Safety Science 34 (2000) 31±45

www.elsevier.com/locate/ssci

Cultural in¯uences on risks and risk

management: six case studies$
W. van Vuuren *
Faculty of Technology Management, Safety Management Group, Eindhoven University of Technology, PO Box
513, 5600 MB Eindhoven, Netherlands

Abstract
Ever since the accident at the Three Mile Island nuclear power plant on 28 March 1979, the
term `safety culture' has been a hot topic for both researchers and organisations. Both the
content and causes of a poor safety culture have been the focus of numerous research projects,
but also its consequences on an organisation's safety performance and the way organisations
should be `designed' to facilitate a `good' safety culture. Since others in this issue focus on the
content and causes of safety culture, this article focuses on its consequences from two di€erent
but inter-related angles. In the ®rst place, the cultural in¯uences on incident causation are
considered. In the second place, the cultural in¯uences on risk management, or speci®cally
incident reporting and analysis, are considered. Both angles are supported by empirical inci-
dent data collected in the Dutch steel industry and the medical domain. To collect this data, a
risk management approach called PRISMA was used. Further, cultural di€erences between
the domains investigated are highlighted and discussed. # 2000 Elsevier Science Ltd. All
rights reserved.
Keywords: Cultural in¯uence; Risk; Risk management; Case studies

1. Introduction

The study presented in this article was stimulated by Reason (1991). He concluded
that only after serious accidents such as the capsizing of the Herald of Free Enter-
prise and the explosions in the nuclear power plant of Chernobyl, has the impor-
tance of organisational and management factors as causes of incidents been
acknowledged. For decades the focus of safety-related research had primarily been
on the technical and human side of incident causation. In an overview given by

$
The study described in this article was supported by the HCM-programme on Human Error Prevention.
* Tel. +31-4024-72569; fax: +31-4024-37161.
E-mail address: [email protected] (W. van Vuuren).

0925-7535/00/$ - see front matter # 2000 Elsevier Science Ltd. All rights reserved.
PII: S0925-7535(00)00005-9
32 W. van Vuuren / Safety Science 34 (2000) 31±45

Wagenaar (1983) this predominance of human error (80ÿ100%) in accident research

is clearly demonstrated. Turner (1978) provided the ®rst step towards a broader view
on incident causation by placing human and technical failures in their social and
organisational context. He introduced the term `incubation period', which refers to
the period of time in which crises and disasters develop in a covert and unnoticed
fashion. Information diculties associated with attempts to deal with uncertain and
ill-structured safety management problems allow the disaster to develop until a
trigger event combines the predisposing factors into a single occurrence. Perrow
(1984) in his book on `normal accidents' claimed that some technical systems are so
complex and so tightly coupled that accidents are inherent in their design. Reason
(1990) has taken up the discussion started by Turner by distinguishing between
active and latent failures. According to Reason, the e€ects of active failures are felt
almost immediately, while the consequences of latent failures may lie dormant
within the system for a long time, only to reveal their true nature when combined
with other latent and active failure factors.
Though the in¯uence of organisational factors on incident causation has been
acknowledged over the past two decades, there is still a great need for tools for
detecting, describing and classifying organisational factors. This article will present
and discuss a taxonomy that was developed as a risk management tool for classify-
ing organisational failure factors of safety-related incidents. This taxonomy divides
organisational failure factors into failures related to the structure of an organisation,
failures related to strategy and goals, and failures related to the safety culture of an
organisation. The taxonomy has been applied in two case studies in the Dutch steel
industry and four case studies in the medical domain (both in the Netherlands and
the UK). This article will discuss the empirical data that were collected during these
case studies with a main focus on the cultural in¯uences on risks and risk manage-
ment. The in¯uences of structure and strategy and goals on risks and risk manage-
ment are addressed in the ®nal section of this article. Before discussing these topics,
the next section will give a brief overview of the methodology used to collect and
analyse the incidents and more importantly the de®nitions of culture and safety
culture used in this study.

2. Concepts and methods used

The taxonomy of organisational failure used in this study was derived from both
literature and empirical incident data. The resulting taxonomy was used as part of a
risk management approach called PRISMA, to classify the organisational root
causes of safety-related incidents. The development of the taxonomy, PRISMA, and
the added value of the taxonomy to PRISMA are discussed in this section.

2.1. A taxonomy of organisational failure

In order to develop the taxonomy, both an approach based on theory and an

approach based on empirical incident data were followed. The theory-based
 W. van Vuuren / Safety Science 34 (2000) 31±45 33

approach aimed at providing a theoretical framework for the taxonomy of organi-

sational failure based on existing literature. The empirical approach focused mainly
on empirical incident data and additional literature to further develop the actual
taxonomy.
In the previous section the lack of tools for detecting, describing and classifying
organisational failure factors is highlighted. Theory on organisational failure does
exist; however, it appeared to be scattered over di€erent ®elds of expertise. In the
area of safety, knowledge about the nature of organisational failure is limited and
mostly related to Reason's (1990) distinction between active and latent failures. A
review of literature in related domains, in particular the organisational change and
development literature (e.g. van de Bunt, 1978; Porras, 1987; Hoeksema and van de
Vliert, 1989), suggested a subdivision of organisational failures into the following
three groups:

1. failures related to the structure of an organisation;

2. failures related to the strategy and goals of an organisation; and
3. failures related to the culture of an organisation.

According to van de Bunt (1978), structure refers to the con®guration of the

organisation, and relates to the division of tasks, authority, responsibilities and
resources, to make the organisation function as eciently as possible. The strategy
and goals of an organisation need to ®t and adapt to the changing external envir-
onment in order to survive. Culture relates to the interpersonal relations between the
people working in the organisation. According to the organisational change and
development literature, these three groups cover the wide spectrum of organisational
problems found in organisations. Since on a root cause level safety-related problems
were not expected to be completely di€erent from the problems discussed in the lit-
erature used, these three groups were used as a theoretical framework for the
development of the taxonomy.
The second step involved an empirical approach to further develop the taxonomy,
based on the theoretical framework. For this empirical approach, empirical incident
data and literature of the three speci®c domains (i.e. structure, strategy and goals,
and culture) were used. Given the focus on safety-related incidents, literature on
culture was limited to safety culture only. The empirical input was based on 78
incidents from two studies in the steel industry, which were analysed according to
PRISMA. These analyses resulted in 498 root causes, of which 184 were organisa-
tional in nature.
An analytic generalisation strategy (Yin, 1994) was used to include empirical
incident data in the development process. According to Yin, a fatal ¯aw in doing
case studies is to conceive of statistical generalisation as the method of generalising
the results of a case. In statistical generalisation, an inference is made about a
population on the basis of empirical data collected about a sample. However, cases
are not sampling units and should not be chosen for this reason. Rather, individual
cases are to be selected as a laboratory investigator selects the topic of a new
34 W. van Vuuren / Safety Science 34 (2000) 31±45

experiment. Multiple case studies should be considered like multiple experiments.

Under these circumstances, the method is analytic generalisation, in which a pre-
viously developed theory or taxonomy is used as a template with which to compare
the empirical results of the case study. If two or more case studies are shown to
support the same theory or taxonomy, replication may be claimed. Based on this
strategy, the following iterative nature of `explanation building' was used to develop
the taxonomy:

1. make an initial taxonomy of the organisational causes of safety related inci-

dents;
2. compare the ®ndings of an initial set of incidents against this taxonomy;
3. revise the taxonomy;
4. compare the revision to the ®ndings of the next set of incidents; and
5. repeat this process as often as needed.

The theoretical framework presented earlier was used as the initial taxonomy.
Instead of changing the initial taxonomy after a single incident, a set of 15 incidents
was used for the ®rst revision, followed by sets of ®ve incidents. Since the taxonomy
was expected to be exhaustive, at least a variety of incidents from di€erent depart-
ments or disciplines were needed to increase the likelihood of complying with this
criterion after the ®rst revision. It is unlikely that one incident will highlight all
organisational problems. A set of 15 incidents was enough to collect at least one or
two incidents from each department involved. The additional sets of ®ve incidents
were needed to check if all types of organisational problems were indeed discovered.
Besides a check on exhaustiveness, the categories of the taxonomy were checked on
exclusiveness. Using the taxonomy, every organisational root cause should be clas-
si®able, but in one category only. The revision process was continued until new
incidents did not lead to new insights and changes to the taxonomy.
Besides empirical incident data, literature was used in de®ning the categories of
the taxonomy. According to Mintzberg (1983), p. 2, ``the structure of an organisation
can be de®ned simply as the sum total of the ways in which its labor is divided into
distinct tasks and then its coordination is achieved among these tasks''. A poor
division of work into distinct tasks and failing co-ordination among these tasks were
recognisable factors in many of the incidents discussed in this article. Mintzberg
(1983) views strategy as a mediating force between the organisation and its envir-
onment. Strategy formulation involves the interpretation of the environment and the
development of consistent patterns in streams of organisational decisions to deal
with it. Van der Bij et al. (1996) claim that, although an organisation's corporate
strategy hardly ever leads to safety problems on the shop ¯oor, it can result in con-
¯icting internal goals and priorities, which do lead to dangerous situations. In
industry, for example, production and maintenance plans are often con¯icting. This
often leads to the situation where maintenance takes place under unsafe conditions,
while production continues. Pidgeon (1991) sees culture as a system of meanings and
de®nes culture as the collection of beliefs, norms, attitudes, roles, and practices
 W. van Vuuren / Safety Science 34 (2000) 31±45 35

shared within a given social grouping or population. Turner et al. (1989) character-
ise safety culture as the set of beliefs, norms, attitudes, roles, and social and technical
practices that are concerned with minimising the exposure of employees, managers,
customers, and members of the public to conditions considered dangerous or injur-
ious. For e€ective risk management, a normative statement on the characteristics of
a good or e€ective safety culture is needed. Only then can decisions be made about
required changes to the system or organisation. According to Pidgeon (1991), a
`good' safety culture can be characterised by the existence of norms and rules for
handling hazards, the prevailing attitude toward safety and the organisation's
re¯exivity on its safety practice.
Table 1 shows the taxonomy of organisational failure that resulted from this
development phase (van Vuuren, 1998). The same taxonomy has also been applied

Table 1
Taxonomy of organisational causes of safety-related incidents

Main Subcategories De®nitions

Structure Task demands (OS1) Refers to failures related to the wrong ®t between the
capabilities of the worker and the demands of the job

Respondibilities (OS2) Refers to failures related to the absence or inaccurate

allocation of responsiilities among departments, groups
and persons

Skills and knowledge (OS3) Refers to failures resulting from inadequate measures
taken to ensure that situational or domain speci®c
skills and knowledge are transferred to all new or
inexperienced sta€

Working procedures (OS4) Refers to failures related to the quality and availability
of the working procedures within the department (too
complicated, inaccurate, unrealistic, absent, poorly
presented)

Supervision (OS5) Refers to failures related to the absence of supervision

on work with increased risks

Strategy and goals Management priorities Refers to failures resulting from management decisions
(OG1) in which safety is relegated to an inferior position when
faced with con¯icting demands or objectives

Safety culture Norms and rules for dealing Refers to failures resulting from the absence of explicit
with risks (OC1) or tacit norms and rules for dealing with risks

Safety attitudes (OC2) Refers to failures related to the collective beliefs about
risks and the importance of safety, together with the
motivation to act on those beliefs

Re¯exivity on safety Refers to failures to an inadequate learning of the

practice (OC3) organisation from its own safety experiences
36 W. van Vuuren / Safety Science 34 (2000) 31±45

in four case studies in the medical domain. The applicability of the taxonomy in a
completely di€erent domain is addressed in the ®nal section of this article.

2.2. PRISMA

To collect empirical incident data, a risk management approach called PRISMA

was used. PRISMA (Prevention and Recovery Information System for Monitoring
and Analysis) was developed to continuously and systematically monitor, analyse
and interpret incidents and process deviations (van der Schaaf, 1992, 1996).
PRISMA provides tools, which aim at building a quantitative database of incident
data, from which conclusions can be drawn to suggest optimal countermeasures.
The main components of PRISMA are:

1. The causal tree incident description method.

2. The Eindhoven Classi®cation Model of system failure.
3. The classi®cation/action matrix to suggest optimal countermeasures.

Causal trees (van Vuuren and van der Schaaf, 1995), derived from fault trees, are
very useful to present critical activities and decisions during the development of an
incident in a chronological order and to show how activities are related to each
other. By using causal trees it becomes clear that incidents are never preceded by a
single cause only but always by a combination of technical, organisational and/or
human causes. The main di€erence between a causal tree and a fault tree is that the
top event in a causal tree is not a class of events but one particular incident, which
actually occurred and for which the chain of incident causation must be discovered.
The data to generate a causal tree are primarily collected through con®dential
interviews with those involved in an incident. The interviews are `triggered' by (ver-
bal) reports that are sent in after an incident has occurred.
Once a causal tree is built, the root causes (those appearing at the bottom of the
causal tree) are classi®ed using the Eindhoven Classi®cation Model of system failure
(van der Schaaf, 1992). This model (Fig. 1) subdivides the root causes into technical,
organisational, human and unclassi®able causes. For every root cause the model is
used to determine its classi®cation. In this study, the correctness of the causal tree
and classi®cations was checked on two levels. Firstly, in every setting investigated
one to seven employees were involved in the incident analysis phase, in order to get
acquainted with PRISMA. Classi®cations of root causes were cross-checked with
these employees and adjusted where necessary. Secondly, the resulting causal tree,
including classi®ed root causes, was sent back to the initial reporter(s) of the inci-
dent involved for a ®nal check. Misinterpretations of the researchers were adjusted
this way. For the case studies discussed in this article the organisational part of the
Eindhoven Classi®cation Model, with only two categories, has been replaced by the
taxonomy of Table 1.
The ®nal step of PRISMA is to link the classi®ed root causes to the most preferred
countermeasures. For this purpose van der Schaaf (1992) developed a classi®cation/
 W. van Vuuren / Safety Science 34 (2000) 31±45 37

Fig. 1. The Eindhoven Classi®cation Model (van der Schaaf, 1992).

38 W. van Vuuren / Safety Science 34 (2000) 31±45

action matrix. In this matrix, each classi®cation category is linked to a preferred

action in terms of expected e€ectiveness. The actions suggested are related to
equipment, procedures, information and communication, training, and motivation.

3. Cultural in¯uences on risks

The cultural in¯uences on risks (i.e. incident causation) were investigated in two
industrial and four medical settings. The two industrial case studies were carried out
in the Dutch steel industry (i.e. a coke producing plant and a steel producing plant).
The medical case studies were carried out in an accident and emergency department
(A&E), an anaesthesia department, an intensive care unit (ICU) and an institute for
the care of the mentally handicapped (MH). The incidents were analysed according
to PRISMA, using the taxonomy to classify the organisational root causes. This
section will primarily focus on the root causes related to safety culture. Based on the
classi®cation of these root causes, the impact of safety culture on incident causation
is discussed. It is important to highlight though that the data presented should,
given the somewhat subjective nature of the categorisation process, be interpreted
semi-quantitatively. The values added to the individual classi®cation categories are
only indications of the relative importance of the di€erent factors. Both domains are
discussed separately, followed by an evaluation of similarities and di€erences.

3.1. Industrial incidents

The distribution of the root causes over the main categories of the Eindhoven
Classi®cation Model for the Dutch steel industry is presented in Table 2. Table 2
shows the number of incidents that were analysed (n) and the absolute and relative
contribution of the di€erent failure types. Worth noting is the considerable impact
of organisational failure on incident causation (35 and 40%) in these two settings. It
is important to highlight this result, given the traditional focus on human and tech-
nical factors as main contributors to incidents discussed earlier. Table 2 shows that
organisational failure factors (including those related to the prevalent safety culture)
should not be underestimated and require equal attention in an organisation's risk
management activities.
The second important observation is presented in Table 3, which shows the dis-
tribution of organisational root causes over the main categories of the taxonomy of
organisational failure. Table 3 shows the considerable contribution of a poor safety
culture to organisational failure (33 and 27%). In both cases cultural factors are the

Table 2
Distribution of root causes over main categories for the steel industry

Organisational Technical Human Unclassi®able Total

Case 1 (coke) 111 (35%) 67 (21%) 126 (40%) 13 (4%) 317 (n=52)
Case 2 (steel) 73 (40%) 46 (25%) 57 (32%) 5 (3%) 181 (n=26)
 W. van Vuuren / Safety Science 34 (2000) 31±45 39

Table 3
Distribution over organisational categories of taxonomy for the steel industry

Structure Strategy and goals Safety culture Total

Case 1 58 (52%) 16 (15%) 37 (33%) 111

Case 2 45 (62%) 8 (11%) 20 (27%) 73

Table 4
Distribution over cultural subcategories of taxonomy for the steel industry

OC1 OC2 OC3 Total

Case 1 4 (11%) 25 (67%) 8 (22%) 37

Case 2 1 ( 5%) 17 (85%) 2 (10%) 20

second largest group of contributing factors after failures related to the structure of
the organisation, which represents the majority of the organisational failure factors.
For e€ective risk management, the impact of the di€erent types of failures can
directly be translated into priorities for improvement. These improvements, how-
ever, should be based on an even more detailed insight into the di€erent failure
types. Table 4 provides such an in-depth view into the cultural failure factors that
have been detected.
Table 4 shows that the majority of the cultural failure factors (67 and 85%) are
related to safety attitudes of the people involved in the incidents. Frequently, enor-
mous risks were deliberately taken simply to gain a few minutes. In both plants, for
example, reporting to someone before starting a job or isolating the system was
regularly `forgotten'. The use of personal protection equipment (e.g. helmets, gloves,
safety glasses) was also often not taken seriously and considered to be an unneces-
sary burden, in particular given the hot working conditions. In these situations
people were aware that safety precautions and norms and rules for dealing with risks
were violated. However, performing the job this way had become accepted by a
group of employees and, unfortunately, in many cases also by the team leaders.
These collective beliefs about risks and the importance of following the safety rules
were often explained by saying that ``nothing ever happened'' or ``I know what I am
doing''. Unfortunately, the reported incidents showed otherwise. To maximise their

Table 5
Distribution of root causes over main categories for the medical domain

Organisational Technical Human Unclassi®able Total

Case 3 (A&E) 42 (45%) 3 (3%) 38 (41%) 10 (11%) 93 (n=19)

Case 4 (Anaest.) 21 (27%) 20 (26%) 31 (40%) 6 (7%) 78 (n=15)
Case 5 (ICU) 30 (30%) 8 (8%) 45 (46%) 16 (16%) 99 (n=21)
Case 6 (MH) 29 (41%) 3 (4%) 24 (34%) 15 (21%) 71 (n=9)
40 W. van Vuuren / Safety Science 34 (2000) 31±45

e€ectiveness, e€orts to improve the system's safety performance should focus on

improving the attitudes of employees and reducing the `blindness' for dangers in day
to day practice.

3.2. Medical incidents

Before discussing the results found in medicine, it should be noted that because of
the limited number of root causes involved in these case studies, the distributions
shown should be interpreted with even greater care than those for the steel industry
and should be merely seen as an indication of possible problem areas. Table 5 again
highlights the impact of organisational failure on incident causation. In the case
study carried out in the A&E, no less than 45% of the root causes appeared to be
organisational. These organisational problems were mainly related to the strong
interdependencies with other departments in the hospital and the low level of
knowledge and experience of junior doctors who run the department for most of the
time. The junior doctors were on a rotation program, working only 6 months in
each department.
If the organisational root causes are classi®ed according to the taxonomy, the
distribution shown in Table 6 results. Table 6 presents a similar picture to Table 3,
where cultural factors were shown to be the second largest organisational con-
tributor leading to incidents in the two case studies in the steel industry.
An in-depth view into the types of cultural factors that contributed most to
unwanted and sometimes unexpected human behaviour is presented in Table 7.
Similar to the case studies in the Dutch steel industry, the majority of these cultural
failure factors were related to the attitudes of employees towards the importance of
safety and the need for following safety regulations. In the A&E department for
example, junior doctors repeatedly stated in the interviews that they felt a cultural
pressure to refrain from contacting senior doctors during night-time. It was also
stated that X-rays were often taken as a matter of protocol only and used accord-
ingly. In the anaesthesia department and the intensive care unit, poor safety atti-
tudes mainly resulted in incidents related to checking the system or the patient (e.g.
the correct connection of tubes to the anaesthetic machine, or the correct connection
of drains when a patient was transferred from the operating theatre to the intensive
care unit). In the last case study, which was carried out in the institute for the care of
the mentally handicapped, residents were often left unsupervised in situations that

Table 6
Distribution over organisational categories of taxonomy for the medical domain

Structure Strategy and goals Safety culture Total

Case 3 22 (52%) 8 (19%) 12 (29%) 42

Case 4 9 (43%) 5 (24%) 7 (33%) 21
Case 5 12 (40%) 8 (27%) 10 (33%) 30
Case 6 9 (31%) 11 (38%) 9 (31%) 29
 W. van Vuuren / Safety Science 34 (2000) 31±45 41

Table 7
Distribution over cultural subcategories of taxonomy for the medical domain

OC1 OC2 OC3 Total

Case 3 2 (17%) 10 (83%) 0 (0%) 12

Case 4 2 (29%) 4 (57%) 1 (14%) 7
Case 5 3 (30%) 6 (60%) 1 (10%) 10
Case 6 0 (0%) 5 (56%) 4 (44%) 9

required close supervision (e.g. while taking a bath). Several incidents were also
related to a poor re¯exivity on the institute's safety practice. Incidents were not or
poorly communicated to departments with similar risk conditions.

3.3. Similarities and di€erences

In both domains the majority of the cultural root causes highlight a poor attitude
towards following existing and known safety regulations. An explanation might be
found in the type of tasks involved. The majority of the incidents were related to
routine tasks. One anaesthetist once said, ``when everything goes right, anaesthesia
is boring''. This lack of `excitement' or a lack of real incidents can easily lead to
situations in which safety procedures are taken less seriously. When nothing ever
happens, it is hard to stay fully alert and easy to reduce vigilance. Near-miss
reporting systems can be helpful in showing that incidents do occur on a regular
basis yet fortunately most often without negative outcomes.
No notable di€erences between the cultural in¯uences on risks in the two domains
were found. This leads to the conclusion that although both domains appear to be
very di€erent on a symptom level (i.e. what is happening), similarities are found on a
root cause level (i.e. why things happen the way they do). Given the variety of set-
tings investigated, this provides an indication of the general applicability of the
taxonomy.

4. Cultural in¯uences on risk management

The prevalent safety culture does not only a€ect behaviour on a shop ¯oor level. It
also in¯uences the priorities of management and their perception of human error.
Lucas (1991) distinguishes three models of human error that can be mapped onto

Table 8
Safety culture and models of human error (Lucas, 1991)

Organisational safety culture Predominant model of human error

Occupational safety management Traditional safety model

Risk management Man-machine mismatch
Systemic safety management System induced error concept
42 W. van Vuuren / Safety Science 34 (2000) 31±45

three major types of organisational safety culture (Table 8). Looking back at the
case studies, several indications were provided to determine the type of safety culture
and the model of human error at hand.
Lucas argues that `occupational safety management' concentrates on the safety of
the individual worker and encompasses such concepts as `safety-mindedness'. This
culture would typically accept a traditional safety model of human error where the
motivation of the worker who has erred is questioned. The `risk management' cul-
ture focuses on the safety of the system and uses a variety of engineering techniques
to identify hazards and to quantify risks of accidents. In case of human error, this
culture predominantly focuses on possible manÿmachine mismatches. The `systemic
safety management' culture may operate when a major organisational disaster has
occurred. This pro-active culture is concerned with the prevention of disasters
through planning and the development of corrective action plans. The correspond-
ing system-induced error concept relates to the idea that human failures are caused
by certain preconditions in the work context (e.g. poor procedure, poor equipment
design).

4.1. Observations from the case studies

In both domains, e€orts to improve safety performance predominantly focus on

the reduction of human and technical failure, without taking into consideration the
preceding organisational failure factors. Given Lucas' (1991) organisational safety
culture types, this would indicate an occupational safety management or risk
management approach, with their corresponding models of human error. The e€ects
of these management styles became evident in the way incidents were analysed.
Incidents were analysed in such a descriptive way (focusing on `who', `what', `where'
and `when') that only the highly visible human and technical factors were
discovered. A system-induced error concept would express the need for a more in-
depth analysis into the organisational preconditions leading to human and technical
failure (focusing on `how' and `why'). PRISMA, which is based on an in-depth
analysis of incidents, reveals these preceding organisational failure factors.
Managers in an occupational safety or risk management culture are not likely to use
methods that look beyond the highly visible human and technical factors at the end
of incident causation. Since these managers blame people or technical design failures
for problems, it is understandable that they do not look for other factors, particu-
larly when they themselves may be part of those factors. In a similar way, the model
of human error held by the organisation in¯uences the attitude of the employees on
the shop ¯oor towards incident reporting systems. During the case studies it was
stated regularly in the interviews that the perceived bene®ts of incident reporting
and analysis had a serious impact on the type of incidents that were reported. Inci-
dents due to organisational failures were rarely reported, since it was known that
``nothing would change anyway''. In the medical domain, incidents were often
reported for liability reasons only, not because doctors believed in the value of
incident reporting.
 W. van Vuuren / Safety Science 34 (2000) 31±45 43

4.2. Di€erences in risk management

Two important di€erences in applying risk management were pointed out by the
case studies. The ®rst di€erence deals with the organisational level from which
initiatives for risk management originate. In the steel industry, initiatives originated
from a management level and had their e€ect on the whole organisation. In the case
studies in the medical domain, the reverse was more common. The majority of the
initiatives arose at a shop ¯oor level and were often restricted to (a part of) the
nursing or medical sta€ only. These local initiatives were often not fully supported
by management. The expertise and resources needed to perform the initiatives
e€ectively were often also not available at a local level. As a result, most of these
initiatives led to sub-optimal results and missed opportunities for improvement.
The second di€erence deals with the focus for improvement. The medical domain
appeared to be highly `end-product' focused, meaning that assessment of quality of
care and learning was primarily based on the ®nal outcome of treatment given to a
patient. Attention was paid to the ®nal result but hardly to the process preceding
this result. The opposite situation was found in the steel industry, where the focus
for assessment and learning was primarily on the process. When looking at adverse
outcomes in medicine, only the tip of the iceberg is likely to be discovered. This not
only results in a very limited set of incidents but also in incidents that have resulted
in a negative outcome already. As Reason (1991) comments, this is ``too little and
too late''. A process focus not only provides more and di€erent information for
improvement; it also provides information in time to make recovery possible. Using
a product focus, mainly mistakes made at the sharp end become visible (e.g. a mis-
diagnosis by a junior doctor). However, contributing factors at the beginning of
incident evolution (e.g. stang levels, training and supervision, cultural factors, etc.)
may remain hidden.

5. Conclusions

Looking back on the empirical incident data that have been presented in this
article, several observations can be made. The ®rst is the considerable impact that
safety culture has on both incident causation and risk management. In particular,
the in¯uence on incident causation was shown in Tables 3 and 6. For risk manage-
ment, and incident analysis in particular, this highlights the need for an approach
that looks beyond the highly visible and explicit factors of incident causation and
also incorporates the far more hidden and implicit factors. The traditional focus on
human and technical failure needs to be replaced by a comprehensive approach that
also includes the organisational and cultural precursors of human and technical
failure.
Secondly, the case studies showed the value of PRISMA as such a comprehensive
risk management approach and its ability to detect the mostly hidden cultural fac-
tors. To obtain information about the organisational root causes of incidents, an in-
depth analysis technique is required. PRISMA provides the tools for such an in-
44 W. van Vuuren / Safety Science 34 (2000) 31±45

depth analysis of incidents. The case studies also showed the value of PRISMA as a
near-miss reporting and analysis approach. In particular, in organisations with low
accident rates, near-miss reporting can be a valuable tool for showing the daily
dangers of the workplace in order to prevent blindness for risks. Blindness may
result from being exposed to risks regularly and was shown to be a main contributor
to unwanted cultural behaviour.
Thirdly, although the emphasis of this article has been on the cultural in¯uences
on risk and risk management, the in¯uences of structure, and strategy and goals
should be given similar importance. The classi®cation model in PRISMA was
developed to classify causes on a root cause level, using categories that would clas-
sify organisational failure factors in one of the three main areas of concern (i.e.
structure, strategy and goals, and safety culture). Of course these three main types of
organisational failure interact during incident evolution. The incident data provided
several examples where cultural attitudes interacted or were even strengthened by
factors related to the structure, and strategy and goals of the organisation. Cultural
pressures to refrain from calling a senior doctor at night are likely to interact with
the way tasks are divided over junior and senior sta€. Senior sta€ only spent part of
their time on seeing patients and never worked night shifts, making it more dicult
to consult them at night. Similar links can be found for strategy and goals. In the
medical domain, management priorities resulted in reducing the number of beds on
wards and stang levels. As a result, work in the A&E department increased, since
patients could not be sent to a ward. With these high workloads it is likely that
procedures are taken a bit less seriously to gain some time.
Finally, the case studies did not reveal notable di€erences between the domains or
the individual settings investigated. For risk management this may mean that there
is no need for di€erent models in di€erent situations. Although on a symptom level
(i.e. focussing on `who', `what', `where' and `when') mainly di€erences appeared,
similar failure types were found on a root cause level (i.e. focusing on `how' and
`why').

References

Hoeksema, L., van de Vliert, E., 1989. Driedimensionaal kijken naar organisatieproblemen. M&O,
Tijdschrift voor organisatiekunde en sociaal beleid 43 (3), 181±191.
Lucas, D.A., 1991. Organisational aspects of near miss reporting. In: van der Schaaf, T.W., Lucas, D.A.,
Hale, A.R. (Eds.), Near Miss Reporting as a Safety Tool. Butterworth Heinemann, Oxford, pp. 127±
136.
Mintzberg, H., 1983. Structure in Fives: Designing E€ective Organisations. Prentice-Hall, Englewood
Cli€s, NJ.
Perrow, C., 1984. Normal Accidents: Living with High-risk Technology. Basic Books, New York.
Pidgeon, N.F., 1991. Safety culture and risk management in organizations. Journal of Cross-Cultural
Psychology 22 (1), 129±140.
Porras, J.I., 1987. Stream Analysis: A Powerful Way to Diagnose and Manage Organizational Change.
Addison-Wesley, Wokingham.
Reason, J.T., 1990. Human Error. Cambridge University Press, Cambridge.
Reason, J.T., 1991. Too little and too late: a commentary on accident and incident reporting systems. In:
 W. van Vuuren / Safety Science 34 (2000) 31±45 45

van der Schaaf, T.W., Lucas, D.A., Hale, A.R. (Eds.), Near Miss Reporting as a Safety Tool. Butter-
worth Heinemann, Oxford, pp. 9±26.
Turner, B.A., 1978. Man-Made Disasters. Wykeham, London.
Turner, B.A., Pidgeon, N.F., Blockley, D.I., Toft, B., 1989. Safety culture: its importance in future risk
management (Position paper for the Second World Bank Workshop on Safety Control and Risk
Management), 6ÿ9 November, Karlstad, Sweden
van der Bij, J.D., van der Schaaf, T.W., Bagchus, P.M., 1996. Organisatie-diagnose via de Kwali-
teitsincidenten Methode (Report EUT/BDK/79), Eindhoven University of Technology, Faculty of
Technology Management
van de Bunt, P.A.E., 1978. De organisatie-adviseur: begeleider of expert. Samsom, Alphen aan de Rijn.
van der Schaaf, T.W., 1992. Near miss reporting in the chemical process industry. PhD thesis, Eindhoven
University of Technology
van der Schaaf, T.W., 1996. PRISMA: A Risk Management Tool Based on Incident Analysis. In: Pro-
ceedings of the International Conference and Workshop on Process Safety Management and Inherently
Safer Processes, 8ÿ11 October, 1996, Orlando, FL, pp. 242ÿ251
van Vuuren, W., van der Schaaf, T.W., 1995. Modelling organisational factors of human reliability in
complex manÿmachine systems. In: Proceedings of the 6th IFAC Symposium on Analysis, Design and
Evaluation of ManÿMachine Systems, 27ÿ29 June 1995, MIT, Cambridge, MA, pp. 323ÿ228
van Vuuren, W., 1998. Organisational failure: an exploratory study in the steel industry and the medical
domain. PhD thesis, Eindhoven University of Technology.
Wagenaar, W.A., 1983. Menselijk falen (inaugural lecture). Leiden University
Yin, R.K., 1994. Case Study Research: Design and Methods, 2nd Edition. Sage, Thousand Oaks.