Conclusion: The Golden Rules in Relation to Systemic Safety

Abstract

In the complex interplay between opposing forces and their interactions, detailed knowledge of all the challenges facing the system (both safety and commercial challenges) and knowledge of its history, are vital in order to chart a safe course and make reasonable compromises and trade-offs. It is not really possible to make good decisions locally other than based on the criterion of overall trade-offs between these opposing forces; no decision in the area of risk management has any chance of being effective if there is no systemic vision.

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The Enterprise is a System Incorporating Contradictory Tensions and Requiring Trade-Offs in the Area of Safety

When managing an enterprise, ongoing tensions must be managed in order to survive economically. The enterprise must guard itself against four risks:

• not winning the contract

  • Having no saleable products, competition, innovation

  • Difficulty making sales, inadequate distribution, economic recessions

• inability to produce in time, to the expected quality and at the expected cost

  • Quality of the production chain, image of the enterprise

  • Quality of maintenance

  • Good industrial relations

• failure to control the financial support available for the business plan in the areas of innovation, production and sales

  • The business model and the choice of company form

  • Cash, liquidity, borrowing, debt and investment

  • Partnerships, alliances and dependencies

• inability to control the safety of production or of the product being sold

  • Human disasters, the image of the enterprise

  • Exposure to penalties imposed by regulators

The management of these risks is distributed between different divisions: commercial, research, production and safety.

Each of these divisions tries to optimise its own road map, often to the detriment of the other divisions (challenge of resource sharing) and justifies its decisions on the basis of risks that constitute a threat to short-term or medium-term survival.

In this process of internal interaction, we know that trade-offs will spontaneously take place according to three constants:

• the time that will elapse before the benefit or risk appears

• Priority is given to immediate benefits over hypothetical long-term benefits

• Long-term risks are accepted in return for control over short-term risks

• frequency versus severity

• Control over hypothetical severity is sacrificed in return for control over frequent, proven problems

• salience and emergence versus rationality

• Internal trade-offs are prioritised in response to threatening external judgments (press, regulators, market, finances)

• the time that will elapse before the benefit or risk appears

• Priority is given to immediate benefits over hypothetical long-term benefits

• Long-term risks are accepted in return for control over short-term risks

On its own, this process of making trade-offs does not tend to promote safe solutions: these would reduce potential risks that are not immediate, with quite high costs (sometimes due to their own costs, particularly in personnel terms, time overheads for training, and would often slow down production due to more procedures and administration); the best advocates for these solutions are no doubt accidents that have already occurred… and the external regulators (if these exist) demanding compliance with regulations. Even this regulatory process, however, represents a potential trap, creating internal trade-offs in favour of safety solutions, since it often encourages the senior management to expect nothing beyond this compliance and monitoring of the indicators that are disclosed to regulators (whose priority is primarily to protect against industrial accidents) and the results will be less favourable unless adequate resources are made available for more systematic, in-depth actions. Finally, the message from the safety division also becomes confused with the quality process on the production line (whose management is often merged with the safety management): this function (which presents immediate challenges in terms of the image of the enterprise) is often given a higher priority than safety itself (which presents different challenges). This creates the illusion that the management is listening and prioritising proposals from the quality and safety division, even though they are only addressing points that have little to do with safety.

Ultimately the process of determining the internal priorities of the enterprise has to be negotiated within a space which allows only limited room for compromise and is subject to the following boundaries:

• the desire to reduce exposure to risks on one side;

• the desire to accept exposure to risk, in order to achieve secondary benefits that are considered more important, on the other.

There are three aspects to the art of intervening effectively in safety:

• gain and effectively communicate a systemic view of the risks facing the enterprise;

• do not resort to compromises on safety beyond a specific threshold;

• maintain the ability to manage the sacrifices that are made intentionally and are not part of the priority plan.

The Dimensions of Compromise and Offsetting Risks Within the Safety Division

We have just reviewed the key dimensions involved in offsetting risks within the enterprise. We will now see how to assess the margin for compromise within the intervention case/safety plan in order to prepare effectively for possible trade-offs during discussions at the strategic level.

The Three Essential Dimensions of Compromise and Offsetting in the Area of Safety

• The life cycle of the system. All industrial and service systems are born and die. The purpose of all interventions in safety is to extend the life of the system while providing the best conditions for ageing (healthy life, economic and physical health). This ambition is expressed in different ways at different phases of the system. The pressure on safety increases at the end of the cycle when the system has gradually exhausted its available margins for economic progress. As a result, the rules governing trade-offs in relation to safety actions (against economic constraints) vary at different phases in the cycle. Market factors and risk-taking are a higher priority than safety data during a large part of the cycle (when the safety model has to accept the risks that are taken and limit their negative consequences) but the paradigm goes into reverse at the end of the cycle, when the exposure to risk has been reduced through the actions taken and again takes priority over the economic model.

• Guidance for operators. If one wishes to ensure that the operator will continue to play an effective role in managing safety, four safety-related traits in the organisation of work must be prioritised. Each of these traits has its own control systems that must be adjusted according to the level of safety in the system: (1) regardless of the level of safety, do not count errors but instead count missed recoveries, (2) in the least safe systems, do not target prevention and simple compliance with procedures, but prioritise recovery strategies and damage limitation in training efforts, accident analysis and when designing procedures; it must be accepted that incidents will continue to occur and that it will not be possible to prevent them in future) and to progressively give the system more internal resilience to allow it to deal with such incidents, (3) in the safest systems, design a system of standards and constraints that is compatible with the desired performance of the enterprise. All excessive demands (which are no doubt satisfactory from the point of view of regulators and in terms of administrative conformity) will result in immediate violations. The enterprise will tolerate these and they will cause the system to start along a gradual and silent path towards loss of control, (4) for all systems, designing workplaces that can be understood intuitively by operators, without the need for excessive mobilisation of their cognitive resources, will allow most regular work to be done routinely, thereby freeing the operator’s attention to focus on aspects that determine safety: anticipation, strategic orientation, choices and decisions.

• The economic model of the system. Not all systems face the same safety challenges. Public systems clearly have different demands from skilled trades, and unstable, highly innovative systems have different constraints. These different systems of work are based on different safety systems, each of which has its own way of internally managing the various compromises and trade-offs between safety and other dimensions within the enterprise. It is necessary to be able to recognise the type of system involved and to apply the rules to ad-hoc trade-offs. In a skilled trade type system, voluntarily seeking out exposure to new risks will be accepted and the safety card can be played by taking action to enhance the competence of the actors involved; in a traditional industrial system which is based on the HRO model, priority will be given to safety actions that concern the group and to procedures, leaving the system free to expose itself to risks and work under quite unstable conditions. In a public or ultra-safe system, the safety model begins to take priority over the economic model and the attention and intensive work will be devoted to supervision and excluding possible exposure to risk.

One example of trade-offsthat take place in medicine: the analysis of value [1, 2]. Why should we think about improving value rather than following a standard quality improvement process? The answer is simple: except in a few rare cases, improving quality has not delivered on its promises in the field of health. The results are poorly understood, disappointing and all too often in conflict with other competing realities, budgets or other priorities in delivering care. In fact a hospital must constantly resolve a range of contradictory forces: improving the quality of care, increasing the volume of care and reducing costs. Some hospitals manage to keep this impossible equation under control more successfully than others. The solution clearly seems to be an organisational one. Improving value is a response to this need. It means actively searching for the best compromise between these three systems which are in tension. Quality can and should be improved, but in real situations this can only be done by agreeing not to harm the other dimensions, or better still by making improvements in these other dimensions too. It should be noted that this approach does not contradict the fact that some improvements in quality, which do not result in savings, may be important and enjoy protection; these are relatively rare, however, in comparison with the quality solutions that do require trade-offs.

Patient safety in connection with errors and multiple organisational failures that shift professionals away from best practice (with multiple errors in management and inter-professional coordination) appears to be a typical area in which improvement in value has a major impact on the volume of care (poorly delivered care extends hospital stays and overloads the health care system), the cost of care and ultimately of course on quality and safety.

The process of improving value involves a compromise between the expected significance for the patient, the burden of implementation, the impact in terms of costs (which is hoped to be positive but is often negative) and the return on investment model.

Two examples of methods that can be used to calculate this compromise:

• 1. The profitability analysis model “cost—expenditure—saving” takes into account:

Example: intervention intended to reduce pressures in a 600 bed hospital:

• the cost resulting from the quality problem, specifically the estimated annual cost to the organisation of a quality deficit;

• the expenditure that is approved to reduce the scale of the problem, i.e. the estimated resources that the organisation will have to invest in order to reduce the problem by 50 %, including expenditure associated with assessment of the problem and its evolution;

• clear savings/losses over 1 year, and in subsequent years, i.e. the annual cost resulting from the problem, from which the estimated expenditure is deducted for 1 year of improvement activity, to show how much the organisation could save in 1 year and in subsequent years.

• cost of waste = $3 million, if reduced by 50 % = $1.5 million;

• expenditure approved for a 50 % reduction = $150,000: team time $30,000, training $70,000, mattresses $50,000;

• clear savings during the first year: $600,000 (supposing that it takes 6 months to design a plan and that this is then put in place during the following 6 months).

• Annual savings in subsequent years: $1.4 million.

• 2. The “cost of obtaining quality” method involves limiting the rolling out of quality to only those areas in which it has a real chance of resulting in gains. It is based on an estimate of the sum of the various real costs that may result from the quality process:

  • prevention costs: costs resulting from activities intended to prevent quality failures;

  • costs of assessing quality: costs of measuring and inspecting products or services to ensure conformity with quality standards (quality control);

  • costs of internal failures (costs of failures affecting the product or service before delivery to the client);

  • costs of external failures (costs resulting from failures after the service has been received by the client).

Five points are needed in order to build a value improvement process and make it succeed:

• a vision for the medical system that includes everyone, both patients and professionals:

• a targeted strategy that makes sense;

• a crescendo of action over 10–20 years to ensure that the organisation can make the changes needed to achieve the goal with a maximum of benefit: NOTHING CAN BE ACHIEVED IN THE VERY SHORT TERM during the first 2 years. IT IS NECESSARY TO BE ABLE TO INVEST AND PURSUE THE SAME STRATEGY while accepting that there will be a cost during the first few years (0–3 to 5 years), while the benefits will increase gradually;

• identification of the processes, their goals and the interactions between them;

• real, recognised, lasting leadership.

Two examples that have been studied particularly frequently due to their educational value:

• 1. The municipality of Jönköping in Sweden is an example known throughout the world for the quality of care delivered to its patients: the complete support which it enjoys among the public and professionals, the spectacular reduction in the number of SAIs, its effectiveness and the local care and support provided to all:

  • the common vision behind the process is simple and ambitious (the uniting slogan): “a good and attractive life for all in the municipality” (Note from the author: the vision does not even mention the medical aspect);

  • the strategy for improving quality is seen as a learning process rather than as a predefined method. A vigilant approach to new tools and new methods, which are systematically studied and tested and only adopted if they can be incorporated into the vision and the culture and will produce benefits;

  • duration is taken into account, as are stability and continuity within teams;

  • every aim that is addressed is prioritised and analysed in terms of added value, and is known and its value recognised by everyone from the secretary to the boss;

  • processes are identified and the support for their guidance, including financing, is assured. The General Manager is personally involved in piloting, as is the Innovation Manager and the Medical Director.

• 2. The Intermountain hospital system in the state of Utah in the United States (a non-profit organisation) offers another example of success in analysing value which has become known throughout the world:

  • the vision which is put forward and shared by everyone is that of “clinical excellence”;

  • all the processes are prioritised and only the ones supported by the best clinical evidence (EBM) exists and offering the best economic value are retained. Eight specialities have been analysed and their guidelines have been drawn up along these lines, after a long process of learning about the method;

  • every clinical programme is the object of a full deployment project, incorporating skills in all sectors, medical of course but also in terms of administrative, IT and statistics. The results are monitored and reported continuously every month to make decisions on corrections or improvements (including deployment of new jobs or resources if necessary);

  • information sharing is at the heart of the commitment from professionals and patients (information technology, computerised medical records, a PC in every patient room, an intranet application to monitor clinical results, processes and outcomes);

  • it took a few years to organise the system along these lines, but the current level of benefit is simply remarkable: the resources (both human and technical) are well above average for American hospitals, delivering highly superior value and service to patients and a healthy financial system resulting from the reinvestment of profits in innovation.

10 Golden Rules to Make an Intervention in Systematic Safety a Success

A review of the various points that are important in a systemic approach to risk within the enterprise reveals that there are 10 basic rules for effective management of the safety plan, its deployment, the sacrifices that have to be accepted and those that cannot be done without. The 10 rules can be divided up on three scales within the system: macro (the system), meso (the enterprise or hospital) and micro (the workplace).

At the MACRO level

• 1. Do not run ahead of the demand for safety and seek to speed up the process of making a system safe: every system has a life cycle; its safety needs change at each stage; it is no use trying to offer a response that goes beyond the demand since that will only accelerate progress towards the end of the cycle.

• 2. Take into account the whole range of constraints faced by the enterprise. Accurately estimate the need for safety. The economic model and in particular the need for exposure to risk guides the safety model that will be chosen. Without seeking to change the economic model, it is necessary to prioritise the optimisation resources that exist within the chosen model before taking on board safety solutions from other models. Wider systemic analysis of the situation and the risk map may lead to the consideration of safety priorities or solutions that had previously been ignored because they were outside its scope (for example action in relation to obesity, prioritising a public health and food education policy rather than a priority focused on medical treatment).

• 3. Surviving accidents is just as important as being able to avoid them. The safety plan should not stop at preventing accidents. Just as error management at the individual level should leave room for detection and recovery, the management of safety in a complex system must leave room for management of an accident (crisis) so that the enterprise will survive the accident.

At the MESO level

• 4. Design a “total” intervention at the macro, meso and micro level: No safety plan can limit itself to safety solutions that are delivered solely by front-line actors. It is always necessary to envisage a part of the risk map and safety intervention process that specifically involves the executive, senior and middle management^{1 2}

• 5. Pay particular attention to the roll-out of the plan among the middle management: feasibility, commitment and training. It must be remembered that risk management involves managing all kinds of problems that can destroy the enterprise. Safety, when it is understood in terms of avoiding accidents, is only one aspect of these risks, alongside economic risks, risks to the image, a lack of innovative know-how etc. In most cases it is actually the other risks that are most immediately perceived as threats to the enterprise. It is vital to be able to accept this as a relative priority while maintaining vigilance and an enlightened defence of pure safety aspects. It is particularly important to do well what can be done and even more important to have a good understanding of what one has (temporarily) decided not to do, in order to strengthen the protection in these areas. The management has a key role in relation to both functions. In fact the benefit of the safety plan, even if its extent is adjusted downwards during negotiations, can be obtained with the full support and commitment of the management. The safety plan should set out how the middle managers will be convinced, how the aspects that have been sacrificed will be explained to them and how those managers envisage the process of persuading and engaging front-line managers and front-line operators. The aspect of informing managers and operators about what one has decided not to do in the safety plan is just as strategically important as the beliefs about doing well what one has decided to do.

• 6. Establish a fair analysis of the economic cost of incidents/accidents. The systematic analysis of safety and the trade-offs that it involves require a very realistic approach. Three sub-cases should accompany the risk analysis, in order to prepare for trade-offs and preserve as many as possible of the actions in this dimension of safety: one sub-case calculates the cost of quality losses and damages, a second offers an assessment of the impact on the commercial image of the loss of quality and mediocre safety performance, and a third calculates the potential impact of what one is probably not going to do, due to lack of resources or due to trade-offs in favour of other priorities.

At the MICRO level

• 7. Establish a fair system for analysing the causes of accidents and incidents. A successful systematic approach must be honest and complete in its analysis of the causes of accidents and decisions to correct them. In particular this involves not excessively simplifying the causal link by only considering obvious errors by operators; equal priority must be given to actions to address latent errors in the organisation. Beyond these actions to address latent or patent errors, priority must also be given in the risk map for the risk of accidents associated with poor links between structures, without the need for any of the structures to have necessarily made mistakes itself (work on interfaces).

• 8. Allowing actors to maintain a fair degree of autonomy. The ultimate robustness or resilience of the system is always based on the remaining adaptive capacity of the actors. It is important to ensure that they are not strait-jacketed by unnecessary procedures, since each procedure slightly reduces the adaptive capacity of the system.

• 9. Putting in place a fair policy of incentives/checks and penalties. The desire to reduce errors and violations leads to a desire to maximise transparency while preserving a system of penalties for the most unacceptable cases. A consensus among the social partners on this system of transparency and sanctions is vital to the success of the safety plan. How will the system reward actors who submit reports, who will be involved (the Board and the management should be involved, and so should front-line actors), what are the real criteria defining what is unacceptable, particularly under suboptimal economic conditions in which the enterprise has to take more risks in order to survive? All these points must be included and discussed in the safety plan.

• 10. Creating a fair information system. Transparency should not only involve reporting adverse events. It should cover the whole process by which workers are informed about the strategies pursued by the enterprise, both from an economic perspective and in terms of safety policy.

The safety of a system is never a finished product; it is always in transition and it is perceived favourably or unfavourably by regulators, clients and by the enterprise itself.

There is no recipe for navigating safety (there is a toolbox available, but that does not deal with the problems). The level of control that can be achieved is based mainly on the ability to question oneself as a risk manager and understand the balances that must be maintained in order to survive today, and those that may evolve in order to give the enterprise a better chance of surviving tomorrow.