The Safety of Work

Ep. 5 Can increasing uncertainty improve safety?

Episode Summary

On today’s episode we discuss whether increasing uncertainty can improve safety.

Episode Notes

Tune in to hear us talk about this topic in the context of the paper we chose to reference this week.



“If you don’t understand the question or you don’t understand the problem well enough, then you’ve got very little chance of coming up with a good solution.”

“We need to take action that deliberately encourages introduction of contradictory information...breaking consensus, not forming consensus.”

“The responsibility is on the organization to provide the right psychological environment for people to speak up.”


Grote, G. (2015). Promoting safety by increasing uncertainty–Implications for risk management. Safety science, 71, 71-79.

Episode Transcription

David: You’re listening to the Safety of Work podcast episode five. Today, we’re asking the question, can increasing uncertainty improve safety? Let’s get started.

Hi everybody. My name’s David Provan and I’m here with Drew Rae from the Safety Science Innovation Lab at Griffith University in Australia. Welcome to the Safety of Work podcast. If this is your first time listening, then thanks for coming. The podcast is produced every week and the show notes can be found at In each episode, we ask an important question in relation to the safety of work or the work of safety and we examine the evidence surrounding it.

Before we get to today’s question, for those of our listeners that are still having their withdrawals about DisasterCast and if they having it made worse by hearing Drew on another podcast with me, I’ve got some good and some bad news. The good news is that we’re going to mention at least four or five disasters to frame today’s question, but the bad news is is that at the moment, I’m probably going to be the one talking about them. Before we get to that, Drew, what’s today’s question?

Drew: The question for today, David, is can increasing uncertainty improve safety? I don’t want to say too much about it because that’s a pretty cool question just standing on its own. We’ve got a bit of an assumption in safety, whether we think about this consciously or not.

Most of our safety practices are really aimed at taking uncertainty and bringing it under control. They’re trying to reduce uncertainty. Yet, every time we assess risk, we try to take it from these vague notion into something that we either quantitatively or semi-quantitatively got a handle on. We’re putting things into categories, we’re taking variable behavior, and we’re trying to put into rules, procedures, and checklists. All of this is about reducing uncertainty, the idea being that a certain world is a safer world.

The paper that we’re looking at today challenges that. It tries to make the exact opposite argument, trying to say that sometimes increasing uncertainty can improve safety. That’s the question that we’d like to answer.

David: That’s a big question for today, Drew, and I’m excited about tackling a question such as this. Right off the bat, we know that this is a difficult conversation for your organization and it’s probably even a difficult thought process for some of our listeners, at least when I first read the paper. It challenged what I hadn’t really thought about too much in my career. It’s just the way that we did safety, which was to try to reduce the uncertainty to do with work. You might be asking, how could uncertainty possibly be good for safety? That’s what we’re going to try to talk through with this paper.

The paper we’ve chosen for today is titled, Promoting safety by increasing uncertainty – Implications for risk management. The author is Gudela Grote, she’s a professor at ETH Zurich, which is a university in Switzerland. She’s very active in the safety science and [...] engineering communities. However, this paper is more of what we call a theory paper. Drew, do you want to give us your thoughts on the role of theory papers in the safety science literature?

Drew: Sure. I have to admit, I’m feeling a little bit guilty because when we set up the podcast, our though was we going to take research evidence and share it, and we’re only at episode five and already we’ve got this paper that we both looked at and go, “Hey, we’ve got to talk about this on the podcast.” We both looked at it and we realized, “Hold on. This paper doesn’t actually have any new data or evidence of it’s own.”

You get this a lot in safety. I thought the first thing I might do is just mention, how do you tell when your reading a theory paper and when you’re reading an evidence paper? There are two clues we look for. One of them is in the abstract of the paper. That’s the 250 words, typically, that comes at the start. We look for keywords like “argument,” and that’s definitely in this paper. It says, “This paper makes the argument...” That’s an immediate clue that this is going to be the author giving us theory rather than giving us evidence. So, you get those suspicions from the abstract. The next thing you do is go and look to see if the paper has a method section. Pretty much, any paper that has a method section is based at least of some sort of collection and analysis of data. If it doesn’t have method section, then it’s a theory paper.

Even within that they there can be quite a range all different things. Just because something’s a theory doesn’t mean that it’s not evidence based, doesn’t mean that it’s wrong. We need to consider what theory is, is its sense-making. It’s taking the data that’s already out there and it’s trying to provide patterns over the top of that data. If people do it well, it ticks two boxes. The first one is, after we’ve read the theory, we go back and we’re seeing the data in a new light. It’s explaining what we’ve already seen but explaining it in a way that makes us have new insights and new ideas.

The test of a really good theory is whether it gives us new questions. If immediately after reading the theory we want to go out and collect more data because we’ve got new and better questions, then the theory has done its job well. Without theory we don’t tend to turn data into usable things and our questions never get any better. But I do think in safety science particularly, we’ve got a bit of an overburden of theory. We’ve got too much theory and once that gets to that point, it’s not really explaining or interpreting the data. It becomes people just giving us their opinions.

In this particular case, I do think that this is a paper which transforms the way we think a couple of activities and it does result in a couple of new, better questions at the end of it. That’s certainly what I found interesting about it. David, how about you?

David: Yeah, exactly Drew. I also look in theory papers for just the weight of literature and like you said, the way that the author recollects that literature around certain central arguments where it makes sense, and particularly when the literature that they’re citing is very well-known and very credible research studies or very credible authors as well. Gudela Grote did a good job of referencing quite extensively when she was making her argument.

Drew: [...] just on that. Then there are pick-ups of referencing as well. One thing that you worry about is where theory is just referencing other theory. So, you evidence that this is a good idea is that you’re ripping off someone else who has similar ideas. You go down the rabbit hole and you never actually get to data.

In this particular one, actually, what Grote’s doing is it’s almost like a literature review of empirical studies. She’s saying we’ve got all this information out there, some of it’s from field work, some of it’s from experiments. How can we put this together in order to think about it? She’s not just rehashing other people’s theory work.

David: The introduction of this paper goes straight into talking about this question about uncertainty and safety by reflecting on some major accidents. I think, Drew, you mentioned in episode zero that we want to use accidents as framing devices, so here it goes.

The paper quoted that the 2012 official report into the Fukushima disaster in Japan, the Fukushima government investigation claimed Japanese culture as the root cause of the nuclear disaster. They specified that the ingrained conventions of the Japanese culture, their reflective obedience, their reluctance to question authority, their devotion to sticking with the program, their groupism, their insularity. These are all words the Japanese government used. These were not outsiders who label the Japanese as having these cultural traits, but they believe that these traits have led to the many faulty decisions before, during, and after the Fukushima catastrophe.

The introduction then goes on to talk about the NASA incidents, Challenger and Columbia, in the now infamous O-rings and foam strikes. So, these problems with the space shuttles that were known amongst engineering departments and known amongst people in the organizations but that were unable to be surfaced due to rigid processes, quantitative risk acceptance, and going back to the question, is this emphasis and focus on certainty, such that the organization didn’t want to stay in the question, didn’t want to acknowledge uncertainty, definitely didn’t want to hang around. And if something couldn’t be proven to be unsafe, then by definition it must be okay and it must be safe.

On the positive side, we’ve seen in 2009 disaster avoided through uncertainty and decision latitude in the case of American Airlines 1549 that Captain Sullenberger landed on the Hudson river. So, we’re seeing in these major incidents and near incidents, had the organization looks at either try to eliminate uncertainty in the operation or provide a certain amount of latitude and decision-making within uncertainty can lead to outcomes. Obviously these incidents have had many, many causes and contributing factors, but it was quite interesting the way that she framed her argument around these major accidents.

Drew: It is a really interesting phrase that you just used. I’m not sure if that’s your own or from the paper. This idea of staying in the question, is that yours?

David: I think we talked about that a little bit in safety definitely in the last 5 or 10 years of my career. It’s like if you don’t understand the question or you don’t understand the problem well enough, then you’ve got very little chance of coming up with a good solution. So staying in the question, staying in the problem for as long as you need to to make sure you really understand it is a very worthwhile thing to do. But organizations are often very geared around not wanting to have problems that don’t have answers.

Drew: Thanks for that because that ties in fairly well to Grote’s central argument that runs through the paper. She’s not saying that we would always be uncertain. This not a diatribe in favor of long-term uncertainty.

Really what she’s saying is that eventually we want uncertainty. Eventually we’re going to have to make some decision or we’re going to take some action, and that space of possibility is going to collapse down into a single point of view. The more space we leave open, the more we’ve got the ability to collect information, to get a hold of different points of view, to consider different options. Ultimately, that’s going to make us have a better decision or action than if we collapse down into a single option or a single point of view too quickly.

She’s not saying stay uncertain forever. She’s saying avoid rushing into uncertainty. That may take some steps to maintain uncertainty for awhile.

David: Yeah. I think Dave Woods talks about that a lot, that organizations need to assume that their initial situation assessments are wrong. They need to assume that their models of risk aren’t going to be reliable for very long. Being able to understand that everything you think is, to some extent, uncertain actually gives you the opportunity to revise your model of risk, to revise your situation assessment, and to not discount new information that becomes available in your operation, particularly as our systems become far more complex.

Drew: If you’ll forgive me using a computer science analogy, let's see how this one works. There’s a well-known problem when we’re trying to get machines to learn how to solve problems, doing neural networks, artificial algorithms, and things like that, as this idea of a local minimum.

If you’re looking for the lowest point in a landscape and all you do is just rush down hill, you’ll eventually get to this point where going any further requires going uphill again. That doesn’t necessarily mean you reached the lowest spot. It just means you’ve reached a relatively stable spot where it looks like you’re fairly low. If only you could add a little bit of randomness in the situation, a bit of willingness to go uphill a little bit, you discover that you’re not at the lowest point. You’re just in a tiny, little dip in the ground and there is a much better, deeper valley just a few steps away.

Adding that period of uncertainty, period of knowing we haven’t yet necessarily found, or provide answers, or the best solution, we’re going to wander around a little bit more, can lead to going from a solution that looks okay, to discovering that there are better options.

David: Sorry for our listeners. We had a bit of a theoretical conversation there about complex systems, uncertainty, information, and just think computer science, but I think it worked okay. It’s a bit theoretical, but there’s a really practical way that this all matters for making good decisions. Tell us about the practical ways that this all matters.

Drew: One of the most obvious ways in which you have uncertainty is where you have differences of opinion. Grote talks a bit about the idea of challenging authority. When people argue, that’s inherently having uncertainty because you’ve got different voices, multiple opinions, multiple answers. The space where uncertainty is encouraged, where consensus doesn’t need to be reached quickly where it’s okay to say, “No, I disagree,” means that we bring out different courses of action and we allow tolerance for the fact that people may make different choices than us. Those different choices may at times be better choices.

The first way that Grote says we need to allow uncertainty, is we need to take action that deliberately encourages introduction of contradictory information, introduction of contrary opinions, breaking consensus, not forming consensus. She also suggests that this big trade-offs that we might want to consider and the uncertainty gives us more space to talk about and negotiate these trade-offs.

David: She talks about stability and flexibility and she also talks about control or accountability. I think she actually talks about them as stability versus flexibility and control versus accountability. For the first one, the trade-off between stability and flexibility is on reducing uncertainty through standardization and automation. This is what we see a lot in high-risk industries and particularly, highly-automated industries like aviation and so on, where she referred back to [...], three different types of industries and how that kind of place [...] organizations needing to have stability and flexibility.

On the flexibility side, she said it was really important that organizations develop that capacity to cope with uncertainty. It’s very different if your an aviation company and you’ve got some more predictability than, say, your healthcare organization in an operating [...]. One situation you can try to manage with stability as much as possible, but another situation such as the operating [...], it beats very hard to manage through stability and you need to teach people to cope with flexibility.

When we get to the practical ideas like Drew said, this isn’t a choice between one or the other. This is a balance and this is where you see it in your industry and your organization. Do you have any thoughts on stability and flexibility, Drew?

Drew: I guess my immediate thought was the concept they use sometimes in human factors called requisite variety, which is the number of different circumstances and behaviors your system can exhibit requires a certain amount of group variety inside the system. A system that’s got lots of different parts moving inside it that aren’t all moving in unison, that aren’t all tightly coupled, gives your system more behaviors.

[...] the humans are the ultimate flexible system because we’re so complex inside. You can’t just neatly model what we’re going to do. We got many different options, sometimes we are fighting against ourselves inside our own minds. And that’s what gives us such a variety of different situations we can cope with it [...]. That’s where the pay-off is, is that also makes us incredibly unreliable with system components. We are not remotely what you consider as stable and predictable, but we are very flexible.

David: Yeah, I do really love that saying, that people in our systems are high performance but unreliable components, and it’s funny that in many of our systems and even in many of our safety practices, we try to make people like machines and try to make machines like people, rather than trying to position them within their [...] technical system in a way that actually maximizes the different capabilities that automation has and the capabilities that humans have.

Drew: And it’s certainly a trade off that we do make, in that the more we try to get humans to become more predictable, the less we are making use of their capacity to deal with uncertainty and to deal with unpredictable situations.

David: The second trade-off that Grote talked about was control versus accountability. Here, she introduced this discussion about power and power might be something that we talk about in a future podcast. What she talked about was that often, when organizations are trying to trade-off between stability and flexibility, they transfer accountability for making things happen to less powerful people in the organization that actually can’t control the outcome that the organization expects them to control. We also see the [...] engineering literature when we talk about the authority responsibility double bind. We actually hold people responsible for something, but they just don’t have either the social organizational authority to make it happen.

A clear example for our listeners might be where organizations hold the safety professional responsible for either the company’s safety culture or the company’s safety performance. In these systems where you try to balance stability and flexibility, it’s really important to match that with an understanding of control versus accountability, who can control what, and how are you holding people accountable for the things that they can meaningfully have control over.

Drew: I think there’s a definite risk we run, that giving people flexibility and then holding them accountable for outcomes they can’t control, isn’t really giving them flexibility. That’s why little organizations did not comply. We’ve given people autonomy. We’ve given them the option why they’re just sticking to the formula. We gave them a choice. How come they always make the same choice? It’s because you may have given them a choice, but you got to hold them accountable and the only safe option is to always do the same thing.

David: Yeah. So Drew, if we think about practice now and we’re thinking about actually increasing uncertainty in practice, if one of our listeners is sitting there thinking, “Oh, gee. Actually, everything my organization does is about eliminating uncertainty. It’s all really prescriptive and we really quantify everything. We don’t want to even encourage a debate where we might not be doing something right or the right way. Our people really don’t have a say in what happens.” How would they start by introducing uncertainty into their organization around safety?

Drew: [...] where I would start, which is by acknowledging that if you’re feeling a little bit uncomfortable about the idea of deliberately increasing uncertainty, and that’s really a very reasonable thing to feel, and if you don’t feel it, it’s certainly a very reasonable thing for other people in your organization to feel. Certainly at a higher risk setting, when we talk about increasing uncertainty, we are genuinely talking about reducing stability and control. That is rightly something that people want to be cautious about because they feel a genuine and authentic need for stability, and a genuine and authentic need to be in control.

There’s a lot of research cited in the paper that suggests that putting too much emphasis on stability and control does lead to less optimal safety outcomes. There’s a choice we’re making here is that stability and control may in fact be bad for safety. We may, in fact, do accept some of these more uncomfortable situations, perhaps even more precarious situation if what we want is the most optimal outcome for safety, particularly in a complex and dynamic system.

It was little bit [...]. So practically, what do we mean? First one is designing flexible rules. Increasing uncertainty by giving people the freedom to make decisions and take a variety of options, rather than specifying one particular course of action. One practical way you can think about this is to look at the rules and think about three different types, and what type of rules you’ve got currently. An action rule is what you use when you require stability. Prices will give you a little bit more flexibility. Gold-based rule is the ultimate example of flexibility. David, maybe you could take us through some examples of these three different types of rules and how they give more or less flexibility.

David: I’ll give some examples and then I want to tell a story about some work that we’ve done that is going to help our listeners to understand this practically a little bit more. The first one of an action or a state rule which is something like, “Do not work at height without fall arrest equipment.” So, action state. If you’re going to take the action of working height, you must have this type of having fall arrest equipment on site. It’s very clear. But we all know those situations when to achieve a certain task at heights that might not be possible and they may need to be other control measures stored up. If you’ve got that rule, then clearly there’s no flexibility around that in your organization.

You might have a process rule, which might be something like, “Obtain a permit to work before commencing these type of high-risk activity.” That’s not going to tell you what actions you need to take or what controls, but it’s going to lead you through a process to hopefully design that for the particular context that you’re about to face.

Then, there is a goal-based rule where there’s no specific process or actions that are prescribed, which might be manage your safety risks as low as reasonably practicable. Choose a process to do that, choose the actions you need to do, but that’s the goal that you need to achieve. Not much about general obligations in legislation are goal-based. Ensure a safe system of work. For example, an organization put processes and actually rules in place to try to achieve those goals.

I want to tell a quick story, Drew, because this is a good one from around stability and flexibility. I’m working with a company that used concrete saws, did a lot of cutting with concrete saws and had a very stable workforce. People have been doing that for 15 years. There was a newish type of saw that the manufacturer had shown from an engineering point of view was safer in certain applications. It didn’t bite as much, it reduced the risk of kick back. From a side-by-side manufacturing engineering analysis was a safer tool. The organization struggled because most of the workforce wanted to use the old saws that they’ve used for 10 or 15 years. So, they put in a rule that these types of activities all had to use the new saw because it was “safer.”

We’re actually involved in a learning team to try to understand why people weren’t following that rule. It was really interesting because when talking to the group, they were like, “No, we don’t really care what the manufacturer said. We feel much safer with our experience in using the saw. We know exactly how it’s going to handle, we know what it can do and what it’s capable of doing.”

I was really a bit confused and I haven’t experienced that type of confusion in my career, which is like you said, how do we stay in the question about consensus? There were clearly two different views and I don’t think it’s clear which is right or wrong. Is the lesser safe piece of equipment with a whole lot of experience safer than a more safe piece of equipment for someone with less experience on that tool?

What we actually did then was we changed that rule to just be flexible. You can use this saw or that saw, whichever you feel safer and more experienced and capable of using. So, we just changed it to a process rule that was around selecting a rule. That’s [...] a little bit how you can maybe practically move a little bit away from stability towards flexibility. But hopefully, our listeners can see has something like that might actually create an environment where some decision latitude might actually improve the safety of their operation.

Drew: And I think it’s important to emphasize here that we’re not talking about making a rule and then giving people flexibility to violate it. We’re talking about thinking at the level of which you want to make a rule so that everyone is comfortable and has the right amount of variability whilst comply with the rule.

David: Yeah, and I think Grote, in the paper, she actually goes to fairly strong links to point out exactly what you said. It’s not about providing leeway when you follow a rule or when you don’t. It’s about expanding the latitude within a rule or the framework around a rule. Always talking about the education, training, and supervision that has to go along with how to apply it. Obviously, if you’re changing your approach to procedures and rules within your organization, to provide more context-dependent decision-making latitude, then you need to help people understand how to work within that.

What you said earlier, Drew, people won’t necessarily immediately know what the organization expects of them and then your need that supporting culture that she says is built on confidence, trust, and fairness. You’re relying on people to make good decisions, then how do you have the competence, the trust, and the fairness in your people that they got to be able to make those decisions and they’ve got to be supported in the decisions that they make.

Drew: We move on to the second [...] from the paper. First one was around rules. The second one is around supporting speaking up. This is something that we took a heck of a lot about in safety and not ways very constructively. I certainly run into, and I’m sure you’re the same, David, with lots of programs that is supposedly about encouraging speaking up. I think there’s actually out there a program, Speak Up For Safety. If you see something or say something, safety is in your hands.

Thankfully, that conversation has moved on from spending lots of time encouraging people to speak up, to recognizing that the responsibility is on the organization to provide the right psychological environment for people to speak up. That requires thinking about things like care, trust, and psychological safety.

Great talks about a study about why air crews in European commercial airline are quiet, why they don’t speak up. It’s interesting because the study breaks up the different roles that people have and the reasons they gave for not speaking up.

It’s really interesting the way the reasons shift whether you’re talking about the captain of an aircraft, or the first officer, or the [...], or the flight attendant. You just looking at the first role here. How many captains don’t speak up because they’re worried about their status? Zero. How many flight attendants don’t speak up because they’re worried about their status? 40%. And then your first officer is placed somewhere in the middle. Obviously, the lower status you have, the more likely it is that your lack of power is why you don’t speak up.

David: I think, Drew, that in that table the results and going back to the methodology of the paper, I like it when theory papers actually publish the data of other studies within the context of their argument, so Grote’s paper pasted the data from another study directly into her paper.

How many captains don’t speak out because of fear of punishment? Zero. The captain goes on, “I can speak up whenever I want. I’m never going to get punished for speaking up.” But 81% of flight attendants won’t speak up because of fear of punishment.

This goes back to this control versus accountability. The further down you’re getting the organization from a power point of view, the most fear and the more difficult it is for people to actually do the things that you’re asking them to do.

Drew: Just pulled out one of the numbers from that table that I think is interesting, is how many captains are concerned about fear of damaging relationships? This is sort of the flip side of power, is that the lesser you become concerned with your own status, the more you become concerned about hurting the feelings of others and damaging your relationship with your subordinates. That becomes the important reason not to speak up.

David: Yes, so the chief practical ways that can introduce uncertainty into operation is thinking about hey you set boundaries around your operations through rules and procedures and how much flexibility you allowed within your rules and procedures for safety. Another way to get uncertainty to, I suppose, be considered by your organization is to create more of an environment where people can talk openly, share ideas, and like we said, stay in a problem, get a diversity of views, and spend more time trying to understand the issues.

It’s only taken us about five podcasts and you said earlier this is more of a theory paper than we thought we’d be talking about, but we ask the question, can increasing uncertainty improve safety? And you see immediately how this question already starts to overlap with other questions we’ve asked. For example in episode two we asked, why people break rules, and we talked about some similar things around rules there. And in last week’s episode four, we talked about what’s the relationship between trust and safety. Now, it’s time to talk about speaking up.

So, you see that even though we’re talking about one paper, or one or two papers, or one or two questions each week, we’re going to start to see these big Venn diagrams of all of these overlapping questions and overlapping issues, which is why safety becomes so hard for us to make sense of simply within organizations because of all the overlapping questions and issues. I spoke to someone the other day about whack-a-mole. It’s almost like you knocked down one mole and then it pops up somewhere else if you don’t quite get it right and get all the considerations of what you’re doing well understood.

Drew: We started this discussion by saying that we were talking about a theory paper because we thought that theory papers can help give you a slightly different point of view and they can help to ask better questions. It’s something that we like to take away from the discussion today is just this idea of recognizing that a lot of what we are doing in safety is about managing uncertainty, and whether we delivered about it or not.

If you start to look at each of the safety activities, what is this activity there to reduce uncertainty or increase uncertainty? That gives you a slightly different way of looking at the world and helps us in making strategic decisions, when we generally want to reduce uncertainty because we think that reduction will be good for safety, and when do we want to deliberately encourage uncertainty because that will help us in the long-term make better decisions? Being a bit more conscious of that, a bit more strategic about that, we think is just a [...] both a theoretical and a practical takeaway.

David: And I think particularly if you’re an organization or an industry that when you sit back and critically reflect these, are your efforts in safety only focused on reducing uncertainty? And will that limit your organization’s ability to cope with the residual uncertainty that they face? I suppose at the moment, we’re seeing what’s playing out with the MCAS system on the Boeing 737 [...] and all the effort that’s gone into automation, senses, and software to control that aircraft, left a couple of pilots with a somewhat inability to actually cope with the uncertainty that they face when the plane started behaving the way that they did.

We need to think about in our industries and, I suppose, within our safety toolkit about uncertainty like in the way that Drew said and finding a way to make sure that we’re conscious of whether our people can actually manage the situations that they face in front of them.

Drew: So, our question this week was, can increasing uncertainty improve safety? I think the overall answer is a definite yes and particularly recognizing that safety is about both product managing certainty and about managing uncertainty, definitely can improve the way that we think about safety.

That’s it for this week. We hope you found the episode thought-provoking and ultimately useful in shaping the safety of work in your own organization. Send any comments, questions, or ideas for future episodes to