe to speak up about problems, errors, and concerns without fear of blame or unfair punishment.28
It is the absolute prerequisite for everything else.
You cannot have rich feedback loops if people are afraid to tell you the truth about “work-as-done.” You cannot learn from failure if every investigation is a witch hunt.
It is critical to understand that a Just Culture is not a “no-blame” culture.30
That is a dangerous misconception.
A Just Culture is about shared accountability.31
The organization is held accountable for the systems it designs, the resources it provides, and the pressures it creates.
Individuals, in turn, are held accountable for the quality of their choices and behaviors within that system.28
The key to making this work is a shared, transparent framework for differentiating between types of human behavior.
Drawing on the work of pioneers like David Marx, we educated our entire leadership team on three distinct behaviors 28:
- Human Error: An inadvertent action, a slip, lapse, or mistake. For example, a worker grabs the wrong bolt from a bin of similar-looking parts. The person did not intend the error. The correct response is to console the individual and look at the system. Why are the bins so similar? Can we improve the labeling? Can we change the process? We manage human error by fixing the system.
- At-Risk Behavior: A choice made by a worker where the risk is not recognized or is mistakenly believed to be justified. For example, a technician skips a step in a diagnostic procedure to save time, a shortcut they and their colleagues have taken many times before without incident. This is where the vast majority of “violations” live. The choice is subconscious, and the perception of risk has eroded over time. The correct response is not to punish, but to coach. We must understand why the risk wasn’t seen. What pressures (time, resources) made this choice seem reasonable? How can we change the system to make the risk visible and the correct choice easier?
- Reckless Behavior: A conscious disregard of a substantial and unjustifiable risk. For example, a forklift driver racing through a crowded pedestrian area at high speed, knowing it is prohibited and dangerous. This is a deliberate and dangerous choice. The correct response is punitive action. A Just Culture holds individuals accountable for reckless choices.
This framework was transformative.
It gave our managers a tool to move beyond their gut reactions and emotional responses.
It forced us to look for risk, not for fault.31
When an error occurred, our first response became restorative: we made sure everyone involved, including the workers, was okay.30
We had to train ourselves to overcome powerful cognitive biases, like
hindsight bias (assuming we would have known what to do in the moment) and the fundamental attribution error (blaming an individual’s character rather than their situation).30
Instead of asking, “What were you thinking?”, we learned to ask, “Help me understand why that made sense to you at the time.”
This approach created the psychological safety that is the bedrock of a reporting culture.28
People began to trust that if they reported a mistake or a near-miss, the goal would be learning, not blame.
Our near-miss reporting skyrocketed, not because we were having more problems, but because people finally felt safe to talk about them.
This relationship between Safety-II and Just Culture is not just complementary; it is symbiotic.
They are two sides of the same coin.
The goal of Safety-II is to learn from the realities of everyday work, which requires honest, unfiltered information from the frontline.10
Workers will only provide this information if they exist within a Just Culture that guarantees a fair, non-punitive, and learning-focused response.30
Just Culture creates the psychological safety needed to gather the rich data for Safety-II.
In turn, the valuable insights gained from Safety-II—which consistently show that workers’ adaptations are what make the system successful—reinforce the wisdom and necessity of maintaining a Just Culture.
You simply cannot have one without the other.
This new model also fundamentally changed how we viewed the return on investment (ROI) for safety.
Traditional safety programs have always struggled to justify their existence beyond the avoidance of direct costs like fines and workers’ compensation claims, forever branding safety as a cost center.1
The resilient ecosystem model completely reframes this calculation.
Investments in cross-training, learning teams, and better-designed systems are not just safety expenses; they are strategic investments in the organization’s overall resilience, flexibility, and adaptive capacity.26
A resilient organization is not just safer.
It is more efficient, more innovative, and better equipped to handle
any kind of disruption, whether it’s a safety incident, a supply chain shock, or a sudden shift in the market.
The adaptations that prevent accidents are often the very same innovations that improve productivity and quality.26
By cultivating a resilient safety ecosystem, we were no longer just managing a compliance cost; we were making a strategic investment in our organization’s long-term health and operational excellence.
Part IV: The Harvest: A Story of Transformation
Chapter 9: From Mechanic to Gardener: Putting the Ecosystem to Work
The true test of any new philosophy is not how elegant it sounds in a meeting room, but how it performs under pressure.
Our test came about a year after we began cultivating our “Resilient Safety Ecosystem.” It involved our automated powder-coating line, a complex and historically high-risk area of the plant.
The event began with a small, seemingly insignificant failure.
A valve on a solvent recovery unit began to stick intermittently.
In the old days of the “safety machine,” this story would have gone one of two ways.
In the first, the operator, fearing a lengthy shutdown and the wrath of a production-focused supervisor, might have tried to “jiggle the handle” or invent a risky workaround, leading to a potential chemical spill or exposure.
In the second, they would have followed the rigid procedure, shut down the entire line, and waited hours for a specialist from maintenance to arrive, costing us tens of thousands of dollars in lost production.
But this was not the old days.
The operator, a young woman named Maria, immediately reported the sticky valve through one of our new, redundant communication channels—a simple digital messaging board monitored by the entire production cell.
She didn’t fear being blamed for “breaking” the machine because our Just Culture (Pillar 4) had taught her that reporting problems was a valued contribution.
Because of our investment in Diversity and Redundancy (Pillar 1), the team on the line didn’t have to wait for a siloed expert.
A maintenance technician, who had been cross-trained in basic line operations, was part of their production cell.
He and Maria were able to quickly consult and diagnose the problem.
They recognized it was a minor mechanical issue, but one that could escalate if the line continued at full speed.
Here, Modularity (Pillar 2) kicked in.
Instead of a full shutdown, they were able to temporarily decouple the powder-coating line from the rest of the plant’s workflow.
The buffer of parts we had built into the system meant that the downstream assembly lines could continue working for over an hour without interruption, preventing the cascading panic that used to characterize any stoppage.
This gave the team the breathing room to implement a solution they had developed during a Safety-II Learning Team (Pillar 3) a few months prior.
They had discussed how to handle minor equipment faults without compromising safety or production.
They had a pre-planned adaptation ready.
They temporarily reduced the line speed by 30%, a level they knew would reduce the strain on the faulty valve while still allowing them to produce finished parts, and called for a dedicated repair technician.
When the technician arrived, he didn’t just fix the valve.
He and the entire production cell had a quick huddle to discuss what happened.
They learned that this type of valve had been sticking more frequently across the plant.
The technician, feeling psychologically safe to share information, mentioned that a newer, more reliable type of valve was available but that the procurement process to get it approved was slow and cumbersome.
The result? The sticky valve was fixed with minimal downtime.
But more importantly, we had turned a potential incident into our most valuable learning opportunity of the year.
The near-miss was a rich signal.
We learned about an emerging systemic risk with a specific component.
We learned that our procurement process was creating a barrier to improving safety and reliability.
We celebrated Maria for her quick reporting.
We celebrated the team for their brilliant, safe adaptation.
We used the data to justify an expedited, plant-wide replacement of the faulty valves.
This single event was the harvest of our new approach.
We saw improved morale and retention, as the team felt empowered and valued, not just like cogs in a machine.7
We saw enhanced productivity, as a potential multi-hour shutdown was reduced to a minor slowdown.7
Most importantly, we had tangibly reduced risk, not by writing another rule after an accident, but by proactively strengthening our system based on the leading intelligence that came from trusting our people and learning from their success.
Chapter 10: Conclusion: Your Workplace is Alive
My journey has taken me from one side of a philosophical divide to the other.
I began my career as a safety mechanic, armed with a wrench and a rulebook, convinced that I could engineer perfection into a complex human system.
I believed that if I could just make the machine perfect, it would never fail.
I was wrong.
The machine is always, inevitably, broken, because the map is not the territory and “work-as-imagined” is never a perfect reflection of “work-as-done.”
My failure, and the subsequent discovery of a new way of seeing, transformed me from a mechanic into a gardener.
I no longer try to build a static machine.
I now spend my days trying to cultivate a living, resilient ecosystem.
My job is not to eliminate variability, but to harness it.
It is not to command and control, but to nurture and empower.
It is not to blame people for failure, but to be endlessly curious about how they create success every single day.
This is my call to action for you—the leader, the manager, the supervisor.
Your workplace is not a machine.
It is alive.
It is a complex, adaptive system, full of brilliant, creative, and resilient people who are navigating challenges you can’t even see from your office.
Stop trying to control them with ever-thicker binders of rules.
Stop treating them as a source of error.
Start seeing them as your single greatest source of resilience and insight.
The future of safety—and indeed, the future of operational excellence—lies in this new paradigm.
It lies in building integrated systems that value human ingenuity and adaptive capacity over mindless compliance.1
It requires us to build a Just Culture where trust is the soil from which everything else grows.
It demands that we become students of our own organizations, learning as much from our daily triumphs as we do from our rare tragedies.
The ultimate goal is to create a workplace where safety is not a program that is bolted on, but a core value that is woven into the very fabric of every action, every decision, and every interaction.7
When you achieve this, you will have done more than just reduce your incident rate.
You will have cultivated an organization that is not only safer, but healthier, more innovative, more engaged, and profoundly more resilient to whatever challenges the future may hold.
Stop fixing the machine.
Start tending the garden.
Works cited
- Modern Workplace Safety Challenges: Why Traditional Approaches Fall Short – KPA, accessed on August 10, 2025, https://kpa.io/blog/modern-workplace-safety-challenges-why-traditional-approaches-fall-short/
- Challenging Traditional Workplace Safety Models | Proceedings – U.S. Naval Institute, accessed on August 10, 2025, https://www.usni.org/magazines/proceedings/2020/july/challenging-traditional-workplace-safety-models
- Establishing a Strong Safety Culture: Challenges and Solutions – OrthoLive, accessed on August 10, 2025, https://www.ortholive.com/blog/establishing-a-strong-safety-culture-challenges-and-solutions/
- Industry Insights: From Compliance to Culture. Strategies for Building a Safety-First Workplace, accessed on August 10, 2025, https://www.keesafety.com/guides/industry-insights-from-compliance-to-culture
- Compliance Culture: A Comprehensive Guide | SafetyCulture, accessed on August 10, 2025, https://safetyculture.com/topics/compliance-culture/
- Beyond Compliance: Creating a Culture of Safety – Rigid Lifelines, accessed on August 10, 2025, https://www.rigidlifelines.com/blog/beyond-compliance-creating-a-culture-of-safety/
- Beyond Safety Compliance: Nurturing a True Culture of Safety – SafetyDocs by SafetyCulture, accessed on August 10, 2025, https://safetydocs.safetyculture.com/blog/beyond-safety-compliance-nurturing-a-true-culture-of-safety/
- Why Creating a Safety Culture Is Better Than Relying on Compliance – Safeopedia, accessed on August 10, 2025, https://www.safeopedia.com/2/1217/safety/why-creating-a-safety-culture-is-better-than-relying-on-compliance
- Why Traditional Safety Programs Cannot Achieve Continual Improvement | EHS Today, accessed on August 10, 2025, https://www.ehstoday.com/safety/article/21908057/why-traditional-safety-programs-cannot-achieve-continual-improvement
- Safety-II: A Proactive Approach to Positive Outcomes | Johns …, accessed on August 10, 2025, https://www.hopkinsmedicine.org/news/articles/2023/01/safety-ii-a-proactive-approach-to-positive-outcomes
- blogs.cisco.com, accessed on August 10, 2025, https://blogs.cisco.com/our-corporate-purpose/sustainability-101-what-is-a-resilient-ecosystem#:~:text=A%20common%20view%20of%20resilient,change%2C%20pollution%2C%20or%20deforestation.
- Ecological Resilience | EBSCO Research Starters, accessed on August 10, 2025, https://www.ebsco.com/research-starters/science/ecological-resilience
- Ecological resilience | Definition, Thoery, Biodiversity, Adaptation …, accessed on August 10, 2025, https://www.britannica.com/science/ecological-resilience
- Ecological resilience – Wikipedia, accessed on August 10, 2025, https://en.wikipedia.org/wiki/Ecological_resilience
- Safety I and Safety II: An explainer, accessed on August 10, 2025, https://www.safetyandhealthmagazine.com/articles/25827-safety-i-and-safety-ii-an-explainer
- Systems Thinking: The Workplace System, accessed on August 10, 2025, https://www.cer-rec.gc.ca/en/safety-environment/safety-culture/safety-culture-learning-portal/human-organizational-factors/systems-thinking-workplace-system/systems-thinking-workplace-system.pdf
- Systems Thinking in Workplace Health and Safety: A Theory and Practice Nexus, accessed on August 10, 2025, https://www.researchgate.net/publication/377985671_Systems_Thinking_in_Workplace_Health_and_Safety_A_Theory_and_Practice_Nexus
- Applying Systems Thinking to Safe Operations – IRMI, accessed on August 10, 2025, https://www.irmi.com/articles/expert-commentary/applying-systems-thinking-to-safe-operations
- Chapter 12.1: Systems – The OHS Body of Knowledge, accessed on August 10, 2025, https://www.ohsbok.org.au/chapter-12-1-systems/
- How Systems Thinking Can Improve Safety Management – ASSP, accessed on August 10, 2025, https://www.assp.org/news-and-articles/how-systems-thinking-can-improve-safety-management
- Applying systems thinking to analyze and learn from events – Nancy Leveson, accessed on August 10, 2025, http://sunnyday.mit.edu/Safety-Science-Events.pdf
- www.hopkinsmedicine.org, accessed on August 10, 2025, https://www.hopkinsmedicine.org/news/articles/2023/01/safety-ii-a-proactive-approach-to-positive-outcomes#:~:text=Safety%2DI%20is%20an%20important,focusing%20only%20on%20negative%20outcomes.
- From Safety-I to Safety-II: A White Paper – NHS England, accessed on August 10, 2025, https://www.england.nhs.uk/signuptosafety/wp-content/uploads/sites/16/2015/10/safety-1-safety-2-whte-papr.pdf
- Safety I, Safety II, and the New Views of Safety | PSNet, accessed on August 10, 2025, https://psnet.ahrq.gov/primer/safety-i-safety-ii-and-new-views-safety
- Reimagining safety practices: from Safety-I to Safety-II – AMCS Group, accessed on August 10, 2025, https://www.amcsgroup.com/resources/blogs/reimagining-safety-practices-from-safety-i-to-safety-ii/
- From Safety-I to Safety-II: A White Paper – SKYbrary, accessed on August 10, 2025, https://skybrary.aero/sites/default/files/bookshelf/2437.pdf
- Blending Safety I and Safety II for Safer Workplaces – Intelex, accessed on August 10, 2025, https://blog.intelex.com/2025/07/17/afety-i-and-safety-ii/
- Patient safety in a ‘just culture’: Encouraging reporting and learning from errors – WTW, accessed on August 10, 2025, https://www.wtwco.com/en-us/insights/2024/08/patient-safety-in-a-just-culture-encouraging-reporting-and-learning-from-errors
- Just Culture Guiding Principles | Alberta Health Services, accessed on August 10, 2025, https://www.albertahealthservices.ca/assets/info/hp/ps/if-hp-ps-ahs-just-culture-principles.pdf
- Just Culture Guide – Safer Care Victoria, accessed on August 10, 2025, https://www.safercare.vic.gov.au/sites/default/files/2022-08/SCV-Just-Culture-Guide-for-Health-Services.pdf
- What Is Just Culture? Changing the way we think about errors to improve patient safety and staff satisfaction – Brigham and Women’s Faulkner Hospital, accessed on August 10, 2025, https://www.brighamandwomensfaulkner.org/about-bwfh/news/what-is-just-culture-changing-the-way-we-think-about-errors-to-improve-patient-safety-and-staff-satisfaction
- Making Just Culture a Reality: One Organization’s Approach | PSNet, accessed on August 10, 2025, https://psnet.ahrq.gov/perspective/making-just-culture-reality-one-organizations-approach
- An introduction to the ‘Just Culture’ concept in HSE, accessed on August 10, 2025, https://www.hse-network.com/an-introduction-to-the-just-culture-concept-in-hse/
- A Just Culture Guide – NHS Wales Performance and Improvement, accessed on August 10, 2025, https://performanceandimprovement.nhs.wales/functions/quality-safety-and-improvement/improvement/improvement-cymru-academy/resource-library/academy-toolkit-guides/a-guide-to-a-just-culture/
- Safety-I, Safety-II and Resilience Engineering – PubMed, accessed on August 10, 2025, https://pubmed.ncbi.nlm.nih.gov/26549146/
