Swiss Cheese Model Analysis¶

Why It Matters¶

Organizations implement multiple defenses precisely because each is imperfect. But we psychologically treat defenses as reliable, leading to complacency. This tool makes explicit that defense-in-depth only works when failures are independent. When the same factor creates holes in multiple layers (common-cause failures), the cheese slices align and protection collapses. It forces checking whether defenses are truly independent or merely redundant.

The Key Move¶

For any system with multiple defenses, draw them as parallel layers. For each layer, identify what conditions create "holes" (make that defense ineffective). Then check for independence: do the same conditions create holes in multiple layers? If yes, you have aligned holes—catastrophic vulnerability despite multiple defenses. If no, calculate combined protection: if each layer is 90% effective and independent, four layers give 99.99% protection. But if they fail together, four layers give only 90% protection.

Classic Application¶

Hospital medication errors. Defenses include: physician prescription, pharmacist review, nurse double-check, patient ID verification, bar-code scanning. Investigation of errors revealed these defenses often fail together—time pressure creates holes in all layers simultaneously (physician rushes, pharmacist is backlogged, nurse is managing multiple patients, scanning is skipped for speed). The defenses were redundant but not independent.

Surprising Application¶

Personal security practices. You use multiple defenses: strong passwords, two-factor authentication, suspicious link avoidance, antivirus software. But notice common-cause failures: if your password manager is compromised, it creates holes in multiple layers. If you're exhausted, you're more likely to click suspicious links AND reuse passwords AND skip 2FA. The Swiss cheese model reveals you need defenses against different failure types, not just multiple instances of the same defense type.

Failure Modes¶

Oversimplifies by treating holes as binary (open/closed) when most defenses have degrees of effectiveness. Implies defenses are static when many are dynamic and context-dependent. Can suggest adding more layers is always better, ignoring that too many defenses create compliance burden that degrades all layers. Doesn't capture active defense (cheese slices that move to block trajectories) versus passive defense.

Go Deeper¶

Reason, "Human Error: Models and Management," BMJ 320, 2000, pp. 768-770; Reason, Managing the Risks of Organizational Accidents, Chapter 11; Perneger, "The Swiss Cheese Model of Safety Incidents: Are There Holes in the Metaphor?" BMC Health Services Research 5, 2005.