How a major incident happens twice.

When a major incident happens at a large organisation with substantial resources available for safety, it seems natural to assume it won’t happen again. The incident attracts senior attention, an investigation is commissioned and corrective actions are assigned. The response is public and persistent. After so much activity, the organisation begins to feel as though the incident has been contained.

Mining companies exist to make money for their shareholders. Major incidents are bad for business: they harm people, interrupt production, attract regulatory attention and erode trust in management. The company has every reason to prevent another one. Yet its ordinary commercial pressures don’t disappear while the response is being implemented. Production must continue, workloads remain, and the people assigned corrective actions must find a way to complete them within the same organisation that existed before the incident.

This is where the objective can quietly change. What began as an effort to prevent the incident from recurring becomes an effort to answer the requirements of the incident report. Workers want to answer to middle management, and middle management wants to answer to upper management, as quickly and quietly as possible: “Here; you asked for this, here it is.” The corrective action may be closed, but the condition capable of producing the incident may remain.

The action reaches Adam

Following a major incident, a senior safety specialist may be brought in to investigate and propose corrective actions. For a time, attention and authority are concentrated around the incident. Once the report is issued, however, that attention disperses. Who will implement the actions? Who is responsible for what, and who has the authority to delegate the work?

The corrective actions most likely to prevent recurrence often require the people assigned to them to work outside their ordinary scope or experience. Someone new to a role may take this in their stride: who are they to challenge the requirement placed before them? They had better make it happen. Someone who has worked within the boundaries of the same role for several years may read the situation differently. A requirement to install an interlock on a piece of equipment is taken less as a challenge than as a mistake: “I’ll respond to this NCR, but they’re not getting what they want—this is obviously someone else’s responsibility.”

The requirement may demand time, authority and technical knowledge that don’t exist within the role—or perhaps within the organisation itself. Somewhere, an engineering company may have people experienced in designing similar controls, along with a portfolio of solutions that have worked elsewhere. But they’ll never become involved if the person assigned the action doesn’t know that external assistance is available, can’t procure it or hasn’t been given a budget. Perhaps outsourcing isn’t an option at all. None of this is necessarily visible in the corrective-action register.

Let’s call the person assigned the interlock Adam. He tries to imagine sitting at his desk, pushing aside the ordinary work of running a team—with all its paperwork, planning and pop-up issues—and beginning to design an interlock on a piece of A4 paper. What did that slewing-crane component look like again? Where was the flange? Where was the access gate? How would the interlock work? Someone, at some point, is going to ask him what he’s doing.

Faced with an action requiring time, expertise and authority he doesn’t possess, Adam looks for something he can realistically deliver. The interlock may become an amended procedure, a tighter JHA approval process or another administrative control. These responses sit within his experience and authority. Unlike the engineered control, they can be written, circulated and entered into the system without disrupting operations for long.

A substitution may be legitimate if new information shows that the original recommendation was unsuitable. But does the person with the authority to require the engineering control participate in that decision? Has the investigator already returned to an ordinary—and no doubt burdensome—workload? Is the substitute assessed against the risk identified in the investigation, or merely accepted because it allows the action to progress?

NCRs can be passed around, redelegated and returned with explanations for why their original requirements could not be met. If closing the action without satisfying it attracts attention, someone may reconsider the demand, provide resources or assign it to the right person. But it may also send a simpler message up the chain of command: “It’s finished.”

The organisation may now have completed its corrective-action process without completing the corrective action. The engineering control has become paperwork—not necessarily because anyone consciously decided to accept the risk, but because each person dealt with the part of the problem that sat within their authority and understanding.

The corrective action may be closed, but the condition capable of producing the incident may remain.

The aura of containment

Several weeks after a major incident, toolbox talks, safety alerts, meetings and Zoom calls have created a shared sense of heightened awareness. Everyone involved appears thoroughly scared enough to prevent it from happening again. The incident begins to feel distant—not because the underlying exposure has been removed, but because the response has been so visible and persistent.

Meanwhile, the corrective actions may have been shaved back from engineering and isolation to administrative controls and PPE. The organisation’s safety infrastructure can conceal this loss of substance. It can also give workers the impression that if something hasn’t been explicitly forbidden, it must be allowed. They may have heard in a toolbox talk or read in a safety alert that a new procedure must be followed, but does it apply to this task? Is this really the situation referred to, or does this situation constitute an exception?

Workers take their cues from multiple sources: the eye roll from the leading hand during the safety meeting, the vague and technical language in the handout, the focus placed on one part of the new procedure but not another—or perhaps the simple fact that nobody has sat them down, explained the change and required them to acknowledge it. Any one of these cues can push a worker back into the mould in which they’ve been trained.

Change is often bemoaned by workers and supervisors alike. The practical requirement can become: agree with the change, complete the paperwork and continue as normal. If the original incident has also been attributed to chance, bad luck or a worker’s failure to use common sense, its recurrence feels more distant still. Human behaviour becomes overemphasised while the conditions that made the behaviour consequential remain in place.

The organisation is left with an aura of containment: the action register shows progress, the workforce remembers the warnings, and management has seen an extensive response. Yet heightened awareness is temporary. When attention moves elsewhere and ordinary work reasserts itself, the opportunity for substantially the same incident remains.

Keeping the action intact

Following a major incident—including a near miss with the potential for catastrophic injury—responsibilities need to be made clear, delegated early and set out distinctly. If a senior safety leader determines that a more effective control is required, their responsibility doesn’t end with recording the recommendation. The plan for developing, funding, implementing and verifying the control is just as important as the idea itself.

Consider an interlock intended to prevent a slewing crane mounted on a locomotive from travelling along a live track while the crane remains deployed rather than stowed. The required outcome may be clear, but the precise engineering solution still needs to be developed with competent technical input. Someone must be authorised to obtain that input, contact contractors and consultants, secure a budget, negotiate interruptions to production and coordinate the work through to completion.

People will often undertake work beyond the usual boundaries of their role when the organisation makes the expectation explicit and acknowledges what it requires of them. Adam needs to be told that his role in the corrective-action plan is exactly what it appears to be: to devote time to it, negotiate or delegate some of his existing responsibilities, and obtain expertise he doesn’t personally possess. Assigning him the action without making room for it leaves the organisation dependent on improvisation.

The incident report may be 150 pages long, but its corrective actions should be shareable, readable and intelligible to the people expected to carry them out. Each action should identify the required outcome, its owner, the authority and resources available, the timeframe, and the process for raising obstacles or proposing changes. A substitute control shouldn’t be accepted merely because it is easier to close; it should be referred back to people competent and authorised to determine whether it controls the risk identified in the investigation.

Accountability matters, but it should produce assistance and escalation as well as scrutiny. When an action hasn’t been completed as required, senior management should find out why, consult with the people doing the work and remove the obstacles where possible. Direct and continuing contact—through a corrective-action committee or another dedicated channel—can prevent the action from disappearing between corporate management and operations. Those parts of an organisation are often siloed, but after a major incident that separation cannot be allowed to decide which controls survive.

The final test isn’t whether the NCR has been closed, but whether the control has been implemented, works under actual operating conditions and has eliminated or minimised the risk identified by the investigation. Otherwise, a large organisation can spend heavily on safety, mount a conspicuous response to a major incident and still preserve the conditions required to repeat it.