After the
Smoke Clears

The Instinct to Move On

This chapter is about what happens after the acute phase of a crisis ends — the period when organisations decide, consciously or not, whether they will actually learn anything. The instinct to move on is powerful. It is also one of the most damaging things an organisation can do. Because the question is never really whether a review will happen. The question is whether the review will produce genuine understanding or a polished document that protects the people who commission it.

There is a predictable rhythm to organisational behaviour after a crisis. First, relief. The immediate threat has passed; the system has survived. Second, exhaustion. The people who led the response are depleted — physically, cognitively, emotionally. Third, a powerful desire to return to normal operations, to close the chapter, to stop being an organisation defined by its worst moment. This desire is entirely human and entirely understandable. It is also the precise point at which most organisations make their most consequential post-crisis mistake.

The pressure to move on is not merely psychological; it is structural. Stakeholders want reassurance. Markets want stability. Media cycles move on. Legal counsel often advises restraint in documenting what went wrong, fearing that candid analysis will become evidence in litigation. The result is a kind of institutional amnesia that masquerades as resilience. We got through it. We're stronger now. Let's look forward, not backward.

But looking backward is precisely how organisations prevent crises from recurring. Research on organisational learning consistently demonstrates that the quality of post-incident analysis is the single strongest predictor of whether an organisation will experience similar failures in the future, as Helmreich found in 2000. Aviation learned this lesson over decades, building what is now the most rigorous learning-from-failure infrastructure of any industry. Most other sectors have not.

The Bad Apple and Its Costs

When something goes badly wrong, organisations face a fundamental choice — though most do not recognise it as a choice, because the default feels so natural. The default is this: identify the person closest to the failure, determine what they did wrong, punish them, and declare the problem solved. Sidney Dekker calls this the bad apple theory — the comforting notion that complex systems are basically safe, and that accidents happen because unreliable people defeat the defences that would otherwise hold, as he described in 2012.

The appeal of this theory is obvious. It provides a clear narrative. It identifies a villain. It implies a simple fix: remove or discipline the villain, and safety is restored. It satisfies the public's desire for accountability. And it protects the organisation's leadership from scrutiny, because if the failure was an individual's mistake, then the system — and the people who designed it — are absolved.

The problem, as Dekker has demonstrated across two decades of research, is that this theory is almost always wrong — and when applied, it is actively dangerous. Punishing individuals for errors that were shaped by systemic conditions does not make the system safer. It makes the system more opaque. Frontline workers learn that reporting errors leads to punishment, so they stop reporting. Near-misses go unrecorded. The systemic conditions that produced the original failure — inadequate training, contradictory procedures, production pressure, poor equipment design — remain untouched, waiting to produce the next incident, as Dekker found in 2008.

The Double Bias

There is a well-documented psychological bias at work here. The fundamental attribution error — our tendency to over-attribute others' behaviour to their character rather than their circumstances — is amplified in accident investigation by a second bias: hindsight bias. Once we know that an action led to a bad outcome, it becomes almost impossible to reconstruct the uncertainty that the actor was operating under at the time. Of course they should have noticed the warning signs. Of course they should have followed the procedure. Of course they should have raised the alarm sooner. But "of course" is the language of hindsight, not of the fog-filled, time-pressured, information-poor reality in which decisions were actually made, as Henriksen and Kaplan noted in 2003.

This double bias — attributing to character what should be attributed to context, and judging decisions against information that was not available when those decisions were made — produces investigations that feel thorough but are fundamentally misleading. They answer the wrong question. Instead of asking "Why did this make sense to the people involved, given what they knew at the time?" they ask "Why didn't the people involved do what we now know would have been right?"

Just Culture: Between Blame and Whitewash

Dekker's just culture framework offers an alternative to both extremes: the blame-first approach that sacrifices learning for the appearance of accountability, and the no-blame approach that sacrifices accountability for the appearance of learning. A just culture, Dekker argues, recognises that most errors occur within systems that make those errors likely, while also acknowledging that some individual actions do warrant accountability — not because the person is a "bad apple," but because the nature of the action itself crosses a threshold that the profession and the public cannot accept, as he described in 2012.

The framework operates through a series of structured questions. When an individual's actions contributed to an adverse event, investigators ask: Was the action a genuine mistake — an unintentional deviation from safe practice? Was it a slip or lapse — an execution failure where the person intended to do the right thing but failed? Was it an at-risk behaviour — a drift from safe practice that had become normalised within the team or organisation? Or was it a reckless action — a conscious choice to disregard a substantial and unjustifiable risk?

The appropriate response varies accordingly. Mistakes and slips warrant consolation and system redesign. At-risk behaviours require coaching and examination of why the drift became normalised. Only genuinely reckless actions — where the person knowingly and unjustifiably departed from acceptable risk — warrant formal sanction. Crucially, Dekker emphasises that the line between these categories is not self-evident. It is drawn by human beings with their own biases, interests, and political pressures. Who gets to draw that line, and how, is itself a question of justice, as Dekker argued in 2008.

The Swiss Cheese, Revisited

In an earlier chapter, we introduced James Reason's Swiss Cheese model as a way of understanding how organisational defences work — and how they fail. The model conceptualises safety barriers as slices of Swiss cheese: each is imperfect, with holes representing weaknesses. An accident occurs when the holes in multiple layers align momentarily, allowing a hazard to pass through every defence, as Reason described in 1990.

Applied retrospectively, the model becomes a powerful tool for resisting the temptation of single-cause explanations. The Grenfell Tower inquiry, for instance, ultimately identified failures across at least seven distinct layers: the building's original design, the selection of cladding materials, the role of testing laboratories, the conduct of the refurbishment project, the building control inspection regime, the government's oversight of building regulations, and the fire service's operational response, according to Moore-Bick in 2024. No single failure caused the disaster. The holes aligned.

But the model must be applied carefully. As Wiegmann and Shappell noted in 2019, a common misuse of the Swiss Cheese model is to treat it as a static diagram — a neat retrospective explanation — rather than as a representation of a dynamic system in which holes are constantly opening and closing. Post-incident, there is a dangerous tendency to freeze the model at the moment of failure and treat the alignment of holes as if it were inevitable or obvious. It was neither. The same system had operated for years with many of those holes present, and on thousands of occasions the holes had not aligned. Understanding why they aligned on this particular day, in this particular sequence, is the work of genuine investigation.

Aviation, Grenfell, Fukushima

Aviation's approach to learning from failure is rightly regarded as the benchmark against which all other industries are measured. The key features are well established: independent investigation bodies with legal authority and no prosecutorial function; mandatory incident reporting; confidential voluntary reporting systems that protect reporters from reprisal; standardised investigation methodologies; and systematic dissemination of findings across the industry, as Helmreich described in 2000.

But even aviation's system is imperfect. Sieberichs and Kluge analysed over two thousand two hundred voluntary incident reports from commercial pilots in 2021 and found significant gaps. Reports involving decision-making errors were far less common than reports involving procedural slips, suggesting that the errors most likely to produce novel system insights are precisely those that pilots are least likely to report. Confidential reporting channels produced richer information about latent failures — the systemic conditions that create the preconditions for error — than mandatory channels, where reporters tended to minimise organisational context. The lesson is sobering: even in the world's most advanced learning-from-failure system, significant learning opportunities are being missed.

Grenfell's Long Translation

The Grenfell Tower inquiry represents a different model — one with exhaustive documentation and substantial public accountability, but where the translation of findings into systemic change has been agonisingly slow. The Phase Two report, published in 2024 — seven years after the fire — identified forty-six specific recommendations embedded in thirty-five paragraphs, targeting failures across government, industry, and regulatory bodies, according to Moore-Bick.

The inquiry demonstrated something important about the politics of post-crisis review: the scope of the investigation determines what it can find. An investigation focused on the fire service's operational response on the night would have identified failures in tactics and communication. The broader inquiry revealed that those operational failures occurred within a system that had been comprehensively degraded by decades of deregulation, corporate dishonesty about product safety, and regulatory capture. The people making decisions on the night were operating inside a system that had already failed them.

Fukushima's Suppressed Warnings

The post-incident investigations following the 2011 Fukushima Daiichi nuclear disaster offer a third model. The National Research Council's report in 2014 explicitly acknowledged the challenge of hindsight bias in evaluating the actions of plant personnel who faced overwhelming circumstances. Operators were making life-and-death decisions with failed instrumentation, no electrical power, no lighting, and incomplete understanding of reactor conditions — yet retrospective investigations inevitably evaluated those decisions against knowledge of what was actually happening inside the reactors.

The Fukushima investigations also revealed a pattern common to many large-scale failures: the pre-disaster warnings that were ignored. TEPCO and Japanese regulators had been aware of the risk of large tsunamis. International experience suggested that existing defences were inadequate. But addressing the risk would have required acknowledging that the plant — and the regulatory framework governing it — was less safe than publicly claimed. The cost of that acknowledgment was judged, implicitly, to be too high. This is not an individual failure of judgment; it is a systemic failure of safety culture, in which uncomfortable truths are suppressed because the organisation has no safe mechanism for processing them.

The Mechanics of an Honest Review

Understanding why reviews matter is necessary but insufficient. Leaders need to know how to actually conduct one. The practical mechanics of post-incident review are more complex than most organisations recognise, and getting them wrong can produce analysis that is worse than useless — analysis that creates false confidence that the problem has been understood when it has not.

The Validated Timeline

The foundation of any serious review is a validated timeline. This sounds straightforward; it is not. Different sources — system logs, witness accounts, communications records, media reports — will frequently contradict each other. Witnesses are particularly unreliable on timing and sequence, not because they are dishonest but because human memory under stress compresses time, reorders events, and fills gaps with plausible inferences that become indistinguishable from actual memories, as Henriksen and Kaplan found in 2003. System logs are more reliable on timing but tell you nothing about what people were thinking, seeing, or deciding. The investigator's task is to triangulate across sources, flag contradictions explicitly rather than resolving them prematurely, and maintain a clear distinction between what is established, what is probable, and what is uncertain.

The Cognitive Interview

How you interview people who were involved in the crisis determines the quality of everything that follows. The critical principle is cognitive interview technique: ask participants to reconstruct their experience forward in time, from what they knew and saw in the moment, without revealing what you already know about what happened next. The moment an interviewer says "and then the alarm went off" or "at that point the system failed," they have contaminated the participant's recall. The participant's memory will reorganise around the outcome, and you will get a hindsight-saturated narrative rather than a genuine account of how the situation unfolded from their perspective.

Sharp End, Blunt End

The analysis phase must explicitly separate systemic findings — conditions in the organisation's design, culture, resources, or procedures that created the preconditions for failure — from individual performance findings relating to specific decisions and actions. This separation is not about protecting individuals; it is about ensuring that systemic issues are not overlooked because an individual's error is more visible and more satisfying to address. The Swiss Cheese model provides the conceptual architecture: for every active failure at the sharp end, ask what latent conditions at the blunt end made that failure possible, likely, or inevitable, as Reason described in 1990.

Recommendations That Live

The most common failure mode of post-incident review is the production of recommendations that are technically sound but organisationally dead on arrival. Recommendations that require sustained cultural change, significant resource investment, or acknowledgment of leadership failures are routinely adopted in principle and abandoned in practice. Effective reviews anticipate this by specifying not just what should change but who owns the change, what resources are required, what the timeline is, and how implementation will be monitored. Without these specifics, the recommendation is not a plan; it is a wish.

The Politics of Narrative

In an earlier chapter, we explored Karl Weick's concept of sensemaking — the process by which people construct meaning from ambiguous or chaotic experience. After a crisis, sensemaking takes on a different character. The ambiguity is, in one sense, resolved: we know what happened. But the meaning of what happened — why it happened, what it reveals, who is responsible, what should change — is constructed through a retrospective narrative process that is deeply political, as Maitlis and Sonenshein demonstrated in 2010.

Organisations construct post-crisis narratives that serve particular functions. A narrative that emphasises individual error serves the function of protecting institutional legitimacy. A narrative that emphasises systemic failure serves the function of driving structural change but may threaten those who built or maintained the system. A narrative that emphasises unforeseeable external factors — the "perfect storm" narrative — serves the function of absolving everyone but often at the cost of learning nothing.

The task for leaders is not to find the "true" narrative — complex crises resist single narratives — but to ensure that the process of narrative construction is honest enough to include uncomfortable truths and inclusive enough to represent the perspectives of those closest to the failure, not just those with the most organisational power. As Maitlis and Sonenshein demonstrated in 2010, the quality of post-crisis sensemaking depends critically on whose voices are heard and whose are silenced.

The question is whether the review will produce genuine understanding, or a polished document that protects the people who commission it.

the argument of this chapter

The Second Victim

There is one dimension of post-crisis management that most organisations are catastrophically bad at addressing: the emotional aftermath for the people who were at the centre of the response. Dekker writes powerfully in 2012 about the second victim phenomenon — the professionals whose actions are under scrutiny after an adverse event and who experience trauma, guilt, self-doubt, and isolation, often without any institutional support.

The irony is acute. These are frequently the people who worked hardest during the crisis, who made difficult decisions under impossible conditions, who stayed when others could leave. And in the aftermath, they find themselves the subject of investigation, media scrutiny, and organisational distancing. Colleagues avoid them. The organisation's lawyers advise them not to discuss what happened. They relive the events constantly but have no sanctioned space to process them.

This is not merely a humanitarian concern — though it should be sufficient as one. It is a systemic issue. When organisations fail to support the people involved in adverse events, those people leave. They take their expertise, their institutional knowledge, and their hard-won understanding of how things actually work at the sharp end. They are replaced by people who have not yet learned those lessons. The organisation becomes less safe. And the next generation of frontline workers learns the real lesson of the organisation's response: when things go wrong, you are on your own.

A just culture addresses this directly. It distinguishes between accountability — which may still be appropriate — and abandonment, which never is. It provides psychological support, peer debriefing, and organisational acknowledgment that the person involved is a professional who was operating within a system, not a criminal who defeated it.

Five Features of a Learning Culture

The ultimate question of this chapter is not about any single review or any single crisis. It is about whether an organisation can build a culture that learns from failure as a matter of routine — not only after disasters but after near-misses, anomalies, and everyday operational surprises. The research identifies several features that distinguish learning cultures from their opposites:

Psychological Safety

Psychological safety for reporting. People must believe that reporting errors and near-misses will lead to system improvement, not personal punishment. This belief is built through consistent behaviour over time, not through policy statements, as Helmreich found in 2000.

Independence of Investigation

Post-incident reviews must be led by people with sufficient independence from the chain of command that produced the failure. Self-investigation is structurally compromised.

Feedback Loops That Close

Reporting systems that collect data but do not feed visible changes back to reporters will atrophy. People stop reporting when they believe no one is listening, as Sieberichs and Kluge found in 2021.

Tolerance for Ambiguity

Learning cultures resist the demand for simple answers and single causes. They are comfortable with findings that identify contributing factors rather than root causes, and with recommendations that address system design rather than individual behaviour.

Leadership Modelling

When senior leaders publicly acknowledge their own errors, discuss what they learned, and demonstrate that mistakes are survivable, they create permission for the rest of the organisation to do the same. When they do not, no amount of policy will compensate.

None of these features are technically difficult. All of them are politically difficult. They require leaders to accept that the system they are responsible for is imperfect, that they may have contributed to its imperfections, and that the appearance of control is less valuable than the reality of learning. For many leaders, this is the hardest thing this course will ask of them.