Blame Is Not an Analysis — Why Naming a Person Is Where Investigations Should Start, Not Stop

Something goes wrong, and within hours a name attaches itself to it. Not a finding — a name. The person who gave the wrong thing, missed the result, read the screen too fast. The investigation, in spirit, is already over; what remains is paperwork. This is the single most seductive move in safety work, and it is a counterfeit. Blame wears the costume of an analysis — it produces a cause, closes a case, satisfies the very human need for someone to be accountable — while pointing precisely away from the thing that will produce the next case. The next person inherits an unchanged world, and in due course makes a version of the same mistake, and gets their own name attached.

The argument here is not that people never err in ways that matter. It is that "a person erred" is the beginning of an investigation, not the end of one — and that treating it as the end is how organisations stay exactly as dangerous as they were the day before.

Why blame is so attractive

Start by being honest about the pull, because it is strong and it is not stupid.

Blame is cognitively cheap. A human mind handed a bad outcome wants a single cause with a single face, and an error gives it one immediately. Conditions are diffuse — a rota, an interface, a fortnight of short staffing, a packaging change three suppliers upstream. A person is concrete. You can point at them. The brain takes the available explanation over the accurate one almost every time, and the available one is standing right there in the incident.

Blame is organisationally convenient. This is the quieter engine, and the more powerful. If the person is guilty, the system is innocent. The rota survives. The interface ships unchanged. The procurement decision is never revisited. Locating the fault in an individual is, for an institution, the cheapest possible outcome — no redesign, no budget, no admission that the conditions of work were themselves a hazard. It closes the loop without spending anything, which is exactly why it is the loop most institutions reach for.

And blame is emotionally satisfying — for everyone except the next patient. It answers the question the room is actually asking, which is not "how did this happen" but "whose fault was it". Those feel like the same question. They are not even close. The first points at conditions you can change; the second points at a person you can punish, and punishment has a finality that analysis never offers. The case feels closed. The hazard is entirely undisturbed.

What blame conceals

Here is the cost of stopping at the name: everything that actually produced the error stays invisible, because you have stopped looking the moment you found someone to hold responsible.

The error-shaped conditions are the first casualty. Most serious mistakes in healthcare are not produced by a uniquely careless individual; they are produced by an environment that made the mistake easy and the catch hard. Two drugs that look alike on the shelf. An interface that puts the dangerous action one careless click from the safe one. A handover at the worst possible moment. Staffing thin enough that attention is a rationed resource. These are not excuses for the person — they are the actual mechanism of the harm, and they are still fully present after the person has been disciplined, waiting with infinite patience for the next operator.

Then there is hindsight. Once you know the outcome, the path to it looks obvious — the warning signs line up like signposts, the wrong choice glows in retrospect. But the person did not have the outcome when they made the choice. They had a normal, ambiguous, busy moment that looked like a thousand others that ended fine. Judging a decision by information that only existed after it was made is one of the most reliable distortions in human reasoning, and it converts ordinary, understandable action into apparent negligence by the simple trick of already knowing how the story ends. Strip the outcome back out and ask what the moment actually looked like from inside, and most "obvious" errors stop being obvious.

The discipline that keeps this honest is a single question, drawn from the safety-science literature: would another capable colleague, dropped into the same conditions with the same information and the same pressures, plausibly have done the same thing? If the answer is yes — and far more often than comfort would like, it is — then what you are looking at is not a defective person. It is a defective situation that happened to catch this particular person on this particular day. Punishing them changes who is unlucky next time. It changes nothing about the odds.

The honest limits of no-blame

It would be easy, and wrong, to read all of this as a case for absolution. It is not, and the version of safety culture that collapses into "nobody is ever responsible for anything" deserves the suspicion it attracts.

A serious culture does not refuse to distinguish between kinds of behaviour — it insists on it. There is honest error: a competent person, in defensible conditions, who made the choice that most others would have made. There is drift: the slow normalisation of a corner-cut, the workaround that became routine because the proper path was unworkable and nobody fixed it. And there is recklessness: a conscious, unreasonable disregard for a risk a person plainly understood — and, in its own category, impairment, where someone should not have been doing the work at all. These are not points on a single dial of naughtiness. They are different things, and they call for different responses.

The useful formulation is roughly this: console the error, coach the drift, confront the recklessness. Treating genuine recklessness as though it were honest error is not compassion — it is negligence with a kind face, and it fails the next patient just as surely as blame does. The point of separating conditions from conduct was never to empty the word accountability. It was to spend accountability where it actually belongs, on the rare conduct that warrants it, instead of squandering it on the ordinary human being who was simply standing closest to a system designed to fail. A culture that cannot tell these apart has not transcended blame. It has just moved its imprecision to the other end.

The digital health version

Software inherited this reflex wholesale, and gave it a tidier name. In clinical technology, the equivalent of "human error" is the training issue — the verdict that the system was fine and the user got it wrong. It is the same move, with the same appeal, and the same blind spot. The user clicked the wrong patient; the user missed the alert; the user entered the value in the wrong field. Case closed, system exonerated, roadmap undisturbed.

But every "user error" in a clinical system is a design hypothesis that has just gone untested. If users keep selecting the wrong patient, that is data about an interface that makes the wrong patient selectable too easily — not a moral failing distributed independently across dozens of clinicians who, remarkably, all happened to be careless in the identical way. When the same mistake recurs across different people, the common factor is not the people. It is the thing they all touched. "Training issue" is how a product team avoids reading its own most valuable feedback, because reading it would imply rework, and blaming the user implies nothing but a memo.

A blame-aware review of software-involved harm asks a different opening question. Not "who clicked it" but "what made that click the path of least resistance, and what would the system have to look like for the safe action to be the easy one". It treats a recurring user error as a returned verdict on the design and reads it accordingly. It assumes, until shown otherwise, that a competent person collided with a hostile surface — because that assumption is not only kinder, it is, far more often than the industry's instinct allows, simply true. The interface is the part you can change. The user is the part you keep replacing.

What this means

Underneath all of it is a confusion between two activities that feel like one. Accountability asks who is answerable. Analysis asks what produced the outcome. They are different jobs, they answer different questions, and performing the first while believing you have done the second is the central self-deception of unsafe organisations. Blame closes the meeting. Analysis changes the system. Only one of them protects the next patient, and it is never the one that ends with a name and a full stop.

The reason this matters past the individual case is that the choice compounds. Every time an organisation reaches for the person instead of the conditions, it buys a clean conclusion today and re-pays for it later, in an incident it has done precisely nothing to prevent. The conditions wait. They are not embarrassed by the disciplinary letter. They simply hold their shape until the next capable person walks into them — and then everyone is surprised, again, by a mistake the last investigation already had in its hands and chose to call a name instead.