Tag: causal reasoning

Sidney Dekker: The Safety Scientist Who Influences How I Think About Quality

Over the past decades, as I’ve grown and now led quality organizations in biotechnology, I’ve encountered many thinkers who’ve shaped my approach to investigation and risk management. But few have fundamentally altered my perspective like Sidney Dekker. His work didn’t just add to my toolkit—it forced me to question some of my most basic assumptions about human error, system failure, and what it means to create genuinely effective quality systems.

Dekker’s challenge to move beyond “safety theater” toward authentic learning resonates deeply with my own frustrations about quality systems that look impressive on paper but fail when tested by real-world complexity.

Why Dekker Matters for Quality Leaders

Professor Sidney Dekker brings a unique combination of academic rigor and operational experience to safety science. As both a commercial airline pilot and the Director of the Safety Science Innovation Lab at Griffith University, he understands the gap between how work is supposed to happen and how it actually gets done. This dual perspective—practitioner and scholar—gives his critiques of traditional safety approaches unusual credibility.

But what initially drew me to Dekker’s work wasn’t his credentials. It was his ability to articulate something I’d been experiencing but couldn’t quite name: the growing disconnect between our increasingly sophisticated compliance systems and our actual ability to prevent quality problems. His concept of “drift into failure” provided a framework for understanding why organizations with excellent procedures and well-trained personnel still experience systemic breakdowns.

The “New View” Revolution

Dekker’s most fundamental contribution is what he calls the “new view” of human error—a complete reframing of how we understand system failures. Having spent years investigating deviations and CAPAs, I can attest to how transformative this shift in perspective can be.

The Traditional Approach I Used to Take:

  • Human error causes problems
  • People are unreliable; systems need protection from human variability
  • Solutions focus on better training, clearer procedures, more controls

Dekker’s New View That Changed My Practice:

  • Human error is a symptom of deeper systemic issues
  • People are the primary source of system reliability, not the threat to it
  • Variability and adaptation are what make complex systems work

This isn’t just academic theory—it has practical implications for every investigation I lead. When I encounter “operator error” in a deviation investigation, Dekker’s framework pushes me to ask different questions: What made this action reasonable to the operator at the time? What system conditions shaped their decision-making? How did our procedures and training actually perform under real-world conditions?

This shift aligns perfectly with the causal reasoning approaches I’ve been developing on this blog. Instead of stopping at “failure to follow procedure,” we dig into the specific mechanisms that drove the event—exactly what Dekker’s view demands.

Drift Into Failure: Why Good Organizations Go Bad

Perhaps Dekker’s most powerful concept for quality leaders is “drift into failure”—the idea that organizations gradually migrate toward disaster through seemingly rational local decisions. This isn’t sudden catastrophic failure; it’s incremental erosion of safety margins through competitive pressure, resource constraints, and normalized deviance.

I’ve seen this pattern repeatedly. For example, a cleaning validation program starts with robust protocols, but over time, small shortcuts accumulate: sampling points that are “difficult to access” get moved, hold times get shortened when production pressure increases, acceptance criteria get “clarified” in ways that gradually expand limits.

Each individual decision seems reasonable in isolation. But collectively, they represent drift—a gradual migration away from the original safety margins toward conditions that enable failure. The contamination events and data integrity issues that plague our industry often represent the endpoint of these drift processes, not sudden breakdowns in otherwise reliable systems.

Beyond Root Cause: Understanding Contributing Conditions

Traditional root cause analysis seeks the single factor that “caused” an event, but complex system failures emerge from multiple interacting conditions. The take-the-best heuristic I’ve been exploring on this blog—focusing on the most causally powerful factor—builds directly on Dekker’s insight that we need to understand mechanisms, not hunt for someone to blame.

When I investigate a failure now, I’m not looking for THE root cause. I’m trying to understand how various factors combined to create conditions for failure. What pressures were operators experiencing? How did procedures perform under actual conditions? What information was available to decision-makers? What made their actions reasonable given their understanding of the situation?

This approach generates investigations that actually help prevent recurrence rather than just satisfying regulatory expectations for “complete” investigations.

Just Culture: Moving Beyond Blame

Dekker’s evolution of just culture thinking has been particularly influential in my leadership approach. His latest work moves beyond simple “blame-free” environments toward restorative justice principles—asking not “who broke the rule” but “who was hurt and how can we address underlying needs.”

This shift has practical implications for how I handle deviations and quality events. Instead of focusing on disciplinary action, I’m asking: What systemic conditions contributed to this outcome? What support do people need to succeed? How can we address the underlying vulnerabilities this event revealed?

This doesn’t mean eliminating accountability—it means creating accountability systems that actually improve performance rather than just satisfying our need to assign blame.

Safety Theater: The Problem with Compliance Performance

Dekker’s most recent work on “safety theater” hits particularly close to home in our regulated environment. He defines safety theater as the performance of compliance when under surveillance that retreats to actual work practices when supervision disappears.

I’ve watched organizations prepare for inspections by creating impressive documentation packages that bear little resemblance to how work actually gets done. Procedures get rewritten to sound more rigorous, training records get updated, and everyone rehearses the “right” answers for auditors. But once the inspection ends, work reverts to the adaptive practices that actually make operations function.

This theater emerges from our desire for perfect, controllable systems, but it paradoxically undermines genuine safety by creating inauthenticity. People learn to perform compliance rather than create genuine safety and quality outcomes.

The falsifiable quality systems I’ve been advocating on this blog represent one response to this problem—creating systems that can be tested and potentially proven wrong rather than just demonstrated as compliant.

Six Practical Takeaways for Quality Leaders

After years of applying Dekker’s insights in biotechnology manufacturing, here are the six most practical lessons for quality professionals:

1. Treat “Human Error” as the Beginning of Investigation, Not the End

When investigations conclude with “human error,” they’ve barely started. This should prompt deeper questions: Why did this action make sense? What system conditions shaped this decision? What can we learn about how our procedures and training actually perform under pressure?

2. Understand Work-as-Done, Not Just Work-as-Imagined

There’s always a gap between procedures (work-as-imagined) and actual practice (work-as-done). Understanding this gap and why it exists is more valuable than trying to force compliance with unrealistic procedures. Some of the most important quality improvements I’ve implemented came from understanding how operators actually solve problems under real conditions.

3. Measure Positive Capacities, Not Just Negative Events

Traditional quality metrics focus on what didn’t happen—no deviations, no complaints, no failures. I’ve started developing metrics around investigation quality, learning effectiveness, and adaptive capacity rather than just counting problems. How quickly do we identify and respond to emerging issues? How effectively do we share learning across sites? How well do our people handle unexpected situations?

4. Create Psychological Safety for Learning

Fear and punishment shut down the flow of safety-critical information. Organizations that want to learn from failures must create conditions where people can report problems, admit mistakes, and share concerns without fear of retribution. This is particularly challenging in our regulated environment, but it’s essential for moving beyond compliance theater toward genuine learning.

5. Focus on Contributing Conditions, Not Root Causes

Complex failures emerge from multiple interacting factors, not single root causes. The take-the-best approach I’ve been developing helps identify the most causally powerful factor while avoiding the trap of seeking THE cause. Understanding mechanisms is more valuable than finding someone to blame.

6. Embrace Adaptive Capacity Instead of Fighting Variability

People’s ability to adapt and respond to unexpected conditions is what makes complex systems work, not a threat to be controlled. Rather than trying to eliminate human variability through ever-more-prescriptive procedures, we should understand how that variability creates resilience and design systems that support rather than constrain adaptive problem-solving.

Connection to Investigation Excellence

Dekker’s work provides the theoretical foundation for many approaches I’ve been exploring on this blog. His emphasis on testable hypotheses rather than compliance theater directly supports falsifiable quality systems. His new view framework underlies the causal reasoning methods I’ve been developing. His focus on understanding normal work, not just failures, informs my approach to risk management.

Most importantly, his insistence on moving beyond negative reasoning (“what didn’t happen”) to positive causal statements (“what actually happened and why”) has transformed how I approach investigations. Instead of documenting failures to follow procedures, we’re understanding the specific mechanisms that drove events—and that makes all the difference in preventing recurrence.

Essential Reading for Quality Leaders

If you’re leading quality organizations in today’s complex regulatory environment, these Dekker works are essential:

Start Here:

For Investigation Excellence:

  • Behind Human Error (with Woods, Cook, et al.) – Comprehensive framework for moving beyond blame
  • Drift into Failure – Understanding how good organizations gradually deteriorate

For Current Challenges:

The Leadership Challenge

Dekker’s work challenges us as quality leaders to move beyond the comfortable certainty of compliance-focused approaches toward the more demanding work of creating genuine learning systems. This requires admitting that our procedures and training might not work as intended. It means supporting people when they make mistakes rather than just punishing them. It demands that we measure our success by how well we learn and adapt, not just how well we document compliance.

This isn’t easy work. It requires the kind of organizational humility that Amy Edmondson and other leadership researchers emphasize—the willingness to be proven wrong in service of getting better. But in my experience, organizations that embrace this challenge develop more robust quality systems and, ultimately, better outcomes for patients.

The question isn’t whether Sidney Dekker is right about everything—it’s whether we’re willing to test his ideas and learn from the results. That’s exactly the kind of falsifiable approach that both his work and effective quality systems demand.

When 483s Reveal Zemblanity: The Catalent Investigation – A Case Study in Systemic Quality Failure

The Catalent Indiana 483 form from July 2025 reads like a textbook example of my newest word, zemblanity, in risk management—the patterned, preventable misfortune that accrues not from blind chance, but from human agency and organizational design choices that quietly hardwire failure into our operations.

Twenty hair contamination deviations. Seven months to notify suppliers. Critical equipment failures dismissed as “not impacting SISPQ.” Media fill programs missing the very interventions they should validate. This isn’t random bad luck—it’s a quality system that has systematically normalized exactly the kinds of deviations that create inspection findings.

The Architecture of Inevitable Failure

Reading through the six major observations, three systemic patterns emerge that align perfectly with the hidden architecture of failure I discussed in my recent post on zemblanity.

Pattern 1: Investigation Theatre Over Causal Understanding

Observation 1 reveals what happens when investigations become compliance exercises rather than learning tools. The hair contamination trend—20 deviations spanning multiple product codes—received investigation resources proportional to internal requirement, not actual risk. As I’ve written about causal reasoning versus negative reasoning, these investigations focused on what didn’t happen rather than understanding the causal mechanisms that allowed hair to systematically enter sterile products.

The tribal knowledge around plunger seating issues exemplifies this perfectly. Operators developed informal workarounds because the formal system failed them, yet when this surfaced during an investigation, it wasn’t captured as a separate deviation worthy of systematic analysis. The investigation closed the immediate problem without addressing the systemic failure that created the conditions for operator innovation in the first place.

Pattern 2: Trend Blindness and Pattern Fragmentation

The most striking aspect of this 483 is how pattern recognition failed across multiple observations. Twenty-three work orders on critical air handling systems. Ten work orders on a single critical water system. Recurring membrane failures. Each treated as isolated maintenance issues rather than signals of systematic degradation.

This mirrors what I’ve discussed about normalization of deviance—where repeated occurrences of problems that don’t immediately cause catastrophe gradually shift our risk threshold. The work orders document a clear pattern of equipment degradation, yet each was risk-assessed as “not impacting SISPQ” without apparent consideration of cumulative or interactive effects.

Pattern 3: Control System Fragmentation

Perhaps most revealing is how different control systems operated in silos. Visual inspection systems that couldn’t detect the very defects found during manual inspection. Environmental monitoring that didn’t include the most critical surfaces. Media fills that omitted interventions documented as root causes of previous failures.

This isn’t about individual system inadequacy—it’s about what happens when quality systems evolve as collections of independent controls rather than integrated barriers designed to work together.

Solutions: From Zemblanity to Serendipity

Drawing from the approaches I’ve developed on this blog, here’s how Catalent could transform their quality system from one that breeds inevitable failure to one that creates conditions for quality serendipity:

Implement Causally Reasoned Investigations

The Energy Safety Canada white paper I discussed earlier this year offers a powerful framework for moving beyond counterfactual analysis. Instead of concluding that operators “failed to follow procedure” regarding stopper installation, investigate why the procedure was inadequate for the equipment configuration. Instead of noting that supplier notification was delayed seven months, understand the systemic factors that made immediate notification unlikely.

Practical Implementation:

  • Retrain investigators in causal reasoning techniques
  • Require investigation sponsors (area managers) to set clear expectations for causal analysis
  • Implement structured causal analysis tools like Cause-Consequence Analysis
  • Focus on what actually happened and why it made sense to people at the time
  • Implement rubrics to guide consistency

Build Integrated Barrier Systems

The take-the-best heuristic I recently explored offers a powerful lens for barrier analysis. Rather than implementing multiple independent controls, identify the single most causally powerful barrier that would prevent each failure type, then design supporting barriers that enhance rather than compete with the primary control.

For hair contamination specifically:

  • Implement direct stopper surface monitoring as the primary barrier
  • Design visual inspection systems specifically to detect proteinaceous particles
  • Create supplier qualification that includes contamination risk assessment
  • Establish real-time trend analysis linking supplier lots to contamination events

Establish Dynamic Trend Integration

Traditional trending treats each system in isolation—environmental monitoring trends, deviation trends, CAPA trends, maintenance trends. The Catalent 483 shows what happens when these parallel trend systems fail to converge into integrated risk assessment.

Integrated Trending Framework:

  • Create cross-functional trend review combining all quality data streams
  • Implement predictive analytics linking maintenance patterns to quality risks
  • Establish trigger points where equipment degradation patterns automatically initiate quality investigations
  • Design Product Quality Reviews that explicitly correlate equipment performance with product quality data

Transform CAPA from Compliance to Learning

The recurring failures documented in this 483—repeated hair findings after CAPA implementation, continued equipment failures after “repair”—reflect what I’ve called the effectiveness paradox. Traditional CAPA focuses on thoroughness over causal accuracy.

CAPA Transformation Strategy:

  • Implement a proper CAPA hierarchy, prioritizing elimination and replacement over detection and mitigation
  • Establish effectiveness criteria before implementation, not after
  • Create learning-oriented CAPA reviews that ask “What did this teach us about our system?”
  • Link CAPA effectiveness directly to recurrence prevention rather than procedural compliance

Build Anticipatory Quality Architecture

The most sophisticated element would be creating what I call “quality serendipity”—systems that create conditions for positive surprises rather than inevitable failures. This requires moving from reactive compliance to anticipatory risk architecture.

Anticipatory Elements:

  • Implement supplier performance modeling that predicts contamination risk before it manifests
  • Create equipment degradation models that trigger quality assessment before failure
  • Establish operator feedback systems that capture emerging risks in real-time
  • Design quality reviews that explicitly seek weak signals of system stress

The Cultural Foundation

None of these technical solutions will work without addressing the cultural foundation that allowed this level of systematic failure to persist. The 483’s most telling detail isn’t any single observation—it’s the cumulative picture of an organization where quality indicators were consistently rationalized rather than interrogated.

As I’ve written about quality culture, without psychological safety and learning orientation, people won’t commit to building and supporting robust quality systems. The tribal knowledge around plunger seating, the normalization of recurring equipment failures, the seven-month delay in supplier notification—these suggest a culture where adaptation to system inadequacy became preferable to system improvement.

The path forward requires leadership that creates conditions for quality serendipity: reward pattern recognition over problem solving, celebrate early identification of weak signals, and create systems that make the right choice the easy choice.

Beyond Compliance: Building Anti-Fragile Quality

The Catalent 483 offers more than a cautionary tale—it provides a roadmap for quality transformation. Every observation represents an invitation to build quality systems that become stronger under stress rather than more brittle.

Organizations that master this transformation—moving from zemblanity-generating systems to serendipity-creating ones—will find that quality becomes not just a regulatory requirement but a competitive advantage. They’ll detect risks earlier, respond more effectively, and create the kind of operational resilience that turns disruption into opportunity.

The choice is clear: continue managing quality as a collection of independent compliance activities, or build integrated systems designed to create the conditions for sustained quality success. The Catalent case shows us what happens when we choose poorly. The frameworks exist to choose better.

What patterns of “inevitable failure” do you see in your own quality systems? How might shifting from negative reasoning to causal understanding transform your approach to investigations? Share your thoughts—this conversation about quality transformation is one we need to have across the industry.

Take-the-Best Heuristic for Causal Investigation

The integration of Gigerenzer’s take-the-best heuristic with a causal reasoning framework creates a powerful approach to root cause analysis that addresses one of the most persistent problems in quality investigations: the tendency to generate exhaustive lists of contributing factors without identifying the causal mechanisms that actually drove the event.

Traditional root cause analysis often suffers from what we might call “factor proliferation”—the systematic identification of every possible contributing element without distinguishing between those that were causally necessary for the outcome and those that merely provide context. This comprehensive approach feels thorough but often obscures the most important causal relationships by giving equal weight to diagnostic and non-diagnostic factors.

The take-the-best heuristic offers an elegant solution by focusing investigative effort on identifying the single most causally powerful factor—the factor that, if changed, would have been most likely to prevent the event from occurring. This approach aligns perfectly with causal reasoning’s emphasis on identifying what was actually present and necessary for the outcome, rather than cataloging everything that might have been relevant.

From Counterfactuals to Causal Mechanisms

The most significant advantage of applying take-the-best to causal investigation is its natural resistance to the negative reasoning trap that dominates traditional root cause analysis. When investigators ask “What single factor was most causally responsible for this outcome?” they’re forced to identify positive causal mechanisms rather than falling back on counterfactuals like “failure to follow procedure” or “inadequate training.”

Consider a typical pharmaceutical deviation where a batch fails specification due to contamination. Traditional analysis might identify multiple contributing factors: inadequate cleaning validation, operator error, environmental monitoring gaps, supplier material variability, and equipment maintenance issues. Each factor receives roughly equal attention in the investigation report, leading to broad but shallow corrective actions.

A take-the-best causal approach would ask: “Which single factor, if it had been different, would most likely have prevented this contamination?” The investigation might reveal that the cleaning validation was adequate under normal conditions, but a specific equipment configuration created dead zones that weren’t addressed in the original validation. This equipment configuration becomes the take-the-best factor because changing it would have directly prevented the contamination, regardless of other contributing elements.

This focus on the most causally powerful factor doesn’t ignore other contributing elements—it prioritizes them based on their causal necessity rather than their mere presence during the event.

The Diagnostic Power of Singular Focus

One of Gigerenzer’s key insights about take-the-best is that focusing on the single most diagnostic factor can actually improve decision accuracy compared to complex multivariate approaches. In causal investigation, this translates to identifying the factor that had the greatest causal influence on the outcome—the factor that represents the strongest link in the causal chain.

This approach forces investigators to move beyond correlation and association toward genuine causal understanding. Instead of asking “What factors were present during this event?” the investigation asks “What factor was most necessary and sufficient for this specific outcome to occur?” This question naturally leads to the kind of specific, testable causal statements.

For example, rather than concluding that “multiple factors contributed to the deviation including inadequate procedures, training gaps, and environmental conditions,” a take-the-best causal analysis might conclude that “the deviation occurred because the procedure specified a 30-minute hold time that was insufficient for complete mixing under the actual environmental conditions present during manufacturing, leading to stratification that caused the observed variability.” This statement identifies the specific causal mechanism (insufficient hold time leading to incomplete mixing) while providing the time, place, and magnitude specificity that causal reasoning demands.

Preventing the Generic CAPA Trap

The take-the-best approach to causal investigation naturally prevents one of the most common failures in pharmaceutical quality: the generation of generic, unfocused corrective actions that address symptoms rather than causes. When investigators identify multiple contributing factors without clear causal prioritization, the resulting CAPAs often become diffuse efforts to “improve” everything without addressing the specific mechanisms that drove the event.

By focusing on the single most causally powerful factor, take-the-best investigations generate targeted corrective actions that address the specific mechanism identified as most necessary for the outcome. This creates more effective prevention strategies while avoiding the resource dilution that often accompanies broad-based improvement efforts.

The causal reasoning framework enhances this focus by requiring that the identified factor be described in terms of what actually happened rather than what failed to happen. Instead of “failure to follow cleaning procedures,” the investigation might identify “use of abbreviated cleaning cycle during shift change because operators prioritized production schedule over cleaning thoroughness.” This causal statement directly leads to specific corrective actions: modify shift change procedures, clarify prioritization guidance, or redesign cleaning cycles to be robust against time pressure.

Systematic Application

Implementing take-the-best causal investigation in pharmaceutical quality requires systematic attention to identifying and testing causal hypotheses rather than simply cataloging potential contributing factors. This process follows a structured approach:

Step 1: Event Reconstruction with Causal Focus – Document what actually happened during the event, emphasizing the sequence of causal mechanisms rather than deviations from expected procedure. Focus on understanding why actions made sense to the people involved at the time they occurred.

Step 2: Causal Hypothesis Generation – Develop specific hypotheses about which single factor was most necessary and sufficient for the observed outcome. These hypotheses should make testable predictions about system behavior under different conditions.

Step 3: Diagnostic Testing – Systematically test each causal hypothesis to determine which factor had the greatest influence on the outcome. This might involve data analysis, controlled experiments, or systematic comparison with similar events.

Step 4: Take-the-Best Selection – Identify the single factor that testing reveals to be most causally powerful—the factor that, if changed, would be most likely to prevent recurrence of the specific event.

Step 5: Mechanistic CAPA Development – Design corrective actions that specifically address the identified causal mechanism rather than implementing broad-based improvements across all potential contributing factors.

Integration with Falsifiable Quality Systems

The take-the-best approach to causal investigation creates naturally falsifiable hypotheses that can be tested and validated over time. When an investigation concludes that a specific factor was most causally responsible for an event, this conclusion makes testable predictions about system behavior that can be validated through subsequent experience.

For example, if a contamination investigation identifies equipment configuration as the take-the-best causal factor, this conclusion predicts that similar contamination events will be prevented by addressing equipment configuration issues, regardless of training improvements or procedural changes. This prediction can be tested systematically as the organization gains experience with similar situations.

This integration with falsifiable quality systems creates a learning loop where investigation conclusions are continuously refined based on their predictive accuracy. Investigations that correctly identify the most causally powerful factors will generate effective prevention strategies, while investigations that miss the key causal mechanisms will be revealed through continued problems despite implemented corrective actions.

The Leadership and Cultural Implications

Implementing take-the-best causal investigation requires leadership commitment to genuine learning rather than blame assignment. This approach often reveals system-level factors that leadership helped create or maintain, requiring the kind of organizational humility that the Energy Safety Canada framework emphasizes.

The cultural shift from comprehensive factor identification to focused causal analysis can be challenging for organizations accustomed to demonstrating thoroughness through exhaustive documentation. Leaders must support investigators in making causal judgments and prioritizing factors based on their diagnostic power rather than their visibility or political sensitivity.

This cultural change aligns with the broader shift toward scientific quality management that both the adaptive toolbox and falsifiable quality frameworks require. Organizations must develop comfort with making specific causal claims that can be tested and potentially proven wrong, rather than maintaining the false safety of comprehensive but non-specific factor lists.

The take-the-best approach to causal investigation represents a practical synthesis of rigorous scientific thinking and adaptive decision-making. By focusing on the single most causally powerful factor while maintaining the specific, testable language that causal reasoning demands, this approach generates investigations that are both scientifically valid and operationally useful—exactly what pharmaceutical quality management needs to move beyond the recurring problems that plague traditional root cause analysis.