Safety Management Systems and Systemic Failure

How Safety Management Systems and systemic failure models explain why organisations produce accidents despite individual competence, using Reason's Swiss Cheese Model, bow-tie analysis, and the Deepwater Horizon disaster as a defining case.

Last updated: 10 Jun 2026

On 20 April 2010, the Deepwater Horizon semi-submersible drilling rig exploded in the Gulf of Mexico. Eleven workers died. The well blew out for 87 days, releasing an estimated 4.9 million barrels of oil. The Presidential Commission's final report, and the separate Bly Report commissioned by BP, both reached the same conclusion: this was not a failure caused by one reckless decision or one faulty component. It was the result of a Safety Management System that had systematically produced a tolerance for risk that no single engineer or executive had ever explicitly approved.

Safety Management Systems (SMS) are the formal organisational structures, policies, procedures, and cultures through which companies attempt to manage safety risk. When they work, they identify hazards before they cause harm, maintain the barriers that prevent escalation, and create a culture in which workers can raise concerns without fear. When they break down, they produce the conditions James Reason identified in his Swiss Cheese Model: multiple holes in defensive layers lining up until nothing stands between a hazard and a disaster.

For forensic engineers, the SMS dimension of an accident investigation is where the analysis moves from the physical evidence (what broke) to the organisational evidence (why the system allowed it to break). This distinction is not merely philosophical. In litigation, it is the difference between a finding of individual negligence and a finding of organisational negligence, and those findings attach to different defendants, different damages, and different regulatory consequences.

Key terms

Safety Management System (SMS): A formal, documented framework of policies, procedures, responsibilities, and performance monitoring through which an organisation identifies hazards, assesses risks, and manages safety performance.
Latent condition: In Reason's model, a pre-existing organisational weakness (poor design, defective procedure, unrealistic scheduling, inadequate training) that lies dormant until aligned with other failures or triggers to produce an accident.
Active failure: An error or rule violation by a front-line operator whose effects are felt immediately. Active failures are the triggers Reason calls 'unsafe acts'; they represent the end of the accident chain, not its root.
Swiss Cheese Model: James Reason's accident causation model representing each defensive barrier as a cheese slice with holes. An accident occurs when holes in successive slices momentarily align, allowing a hazard trajectory to pass all defences.
Bow-tie analysis: A risk-visualisation method combining a fault tree (left of the bow-tie, hazard to critical event) with an event tree (right, critical event to consequences), with barriers drawn explicitly on both sides to show prevention and mitigation.
Blowout preventer (BOP): A large specialised valve or series of valves installed at the wellhead of an oil or gas well to seal, control, and monitor the well. The BOP is the last physical barrier between the well pressure and the rig; its failure in the Deepwater Horizon disaster removed the final layer of protection.

James Reason and the Swiss Cheese Model

Accidents happen when holes in layers of defence align, not when one person makes one mistake.

James Reason, then Professor of Psychology at the University of Manchester, published his influential Human Error in 1990 and refined the Swiss Cheese Model through the 1990s. The model has been adopted in aviation (ICAO Annex 19 SMS framework), healthcare, nuclear power, and the offshore oil industry as the conceptual foundation for systemic accident investigation.

Reason distinguishes between two broad failure categories. Active failures are the unsafe acts committed by front-line workers: the operator who failed to close a valve, the pilot who misread the altitude, the nurse who gave the wrong dosage. These are visible and immediate, and they are almost always what early-stage investigations focus on. Latent conditions are the hidden failures that incubate within the organisation: a maintenance system that deferred inspection, a training programme that never covered an unusual scenario, a risk register that categorised a known hazard as acceptable because no one had been hurt yet.

Reason's Swiss Cheese Model showing hazard trajectory passing through aligned holes in successive defensive barriers.

The practical implication is that fixing the front-line operator who made the active failure is the least effective corrective action available. That individual will be replaced or retrained, but the latent conditions remain for the next operator in the same situation. Sustainable improvement requires identifying and closing the holes in the upstream layers: the design, the procedure, the training, the supervision, and the management culture that tolerated the precursor signals.

Bow-tie analysis: visualising prevention and mitigation together

A bow-tie shows, on one diagram, what stops an accident happening and what limits the harm when prevention fails.

Bow-tie analysis emerged from the Shell and ICI major-hazard process-safety tradition in the 1980s and was formalised as a risk management tool by the Energy Institute, DNV, and others in the 2000s. Its structure is deliberate: the knot at the centre of the bow-tie is the critical event, the single most important moment to prevent. The left half shows the threat pathways and the prevention barriers. The right half shows the consequence pathways and the mitigation barriers.

Identify the top event (hazard release)
This is the moment of loss of control: loss of well control, release of toxic gas, structural failure. It is specific and observable. The bow-tie is built around one top event at a time.
Map threats (left side)
List the credible ways the top event can be reached. For a well, threats include failure to detect abnormal pressure, incorrect cement job, inadequate mud weight. Each threat gets its own branch, and the prevention barriers are placed as gates on each branch.
Map consequences (right side)
List what happens after the top event if it is not contained. For a well blowout, consequences include explosion, fire, loss of life, environmental release. Mitigation barriers (emergency shutdown systems, evacuation procedures, BOP activation) are placed on the consequence branches.
Assess barrier health
The real value of a bow-tie is in tracking whether each barrier is functioning. A bow-tie mapped against the Deepwater Horizon timeline shows which barriers were degraded, non-functioning, or bypassed before and during the critical event.

What an SMS framework contains and where it fails

An SMS is only as good as the management attention that keeps it alive.

A complete SMS, as defined by ICAO Annex 19 for aviation, the International Safety Management Code (ISM Code) for shipping, OSHA's Process Safety Management standard (29 CFR 1910.119) for process industries, and industry frameworks such as API RP 75 for offshore oil, has four functional pillars: safety policy and objectives, safety risk management, safety assurance, and safety promotion.

SMS pillar	What it requires	Common failure mode in accident investigations
Safety policy and objectives	Clear accountability, measurable safety targets, management commitment	Production pressure overrides stated safety commitments; stop-work authority not exercised
Safety risk management	Hazard identification, risk assessment, barrier management, change management	Process changes not reassessed; MOC (management of change) bypassed under schedule pressure
Safety assurance	Monitoring, auditing, incident reporting, performance measurement	Near-miss reports filed and closed without root-cause investigation; audit findings deferred
Safety promotion	Training, competency, communication, safety culture development	Competency gaps not closed; safety culture assessments show fear of reprisal for raising concerns

The most common systemic failure pattern the forensic engineer encounters is the SMS that looks complete on paper and is hollow in practice. A company can have a beautiful Process Safety Management manual, a full set of procedure documents, a completed risk register, and a functioning audit schedule, and still produce a catastrophic accident, because none of those documents were treated as living controls that actually governed decisions under production pressure. The distance between the written SMS and the practiced SMS is where most organisational accidents live.

Individual error versus organisational failure: the legal distinction

The same act can be individual negligence, organisational negligence, or both, and the difference determines who pays and who is prosecuted.

In most jurisdictions, corporate manslaughter, corporate homicide, and equivalent offences require proof that a senior management failure (not just a front-line worker's error) caused the death. The UK Corporate Manslaughter and Corporate Homicide Act 2007 requires a 'gross breach of duty of care' attributable to the 'way in which its activities are managed or organised by its senior management'. Demonstrating that breach requires exactly the kind of SMS gap analysis that Reason's framework enables.

In the United States, criminal prosecution for major industrial accidents typically runs through a mix of environmental statutes (Clean Water Act, Clean Air Act) and workplace safety regulations (OSHA) rather than a corporate manslaughter framework. Civil liability under US law allows plaintiffs to reach senior management and the corporation through theories of negligent supervision, failure to maintain a safe workplace, and negligent SMS design or execution.

Evidence for individual failure: the operator deviated from a clear, known, and feasible procedure without justification; training records confirm the correct procedure was known and tested.
Evidence for organisational failure: the same deviation was common and known to supervisors; the procedure was unworkable under actual operating conditions; previous similar incidents were not investigated to root cause; stop-work authority was never used despite multiple known precursors.
Evidence for systemic failure: the SMS did not require MOC when the process changed; hazard assessments were not updated; audit findings were deferred without risk acceptance at an appropriate management level; production incentives structurally outweighed safety incentives.

The Deepwater Horizon disaster: SMS failure as a forensic case study

Every SMS failure pattern described in this topic appeared in the 2010 Gulf of Mexico blowout.

The Bly Report (BP's internal investigation), the Presidential Commission report, and the US Chemical Safety Board's investigation of the Macondo well blowout together constitute one of the most thoroughly documented industrial SMS failures in history. The primary physical cause was a failure of the cement job on the production casing, which allowed hydrocarbons to migrate up the wellbore. But the cement failure was one hole in one layer. What made the accident catastrophic was the alignment of holes in every other defensive layer.

Negative pressure test misinterpretation: the crew performed a negative pressure test to confirm wellbore integrity before temporarily abandoning the well. Anomalous pressures were observed and misinterpreted as 'bladder effect', a non-standard term that had no engineering basis. The test should have stopped operations; instead it provided false reassurance. No clear written procedure existed for interpreting the test result.
Removal of heavy drilling mud: the crew displaced the heavy drilling mud with seawater before a secondary barrier (a lockdown sleeve) was confirmed in place. This removed a hydrostatic barrier against wellbore pressure. The Bly Report identifies this as a decision made under pressure to begin completion operations sooner.
BOP failure: the blind shear ram of the BOP failed to seal the well. Post-accident testing by the US Bureau of Safety and Environmental Enforcement confirmed design deficiencies relevant to the pipe configuration in the well, a pre-existing hydraulic leak that had been identified and not repaired, and battery issues in the acoustic trigger. Three separate BOP failure modes converged.
MOC absent: multiple changes to the well design were made in the final days before the blowout, including changes to the casing design and the decision to use fewer centralizers than recommended by the cement contractor Halliburton. The Presidential Commission found no evidence of formal management-of-change review for these decisions.
Audit findings deferred: an internal BP audit of the Atlantis platform, conducted before the Macondo incident, had identified similar process-safety issues with well-control barriers. The audit findings had not been closed. The Presidential Commission noted a pattern of audit findings being generated and not acted upon.

The Deepwater Horizon investigation is a masterclass in how the same set of facts can be framed as individual human error (the crew misread the negative pressure test) or as systemic SMS failure (the company had no clear procedure for interpreting the test, a culture of schedule pressure that discouraged raising concerns, and multiple previous warning signals that were not investigated to root cause). Both framings are factually supported. In litigation, BP ultimately paid more than 65 billion US dollars in fines, damages, and cleanup costs, a figure that reflects both the direct physical harm and the depth of the organisational failure.

Reporting systemic failure findings to a court

Translating Swiss Cheese and bow-tie findings into language a judge and jury can work with.

The challenge in presenting systemic failure evidence is making the connection between abstract organisational concepts and specific acts of commission or omission that a court can evaluate. An expert who testifies that 'the safety culture was deficient' without pointing to specific, documented, dated evidence will be attacked on cross-examination as offering impressionistic opinion. The same analysis grounded in SMS audit records, management review minutes, incident reports, and deferred corrective actions is far more durable.

The sequence that survives cross-examination typically runs: (1) state what the defendant's SMS required, citing the specific SMS document and section; (2) identify the specific evidence that this requirement was not met, citing dated records; (3) show how this gap produced the specific conditions that led to the accident, using the barrier analysis or bow-tie as the connective structure; (4) state what a competent operator in the same industry would have done, citing industry standards and comparator evidence if available. Each step is document-based and falsifiable, which is what Daubert reliability requires.

Worked example

Refinery fire: from active failure to systemic SMS gap

An operator opens the wrong valve; the investigation traces back three layers of SMS failure.

A refinery operator opens a block valve on the wrong section of a process train during a restart, releasing flammable vapour into an area where hot work is in progress. An explosion and fire result, killing one contractor and injuring four workers. Initial investigation identifies the valve operation as the cause: wrong valve, wrong time, operator error.

Layer 1: the immediate act. The operator opened Valve FCV-127 instead of FCV-172, valves that were physically close and identically labelled on a faded P&ID that had not been updated to reflect a piping modification made eight months earlier. The procedure for the restart sequence referenced valve numbers not shown on the working copy of the P&ID in the control room. The operator error is real. So is the paper-trail gap that made it easy.
Layer 2: the permit-to-work system. Hot work authorisation had been issued for the adjacent area without checking that the startup sequence for the connected unit was not scheduled for that shift. The permit-to-work system required a 'conflicting operations' check; no record of the check exists in the permit documentation. This is a procedural barrier that failed.
Layer 3: management of change. The piping modification made eight months earlier had been through a technical review but the required update to the P&IDs, procedures, and control room displays had been deferred pending a scheduled instrument turnaround. That turnaround had been postponed twice. The MOC procedure required P&ID updates before restart of the modified system; the requirement had not been enforced. This is an SMS assurance failure.
Bow-tie overlay. Mapping the incident onto a bow-tie for 'loss of containment from process piping', the three identified barrier failures map as follows: prevention barriers (accurate P&IDs, correct procedure reference, MOC completeness check) all degraded; mitigation barriers (hot work permit conflicting-operations check, area gas detection) also degraded. The investigation shows the incident needed four independent barrier failures to line up, all four were present and undiscovered, and all four trace to SMS documents that required the relevant checks.

The forensic report recommends three corrective actions at the SMS level: a mandatory close-out verification for all MOC P&ID updates before system restart; an automated conflict check in the permit-to-work system for adjacent operations; and a quarterly audit of P&ID currency against the physical plant. It also recommends disciplining the supervision chain that approved the deferred MOC updates, because the failure was not the operator's error. The operator was the last domino. The failure was the eight months of undisclosed holes upstream.

Check your understanding

Question 1 of 4· 0 answered

In Reason's Swiss Cheese Model, 'latent conditions' are best described as:

Key Takeaways

Reason's Swiss Cheese Model distinguishes latent conditions (pre-existing organisational weaknesses) from active failures (front-line unsafe acts); sustainable accident prevention requires addressing latent conditions, not just retraining the operator.
A bow-tie diagram combines prevention barriers (left side, stopping the critical event) with mitigation barriers (right side, limiting consequences), making it a powerful tool for both SMS management and courtroom communication of barrier failures.
SMS failures typically cluster around four areas: safety policy not enforced under production pressure, risk assessments bypassed through inadequate management of change, audit findings deferred without risk acceptance, and safety culture that suppresses near-miss reporting.
The Deepwater Horizon investigation documented MOC failures, negative pressure test procedural gaps, and BOP design deficiencies as convergent SMS breakdowns, each traceable to specific company documents and decisions made years before the blowout.
Forensic engineers presenting systemic failure evidence must ground each finding in specific, dated SMS documents rather than broad cultural characterisations, and must stop short of asserting the legal conclusions (negligence, recklessness) that belong to the court.

What is the difference between an active failure and a latent condition in Reason's Swiss Cheese Model?

An active failure is a human error or rule violation by a front-line operator that has immediate, observable consequences. A latent condition is a pre-existing weakness in the system created by decisions made far upstream: poor design, inadequate training, unrealistic production schedules, or defective maintenance systems. Latent conditions are dormant until an active failure or a triggering event aligns them, at which point they dramatically amplify the consequences.

What does a bow-tie diagram add to a risk assessment that a standard fault tree does not?

A bow-tie diagram combines a fault tree on the left (showing how hazards escalate to a critical event) with an event tree on the right (showing how the critical event propagates to consequences), with barriers drawn explicitly on each side. It communicates, at a glance, the barriers that prevent the event from occurring and the barriers that limit consequences if the event does occur. It is a risk communication and management tool rather than a quantitative calculation tool; its strength is clarity for non-specialists.

How did the Deepwater Horizon blowout preventer failure contribute to the disaster?

The BOP was the last physical barrier between the well and an uncontrolled blowout. During the April 2010 incident, the BOP's blind shear ram failed to function as designed. Post-accident analysis found design deficiencies in the shear ram for the pipe configuration in the well, battery issues in the control system, and a previously identified hydraulic leak that had not been repaired. The BOP failure removed the last physical barrier, allowing the blowout to reach the surface.

What is stop-work authority and why does its exercise (or non-exercise) matter in accident investigations?

Stop-work authority is the explicitly delegated right of any worker to halt an operation they believe is unsafe, without fear of reprisal. Its exercise in an investigation context matters because records of whether workers felt empowered to raise concerns, whether previous stop-work events were followed up, and whether a culture of production pressure discouraged its use are all evidence of the organisational safety culture. If workers identified the same precursors before a fatal incident and were not supported when they raised them, that is direct evidence of an SMS failure.

Can an individual operator be both personally responsible and a victim of a systemic failure at the same time?

Yes, and this dual framing is central to modern accident investigation. An operator may have made an error that was the immediate triggering act, while the conditions that made that error likely and its consequences catastrophic were created by the organisation's SMS gaps. Reason's model is not an excuse for individual errors; it identifies where the deeper corrective work needs to happen.

Test yourself on Forensic Engineering with free, timed mocks.

Practice Forensic Engineering questions

Found this useful? Pass it along.

Spotted an error in this page? Report a correction or read our editorial standards.

SMS pillar

What it requires

Common failure mode in accident investigations

Safety policy and objectives

Clear accountability, measurable safety targets, management commitment

Production pressure overrides stated safety commitments; stop-work authority not exercised

Safety risk management

Hazard identification, risk assessment, barrier management, change management

Process changes not reassessed; MOC (management of change) bypassed under schedule pressure

Safety assurance

Monitoring, auditing, incident reporting, performance measurement

Near-miss reports filed and closed without root-cause investigation; audit findings deferred

Safety promotion

Training, competency, communication, safety culture development

Competency gaps not closed; safety culture assessments show fear of reprisal for raising concerns

Key Takeaways

Reason's Swiss Cheese Model distinguishes latent conditions (pre-existing organisational weaknesses) from active failures (front-line unsafe acts); sustainable accident prevention requires addressing latent conditions, not just retraining the operator.

A bow-tie diagram combines prevention barriers (left side, stopping the critical event) with mitigation barriers (right side, limiting consequences), making it a powerful tool for both SMS management and courtroom communication of barrier failures.

SMS failures typically cluster around four areas: safety policy not enforced under production pressure, risk assessments bypassed through inadequate management of change, audit findings deferred without risk acceptance, and safety culture that suppresses near-miss reporting.

The Deepwater Horizon investigation documented MOC failures, negative pressure test procedural gaps, and BOP design deficiencies as convergent SMS breakdowns, each traceable to specific company documents and decisions made years before the blowout.

Forensic engineers presenting systemic failure evidence must ground each finding in specific, dated SMS documents rather than broad cultural characterisations, and must stop short of asserting the legal conclusions (negligence, recklessness) that belong to the court.

What is the difference between an active failure and a latent condition in Reason's Swiss Cheese Model?

What does a bow-tie diagram add to a risk assessment that a standard fault tree does not?

How did the Deepwater Horizon blowout preventer failure contribute to the disaster?

What is stop-work authority and why does its exercise (or non-exercise) matter in accident investigations?

Can an individual operator be both personally responsible and a victim of a systemic failure at the same time?

Your journey to becoming a forensic professional starts here.

Key Takeaways

Key Takeaways