One theory of how accidents happen is called the ‘Swiss Cheese model’, because it conceptualises safety systems as slices of the holey dairy product interposed between a hazard and a situation. Hazards exist everywhere, but working safety systems block them, so preventing incidents and accidents. Each safety system is different, and thus each has a unique configuration of holes. If, when all the slices of cheese are lined up, the holes align, then the hazard can get through the barriers and cause an incident.

This theory came out of research from Shell International and the universities of Manchester (UK) and Leiden (Netherlands) in the 1980s and 1990s, and led to the accident investigation technique called Tripod, which is co-administered by the Energy Institute and the Stichting Tripod Foundation. It is so named because of the three elements of each incident: the event, the person or thing, and the driving force that acts on them.

Many jurisdictions require by law that companies report accidents on the job which cause injuries, and companies record and report serious injuries and fatalities. An important tool in accident reporting involves also recording accidents that don’t happen.

What is a near miss, and why does it matter? 
Near misses are losses of control without any harm or significant consequence, according to John Sherban, President of Systemic Risk Management of Calgary, Alberta, Canada. Other names include a ‘near hit’, ‘good catch’, or ‘top event’.

Such positive language indicates the favour with which the oil and gas industry generally regards near misses.

They provide a useful basis of comparison to actual incidents. ‘Particularly in companies with good safety records, the number of incidents each year is statistically insignificant, making trends from one year to the next meaningless. Near misses give us more data,’ adds Stuart King, Energy Institute Good Practice Manager – Human Performance and Power Systems.

But employees will only report ‘near misses’ in the right context, if they feel comfortable to do so. Mark Cowan, Director and Principal Specialist at Worley in Kuala Lumpur, Malaysia, says: ‘Despite the significance of near miss reporting, a range of psychological, cultural and operational barriers may prevent employees from reporting.’ He lists the fear of judgement/blame, ‘nothing bad happened, so let’s not put time into reporting’, time pressure/workload, lack of management support and fear of impacting performance metrics as potential barriers to reporting.

For Sherban, cultural factors within organisations can limit the utility of near misses. He comments: ‘The problem I see is that these are not implemented with a learning frame of mind. Most companies I see have a very negative disposition about learning from incidents, and this comes across to anyone involved in the process of finding and communicating the learnings. I have seen few leadership teams who actually take the time to hear, understand and reflect on the findings, let alone improve their operations accordingly.’

How to monitor and report on ‘near misses’ 
The unfortunate fact is that ‘near miss’ reports have a habit of accumulating; a typical mid-size organisation of 3,000 people might have 2,000–10,000 per year. And most of them are of little or no value on their own, according to Tony Gower-Jones, a board member of the Tripod Foundation with more than 40 years of senior health and safety positions in oil and gas and rail sectors. He offers examples such as someone walking into a work area without the right PPE (personal protective equipment); another leaving a gate open; a third forgetting to lock off a piece of property.

He continues: ‘You have to get out of your head the idea that reporting or investigating one on its own is valuable. That’s a myth. All one does is tell you that the reporting system is working.’ By that, he means that it allows management to determine if the reason why they don’t have any incident reports is because the company’s operations are super-safe or because a technical issue is preventing reports from coming through.

But ‘near misses’ are valuable in aggregate, he explains. ‘This is a numbers game. One in 100 will have significant learning value. But to achieve that value takes many man-days of investigation by experienced people. The key is screening, just like triage in a hospital. An experienced professional flags those that are likely to have high learning value either because of their potential outcome or the type of barrier failure.’

‘The other 199 have little value unless you can analyse them quickly and identify the generic type of immediate cause and the underlying cause – in other words, sticking them in the right bucket.’

By bucket, he is referring to the GEMS (generic error modelling system) developed by Dr James Reason, which classifies errors into three types: slips and lapses (errors of inattention), knowledge-based mistakes (not knowing the right thing to do) and rule-based mistakes (choosing the wrong action in the circumstances).

Free ‘near miss’ accident analysis tool 
Tripod Lite was developed to screen incidents quickly that have just one or two barrier failures. It uses a free PDF-based or spreadsheet-based process to pick drop-down items from a list. They consist of the environmental and work conditions that led to the issue, such as unclear processes or lack of training. These options help investigators track back from an incident to its causal factors.

Gower-Jones says that the point of analysing ‘near misses’ in this way is that it can prompt an interesting management conversation: ‘You are going to have the most common causes of barriers failing, and the most underlying causes, and the correlations between them. That leads to insight: what are the things that people are doing in the business that are creating conditions where they are not putting in barriers. That’s useful.’

Tripod Lite is a simplified form of the Tripod Beta accident analysis system launched in 2017. If an incident had multiple causal factors, as often happens in the real world, a more appropriate investigatory tool might be the full-scale process, Tripod Beta. But that is slow, painstaking work that requires skilled investigators. Deciding whether or not to take a deeper look into any ‘near miss’ depends on three factors, according to Gower-Jones: the potential of the incident, how much effort will it take to get the information, and what is likely to be learned from it.

He offers the example of a near miss report detailing the discovery of an override installed on a high-water sensor mounted to an open town water tank. The situation is not dangerous; worst case in this scenario involves the water overflowing the sides of the tank, spilling down the sides and going down a nearby drain. But the potential implications of this should be a red flag to an accident investigator, points out Gower-Jones: if the working culture allows people to put in unauthorised overrides, then they might have installed others in far more dangerous parts of the plant. Where else might be at risk?

How not to use ‘near misses’ to improve safety 
Another myth about ‘near misses’, contends Gower-Jones, is that safety investigators should act on every one, by adding new barriers to defend against other potential hazards. The only significant consequence of that is to swamp the organisation. ‘It won't improve safety,’ he says.

In fact, the key to improving safety under the Swiss Cheese model is not to add more barriers. They are just as likely to fall down as their predecessors did. Instead, it’s to make the barriers that already exist less likely to fail.

‘We probably have the right controls, we just can’t get them to work,’ quips the safety expert about that common situation in industry, adding that only once in a lifetime of incident analysis – covering many fatal accidents – has he ever encountered a case where additional barriers were needed.

And why do barriers fail? That is the whole point of the Tripod process. In the theory that Tripod is based on, barriers fail because of immediate causes; that is, human action/inaction. People are influenced by their environment, and the environment is created by the organisation. ‘Near misses’ show failures occurring without the damage to workers, property and processes.

‘Near misses are gifts to an organisation if they use the opportunity to learn from them,’ says Sherban.

Speaking of causes, Gower-Jones differentiates between two types. There are deterministic, Newtonian causes involving mechanical forces. For example, if you don’t put your seat belt on, it won’t protect you in a crash. And then there are weaker linkages, for example in the way that we manage business, that create the conditions that influence behaviour.

To better express the nature of that latter relationship, a Tripod causal tree uses a dotted, rather than a solid, line between the precondition and the immediate cause. And this is key to understanding why barriers fail, concludes Gower-Jones.

‘Organisational leaders have multiple pressures and can’t always predict the unintended consequences of their actions that encourage people to breach controls. They don’t mean for that to happen, but I’ve seen it on multiple occasions.’