What is the Swiss Cheese Model?

The Swiss Cheese Model of accident causation has been an influential force in how people think about serious incident prevention.

Here, we explain how the Swiss Cheese Model works, some common misconceptions about the model, and how it has inspired risk prevention strategies such as the Forwood Solid Cheese Model.

Overview of the Swiss Cheese Model

The Swiss Cheese Model is a well-known theory of accident causation. Developed by psychology professor James Reason, the model illustrates the “system approach” to understanding the conditions and circumstances that can lead to workplace incidents.

It’s perhaps best known for its graphical representation as a series of Swiss cheese slices, usually with an arrow pointing from a hazard to an unwanted event.

Reason developed the theories behind the Swiss Cheese Model over many years and in different publications.

Here, we focus on the Swiss Cheese Model as Reason describes it in his article “Human error: models and management”, published in the British Medical Journal in 2000.

What is the system approach in the Swiss Cheese Model?

Underlying the Swiss Cheese Model is the “system approach” to managing the human errors involved in workplace accidents. Unlike in the “person approach”, where incidents are the result of human behaviour, the system approach understands errors to be “consequences,” rather than root causes, in a wider organisational context.

That is, the system approach acknowledges that humans make errors but instead of blaming individuals, attributes the origin of accidents to systemic factors within an organisation.

At the centre of this approach are “system defences.” These defences are designed to act as countermeasures to mitigate or avert errors and protect people from harm.

As Reason says, “When an adverse event occurs, the important issue is not who blundered, but how and why the defences failed.”

Ideally, these defences comprise solid layers of protection, ranging from safety measures at the frontline (safety programs, physical barriers, PPE) to organisational mechanisms (policies, audits, administrative controls).

In actuality, the defensive layers are more like slices of Swiss cheese, dotted with holes that can align and place people at risk of serious injury or death.

Reason called this the “Swiss cheese model of system accidents.”

Deadly alignment and the trajectory of accident opportunity 

A common misinterpretation of the Swiss Cheese Model is that the holes in cheese are fixed and permanent.

Rather, the holes in the defensive layers are not static like in real cheese, but constantly opening, closing, and changing location.

Holes in one layer are rarely enough to lead to an incident on their own. It’s when holes in multiple layers line up to create a “trajectory of accident opportunity” that serious injuries or fatalities (SIFs) can occur.

In other words, it’s this trajectory that creates the potential for hazards to come into contact with people, rather than the individual holes themselves.

What causes the holes in the Swiss Cheese Model? 

According to Reason, the holes in an organisation’s safety defences represent failures at four hierarchical levels:

• System failures

• Organisational influences

• Unsafe conditions

• Unsafe acts.

Unsafe acts, or active failures, are mistakes, violations, or other risky actions by people at the frontline. They poke direct but short-lived holes in the defensive layers.

System failures, organisational influences, and unsafe conditions comprise latent conditions that, as the name suggests, can lay dormant, causing long-term holes or weaknesses.

Latent conditions are factors within an organisation that can increase the chances of people committing unsafe acts. These factors often go unnoticed until they combine with active failures and local conditions (the immediate context or environment) to cause a workplace accident.

So, where do these latent conditions come from? Reason says decisions made by management, designers, builders, and procedure writers all contribute, whether they be “mistaken” or unintentional decisions.

Their adverse effects emerge within the work environment, for example understaffing, time pressure, and inadequate equipment. They can also create weaknesses in frontline safety defences, like unreliable alarms or impractical procedures.

Crucially, Reason argues that latent conditions can be identified and fixed before an incident occurs. This approach transforms risk management from reactive to proactive.

Is an accident inevitable in the Swiss Cheese Model? Common misconceptions 

Despite the ubiquity of the Swiss Cheese Model diagram in safety, the underlying concepts are often misinterpreted.

Some of the most common misconceptions of the Swiss Cheese Model include: