Erosion of Managerial Resilience: From Vasa to NASA
Organisational resilience is defined in this volume as ‘the characteristic of managing the organisation’s activities to anticipate and circumvent threats to its existence and primary goals. This is shown in particular in an ability to manage severe pressures and conflicts between safety and the primary production or performance goals of the organisation’ (Hale & Heijer, Chapter 3). While the organisational or systems level of analysis offers one perspective on resilience, for practical application, it is also necessary to understand how the concept can be decoded to a behavioural level of analysis. What do workers or managers actually do differently in more resilient organisations?
If the above definition is translated to a managerial level, then the essence of resilience appears to be the manager’s ability to deal with conflicts between safety and performance goals. Woods conceptualises this as the skill in making ‘sacrificial decisions’ (Chapter 2). In order to reduce the risk of accidents, managers have to recognise threats to safety and rebuff or circumvent these while minimising threats to productivity. In cases where this component of resilience fails – managers do not detect the threats or they recognise the threats but fail to take the requisite action.
Post-hoc analyses of accidents have well documented limitations but they do offer salient illustrative material. A number of authors in this volume have referred to the space shuttle explosions, but much earlier accounts of transportation disasters also reveal erosion of managerial resilience.
In 1625, the Swedish King, Gustavus Adolphus, was building an empire around the Baltic Sea, and to this end, ordered several new warships. Among them was the Vasa, which was to be built in Stockholm by a Dutch shipbuilder. His experience was essential as the Vasa was to be the mightiest warship in the world, armed with 64 guns on two gundecks. The finished battleship was a magnificient vessel with three tall masts and her wooden hull decorated with elaborate carvings of lions’ heads, angels and mermaids. On Sunday August 10th 1628, she set sail from Stockholm on her maiden voyage, watched by a large crowd of spectators, including foreign diplomats (Figure 14.1). After a few minutes, she heeled over and sank to the bottom of Stockholm harbour. Of 150 people on board, fifty died in the disaster. (The ship was salvaged in 1961 and now sits, beautifully preserved, in the Vasa Museum in Stockholm.)
Figure 14.1: The Vasa founders in Stockholm harbour on her maiden voyage
Analysis of the circumstances leading to the loss of Vasa (Borgenstam & Sandström, 1995; Ohrelius, 1962) revealed several weaknesses in organisational resilience. Treating the Vasa capsize as a new-product disaster, Kessler et al. (2001) identified contributing causal factors, including:
• Obsession with speed (productivity).
• Top management meddling.
At the time of the Vasa construction, Sweden’s military campaigns were under threat. In 1625, ten naval ships had been lost, resulting in a need to accelerate the development of the Vasa. Moreover, their arch-rivals the Danes, were building a super-sized warship, and on learning of this, the Swedish King was determined to have a ship with as many heavy guns as possible, and added a second gundeck and additional cannons to the Vasa’s specifications. He had approved the Vasa’s dimensions and was keen to have her completed rapidly to strengthen his naval power, but continuously requested design changes in ornamentation and armature. According to Kessler et al. (2001, p. 89), “On several occasions the master shipbuilder cautiously tried to dissuade the king, but the king would not listen. Some speculate the extreme vanity of the king was to blame for his overly grandiose goals and over-involvement.” Hybbertson, the master shipbuilder responsible for the Vasa, then became ill and died in 1627, and the ship’s construction was left under the supervision of another manager. The stability test on the ship in the summer of 1628 had to be halted when she heeled violently in response to thirty men running across her decks. Nevertheless, the Admiral in charge of the test decided not to delay the commissioning of the ship, and less than a month later, she sank. It appears that weaknesses in managerial resilience, especially the failure to withstand the ‘drive for production’ from the authority of the King, were instrumental in the disaster.
So it is proposed that the resilience of middle managers is a critical component of organisational safety. They should be able to function as a protective buffer between the competing demands of production (usually driven by senior management) against the safety needs of people, plant and environment. In the case of the Vasa, it appeared that this essential managerial resilience was deficient. For instance, the senior shipbuilder who had expert knowledge and therefore some degree of power, had died before the final year of construction. The Admiral running the sea trials could see that the ship was unstable, but did not dare to delay the launch date (Ohrelius, 1962). One cannot be over-critical of their decisions; in 17th Century Europe disregarding the wishes of your King could have fatal consequences, so their reluctance to contradict Gustavus Adolphus was certainly understandable. But 350 years later, many modern accidents have similar hallmarks indicating a loss of managerial resilience: The regal is power now located in senior management boardrooms and government offices. Dangerous practices can be tacitly encouraged by management even though they contradict formal safety policies (Cutler & James, 1996; Nichols, 1997).
Managerial resilience at NASA also failed in the loss of the space shuttle Challenger in 1986, with powerful political and commercial pressures being applied by senior managers to keep the shuttle programme on schedule. On the eve of the fatal launch, when the engineers were concerned about the fragility of the O rings in low temperature and were voting against the launch, one of the engineers who was hesitating was asked to “take off his engineering hat and put on his management hat” (Vaughn, 1996, p. 398). This engineer then voted in favour of the launch. When the launch took place the next morning in low temperature, the O rings failed and the shuttle exploded on take-off. As Vaughn’s analysis reveals, the behaviour of the engineer has to be interpreted in the context of the prevailing organisational culture in NASA, drifting towards the acceptance of increasingly risky operations. Less than a decade later, in 2003 when the Columbia shuttle was damaged on take-off and exploded on re-entry, the accident investigation shows a similar pattern of flaws in NASA managers’ decision-making in response to schedule pressure (Gehman, 2003). According to Woods (2003, p. 8) this created ‘strong incentives to move forward and look askance at potential disruptions to schedule’.
Other industries are not immune to breakdowns in managers’ resilience. Ill-advised trade-offs between production and safety in the energy industry regularly feature in accident analyses (Carson, 1981; Hopkins, 2000; Wright, 1986). In the Piper Alpha oil platform disaster, which killed 167 men (Cullen, 1990), there had been continual pressure for production, coupled with cost cutting but little evidence of any resistance to this (Pate-Cornell, 1990). Hopkins (2005) outlines a similar situation in the Australian airforce where planes became more important than people and consequently 400 maintenance workers were poisoned by exposure to toxic chemicals. So what exactly characterises managerial resilience and how can it be measured and trained?
Resilience has become a fashionable concept in the corporate world (Coutu, 2002; Sutcliffe & Vogus, 2003; Jackson & Watkin, 2004) with diagnostic tools available, such as the Resilience Factor Inventory, to measure individual levels of resilience (Reivich & Shatte, 2002). This is typically discussed at the level of the employee coping with workplace demands and based on the notion of resilience to life’s adversities. Luthans and Avolio (2003) point out that the application of resilience to leadership has been largely ignored. Their new model of ‘authentic leadership’ redresses this by incorporating resiliency as a ‘positive psychological capacity’ – with themes of realism, improvisation and adaptation. This is a general model of leadership using the interpretation of resilience as the capacity to bounce back from adversity, but it does not make any reference to dealing with safety issues.
The essence of managerial resilience in relation to safety was defined above as the ability to deal with conflicts between safety and the primary performance goals of the organisation. The main goal is usually pressure for production: in industrial settings, there can be significant pressure (explicit or tacit) on site managers and supervisors from more senior managers in the organisation (Mattila et al., 1994). Moreover, there can be internalised or intrinsic pressures from the professionalism of the individual manager to complete tasks, meet targets, reduce costs. These combined pressures can influence workforce behaviour in a manner that drives the organisation too close to its risk boundary, as the Vasa, Challenger and other accidents have shown. Thus, part of the middle manager’s resilience must be the ability to recognise encroaching danger from antagonistic risk situations and then to make trade-off decisions between business targets and safety considerations. Safety-conscious companies operating in higher risk sectors, such as energy production, do not pretend that these conflicts do not exist. Malcolm Brinded (currently CEO of Shell Europe) has stated, ‘Though there are many occasions on which changes to improve business performance also deliver improved safety, we must ensure that everybody is clear that “if there is any conflict between business objectives, safety has priority”‘ (Brinded, 2000, p. 19).
Three component skills characterise managerial resilience in relation to safety. The first is Diagnosis – detecting the signs of operational drift towards a safety boundary. For a manager this means noticing changes in the risk profile of the current situation and recognising that the tolerance limit is about to be (or has been) breached. This requires knowledge of the organisational environment, as well as risk sensitivity: but Hopkins (2005) describes how managers can be risk-blind in spite of direct warnings. Weick has long argued for the importance of mindfulness and sensemaking skills in managers, as well as in operating staff (Weick & Sutcliffe, 2001). This component of managerial resilience is essentially the cognitive skill of situation awareness which encompasses gathering information, making sense of it and anticipating how the present situation may develop (Banbury & Tremblay, 2004; Endsley & Garland, 2002).
The second component is Decision-making – having recognised that the risk balance is now unfavourable (or actually dangerous), managers have to select the appropriate action to reduce the diagnosed level of threat to personnel and/or plant safety. These are relevant across work settings. Woods, (this volume, Chapter 2) calls these trade-off or sacrificial decisions and argues that these were not being taken when NASA’s policy of faster, better, cheaper began to produce goal conflicts with safety objectives. Dominguez et al. (2004) studied conversion decisions when surgeons abandon the fast, minimally invasive technique of laparoscopy to switch to a full abdominal incision when the risk balance for the patient is diagnosed as shifting in an adverse direction. In the oil industry, interviews with offshore managers who had faced serious emergencies, showed that their trade-off decisions were key to maintaining the safety of their installation. One described having to go against the advice of his onshore managers (not usually a career enhancing strategy in the oil industry) by dumping a large quantity of expensive drilling mud overboard in order to de-weight and raise the level of his rig in a dangerous storm. He said this action was “too drastic for them but seemed to be the safest thing to do and all on board relaxed when that decision was made” (Flin & Slaven, 1994, p. 21).
In order to accomplish this kind of resilient response, the manager may also require Assertiveness skills in order to persuade other personnel (especially more senior) that production has to be halted or costs sacrificed. Dealing with demands from above is a central facet of a middle manager’s responsibility for safety. Yet almost the entire literature on managers and industrial safety concentrates on how managers should behave with their subordinates (e.g., Hofmann & Morgeson, 2004). What many supervisors and managers actually find more difficult is how to effectively challenge their boss when they believe that safety may be in conflict with production goals. During the Piper Alpha oil platform accident, the two adjacent platforms Claymore and Tartan were inadvertantly feeding Piper’s catastrophic fire with oil because they were so reluctant to turn off their own oil production. (Platforms can take several days to return to full production following a shut-down.) According to the Public Inquiry report, (Cullen, 1990) the production supervisor on Claymore asked his boss, the offshore installation manger, to close down oil production on six separate occasions without achieving a result.
These three skills characterising managerial resilience (diagnosis, decision-making, assertiveness) are influenced by a manager’s underlying attitudes, particularly Commitment to safety. Managers’ implicit attitudes can be revealed in sharp relief when production and safety goals are clashing and critical decisions must be taken.
Safety Culture and Managerial Resilience
Whether or not managers make sacrificial decisions in favour of safety depends not only on their skills and personal commitment to safety but on the general level of commitment to safety in the managerial ranks of the organisation. This is the essential ingredient of the organisation’s safety culture (Flin, 2003; Zohar, 2003) which affects behaviours such as balancing production and safety goals, implementing safety systems, spending on safety. An effective safety culture produces a belief that when safety and production goals conflict, managers will ensure that safety will predominate.
The organisational culture also has to be sufficiently favourable to allow workers and managers to speak up when they are concerned about safety. Staff need to be sure that when they do challenge their boss, order production to be stopped or express concern about risks, that they will not be penalised. Unfortunately this has not always been the case and, certainly in the UK, there are some striking examples of workers having inordinate difficulty in persuading anyone to listen to their concerns, or even being ostracised for expressing them. In the Bristol hospital where two paediatric cardiac surgeons were operating on babies despite unusually high failure rates, Stephen Bolsin, the anaesthetist who endeavoured to raise concern about their unsafe performance, was given no support and it took several years before the scandal was fully revealed (Hammond & Mosley, 2002; Kennedy, 2001). In fact, Bolsin displayed all three resilience skills described above: he recognised the risks, took the appropriate decision that the situation was unsafe and something had to be done, and (at considerable risk to his own career) spoke up. But despite his courage and assertiveness, the culture of the British medical profession did not endorse such behaviour and his efforts were thwarted. By all accounts this resulted in the avoidable deaths of babies treated by the two surgeons before they were finally suspended. In the UK, ‘whistle blowing’ legislation has now been introduced (Public Interest Disclosure Act 1998) which is designed to protect workers who disclose information about dangers to health and safety in their organisation.
Measuring Managerial Resilience
Three possible techniques to measure managers’ safety resilience are discussed, safety climate surveys, upward appraisal and identifying managerial scripts.
Safety Climate
Safety climate questionnaires measure the underlying organisational safety culture (Cox & Flin, 1998) and provide a leading indicator of safety that complements lagging data, such as accident reports. They can be used as one measure of managerial commitment to safety as they record workforce perceptions of the way in which safety is managed and how it is prioritised against other business goals (e.g. production, cost reduction). When safety climate surveys were first conducted in the North Sea oil industry, they showed that a significant percentage of workers were sceptical about management commitment to safety. In one study on six offshore platforms, 44% of workers agreed that ‘there is sometimes pressure to put production before safety’ and that ‘pointing out breaches of safety instructions can easily be seen as unnecessary hassle’ (Flin et al., 1996). Two years later, the culture had not changed, in a safety climate survey of ten installations, only 46% of workers agreed that ‘Management onshore are genuinely concerned about workers’ safety’ and just 23% believed that ‘nowadays managers are more interested in safety than production’ (Mearns et al., 1997).
Upward Appraisal
In one of the North Sea oil companies, the managing director was so concerned about his offshore workforce’s scepticism about his managers’ commitment to safety, revealed in their safety climate data, that he commissioned an upward appraisal of the managers’ safety attitudes. It was designed to determine how effectively senior managers communicated their safety commitment to their immediate subordinates/direct reports (who in this case were also senior managers). An upward appraisal exercise of this type can also provide a measure of managerial prioritisation of safety against other goals.
There are no standard tools for measuring safety commitment and safety leadership in an upward appraisal exercise, although 360° appraisal is widely used in assessment of business performance. Therefore, a special questionnaire was designed which included sections on safety commitment behaviours, prioritisation of safety, production, cost reduction and reputation, as well as a leadership scale (Yule, Flin & Bryden, under review). For example, one question asked ‘if he was to fail on one of the following business drivers which one would concern him most (production, reputation, safety, cost reduction)?’ The questionnaire was given to 70 directors and senior managers, including directors from their major contracting companies. Each manager completed the questionnaire describing his own safety attitudes, behaviours and leadership style. He also gave a mirror-version of the questionnaire to five direct reports and asked them to rate him in the same way.
The senior managers attended a one-day safety workshop during which each was given a personal report describing his self-perception of safety commitment, contrasted against the view of his subordinates (shown as average and range data). Aggregate results were prepared for the group and presented, resulting in a frank discussion of whether senior managers were successfully communicating consistent messages about their safety commitment. The exercise produced a very positive response from the managers involved, with subsequent evidence of managers taking action to change their behaviour in relation to safety management. Undertaking an upward appraisal survey of this type to assess senior managers’ behaviours, such as prioritisation of safety or their response when safety concerns are raised, is another indicator of whether the prevailing culture is likely to support resilient behaviours in managers and supervisors.
Managerial Scripts
Zohar & Luria (2004) have developed an interesting technique based on behavioural scripts for identifying the extent to which managers prioritise production over safety, and the influencing conditions. They explain that, ‘From the perspective of employee safety as a focal goal, the primary attribute of managerial action patterns is the priority of safety relative to that of competing goals, such as production or costs’ (Zohar & Luria, 2004, p. 323). They gave platoon leaders from the Israeli army a set of eight infantry scenarios involving competing safety and mission demands and asked them to say whether the mission should continue or be aborted. They used the responses to measure the leaders’ safety priority and found that this interacted with leadership style to influence platoon injury rates. This method could easily be adapted for use in other organisational settings to reveal managerial risk awareness and decision-making in relation to safety versus production goals.
Training Managerial Resilience
There are organisations (e.g. the emergency services, military) whose incident commanders are trained to be resilient, i.e., to develop the diagnostic, decision-making and assertiveness skills outlined above (Flin, 1996). Although their risk acceptance thresholds tend to be much higher than those of industrial managers, they too have to make difficult trade-off decisions, such as sacrificing the few to save the many, or halting an operation because the risks exceed the rewards. As Bigley & Roberts (2001) have argued, there may be much to learn for the business world by developing a better understanding of the organisational systems used by the emergency services. The skills of incident commanders translate into resilience competencies that managers could acquire to enhance organisational safety. For example, dynamic decision-making used by fire officers could be applied to enhance risk assessment skills in industry (Tissington & Flin, in press), and there are techniques for training situation awareness and decision-making (Crichton et al., 2002).
Assertiveness training can include influencing skills (Yukl & Falbe, 1992), as well as challenging behaviours and these are already taught in some industrial settings, most notably aviation. Following a series of aircraft accidents, where co-pilots realised that there was a serious risk but failed to challenge the captain’s actions, the need for pilots to receive assertiveness training was identified. This gives pilots specific advice and practice on the communication methods to make their challenge in an assertive manner without being passive or aggressive. One large airline considered changing the term co-pilot to ‘monitoring and challenging pilot’ to emphasise the safety-critical nature of this role.
All three of these resilience skills – risk sensitivity, decision-making, assertiveness – are trained in operational staff in high risk organisations under the banner of Crew Resource Management (Flin et al., in preparation; Wiener et al. 1993). Of course, any organisation that provides this type of training is already moving to a safety culture that has acknowledged the need for such behaviours and is going to accept and reward them as essential for the maintenance of safety.
Organisational resilience has emerged as a conceptual antidote to the traditional pathological approach to safety and disaster research. It reflects the Zeitgeist in positive psychology to develop an understanding of human strengths (Seligman, 2003) rather than the prevailing fascination for cataloguing frailties. So does the resilience approach offer us a paradigm shift or is it just a more positive repackaging of a century of ideas on industrial safety? I suspect the latter but it is encouraging a re-analysis of pervasive, intractable safety problems and the focus on positive attributes provides more constructive advice for managers. This chapter has examined one component of organisational resilience, namely managerial resilience – defined as the ability to deal with conflicts between safety and performance goals. As Quinn (1988) has pointed out, leadership is by its very nature inherently paradoxical and the most resilient managers are those that can recognise and respond appropriately to the paradoxes of risk.