Swiss Cheese Model Explained: 4 Failure Layers an Incident Review Must Test

F7 explainer for EHS leaders, incident investigators, and operational managers

An incident review becomes shallow when the last visible action receives all the attention. A worker opened the wrong valve, a supervisor accepted a shortcut, or a team failed to report a warning, so the investigation closes around the person who stood closest to the event.

The Swiss Cheese Model, developed by James Reason, explains why accidents occur when weaknesses in several defensive layers line up. In practice, the model is not a picture to place in a training deck. It is a test for the conditions, decisions, controls, and management assumptions that allowed the event to reach a person.

What does the Swiss Cheese Model explain?

The model explains how an incident can pass through multiple defenses even when each defense appears reasonable in isolation. Procedures, equipment, supervision, competence, planning, and management decisions each contain gaps, and those gaps do not need to be visible at the same time for harm to occur.

Reason distinguishes between active failures, which are close to the event in time and place, and latent conditions, which remain in the system until a task exposes them. That distinction changes the investigator's question. Instead of asking only who made the final error, the review asks why the system made that error likely, difficult to detect, or costly to correct.

OSHA's incident investigation guidance takes a similar systems approach by directing employers to identify underlying causes and correct conditions that could produce recurrence. The purpose is prevention, not a more polished explanation of what the person at the scene did last.

Why is the final operator action rarely the whole explanation?

The final action is often the easiest fact to observe, which makes it dangerously attractive as the conclusion. A camera may show a hand reaching into a machine, while the recording does not show the production target that compressed the job, the isolation point that was poorly labeled, or the supervisor who had no practical way to verify the control.

Andreza Araujo's book Sorte ou Capacidade, translated as Luck or Capability, treats accidents as systemic events rather than bad luck. That position does not remove personal responsibility. It places personal action inside the operating conditions that shaped the decision and determines whether the organization can prevent a similar path tomorrow.

A useful review therefore preserves the operator's action as evidence, but refuses to treat it as the full causal story. The four layers below provide a disciplined way to widen the inquiry.

What are the 4 failure layers to test?

The layers are not a rigid sequence. They are four evidence fields that keep the review from stopping at the first plausible answer. If one field is missing, the investigation may describe the event while leaving its recurrence path intact.

Layer 1: How did task conditions shape the event?

Start with the work as it existed, not with the procedure as it was written. Document the physical arrangement, the equipment condition, the people present, the sequence of work, the time available, and the changes that had occurred since planning.

This layer matters because a task can remain nominally identical while its risk changes. A blocked access route, a replacement component, a night shift, a delayed permit, or a changing weather condition can turn a familiar step into a different exposure.

Use photographs, measurements, interviews, work records, and maintenance history to reconstruct the setting. OSHA's investigation requirements also identify documentation such as time, location, operations, photographs, interviews, and measurements as part of a credible report.

Layer 2: Which frontline defenses were missing or weak?

Next, test the barriers that should have prevented contact with the hazard or limited the consequences. A control counts as evidence only when it was available, suitable, understood, and usable under the conditions that actually existed.

Investigators should distinguish between a control that was absent and a control that was present only on paper. A lockout procedure that cannot be completed with the available equipment, a permit that does not identify the changed exposure, or a guard that is routinely removed represents a different problem from a one-time execution lapse.

Ask who verified the defense, what proof they used, and what would have happened if the worker had challenged the arrangement. A strong finding identifies the barrier's design weakness, ownership gap, or verification failure rather than assigning every explanation to retraining.

Layer 3: What decision environment made the error likely?

People make decisions inside an environment that signals what matters, what can wait, and what will be challenged. The review should examine production pressure, staffing, competing priorities, handover quality, escalation routes, and the practical meaning of stop-work authority.

This is not an invitation to turn every investigation into a broad culture essay. The investigator should connect each organizational condition to the event. If a deadline shortened the permit conversation, identify how it changed the control. If a staffing gap removed an experienced verifier, show how the missing check affected the exposure.

The decision environment becomes visible when interviews move beyond “why did you do that?” and ask “what information, authority, and time did you have when you had to decide?” That question produces evidence about the work system without excusing conscious disregard of a known rule.

Layer 4: Which latent conditions allowed the gaps to persist?

Latent conditions are weaknesses that may remain invisible until several circumstances bring them together. They include unclear ownership, weak standards, poor resource decisions, ineffective assurance, outdated risk assessments, and management assumptions that are never tested against field evidence.

At this layer, the investigator should look for repeated signals. Has the same control failed in another area? Have workers raised the same concern without a durable response? Does the audit process verify documents instead of control performance? Are corrective actions closed when a task is completed, even though the hazard remains?

James Reason's contribution is valuable here because it shows why a safe-looking organization can still contain conditions that make failure predictable. Andreza's A Ilusão da Conformidade, translated as The Illusion of Compliance, offers a compatible warning: documented compliance is not proof that the operating system can withstand pressure.

How should investigators connect the four layers?

Build the explanation as a chain, not as four disconnected categories. Describe the task condition, identify the defense that should have responded, show how the decision environment weakened that defense, and then trace the management condition that allowed the weakness to remain.

For example, a maintenance team may encounter a mislabeled isolation point during a night repair. The frontline defense was the isolation verification, but the verification was weakened by unclear labeling and an absent competent person. The decision environment included a delayed restart and a handover that did not identify the change. The latent condition was a maintenance assurance process that had never tested whether labels matched the field.

That chain is more useful than a conclusion such as “the worker failed to follow the procedure,” because it identifies several points where prevention can act. It also makes ownership clearer. The maintenance manager may own the labeling standard, the operations leader may own the handover, and the site leader may own assurance that the controls work in the field.

What evidence separates a real finding from a convenient story?

A finding is stronger when it is supported by more than one evidence source and when it explains both the event and the failed opportunity to detect it earlier. Compare interviews with work orders, permits, training records, photographs, observation data, maintenance history, and prior action plans.

Be careful with evidence that appears precise but only repeats the organization’s preferred story. A completed checklist proves completion, not necessarily control effectiveness. A training record proves attendance, not competence under pressure. A procedure proves intent, not usability at the point of work.

The review should also test disconfirming evidence. If the team concludes that an individual lacked knowledge, what shows that the knowledge was available, understood, and reinforced? If the team concludes that the barrier failed because of a unique deviation, what proves that similar deviations were not already tolerated elsewhere?

How do you turn the model into corrective action?

Each finding should produce an action that changes a condition, a control, a decision, or an assurance mechanism. Retraining can be appropriate when knowledge was genuinely absent, but it is weak when the procedure is unusable, the control is unavailable, or the work design rewards the shortcut.

Prioritize actions that move the system away from dependence on memory and individual vigilance. Redesign the equipment, improve isolation identification, clarify authority, remove conflicting targets, strengthen verification, or change the review cadence so that evidence reaches the person who can act.

Use the post-incident action plan as a decision document, not as a list of promises. Each action needs an owner, a completion condition, and a test that shows whether the risk has actually changed.

When should leaders use the Swiss Cheese Model?

Use the model after a serious injury, fatality, high-potential near miss, failed critical control, or repeated event pattern. It is also useful when an investigation produces a suspiciously short explanation, especially when the conclusion rests on one person's behavior and leaves the surrounding conditions unexamined.

Leaders do not need to wait for a major event. A review of a high-potential near miss can reveal the same alignment of weak defenses before harm occurs. The near-miss review comparison helps determine when the event needs a broader investigation rather than a quick local correction.

Conclusion: investigate the alignment, not only the last action

The Swiss Cheese Model makes one practical point clear. Harm becomes possible when weaknesses in several layers align, so an incident investigation must test task conditions, frontline defenses, decision environment, and latent management conditions.

An investigation earns its value when the findings change the system that produced the exposure. For more practical guidance on safety culture and incident prevention, visit Andreza Araujo.