Just culture in a plant: what it is, where it comes from, and how a supervisor applies it after an incident

Where the idea comes from: aviation and healthcare

Reason's line, and his decision tree

Reason's 1997 book described a safety culture as five overlapping parts: informed, reporting, just, flexible and learning. The just part is what makes the reporting part possible. He also drew a culpability decision tree that walks one unsafe act through a short series of questions. Were the actions and their consequences intended? Was the person impaired by alcohol or drugs? Did they knowingly break a safe procedure, and if so, was the procedure workable and had the breach already become the way the job is done around here? Would a different person have done the same? Is there a history? The branches run from sabotage at one end to blameless error at the other, with system-induced violation and system-induced error in the middle, and most real cases land in the middle. The Global Aviation Information Network reproduced the tree in A Roadmap to a Just Culture (2004).

The substitution test

The question that does most of the work in Reason's tree came from Neil Johnston, an Aer Lingus training captain and human factors specialist, in 1995. Take the person out and put in someone from the same job with comparable experience and qualifications. Given how events unfolded and how they looked to the people in them at the time, would that person have done anything different? If the honest answer is probably not, blame has no useful part to play, and the finding is about the task, the training or the equipment. If the answer is no, they would not have done that, ask next whether something in the system produced the difference, such as selection, training or experience, before the word negligence is allowed in. The test is meant to be answered by peers, not by the manager who is deciding, which is why this page keeps coming back to who is in the room.

Marx and the three behaviours

David Marx, an engineer and lawyer, wrote Patient Safety and the Just Culture: A Primer for Health Care Executives for Columbia University in 2001. The primer explained the legal distinctions between human error, negligence, recklessness and knowing violations to hospital leaders, and argued that any discipline should follow the behaviour and the risk it created, not the harm that happened to follow. The version most workplaces meet today is the Just Culture Algorithm he developed afterwards, which sorts conduct into three behaviours with three responses: console human error, coach at-risk behaviour, and reserve discipline for reckless behaviour. The at-risk category is the hinge. The Institute for Safe Medication Practices puts the test as a single question: how likely is it that anyone else here would have made the same choice in those circumstances? If the answer is yes, the behaviour was at-risk, not reckless, and the work is to find the system failures people were working around and to take away the reward the shortcut was paying.

Dekker: who gets to draw the line

Sidney Dekker's Just Culture: Balancing Safety and Accountability (Ashgate, 2007; second edition 2012; third edition retitled Restoring Trust and Accountability in Your Organization, CRC Press, 2017) and his 2009 paper in Cognition, Technology and Work, Just culture: who gets to draw the line?, are the standing objection to all of the above. Every scheme draws a line between acceptable and unacceptable, and every scheme assumes that culpability lives in the act. Dekker's point is that it does not. It is a judgement made afterwards, by someone who knows the outcome and has power over the person. So the question that matters is who draws the line and whether the process is fair. He contrasts retributive accountability, which asks which rule was broken, who broke it and what the consequence should be, with restorative accountability, which asks who was hurt, what they need and whose obligation it is to meet that need. For a plant this is a warning rather than a veto: the algorithm is only as fair as the people who run it.

Aviation wrote it into rules

Two places show what the idea looks like once it is written down. The Federal Aviation Administration's Aviation Safety Action Program (Advisory Circular 120-66C, 2020) lets airline and repair station employees report safety events voluntarily. An Event Review Committee made up of a company manager, an employee representative (the union where there is one) and an FAA inspector reviews each report and decides by consensus. Accepted reports lead to corrective action instead of enforcement or company discipline. Reports involving reckless conduct, which the circular defines as a gross disregard for or deliberate indifference to safety, and the so-called Big Five (criminal activity, substance abuse, controlled substances, alcohol and intentional falsification) are excluded. In Europe, Regulation (EU) No 376/2014 on the reporting of occurrences in civil aviation defines just culture in Article 2(12): front-line operators are not punished for actions, omissions or decisions that match their experience and training, while gross negligence, wilful violations and destructive acts are not tolerated. A plant has no regulator at the table. The structure carries over anyway: more than one party decides, the exclusions are known in advance, and corrective action is the default outcome.

A decision path for the supervisor after an incident or an unsafe act

Six steps, in the order they happen. The supervisor runs the first two alone and in the first hours. The next three are done with the safety lead, and HR joins at step five only if discipline is on the table.

1. 1

   Make it safe, then get the person's account before you form a view

   Stop the task if the hazard is still live, put an interim control in place and look after anyone who was hurt. Before the end of the shift, sit down with the person away from the crew and ask them to walk you through what happened and what they were trying to get done. Ask, do not tell, and write what they say in their words. Say what the process is: the plant looks at what happened and why, then at what a colleague would have done, and any response follows the behaviour and not the outcome. Do not promise that nothing will happen. Promise the process.

2. 2

   Rule out the cases that sit outside the model

   Reason's first two questions. Was the harm intended? Was the person impaired by alcohol or drugs? Either answer takes the case out of the safety process and into HR and, where it applies, the law. Most supervisors go a whole career without meeting one. If the answer to both is no, carry on.

3. 3

   Name the behaviour: human error, at-risk or reckless

   Did the person intend the action itself? A wrong button, a missed step, a misread label: if the action was not what they meant to do, it is human error, whatever followed. If they chose the action, did they see the risk? Ask whether the shortcut is known on the crew, tolerated by supervisors or rewarded by the schedule; if so, it is at-risk behaviour. Reckless is reserved for someone who understood a substantial risk, had no good reason to take it, and took it in a way their peers would not. Check the standard at the same time: was it written for this machine, trained, available at the station, and possible to follow at line speed?

4. 4

   Run the substitution test with peers, and record it

   Ask two or three people who do the same job with similar experience, each on their own: knowing what this person knew at the time, would you have done the same? If the answer is probably yes, the behaviour is blameless or at-risk and the fix is to the system. If the answer is no, ask what made the difference, such as training, selection or experience, before anyone says negligence. Write down who was asked and what they said. The test only works when the peers are not afraid of the answer, which is one more reason the first conversation has to go well.

5. 5

   Choose the response, and the system action regardless

   Console, coach or discipline, and in every case a system action with a named owner, a due date, the level it sits on the hierarchy of controls and a way to verify it; our guides on unsafe acts and unsafe conditions and root cause analysis cover how to write one that holds. After human error the action is design: make the slip impossible or caught. After at-risk behaviour it is to take away whatever made the shortcut pay and to fix the standard that could not be followed. Discipline goes through the plant's existing disciplinary procedure with HR, consistent with past cases and with any collective agreement, and the same three questions are put to the supervisor who tolerated the shortcut or set the schedule.

6. 6

   Document it and close the loop with the crew

   The file holds the account in the person's own words, the behaviour named and why, the result of the substitution test and who was asked, the condition of the standard, the response, the system action with its owner and date, and what the crew and the reporter were told. The incident investigation report and the near-miss report form have room for each. At the next huddle, tell the crew what happened and what is changing, without the person's name, and thank whoever reported it. When the fix is in, go back to the reporter and say so.

What to say in the first 24 hours

Who decides, and how to keep workers' trust

The supervisor gathers the facts and has the first conversation, and should not classify the behaviour alone: the person who was on shift when it happened is the person with the most to explain. The classification is done by the supervisor and the safety lead together, with a worker representative or an experienced peer for the substitution test, and HR when discipline is possible. Publish the path and the three behaviours before the first case, so that people meet the process before they meet it in anger. Apply it upward as well as down: a supervisor who tolerated the at-risk behaviour, a planner who left no time for the standard, a maintenance manager who left the guard off, are all inside the same frame, and the crew will notice at once if they are not. Keep a log of cases and responses and read it every quarter for consistency across shifts and departments. Never let near-miss reports feed appraisals, bonuses or incentive schemes. Keep an anonymous route open and treat how much of it gets used as a measure, which the section on indicators returns to.

One case worked through

An illustrative case; the people and the site are made up. A reach-truck driver on the night shift clips the end of a rack at a blind aisle corner, and a picker who had stepped into the aisle gets back just in time. The blame version writes itself: driver warned for speed, picker reminded to look. The path gives a different report. The driver's account, taken that night: he slowed for the corner as he always does, but the convex mirror at the aisle end was taken down during a rack move three weeks ago and never refitted, and the whole night crew has been driving the corner blind since. No intent to harm, no impairment. The driver chose to drive a corner he could not see round, as the crew does every night: at-risk behaviour. The picker stepped out without looking, the kind of lapse anyone makes on the hundredth trip: human error. Three other drivers, asked separately, say they would have done the same. Response: coach both, no discipline. System actions: mirror refitted today, with cones and a spotter until then; the rack-move procedure gains a step that restores every visual control before the aisle reopens, signed off by the shift lead; a pedestrian barrier at the aisle end goes on the hierarchy as the engineering control, with an owner and a date. The crew hears about the fix at the tier meeting, with nobody's name in it. What changed in the write-up is what it is about: a mirror and a procedure, with two people in it who would have been hurt.

Where the model is weak

This page would be dishonest if it stopped at the algorithm. Six limits, in the order a plant usually meets them.

• The line is drawn after the fact. Dekker's objection stands: the person classifying the behaviour knows how it ended, and bad outcomes pull judgement toward blame. Have the classification done by people who were not hurt by the outcome, and make them write the reason down.
• At-risk and reckless blur. The textbook reckless case is rare. The hard cases are habitual shortcuts a plant tolerated for years, and when the peers are asked whether they would have done the same, peers who share the drift will say yes. That answer is still the truth about your plant, and the fix is still to the system.
• It can become a politer blame culture. If every case ends with the operator coached and nothing changed on the machine, the word just has been borrowed for the old habit. The yellow bar in the figure is the test.
• A plant is not an airline. ASAP has a regulator and a union in the room and legal protection behind it. Most plants have a supervisor, a safety lead and HR. The structure can be copied, more than one party deciding, exclusions known in advance, corrective action as the default; the legal protection cannot.
• Jurisdiction and contracts come first. Disciplinary steps, union representation, testing rules and the duty to report differ by country and by agreement. The model does not override any of them, and a policy that claims it does will not survive its first hearing.
• Trust is slow and lopsided. One case handled badly undoes a year of cases handled well, and the people who stop reporting will not tell you that they have. The indicators below are the only way to notice.

Common mistakes

• Announcing a just culture without changing the disciplinary procedure. The first grievance hearing will be run on the old document.
• Letting the outcome set the response. The same slip gets the same answer whether it broke nothing or broke an arm; if it does not, the crew has learned that luck is what gets punished.
• Running the substitution test in your own head. It is a question for peers, asked one at a time, and written down.
• Reading at-risk as reckless because the risk is obvious to you afterwards. Hindsight makes every risk obvious. Ask whether it was obvious to the crew on Tuesday.
• Coaching the operator and leaving the machine alone. A case that ends without a system action has fixed nothing and used up some trust.
• Applying it only downward. A supervisor who tolerated the shortcut and a planner who left no time for the standard are inside the same frame.
• Using near-miss reports in appraisals, or rewarding months without an injury. Both teach people to keep quiet, and OSHA's own guidance says so.
• Promising no consequences. Promise the process instead, and keep that promise every time.

Definitions and sources

• The first full statement of a just culture, the five parts of a safety culture (informed, reporting, just, flexible, learning), the argument that a no-blame culture is neither feasible nor desirable, and the culpability decision tree: James Reason, Managing the Risks of Organizational Accidents (Ashgate, 1997), as reproduced and summarised in Global Aviation Information Network Working Group E, A Roadmap to a Just Culture: Enhancing the Safety Environment, first edition, September 2004, which also sets out the substitution test and Reason's foresight test. Reason's book itself was not read for this page; its decision tree is cited from the GAIN reproduction, which gives the page as 209.
• The substitution test and its attribution to Neil Johnston (1995), an Aer Lingus training captain and human factors specialist: the GAIN roadmap above and SKYbrary's Safety and Justice toolkit. Johnston's original paper was not read.
• The four legal categories (human error, negligence, reckless conduct, knowing violations) and the argument that discipline should follow behaviour and risk rather than outcome: David A. Marx, Patient Safety and the Just Culture: A Primer for Health Care Executives (Trustees of Columbia University, 2001), as summarised by the AHRQ Patient Safety Network and by the American Nurses Association's position statement on just culture (2010). The three behaviours and the responses console, coach and discipline: the Just Culture Algorithm (Outcome Engineering, 2008) as described in the ANA statement; the single question for at-risk against reckless: Institute for Safe Medication Practices, Medication Safety Alert, March 2021, as reported by Patient Safety Solutions, April 2021. The primer itself was not read; its contents are cited from those summaries.
• Who draws the line, culpability as a judgement made afterwards, and retributive against restorative accountability: Sidney W. A. Dekker, Just culture: who gets to draw the line?, Cognition, Technology and Work, volume 11 (2009), and Just Culture: Balancing Safety and Accountability (Ashgate, 2007; second edition 2012), third edition retitled Just Culture: Restoring Trust and Accountability in Your Organization (CRC Press, 2017). The 2009 paper was read; the books are cited from their publishers' descriptions.
• Human failure as normal and predictable, slips and lapses that training does not remove, violations as well-meant attempts to get the job done, and training mistakes read as violations: Health and Safety Executive, Managing human failures (hse.gov.uk/humanfactors), and Reducing error and influencing behaviour, HSG48, second edition 1999.
• The reasonable reporting procedure, the duty to inform employees of their right to report free from retaliation, and the prohibition on discharge or discrimination for reporting: 29 CFR 1904.35(b)(1), as amended by OSHA's 2016 rule. Near-miss reporting, anonymous reporting, fear of blame as a barrier, and the warnings on incentive programmes and post-injury drug testing: OSHA, Recommended Practices for Safety and Health Programs, Worker Participation.
• The Event Review Committee, consensus, corrective action in place of enforcement, the exclusion of reckless conduct and of the Big Five: Federal Aviation Administration, Advisory Circular 120-66C, Aviation Safety Action Program, 31 March 2020. The definition of just culture: Regulation (EU) No 376/2014 on the reporting, analysis and follow-up of occurrences in civil aviation, Article 2(12), paraphrased.
• Worker participation in investigations and corrective action: ISO 45001:2018, clause 5.4, Consultation and participation of workers, and clause 10.2, Incident, nonconformity and corrective action (clause titles only; the standard's text is not reproduced).
• The just culture as a leadership matter and the warning that it is a start rather than the whole of a safety programme: Rajni Walia, Safety Leadership: Move your organization toward a just culture, Safety+Health, 28 March 2021.
• What was not used: no rate of reporting, discipline, injury or anything else appears on this page, because none could be traced to a study that applies to your plant. The only numbers are dates, clause numbers and the made-up details of the worked case.