Blameless review

Why does holding someone accountable for an outage make the next one more likely?

An engineer runs a command with the wrong flag and takes down payments for forty minutes. The organisation does the thing that feels like seriousness: it names the person, notes it in their file, and requires a sign-off from a manager before anyone runs that command again.

Everything about that is defensible in isolation. And yet organisations that respond this way tend to have more serious incidents afterwards, not fewer. So there is something wrong with the reasoning, and it is worth finding out exactly where — because the case for blame is not stupid, it is just built on an assumption that does not hold.

The assumption is this: that the outage happened because that person was insufficiently careful, and that raising the personal cost of carelessness will raise care. Let us test each half.

Take the first half. Ask what the engineer knew at the moment they pressed enter. Not what we know now, but what was visible then. Almost always the command looked ordinary, the flag looked right, the environment looked like the one they meant, and nothing on the screen suggested otherwise. This is what safety researchers call the local rationality principle: people's actions make sense given their goals, their attention, and the information actually in front of them. The action looks reckless only from the far side of the outcome, once we know which of the many ordinary-looking moments turned out to matter.

That knowledge changes what we can see. Hindsight bias makes the path to the failure look obvious and inevitable after the fact — the missed signal now glows, though it sat in a stream of identical-looking signals at the time. Outcome bias does something further: it makes us judge the decision by how it turned out. Notice that the same command with the same flag, run on a quieter day, would have caused nothing and been reviewed by nobody. If the judgement of the act depends on the outcome rather than on the act, we are not really assessing carefulness at all.

Now the second half — does raising the personal cost raise care? Consider what the engineer's colleagues learn from watching. They learn that reporting a near miss is dangerous, because a near miss is an outage that merely happened to land well and will be judged once someone knows about it. So they stop volunteering the small stuff: the confusing tool, the mistake caught at the last second, the workaround everyone quietly uses. Do you see what the organisation has just lost? Not the errors — those continue — but the reports of them. The rate of visible incidents falls, which reads as improvement, while the reservoir of unexamined hazard grows.

There is a second loss during the incident itself. In a blaming culture, the first person to notice a fault has a private incentive to check whether they caused it before saying anything. That is minutes, sometimes hours. And in the review afterwards, the person who understands the failure best — the one with their hands on it — is precisely the one who must now be careful about what they say, so the account you get is defensible rather than complete.

Set against that, what does blame buy? Usually only the belief that the cause has been addressed. And here the deeper point arrives: the flag was accepted by a tool that offered no confirmation, in an environment indistinguishable from production, without a dry-run mode, at a time when it was possible for one command to remove payments entirely. All of those conditions survive the individual's departure. Removing the person removes the last link in a chain and leaves the rest of the chain in place, wearing a new name.

This is not a purely theoretical position. Aviation acted on it deliberately: NASA has run the Aviation Safety Reporting System since 1976 as a confidential channel, with limited enforcement immunity for reporters, on the explicit reasoning that near-miss information is worth more than punishing the people best placed to supply it. The evidence base is largely from aviation, healthcare and case studies rather than controlled trials — worth saying plainly — but it points consistently in the same direction.

One caution, because "blameless" is routinely misheard. It does not mean nothing has consequences. The just-culture framing separates honest error, at-risk behaviour where a hazard was underestimated, and genuine recklessness where a known risk was knowingly disregarded. The first is a systems problem; the second calls for coaching and guardrails; the third can carry sanction. What blameless review removes is punishment for the ordinary error any competent person would have made in that position.

Three refinements.

Blamelessness is not the same as no accountability. The engineer is entirely accountable — for narrating what happened honestly, and for helping fix the conditions that made it possible. That is a heavier obligation than being written up, and one the person can only meet if it is safe to.

The claim is not that individuals never matter. It is that the individual is the least durable of the causes. A review that ends at "human error" has stopped at the first plausible explanation rather than the most useful one, and it will produce the same class of incident again from a different pair of hands.

Finally, culture here is not a poster but a set of observable behaviours: what happened to the last person who admitted a mistake determines what any future review can discover, and no stated policy overrides it.

• Just culture, and how it draws the line between honest error and knowing recklessness.
• Why "human error" is best treated as the starting point of an investigation rather than its finding.
• Counterfactual language in postmortems ("should have noticed"), and why it quietly reintroduces hindsight.

Every term the collection defines is gathered in the glossary.