Risk Barriers as Swiss Cheese?

There’s a model that can help us visualize and consider the different barriers to harm: The Swiss Cheese Model of Accident Causation.

Learn what makes up this model and how ideas are represented. There are also different ways that the model is being used today.

How can we design for controls, policies, or actions that are part of the use of our product but outside of our control? We step through an example of a situation where we’re thinking about our product design in this way.

View the Episode Transcript

See how Flight Safety of Australia uses the Swiss Cheese Model to break-down and communicate risk barriers to prevent commercial airline crashes. Safety in mind: Swiss cheese and bowties | Flight Safety Australia

“Safety in mind: Swiss cheese and bowties.” Flight Safety Australia. Civil Aviation Safety Authority Australia. September 7, 2016. https://www.flightsafetyaustralia.com/2016/09/safety-in-mind-swiss-cheese-and-bowties/ Accessed Jan 10, 2021.

An article interviewing people about the Swiss Cheese Model and measuring the common understanding about the features of the model.

Perneger, Thomas V. “The Swiss Cheese Model of Safety Incidents: Are there Holes in the Metaphor?” BMC Health Serv Res. 2005; 5: 71. Published online 2005 Nov 9. doi: 10.1186/1472-6963-5-71. Accessed 2022 Jan 10.

Just for fun

Episode Transcript

I’ve got a riddle for you today. What does swiss cheese and risk management have in common? I’ll tell you the answer after the introduction.

Hello, and welcome to Quality during Design, the place to use quality thinking to create products others love, for less. My name is Dianna. I’m a senior level quality professional and engineer with over 20 years of experience in manufacturing and design. Listen in and then join the conversation at qualityduringdesign.com.

There’s an idea of how to execute risk management in systems. And it’s modeled after Swiss cheese. It’s called the Swiss Cheese Model of Accident Causation. It’s a visual model of risk management. Sometimes we just need that clear visual so we can all get on the same page and move forward together.

Let’s talk about the Swiss cheese model. First think of slices of deli Swiss. Like what you’d put on a sandwich. One slice of our Swiss has holes of varying sizes and locations (or eyes). No two slices are exactly the same. In system design, we’re layering and assembling different things to create a system. Each layer of control, action, or policy that we put in place to control a risk is a slice of swiss. The holes in our slices of swiss are the shortcomings in our systems. Risk is always trying to penetrate our layers like an arrow, but the only way it can do so is if the holes in our slices line up just right so the risk can make it through and become an undesired event like user harm. Sometimes it’s the case that the more layers we add, or the more slices of cheese, the more likely the shortcomings or the holes will not line up and the risk event will not turn into a harm. We can also fix the shortcomings, or plug the holes in our slices, to reduce the chance of harm.

The Swiss Cheese Model is credited to James T. Reason in the 1990s and 2000s. He was evaluating methods of assessing risk of complex systems like nuclear power plants, spacecraft, and offshore oil drilling rigs. He was concerned about failures caused from the interaction of technical systems and their operators. A complex system could have many layers of controls, actions and policies. And on any given day, a mishap or a shortcoming in one of those layers may be acceptable and okay, but the cumulative effect of errors or mishaps some shortcomings that happen to show up and don’t get fixed can lead to a situation where harm can occur.

I’ve mentioned that the cheese slice is a barrier to risk and that could be a control and action or a policy. And it includes actions that can lessen the consequences of an error. And I’ve also mentioned that the arrow represents the potential of harm. If the arrowhead makes it through all the slices of Swiss, it means that the risk barriers fail, and the harmful event was allowed to happen. The holes represent failure. In the classic Swiss Cheese Model of Accident Causation, holes involve active failures, preconditions and latent failures. Active failures can also be thought of as immediate causes or specific actions involving people making decisions. Maybe the operator bypasses the safety mechanism because they think it’s a pain to do their job with it. Latent failures can be thought of as underlying causes, like the built-in safety mechanisms on the standby waiting to be triggered, but there’s something wrong with it and it wouldn’t trigger, anyway. A latent failure is a failure of the system’s design that increases the chance of harm. Preconditions can be situational; are the conditions of the situation just right to promote a risk event?

The Swiss cheese model has been simplified over the years and used in a lot of different disciplines. The slices used may vary depending on application. In healthcare, data breaches can be attributed to a combination of different aspects like human, organization, and technology interfaces. Airlines use it with different slices, like specific acts, supervision, preconditions, and organizational influences. Recently it’s been used to describe the controls we can have in place to address this pandemic. I’ll post a gift on the podcast blog that uses the Swiss Cheese Model for that purpose.

For product design, this model can be used when thinking about controlling risks of a design that involves human interaction. Each slice of cheese would be a component of an organization that’s involved in the use of our product design. Let’s use an example from healthcare. Say we make two medical devices. One is coated with a special medicine. The other is not. The decision of which one to use is dependent upon the physician’s decision. And that is based on the treatment length of use and whether the patient is allergic to the coating. Patient harm may happen if a coded product is used on someone who’s allergic, that’s our risk. What are the barriers that are in place to prevent this risk? What are our slices of cheese? There are hospital procedures involving the patient intake and knowledge of allergies. There are different hospital procedures involving ordering and control of the stockroom. There’s the system used to get product from stock, a physician’s order being fulfilled by someone from the stockroom. There’re nurses prepping the product for the procedure, removing labels and packaging, and checking that the right products were pulled from stock. In knowing all the barriers, we can start thinking about how well they’ll prevent harm.

What are the shortcomings of the controls? Where are the holes in use? Will these holes line up and lead to coated product being used on a patient that’s allergic potentially leading to patient harm? If so, is there another control we need to add to prevent the risk? We are the ones designing and making the product. We’re not in control of hospital procedures, but we are in control of our product design. How can we help our users more easily identify that the product is coated? When do they need to check that? Are the part numbers and names of the product significantly different to reduce the chance that the physician will choose the right part number? Are the colors on the packaging distinctive, so the stockroom person can easily choose the right product? How about during the procedure: if the nurse preps the product and removes all the external labels, is there another way the product is identified as having coating? Is the product itself a different color? Do we need to include instructions for how to test for a patient allergy before using the product? Is there any way we can help the hospital staff to do this?

Knowing the origins of this Swiss Cheese Model, we can see that it can be used to help us think through complex systems. Not everyone is a fan though. Someone studied if the Swiss cheese model was clearly understood by everyone, that it was interpreted the same way by different people. The conclusion of the study was that it’s not interpreted the same way, but I don’t think that matters. It’s a model that we can use to visualize and communicate complex problems. I hope it will help you with your risk management ideas for your designs, both in developing them and communicating them.

Please go to my website at qualityduringdesign.com. You can visit me there. And it also has a catalog of resources, including all the podcasts and their transcripts. Use the subscribe forms to join the weekly newsletter, where I share more insights and links in your podcast app. Make sure you subscribe or follow quality during design to get the episodes and get notified when new ones are posted. This has been a production of Deeney Enterprises. Thanks for listening.