7.4 HIGHLY DESIRABLE ELEMENTS OF RISK-MANAGEMENT CULTURE

‘… an ideal safety culture is the engine that continues to propel the system towards the goal of maximum health, regardless of the leadership’s personality or current commercial concerns.’

The concept of a learning organisation embodies systems thinking, action research / action learning which, in turn, enable managers to develop situation awareness. Senge (1990: 14) stresses that a learning organisation is one that continually expands its capacity to create its own future.

Koffman and Senge (1995: 33) observe that in learning organizations, people are always inquiring into the systemic consequences of their actions, rather than just focusing on local consequences. They can understand the interdependencies underlying complex issues and act with perceptiveness and leverage.

In a learning organisation there is an inherent culture, which if accompanied by an awareness of risky situations is the ideal to which we should strive to create to facilitate highly effective risk management.

As Reason observes, in a learning organisation, this culture will exist regardless of the leadership’s personality or their current concerns about the direction of the organisation.

‘The power of this engine relies heavily upon a continuing respect for the many entities that can penetrate and breach the defences. In short, its power is derived from not forgetting to be afraid.’

Situation awareness involves a state of heightened sensitivity to what is going on, particularly attempts to breach the defences or safeguards we have put in place. To be effective risk managers, we need to be motivated and continually vigilant, as Reason notes ‘not forgetting to be afraid’. We also must not be afraid to act: at critical times we also need to exercise moral courage. See Section 5.5.2.5.

‘… to sustain a state of intelligent and respectful wariness is to gather the right kinds of data. This means creating a safety information system that collects, analyses and disseminates information from incidents and near-misses as well as regular proactive checks on the system’s vital signs … all of these activities can be said to make up an informed culture—one in which those who manage and operate the system have current knowledge about the human, technical, organizational and environmental factors that determine the safety of the system as a whole. In most important respects, an informed culture is a safety culture.’

According to our metaphor above and our mapping in Chapters 2 and 3, we must be aware of where to look and set in place the intelligence-gathering systems that might inform us of what is happening, that is, systems that will collect, analyse and disseminate information. However, this informed culture is best achieved through each of us having (at the appropriate level of aggregation) a systems view built on a strong appreciation of causality.

Senge (1990: 126) and Senge et al. (1994) explain that the art of systems thinking lies in being able to recognise increasingly (dynamically) complex and subtle structures, … amid the wealth of details, pressures, and cross currents that attend all real management settings. In fact, the essence of mastering systems thinking as a management discipline lies in seeing patterns where others see only events and forces to react to.

In all forms of management, regardless of what risks may be involved, we must never assume that the information will simply and automatically come to us. It will not normally come, though (ideally) in a learning organisation, if we can create such an organisation, it just might through acts of unreserved sharing. More frequently, we will have to fight hard to win the information we need. It is better to direct energies to building a learning organisation that shares what it knows rather than perpetuating one that jealously guards what it knows. See Sections 1.10-1.12. Unlike an organisational safety context, in risk management, setting up the necessary procedures and reporting mechanisms may not be logical extensions of what people do daily or routinely in the organisation. There will always be some things we cannot legislate against. It should be noted that in many risky situations in organisations, and in project management teams, risks are endogenous, that is, they come from within, a product of the ways people think and act.

‘Any safety information system depends crucially on the willing participation of the workforce, the people in direct contact with the hazards. To achieve this, it is necessary to engineer a reporting culture—an organizational climate in which people are prepared to report their errors and near-misses.’

Willing participation of all involved cannot be assumed, though in our model of risk management we aim to establish participatory management as the normal situation and the ultimate goal would be to create a learning organisation. Noting that there can be potentially belligerent or non-aligned gatekeepers in any organisation, we are most likely to need effective stakeholder management. See Section 4.7. This is as essential as effective communication and building commitment to enact chosen risk-management strategies, as was identified in IISD. See Chapter 5. We have seen that things can go desperately wrong, even though they might appear relatively ‘normal’. To do something, to take action when we see what we know to be wrong or potentially risky (or dangerous) demands we exercise moral courage. See Section 5.4.2.5. To encourage others to exercise moral courage, we managers face the continual challenge of building an environment in which such exercise is not associated with punishment and blame—rather it is supported by trust, honesty and respect.

‘An effective reporting culture depends, in turn, on how the organization handles blame and punishment. A ‘no blame’ culture is neither feasible nor desirable… What is needed is a just culture, an atmosphere of trust in which people are encouraged, even rewarded, for providing essential safety-related information—but in which we are also clear about where the line must be drawn between acceptable and unacceptable behaviour.’

See above. A learning organisation attempts to achieve many of the elements of what Reason describes as a just culture. However, in many risk-management situations, it is not possible to identify what are acceptable and unacceptable ways of behaving because it is thinking rather than behaving, per se, that creates the main problems for risks management. Risks, for example, may be created by strategies for investing money or going about a project.

To understand how this may impact on what individuals might do or say in an organisation, we need to appreciate systems of meaning, and those things that might militate against the honest application of those systems of meaning. These include cognitive dissonance, systems of knowledge-power, groupthink, and culture of denial.

‘Evidence shows that high-reliability organizations—domain leaders in health, safety and environmental issues—possess the ability to reconfigure themselves in the fact of high-tempo operations or certain kinds of danger. A flexible culture takes a number of forms, but in many cases it involves shifting from the conventional hierarchical mode to a flatter professional structure, where control passes to task experts on the spot, and then reverts back to the traditional bureaucratic mode once the emergency has passed. Such adaptability is an essential feature of the crisis-prepared organization and, as before, depends crucially on respect—in this case, respect for the skills, experience and abilities of the workforce and, most particularly, the first line supervisors. But respect must be earned, and this requires a major training investment on the part of the organization.’

A flatter more flexible structure is a characteristic of a learning organisation, as is a strong focus on sharing knowledge and understanding in an honest, fair and open environment. However, it is not always possible to achieve this learning organisation structure when exacting, demanding and highly stressful tasks are performed, such as training for counter terrorist operations. Frequently, the ways of doing things must be codified and institutionalised and very high levels of skills achieved through exceptional teamwork. To perform repeatedly with safety, that is with appropriately low levels of risk, demands high levels of competence that come from extensive training and retention of currency in those skills. This training must be accompanied by an understanding of the skills and knowledge that others in the team possess. We have seen where unreasonably high levels of reliance on a dominant stakeholder led to failures by others, those in important managerial positions, to understand and manage the risks.

‘…an organization must possess a learning culture—the willingness and the competence to draw the right conclusions from its safety information system, and the will to implement major reforms when their need is indicated.’

It is no coincidence that the empirical research underlying this book (McLucas, 2000a; 2000b; 2000c, 2000d, 2001) and the cases at Chapters 2 and 3, found that there were repeated failure to learn and hence failures to manage the risks involved with what people were doing. To be more effective in risk management, we need more effective ways of thinking about and visualising complex problems, that is, systems thinking, developed and exercised through heightened situation awareness.