Safety Science 71 (2015) 71–79

Contents lists available at ScienceDirect

Safety Science
journal homepage: www.elsevier.com/locate/ssci

Promoting safety by increasing uncertainty – Implications for risk

management
Gudela Grote ⇑
ETH Zürich, Department of Management, Technology, and Economics, Weinbergstrasse 56/58, CH-8092 Zürich, Switzerland

a r t i c l e i n f o a b s t r a c t

Article history: Recent developments in risk assessment acknowledge the need to capture both quantitative and qualita-
Available online 1 March 2014 tive uncertainties in order to better understand and manage risks. This paper goes a step further yet by
arguing that existing uncertainties do not only have to be acknowledged in order to improve risk man-
Keywords: agement and safety, but that in certain circumstances deliberate increases in uncertainty are conducive
Decision-making to more safety. Within a general framework of managing uncertainty, balancing stability and flexibility in
Uncertainty work processes and matching control and accountability for these processes are proposed as criteria for
Risk management
decisions on reducing, maintaining, and increasing uncertainty. How operational and strategic decision-
Flexible rules
Speaking up
making involved in designing, employing and monitoring high-risk systems is affected by considering
increasing uncertainty as a viable option is shown for two examples: rule-making where the most appro-
priate rules are not necessarily those that are most restrictive and thereby uncertainty-reducing, but
rather ‘flexible rules’ that support adaptive action by providing degrees of freedom which initially raise
rather than reduce uncertainty for the decision-maker; and speaking up which entails empowering peo-
ple to voice concerns and doubts about a chosen course of action in ways that allow to incorporate the
added uncertainty into sounder decision-making. Finally, decision-making in risk management is dis-
cussed more generally by drawing on current debates of what constitutes rational choice. In order to pre-
pare the ground for capitalizing on the benefits of increasing uncertainty, the necessity to reflect on
fundamental beliefs concerning human rationality is emphasized.
Ó 2014 Elsevier Ltd. All rights reserved.

1. Introduction and whether it concerns expected gains or losses. In an attempt to

Uncertainty is at the heart of risk. Only very recently, though,
uncertainty has regained a significant place in debates on risk. In
an early economic definition by Knight (1921), risk was distin-
guished from uncertainty by postulating that risk is measurable,
while uncertainty is not. Subsequently, risk has dominated the de-
bate, usually based on definitions where uncertainty is quantified
into probabilities, which presumably renders a separate discussion
of uncertainty obsolete. By virtue of renewed concerns with
improving our grasp of very rare events, as illustrated by the pop-
ularity of Taleb’s (2007) book ‘‘The Black Swan’’, uncertainty has
re-entered academic and practical discourse in risk management.
This is reflected in recent, very broad risk definitions like the one
by Aven and Renn (2009), where ‘‘risk refers to uncertainty about
and severity of the events and consequences (or outcomes) of an
activity with respect to something that humans value’’, leaving
open whether uncertainty is of a quantitative or qualitative nature
⇑ Tel.: +41 44 632 7086.
E-mail address: ggrote@ethz.ch
disentangle the risk metaphors of ‘black swans’ and ‘perfect
storms’, Paté-Cornell (2012) differentiates between two types of
uncertainty: perfect storms in her view entail rare conjunctions
of known events which in principle can be expressed by probabil-
ity estimates, while black swans involve unknown events that defy
any kind of prediction. By arguing for the importance of capturing
both quantifiable and non-quantifiable uncertainties in risk assess-
ments, risk researchers aim to increase political and public accep-
tance of admitting to realms of risk that are difficult if not
impossible to control by current methods and instruments in risk
management. At the same time, acknowledgement of uncertainty
that can neither be reduced nor captured quantitatively is hoped
to spur development of new methods in risk assessment and man-
agement that build risk control on more realistic scenarios, for in-
stance by integrating weighted costs and benefits of best and worst
cases (Farber, 2011).
This paper goes a step further still by arguing that not only do
existing uncertainties have to be more fully acknowledged in risk
assessment, but that in order to improve risk management and
safety more generally deliberate increases in uncertainty may be

http://dx.doi.org/10.1016/j.ssci.2014.02.010
0925-7535/Ó 2014 Elsevier Ltd. All rights reserved.
72 G. Grote / Safety Science 71 (2015) 71–79
beneficial. This leads to suggesting that risk management – defined
as ‘‘coordinated activities to direct and control an organization
with regard to risk’’ (ISO3100, 2009, p. 2) – includes decision-mak-
ing on avoiding, reducing, retaining or transferring risk and uncer-
tainty as well as on increasing uncertainty. A similar extension is
mentioned in the ISO 31000 standard by listing ‘‘increasing risk
to pursue an opportunity’’ as an option for risk treatment
(ISO3100, 2009, p. 6). Spelling out in more detail when this is a via-
ble option and demonstrating the potential value of increasing
uncertainty more generally for the risk management process, that
is all activities ranging from risk identification and assessment to
risk treatment and risk communication, is the main purpose of this
paper. Within a general framework of managing uncertainty
requirements for decision-making on reducing, maintaining, and
increasing uncertainty at the strategic and operational level of
organizational functioning are analyzed and implications of cur-
rent debates on what constitutes rational choice discussed.
2. Managing uncertainty as part of risk management
The final report on the events at Fukushima makes the disturb-
ing claim that Japanese culture should be considered the root cause
of the nuclear disaster. ‘‘What must be admitted – very painfully –
is that this was a disaster ‘Made in Japan’. Its fundamental causes
are to be found in the ingrained conventions of Japanese culture:
our reflexive obedience; our reluctance to question authority;
our devotion to ‘sticking with the program’; our groupism; and
our insularity’’ (NAIIC report, 2012). Thus it is argued that uncer-
tainty avoidance led to the many faulty decisions before, during,
and after the Fukushima catastrophe.
Challenging authority by voicing concerns, encouraging diver-
gent thinking in order to bring out more alternatives and criteria
in decision-making, and allowing decision latitude in support of
adaptive behavior are crucial elements of sound decision-making.
This implies, however, a willingness to deliberately increase uncer-
tainty at least temporarily, which seems to have been missing in
Japan, but also in many other reported cases such as the two major
accidents of US shuttles. Concerning those accidents Feldman
(2004) made the interesting observation that uncertainty could
not appropriately enter the discussions because the involved engi-
neers were used to taking only quantifiable uncertainties into ac-
count, while many of the concerns in these two tragedies were of
a qualitative nature. ‘‘They (the NASA engineers) were not able to
quantitatively prove flight was unsafe, so in this culture it became
easy for management to claim it was safe. [. . .] Under conditions of
uncertainty, cultures dominated by the belief in [. . .] objectivity
must be silent. This silence makes these cultures vulnerable to
power and manipulation’’ (Feldman 2004, p. 708). Similarly, Farber
(2011) has described the unwillingness of the US Nuclear Regula-
tory Commission to consider risks that could not be quantified,
such as terrorist attacks on nuclear facilities, which led them to
ignore those risks in all further decision-making.
These examples illustrate the necessity to manage uncertainty
in a more explicit and systematic manner in risk management
not only by considering both quantitative and qualitative uncer-
tainty in risk assessments (e.g., Bjelland and Aven, 2013), but also
by including options of reducing, maintaining and increasing
uncertainty in decisions on risk mitigation. In the discussions to
follow, uncertainty is understood in its most basic form as ‘not
knowing for sure’ due to lack of information and/or ambiguous
information (Daft and Lengel, 1984; Galbraith, 1973; ISO3100,
2009). With this understanding in mind, it is important to note,
however, that more information does not necessarily reduce
uncertainty, but may open up new perspectives for decision-
making for which again further information is required, thereby
in fact increasing uncertainty.
The examples also hint at a fundamental difficulty in ade-
quately managing uncertainty in terms of assessing all three op-
tions of reducing, maintaining and increasing uncertainty: These
three options are founded on fundamentally different conceptions
of risk control (see Table 1). Reducing uncertainty to a level of
acceptable risk is the main thrust in classic risk mitigation. The
overall objective is to create stable systems that allow for a maxi-
mum of central control. Measures such as standardization and
automation help to streamline work processes. Maintaining uncer-
tainty follows from acknowledging the limits to reducing uncer-
tainty in complex systems, which has led to the development of
concepts like ‘‘high reliability organizations’’ (Weick et al., 1999)
and ‘‘resilience engineering’’ (Hollnagel et al., 2006). Flexibility as
a source for resilience, that is the capability of systems to recover
from perturbations, is sought. For this purpose, control capacity
needs to be decentralized, e.g. by means of empowering local ac-
tors. Increasing uncertainty, finally, aims at flexibility not only in re-
sponse to perturbations, but also in support of innovation. An
important conceptual basis is complexity theory (cf. e.g. Anderson,
1999) and self-organization as one of the theory’s fundamental
principles. Self-organizing local agents are assumed to not be di-
rectly controllable; instead they are indirectly influenced in their
adaptive behavior by shaping contexts, for instance through set-
ting incentives and constraints for experimentation.
Carroll (1998) has pointed out that the different conceptions of
risk control tend to be prevalent in different professional (sub)cul-
tures within organizations (Schein, 1996). While engineers and
executives believe in uncertainty reduction through design and
planning, operative personnel are very aware of the need for resil-
ience in the face of only partially controllable uncertainties. Social
scientists finally will argue for openness to learning and innova-
tion, thereby even adding uncertainty. Reducing, maintaining,
and increasing uncertainty also form the core of the three models
of safety postulated by Amalberti (2013) for different industries.
According to him, ultra-safe systems like aviation are built on
reducing uncertainty through standardization and external super-
vision, while high reliability organizations, for instance in health
care or the chemical industry, are characterized by their ability
to collectively cope with inevitable uncertainties. Ultra-resilient
systems, finally, are those that seek uncertainty as part of their
business models, for instance in stock market trading or in military
aviation. The safety performance of these systems is generally low-
er compared to the other two types of organizations, but will
greatly vary based on the level of competence of the highly auton-
omous actors that run ultra-resilient systems.
Building a shared understanding of the legitimacy of all three
options of reducing, maintaining and increasing uncertainty across
professional boundaries is paramount to developing a more com-
prehensive approach to risk management. Once this has been
achieved – which is in itself a very difficult task to which I will re-
turn in the final sections of this paper – the issue becomes to deter-
mine criteria that will allow decision-makers to systematically
choose between the three options. Beside all the specific opera-
tional, strategic, and political concerns that will govern such
choices, there are two fundamental criteria: (1) Optimal balance
between stability and flexibility; (2) Optimal match between con-
trol and accountability. Both of these are expanded upon in the
following.
2.1. Balance between stability and flexibility
Early work in organization theory promoted a contingency per-
spective which called for either stability or flexibility depending on
the level of uncertainty with which an organization is faced (cf. e.g.,
 G. Grote / Safety Science 71 (2015) 71–79
Table 1
Options for managing uncertainty.
Reducing uncertainty
Objective Stability
Conceptual approach Classic risk mitigation
Control paradigm Central control
Examples of measures Standardization; automation
Thompson, 1967). More recently, consensus has emerged across
different management disciplines that organizations need concur-
rent stability and flexibility because stability and flexibility each
offer unique advantages at the organizational, team and individual
level which should best be combined (Farjoun, 2010; Gebert et al.,
2010; Leana and Barry, 2000; Manz and Stewart, 1997). The high
levels of routine, standardization and formalization which create
stability generally enhance predictability and control and reduce
the need for ad hoc coordination. The capacity for flexibility and
change, on the other hand, allows for learning and ad hoc adapta-
tions in the face of uncertainty and the new and variable demands
it creates.
When decisions are made on how uncertainty should be best
managed for particular work processes or more generally in an
organization’s operations, stability and flexibility requirements
need to be analyzed in view of the specific necessities for control
and adaptation. Clearly, companies like Google or Apple that are
geared towards maximum innovation will overall look for a differ-
ent balance between stability and flexibility than companies
whose operations imply the need to control high levels of risk for
human life and the environment. However, for particular processes
even high innovation may require higher levels of control and sta-
bility, for instance when meeting a particular release date is cru-
cial. On the other hand, a nuclear power plant will have to allow
for uncertainty that comes, for instance, with technical innovations
in plant operation, even though most likely evolutionary rather
than radical innovation will be sought.
In order to determine more specific stability and flexibility
requirements for optimizing control and accountability in the
functioning of socio-technical systems, one can take the two classic
scenarios discussed in the organization literature – minimizing
uncertainty versus coping with uncertainty (Grote, 2009) – as a
starting point. While the first scenario is oriented towards reducing
uncertainty to the utmost by standardization and automation, that
is the Fordist notion of Model-T in black, the second scenario
acknowledges the inevitability and possibly even desirability of
uncertainty and counts on building resources for local adaptive ac-
tion following the socio-technical systems design principle of cop-
ing with variances at their source (Cherns, 1987). Mostly though,
neither of these scenarios will be fully applicable to any given orga-
nization, but appropriate mixes of stability- and flexibility-enhanc-
ing mechanisms will have to be found. In this process, stability and
flexibility should not be treated as two ends of one dimension, but
as analytically distinct dimensions with separate mechanisms
operating on them (Grote et al., 2012). Flexibility is a response to
uncertainty, while stability is a response to the need for control.
Measures that increase flexibility, such as availability of several re-
sponses in a given situation, may in fact also increase stability be-
cause control capabilities are increased by making the system
more resilient. On the other hand, measures to increase stability
by for instance excluding some options for action and thereby
bounding uncertainty may enhance flexible responses to other
uncertainties. This interconnectedness of stability and flexibility
has also been described as the duality of stability and flexibility
(Farjoun, 2010). Stability and flexibility can interact in positive
ways as in the examples mentioned so far, but there may also be
negative effects when, for instance, stabilizing factors like rules
are taken away in an attempt to increase flexibility, but instead
73
Maintaining uncertainty Increasing uncertainty
Flexibility Flexibility/innovation
Resilience Complexity theory
Control by delegation to local actors Shaping contexts for self-organizing agents
Empowerment Controlled experimentation
actors are disoriented, or when rules are put in place to increase
control, but these rules are inadequate so that flexibility is lost
without gaining control.
Generally, continuous monitoring of stability and flexibility
requirements along with adaptations in reducing, maintaining
and increasing uncertainties and the processes needed to handle
these uncertainties is crucial for comprehensive risk management.
Table 2 illustrates how organizations in different industry sectors,
different functions within organizations and finally different work
processes rely on the three options for handling uncertainty, indi-
cating that within organizations which are geared towards reduc-
ing uncertainty there will be certain functions and work processes
that require maintaining or increasing uncertainty and vice versa.
Determining the right mix between stability and flexibility is a core
task for organizations running high-risk operations, but also for
regulatory bodies supervising these operations. Regulatory re-
gimes have to match the stability and flexibility requirements of
the operations they are to meant to regulate (Hale and Borys,
2013b; May, 2007). A more in-depth discussion of this point will
follow in a later section where the notion of flexible rules is
introduced.
2.2. Match between control and accountability
Concerning the second criterion, the match between control
and accountability, the core principle is to not hold actors account-
able for outcomes they have no control over. This problem has
been mostly discussed in the context of automated systems where
human operators are supposed to handle uncertainties in excep-
tional situations for which they lack adequate cognitive resources
(Bainbridge, 1983). It has been argued that if situations are truly
unpredictable then systematic intervention is not possible and
responsibility cannot be assigned to the individuals involved. More
recently, this problem has been taken up by Suchman (2002) in her
discussion of located accountability. She argues that the fact that
knowledge and practice are distributed and that no one has the
overall picture does not relieve anyone of responsibility, but makes
everybody personally responsible for what lies within their reach
in their different roles. Thus, human operators are still to be held
accountable, but so are the designers of the technology, the organi-
zations operating the technology, and the regulators supervising
adequate operation. Clearly, diffusion of responsibility can be a
new problem when following this approach, but at least the dis-
cussion is opened on where control and accountability are to be lo-
cated instead of implicitly or explicitly assuming from the start
that the human operator will be the culprit as soon as something
goes wrong.
Capabilities for controlling uncertainties can also be considered
a hallmark of power which includes the power to transfer uncer-
tainties to other less powerful actors (Marris, 1996). Therefore,
the management of uncertainty needs to be analyzed in the con-
text of power relationships to avoid undue transfers of uncertain-
ties to actors that have no means of controlling them. However,
just as much as avoiding situations where uncertainty is trans-
ferred to actors that cannot control them, care also needs to be ta-
ken to hold actors accountable for outcomes they have in fact
control over. This latter issue has become salient in discussions
about the various recent crises in the financial services industry
74 G. Grote / Safety Science 71 (2015) 71–79

Table 2
Illustration of options for managing uncertainty at different organizational levels.

Reducing uncertainty Maintaining uncertainty Increasing uncertainty

Industry sector Nuclear power Health care Oil exploration
Organizational function Production planning Operations R&D
Work process Routine task Problem-solving Inventing

where regulatory action is now aimed at ensuring accountability of coordination (Perrow, 1984). However, in view of changing de-
banks (Sundström and Hollnagel, 2011). mands and unforeseen situations, actors still need to be able to
adapt their behavior by modifying prescribed procedures (e.g.,
Hale and Borys, 2013a; Rasmussen, 1997). In order to employ rules
3. Benefits of increasing uncertainty for promoting safety
– defined in the most general sense as written prescriptions for
behavior – in ways that permit the required balancing of stability
To further substantiate the claim that in risk-related decisions
and flexibility, while also providing a match between control and
the option of increasing uncertainty should be considered more
accountability, Grote and colleagues have argued that the notion
explicitly, possible benefits of higher levels of uncertainty need
of flexible rules is important (Grote et al., 2009; Grote, 2012).
to be demonstrated. Direct benefits of uncertainty can be seen
The idea of flexible rules draws on the distinction suggested by
most easily in contexts where innovation and creativity are sought
Hale and Swuste (1998) between goal, process, and action rules
as integral part of company strategy (Kaplan and Mikes, 2012).
(see Table 3). Goal rules only define the goal to be achieved, leaving
Bringing about new ideas requires the willingness to leave existing
open how this is accomplished by the actors concerned. Process
behavioral routines behind and to engage in exploration and diver-
rules provide guidance for deciding on the right course of action
gent thinking, which implies embracing uncertainty. Conse-
for achieving certain goals. Finally, action rules prescribe detailed
quently, whenever innovation is needed in high-risk settings
courses of action, possibly without even mentioning the goal to
uncertainty will have to be increased. This is indeed the case in a
be achieved. Goal and process rules and also those action rules that
variety of situations ranging from strategic responses to changing
entail some decision latitude constitute flexible rules.
regulatory, economic or societal demands to handling non-routine
As a rule of thumb on good rule making, action rules should be
operational events. However, increasing uncertainty can also be
used when stability of processes is required; goal and process rules
beneficial for safety at the opposite end of the spectrum, that is
should be used when flexibility is required. However simple that
in situations where there is danger of overroutinization of behavior
may sound, current practice in rule making appears to be largely
due to highly standardized and repetitive task requirements. In or-
unaware of these contingencies (Grote et al., 2009; Hale and Borys,
der to keep attention and motivation high, confronting operators
2013b). Moreover, it is important to check whether the responsi-
with novel demands can be very useful, even though the learning
bility for handling uncertainty as assigned by the rule matches
required may temporarily hamper performance (Gersick and Hack-
the capability of the actor(s) concerned. The following example
man, 1990).
from the rulebook of a railway company may serve as an illustra-
When uncertainty is increased, stability and control are re-
tion of these distinctions: ‘‘The correct functioning of the train con-
duced, which for high-risk settings is a particularly uncomfortable
trol system and the automatic traffic control system is to be
situation to be in. Hence, choosing the option of increasing uncer-
monitored by the signaller. If necessary, he/she has to intervene
tainty requires great care and also a good understanding of what it
manually. During normal operation, no monitoring is necessary
takes to eventually reduce uncertainty again and to regain control.
as long as the operational requirements are met. In the case of dis-
Premature agreement on inadequate decisions needs to be avoided
turbances or incidents, the notification of the required services and
just as much as unnecessary indulgence in overly complex problem
the required alarm procedures must be guaranteed.’’ When dis-
representations. This delicate balance is to be struck both in daily
secting this set of rules, one can see that the first sentence is an ac-
operational decision-making by operators of high-risk systems
tion rule without any decision-latitude and the second sentence an
and in strategic decisions by top management, risk managers, or
action rule with some decision-latitude indicated by the expres-
regulators. There is ample evidence that risk management tools
sion ‘if necessary’. Together these two rules aim at creating stabil-
are employed in less than optimal ways because closure in deci-
ity through clearly assigning responsibility for running the highly
sion-making is sought prematurely (Carroll, 1998; Nicolini et al.,
automated traffic control system to the signaller. The third rule
2011; Schöbel and Manzey, 2011). In the following, designing flex-
comes as a surprise because it seemingly contradicts the first
ible rules and support for speaking up are discussed as two practi-
two rules. It is a process rule, permitting flexibility in executing
cal measures in risk management that can help take advantage of
tasks in response to different operational states, but also stating
uncertainty for improving safety. Rule-making can be considered
one definite boundary condition: meeting operational require-
a core activity in strategic and operational risk treatment, while
ments. The last rule is a goal rule, leaving open how the set goal
speaking up concerns decision processes across all elements of risk
is to be achieved, thereby allowing much flexibility in responding
management, from risk identification and assessment to risk treat-
to unforeseen events.
ment and risk communication. Therefore it is hoped that these two
At first sight, this set of rules conveys a rather contradictory
examples will prove valuable for conceptual and practical reevalu-
message, which in order to be accepted by the actors involved
ation of a wide range of risk management activities.
needs to be well grounded in a high level of trust and a shared
understanding of the necessity to handle conflicting demands.
3.1. Designing flexible rules However, considering the overall task of signallers, which is to en-
sure smooth operations in a very dense railway network, the rule
Standards and procedures are prevalent in most high-risk orga- can be considered as striking the right balance between stability
nizations. They permit coordinated action of many different actors and flexibility. Increasing uncertainty by explicitly acknowledging
without the need for personal coordination (March et al., 2000). As the conflicting requirements of monitoring an automated system
personal coordination is assumed to be error-prone, standards and while also relying on its functioning with one’s own attention
procedures are also considered a particularly safe way of ensuring being absorbed elsewhere – one of the hallmarks of the ironies of
 G. Grote / Safety Science 71 (2015) 71–79 75

Table 3
Examples for different rule types.

Rule Definition Example

type (from Hale and Swuste, 1998) (taken from flight operations manual of a European Airline)
Goal Rule defining goals and It must be clearly understood that not all combinations of cumulative operational problems (engine failure plus e.g. terrain,
rule priorities weather, availability of aerodromes etc.) can be covered by this policy. In such situations the solution offering the highest
degree of safety should be sought
Process Rule providing guidance for In order to complete a replanning, any documented cruise systems and all means available may be used, such as flight
rule deciding on the right course management systems and data contained in the respective Aircraft Operation Manuals
of action
Action Rule prescribing detailed Every evacuation must be carried out as quickly as possible. The passengers must be assisted to leave the aeroplane without
rule courses of action their belongings and directed to a point at a safe distance from the aeroplane

automation (Bainbridge, 1983) – is helpful under those circum- adaptive action is provided. However, a number of boundary con-
stances because the continuous necessity to decide on an appropri- ditions need to be met in order to ensure that the uncertainty is in
ate allocation of cognitive resources is highlighted. This benefit can fact necessary and can be adequately handled by the actors con-
only come to bear though, if, as in the case of the signallers, the fronted with it. Close cooperation between operating organizations
individuals having to follow such rules are well trained and and regulators is required to realize these conditions, which also
embedded in a trusting and supportive culture which provides entails balancing prescriptive, system-based and performance-
for a good match between accountability and control. based regulatory regimes (May, 2007).
Proposing flexible rules as support for safe operations implies
that rules do not necessarily have to reduce uncertainty in order
3.2. Support for speaking up
to be good rules as is generally believed. Goal and process rules
partially reduce uncertainty, e.g. by setting priorities or defining
Speaking up has been defined as ‘‘discretionary communication
a certain process to follow in problem-solving. However, much
of ideas, suggestions, concerns, or opinions about work-related is-
uncertainty is retained by leaving significant decision-latitude to
sues with the intent to improve organizational or unit functioning’’
the actor in determining the right course of action. Furthermore,
(Morrison, 2011, p. 375). Benefits of speaking up have been shown
uncertainty may even be increased by pointing to different options
in the context of innovation and organizational learning (e.g.,
for action among which the actor has to choose or by – even in ac-
Edmondson, 2003), but also concerning safety, for instance in a
tion rules – employing modifiers such as ‘may be necessary’ or ‘in
study by Kolbe et al. (2012) where frequency of speaking up by
certain circumstances’ which require the actor to decide possibly
nurses was positively related to more adequate handling of minor
without much further guidance as to the necessities and circum-
non-routine events during simulated anesthesia inductions.
stances to be considered. To ensure that this decision-latitude pro-
One immediate effect of speaking up is that uncertainty is in-
motes the intended flexibility rather than creating confusion and
creased because doubts about a particular course of action are
helplessness a number of boundary conditions need to be met:
raised, new options for action are suggested, or a new perspective
on a situation is opened up. Often this increased uncertainty is ex-
 Flexibility must be explicitly chosen based on considerations of
actly what keeps people from speaking up as illustrated by the tra-
adequate management of uncertainty.
gic accident of British Midland flight 92 in January 1989 (Air
 It is to be clearly communicated that flexibility is not about pro-
Accident Investigation Branch [AAIB], 1990). Following a fan blade
viding leeway for violating rules.
rupture on the left engine, the captain had mistakenly shut down
 Flexibility should never be taken as an excuse for ill-specified
the right engine. The first officer showed some confusion as to
rules.
which of the engines was malfunctioning but did not intervene.
 Education and training as well as support by supervisors and
The cabin crewmembers saw evidence of the fire in the left side en-
team members needs to be ensured to help actors adequately
gine, but this information was never conveyed to the cockpit be-
use the flexibility provided.
cause, as the surviving purser later said, they did not want to
 Flexibility requires an organizational culture built on compe-
undermine the pilots’ authority. Flying with one engine shut down
tence, trust, and fairness.
and the other engine burning, the aircraft finally crashed on a
motorway killing 47 passengers and seriously injuring another 74.
Meeting these boundary conditions requires rule-makers to
The uncertainty resulting from speaking up will be beneficial in
very explicitly and systematically consider the amounts and kinds
as much as individuals and teams have sufficient cognitive re-
of uncertainties to be embedded in the rules. Recently, we were
sources for shifting into a mode of divergent thinking during their
asked by a railway company to analyze their rulebook with respect
on-going activity, but are also capable of converting back to con-
to the criteria outlined above. A number of instances were found of
vergent thinking in order to adapt their course of action in a timely
inadequate and non-systematic use of goal, process, and action
manner, especially in time-critical situations. For this to happen,
rules, e.g. by providing comparatively more decision-latitude to
three fundamental prerequisites are required. First of all, individu-
less qualified workers (Grote et al., 2009). These results led the
als and teams need to be encouraged to speak up. Research indi-
company together with the national regulator to draw up guide-
cates that inclusive leadership – that is supervisors encouraging
lines to support rule-makers in explicitly choosing different de-
and explicitly valuing team member contribution in decision-mak-
grees of flexibility in their rules (see Bundesamt für Verkehr
ing (Nembhard and Edmondson, 2006) – and psychological safety,
et al., 2011).
defined as team members’ belief that they can take interpersonal
In summary, rules do not necessarily always reduce uncertainty
risks without having to fear punishment, rejection, or embarrass-
for the actors charged with following them. If uncertainty is delib-
ment (Edmondson, 1999), are important in this respect. Both of
erately designed into the rules, by using goal and process rules and
these factors can also counteract low status as a significant imped-
by providing decision-latitude even in action rules, safety can be
ing factor for speaking up (Nembhard and Edmondson, 2006;
supported because both sufficient openness and guidance for
Bienefeld and Grote, in press). Secondly, speaking up has to happen
76 G. Grote / Safety Science 71 (2015) 71–79

in a constructive, non-threatening manner. One practical recom-
mendation to this effect is the so-called two-challenge rule
(Pian-Smith et al., 2009). This rule states that speaking up should
happen from a perspective of curiosity and concern, including an
open-ended inquiry that allows the recipient to explain their point
of view rather than justifying their actions. The rule also proposes,
though, that after two attempts at producing a change in the reci-
pient’s behavior in this way, the person having spoken up should
take the initiative to induce a new course of action him- or herself.
Thirdly, the person(s) spoken up to need to react in constructive
ways, in terms of adequately processing the new information,
but also in terms of acknowledging the contribution of the person
who has spoken up even if that contribution turns out to be of little
practical use. Carroll’s (1998, p. 706) example of an executive at a
US nuclear power plant who stated for his plant that ‘‘it is against
the culture to talk about problems unless you have a solution’’ is a
negative case in point in this respect.
How intricate the dynamics involved in speaking up are, can
also be seen by looking into reasons for silence, that is, people
not speaking up even when they know they should (Detert and
Edmondson, 2011). In Table 4 an example is given of the responses
of aircrew members of a European commercial airline who had
been instructed to think of one specific situation experienced in
their current job position in which they had felt they should have
spoken up about a safety-relevant issue, but had not (Bienefeld and
Grote, 2012). The response patterns are interesting in many differ-
ent ways, but maybe most importantly show that different profes-
sional groups may have quite different reasons for silence and
therefore also need different kinds of encouragement to speak
up. Furthermore, the data show that high status is not a sufficient
condition for raising one’s voice as even captains reported situa-
tions where they did not dare to speak up. Finally, the responses
indicate that silence can also be grounded in concerns for others,
not least overburdening them by adding complications to an al-
ready stressful situation.
The three essential prerequisites discussed above for supporting
individuals and teams in handling the extra uncertainties involved
in speaking up require organizational measures aimed at support-
ing teams and especially team leaders in creating a shared under-
standing of the benefits of speaking up. Additionally, training is
necessary to build a repertoire of behaviors needed for speaking
up and for adequately reacting when spoken up to. Such training
is very demanding because it requires an atmosphere of psycholog-
ical safety among the participants and between participants and
instructors which needs to be created by carefully tailored,
non-threatening instructor interventions. Training contents should
include discussion of hurdles to and enablers of speaking up,
reflection on the specific social interaction processes involved in
speaking up, and also practicing appropriate communication
algorithms. Structured debriefings following simulation-based
team training can be a powerful vehicle, using techniques like
guided team self-correction, open-ended inquiry, and encourage-
ment for perspective taking (Kolbe et al., 2013). Table 5 provides
an example of a debriefing structure used in the training of medical
teams.
In summary, speaking up is crucial for safety exactly because it
increases uncertainty by opening up new perspectives for decision-
making and action. However, a sense of heightened uncertainty –
on a personal level as well as concerning the task at hand – is also
one of the most prevalent reasons for people’s reluctance to speak
up. To counterbalance this uncertainty, a general culture of trust
and more specifically psychological safety is important, as is sys-
tematic training aimed at learning and practicing the behaviors
needed for constructive speaking up and adequate reactions to
being spoken up to.
4. Some general considerations for decision-making in risk
management
As was stated earlier, reducing, maintaining, and increasing
uncertainty as options in risk management each are based on very
different assumptions about adequate risk control. Moreover, they
relate to different paradigms in decision-making itself. The pre-
dominance of risk control by means of minimizing uncertainty in
classic risk mitigation is allied to prescriptive models of rational
decision-making. Those models such as maximization of subjective
expected utility or multi-attribute utility are rooted in mathemat-
ical conceptions of rationality relying on consistent and maximum
use of information, which implies reduction of uncertainty. Hence,
in order to stimulate discussion in risk management on the poten-
tial utility of increasing uncertainty, fundamental beliefs about
what constitutes rational decision-making have to reflected upon
(Grote, 2011).
Empirical evidence has been accumulated to show that the pre-
requisites for mathematical models of rational choice are often not
met in actual decision-making. For instance, there should be no a
priori preference for certain or uncertain options, but in fact cer-
tainty is often preferred in decisions on gains, while uncertainty
is preferred when losses are to be decided upon (Kahneman and
Tversky, 1979). Concerning multi-attribute utility, Simon (1955)
pointed out more than half a century ago that people’s cognitive
capacities are limited, which he termed bounded rationality, lead-
ing them to accept ‘‘satisficing’’ choices, for instance based on an
alternative’s acceptable level on one crucial dimension. More re-
cently, Gigerenzer has advocated the view that even with abundant
cognitive resources at hand the use of simple decision heuristics
may often be fully adequate. He postulates that expert intuition is

Table 4
Reasons for silence given by members of aircrews in a European commercial airline (adapted from Bienefeld and Grote, 2012).

Reasons for silence Captains (n = 261) First officers (n = 334) Pursers (n = 307) Flight attendants (n = 849)
(%) (%) (%) (%)
Status differences 0 11 20 40
Fear of damaging relationships 53 43 15 42
Feelings of futility 0 33 23 51
Lack of experience in current job position or on aircraft type 14 13 3 0
Negative impact on others 24 24 16 36
Poor relationship with supervisor 0 20 26 35
Fear of punishment 0 23 67 81
Fear of negative label 3 29 21 6
Perceived conflict efficiency versus safety 21 14 70 29
Perceived time pressure 20 11 41 13

Notes: Percentages of reasons add up to more than 100%, as most participants indicated more than one reason for their silence; numbers in bold represent the two most
frequently chosen reasons per occupational group.
 G. Grote / Safety Science 71 (2015) 71–79
Table 5
Example for structured debriefing in simulation-based training for medical teams (adapted from Kolbe et al., 2013).
Step Instructor’s method (examples)
1. First reactions of trainees Narrative question
2. Debriefing of the clinical part of the scenario Narrative question
Advocacy-inquiry
3. Transfer from simulation to reality Narrative question
4. Discussion of CRM (Crew Resource Guided team self-correction: elicit
Management) principles and their reflection about positive behavior
relationship to clinical outcomesa
Advocacy-inquiry (using simulation
video)
Observer-perspective, circular question
(to trainees who have observed the
scenario)
5. Summary of learning experience and closing Inquiry
debriefing
Circular question
6. If required, retraining of clinical skills Further practice of clinical skills that
were not optimally performed during
the simulation
a
Examples chosen here specifically for speaking up as one of the CRM principles.
about knowing which information is important and ignoring the
rest (Gigerenzer and Goldstein, 1996; Gigerenzer, 2007).
For a long time, instead of revising prescriptive models of deci-
sion-making according to the empirical evidence, the main thrust
of conclusions drawn has been to point to the fallibility of human
decision-making and the need to educate and support decision-
makers in more rational decision-making (Mellers et al., 1998).
Only in recent years, voices have become louder which propose
abandoning mathematical models as a gold standard for human
decision-making and to focus on its functionality for adapting to
personal and situational requirements instead (Kerr and Tindale,
2004; Kahneman and Klein, 2009; Shafir and LeBoeuf, 2002). In
order to resolve the apparent contradictions between heuristics-
based intuitive decision-making and formal rational decision-
making, dual-process models have been introduced (Evans, 2008;
Kahnemann, 2011). These models assume the parallel functioning
of both types of decision-making, sometimes called System 1 and
System 2. While System 1 refers to intuition and is characterized
by implicit, automatic, low effort, holistic, fast, and emotional pro-
cesses, System 2 entails reasoning with explicit, controlled, high ef-
fort, analytic, slow, and cognitive processes.
However, many fundamental questions remain: Is one of the
models to be preferred as the better way of making decisions? Is
switching between the two modes of functioning necessary in cer-
tain conditions? What would be conditions for such switches and
how could decision-makers be helped in making them? With re-
spect to the first question whether one model should generally
be considered superior to the other, the case of ‘Linda’ is instru-
mental: In an experimental setup participants are asked to first
read a short text about a woman called Linda, describing her as
having leftist political attitudes, and then to indicate whether they
consider it more probable for her to be a bank teller or a bank teller
and a feminist. The answer usually is the latter which implies the –
in mathematical terms completely irrational – decision that two
events combined are more likely than one of them alone.
Kahnemann (2011) argues that this finding reflects the workings
of system 1, while still maintaining that this is by any account
faulty decision-making because it defies mathematical logic.
77
Example of instructor’s communication
‘How did you feel?’
‘What happened?’
‘I would like to talk about intubation procedures. I saw you re-attempting
to intubate using the laryngoscope three times in a row, each time it turned
out unsuccessful. I think that you could have intubated faster by using
another device such as the Laryngeal Mask or Bag Mask Ventilation. So, I
am wondering what was on your mind in that moment?’
‘What aspects of this scenario are familiar to you from your ‘real’ work?
What similar situations have you already experienced?’
‘As heard earlier, rising voice when in doubt can be life-saving in
anaesthesia. It is also one of the 10 CRM principles. Describe an instance
when one of you spoke up’.
‘In that situation my impression is that you are not OK with what he is
doing. I was concerned that you would not let him know this and that he
would proceed giving the wrong medication dose. What was on your
mind?’
‘What do you think she might have needed from him to speak up in that
situation?’
‘Which of the CRM-principles do you consider most important after that
simulation?’
‘Overall, if inexperienced anaesthesia residents and nurses had watched
you during the scenario, what could they have learned from you?’
Gigerenzer (2007), on the other hand, postulates that under the given
circumstances it is perfectly rational to decide for the formally less
likely option because based on the additional information provided
in the description of Linda the less likely option is more plausible.
An example closer to the current topic of risk management con-
cerns differences between experts’ and lay people’s risk perception.
The general finding is that the latter in essence follow System 1
decision-making while the former follow System 2. After many
decades where the System 2 expert view was taken as the more ra-
tional and therefore more substantial perspective, it seems that
gradually consensus is building to accept both views as legitimate,
resulting in the need to integrate them through broad public dia-
logue (Renn, 2008).
These examples show that the debate as to whether deviations
from the formal prescriptive decision models make human deci-
sion-making irrational or whether the formal models are built on
a very restricted and possibly even irrelevant understanding of
rationality is still on-going (Weber and Johnson, 2009). No attempt
is made here to provide any definite answers in this fascinating de-
bate. Rather the debate itself can serve as another example for the
argument made all through this paper that decision-making itself
as well as assumptions about what constitutes good decision-mak-
ing are strongly influenced by basic belief systems.
The implication for risk-related decision making – as in fact for
all decision-making – is that these beliefs need to be reflected upon
to reach adequate decisions. Risk-related decisions may be partic-
ularly vulnerable to beliefs about the superiority of narrowly de-
fined mathematically based rationality because these beliefs also
promise maximum control, which is a core driver for much of man-
agerial decision-making (Senge, 1990). In order to overcome the
limitations of current risk management, which are evident in abun-
dant cases of faulty decision-making implicated in recent acci-
dents, crises and catastrophes (e.g., Farber, 2011; Paté-Cornell,
2012), these beliefs have to be questioned in very fundamental
ways. Feldman (2004) has recommended changes in engineering
training to support engineers in handling qualitative uncertainty,
in understanding the social and historical roots of knowledge in-
stead of taking it as an ahistoric and impersonal truth, and in
78
speaking up against power and politics based on their professional
expertise. Another very pragmatic way to achieve reflection of
decision-making premises was followed in this paper by promot-
ing open discussion of possible advantages of (sometimes) increas-
ing uncertainties in high-risk systems. This requires breaking a
vicious cycle though: Experts engaged in risk management have
to build more confidence in human capabilities for dealing with
risk and uncertainty in order to come to see advantages of in-
creased uncertainty for safety; but they will only develop that con-
fidence once they stop modelling risks in ways that leave many
uncertainties unaccounted for, thereby rendering control of these
risks an illusion.
5. Concluding remarks and outlook
Power (2007) postulates that uncertainty is transformed into
risk when it becomes an object of management. Therefore, when
uncertainties are managed well, a basic prerequisite for good risk
management is established. Following this proposition, I have ar-
gued for the importance of making deliberate operational and stra-
tegic choices between reducing, maintaining, and increasing
uncertainty in order to establish a balance between stability and
flexibility in high-risk systems while also matching control
and accountability for the actors involved. Using flexible rules
and speaking up as examples, potential benefits of increasing
uncertainty for promoting safety were demonstrated. In order to
prepare the ground for capitalizing on these benefits, the necessity
to reflect on fundamental beliefs concerning the human capacity
for rational choice was emphasized.
The focus of the paper has been on risk management within and
for organizations, arguing that uncertainties related to organiza-
tional functioning should not only be acknowledged more pro-
foundly in risk assessment (e.g., Aven and Renn, 2009; Bjelland
and Aven, 2013), but also in all other aspects of risk management,
and that in some situations deliberately increasing uncertainty in
risk-related decision-making can be beneficial. An interesting test
and extension of the arguments presented would be to apply them
to debates on risks in the public domain, such as privacy protection
in IT systems or health hazards related to nanotechnology. For in-
stance, undue transfers of uncertainties by not formally acknowl-
edging them in risk assessments can be assumed to be even
more prevalent for those risks because actors are distributed across
many societal systems whose boundaries are very blurry. This ren-
ders open dialogue among all relevant actors about the costs and
benefits of different options for managing uncertainty more diffi-
cult, but at the same time even more necessary.
References
Air Accident Investigation Branch [AAIB], 1990. UK AAIB Report 4/90 on the 8
January 1989 Accident of a British Midland B737-400 at Kegworth,
Leicestershire, England. Aldershot, UK: Air Accident Investigation Branch.
Amalberti, R., 2013. Navigating Safety. Springer, Dordrecht.
Anderson, P., 1999. Complexity theory and organization science. Org. Sci. 10, 216–
232.
Aven, T., Renn, O., 2009. On risk defined as an event where the outcome is uncertain.
J. Risk Res. 12, 1–11.
Bainbridge, L., 1983. Ironies of automation. Automatica 19, 775–779.
Bienefeld, N., Grote, G., 2012. Silence that may kill: when aircrew members don’t
speak up and why. Aviat. Psychol. Appl. Human Factors 2, 1–10.
Bienefeld, N., Grote, G., 2014. Speaking up in ad hoc multiteam systems: individual
level effects of psychological safety, status, and leadership within and across
teams. Eur. J. Work Org. Psychol (in press).
Bjelland, H., Aven, T., 2013. Treatment of uncertainty in risk assessments in the
Rogfast road tunnel project. Saf. Sci. 55, pp. 34–44.
Bundesamt für Verkehr, VöV, SBB, 2011. Leitfaden für Vorschriftenerstellung.
<http://www.bav.admin.ch/grundlagen/03514/03533/03649/
index.html?lang=de>.
Carroll, J.S., 1998. Organizational learning activities in high-hazard industries: the
logics underlying self-analysis. J. Manage. Stud. 35, 699–717.
G. Grote / Safety Science 71 (2015) 71–79
Cherns, A., 1987. Principles of sociotechnical design revisited. Human Relat. 40,
153–162.
Daft, R.L., Lengel, R.H., 1984. Information richness: a new approach to mana gerial
behavior and organizational design. In: Cummings, L.L., Staw, B.M. (Eds.),
Research in Organizational Behavior, vol. 6. JAI Press, Homewood, IL, pp. 191–
233.
Detert, J.R., Edmondson, A., 2011. Implicit voice theories: taken-for-granted rules of
self-censorship at work. Acad. Manag. J. 54, 461–488.
Edmondson, A., 1999. Psychological safety and learning behavior in work teams.
Adm. Sci. Quart. 44, 350–383.
Edmondson, A.C., 2003. Speaking up in the operating room: how team leaders
promote learning in interdisciplinary action teams. J. Manage. Stud. 40, 1419–
1452.
Evans, J.S.B.T., 2008. Dual-processing accounts of reasoning, judgment, and social
cognition. Annu. Rev. Psychol. 59, 255–278.
Farber, D.A., 2011. Uncertainty. Georgetown Law J. 99, 901–959.
Farjoun, M., 2010. Beyond dualism: stability and change as duality. Acad. Manag.
Rev. 35, 202–225.
Feldman, S.P., 2004. The culture of objectivity: quantification, uncertainty, and the
evaluation of risk at NASA. Human Relat. 57, 691–718.
Galbraith, J., 1973. Designing Complex Organizations. Addison-Wesley, Reading,
MA.
Gebert, D., Boerner, S., Kearney, E., 2010. Fostering team innovation: why is it
important to combine opposing action strategies? Organ. Sci. 21, 593–608.
Gersick, C., Hackman, J.R., 1990. Habitual routines in task-performing groups.
Organ. Behav. Hum. Decis. Process. 47, 65–97.
Gigerenzer, G., 2007. Gut Feelings: The Intelligence of the Unconscious. Penguin,
London.
Gigerenzer, G., Goldstein, D.G., 1996. Reasoning the fast and frugal way: models of
bounded rationality. Psychol. Rev. 103, 650–669.
Grote, G., 2009. Management of uncertainty. Theory and application in the design of
systems and organizations. Springer, London.
Grote, G., 2011. Risk management from an organizational psychology perspective: a
decision process for managing uncertainties. Die Unternehmung 65, 69–81.
Grote, G., 2012. Safety management in different high-risk domains – all the same?
Saf. Sci. 50, 1983–1992.
Grote, G., Weichbrodt, J.C., Günter, H., Zala-Mezö, E., Künzle, B., 2009. Coordination
in high-risk organisations: the need for flexible routines. Cognit. Techol. Work
11, 17–27.
Grote, G., Kolbe, M., Waller, M.J., 2012. On the confluence of leadership and
coordination in balancing stability and flexibility in teams. Paper Presented at
the Academy of Management Conference, Boston, August 2012.
Hale, A.R., Borys, D., 2013a. Working to rule or working safety? Part 1: A state of the
art review. Saf. Sci. 55, 207–221.
Hale, A.R., Borys, D., 2013b. Working to rule or working safety? Part 2: The
management of safety rules and procedures. Saf. Sci. 55, 222–231.
Hale, A.R., Swuste, P., 1998. Safety rules: procedural freedom or action constraint?
Saf. Sci. 29, 163–177.
Hollnagel, E., Woods, D.D., Leveson, N., 2006. Resilience Engineering: Concepts and
Precepts. Ashgate, Aldershot, UK.
ISO3100, 2009. Risk Management – Principles and Guidelines. Geneva: ISO.
Kahneman, D., Klein, G., 2009. Conditions for intuitive expertise – a failure to
disagree. Am. Psychol. 64, 515–526.
Kahneman, D., Tversky, A., 1979. Prospect theory: an analysis of decision under risk.
Econometrica 47, 263–291.
Kahnemann, D., 2011. Thinking, Fast and Slow. Farrer, Straus and Giroux, New York.
Kaplan, R.S., Mikes, A., 2012. Managing risks: a new framework. Harvard Business
Rev. 90 (6), 48–60.
Kerr, N.L., Tindale, R.S., 2004. Group performance and decision making. Annu. Rev.
Psychol. 55, 23–655.
Knight, F.H., 1921. Risk, Uncertainty and Profit. Kelley, Boston and New York.
Kolbe, M., Burtscher, M.J., Wacker, J., Grande, B., Nohynkova, R., Manser, T., Spahn,
D.R., Grote, G., 2012. Speaking up is related to better team performance in
simulated anesthesia inductions. An observational study. Anesth. Analg. 115,
1099–1108.
Kolbe, M., Weiss, M., Grote, G., Knauth, A., Dambach, M., Spahn, D.R., Grande, B.,
2013. TeamGAINS: a tool for structured debriefings for simulation-based team
trainings. BMJ Quality Safety 22, 541–553.
Leana, C.R., Barry, B., 2000. Stability and change as simultaneous experiences in
organizational life. Acad. Manag. Rev. 25, 753–759.
Manz, C.C., Stewart, G.L., 1997. Attaining flexible stability by integrating total
quality management and socio-technical systems theory. Organ. Sci. 8, 59–70.
March, J., Schulz, M., Zhou, X., 2000. The Dynamics of Rules: Change in Written
Organizational Codes. Stanford University Press, Stanford, CA.
Marris, P., 1996. The Politics of Uncertainty: Attachment in Private and Public Life.
Routledge, London.
May, P.J., 2007. Regulatory regimes and accountability. Regul. Govern. 1, 8–26.
Mellers, B.A., Schwartz, A., Cooke, A.D.J., 1998. Judgment and decision making.
Annu. Rev. Psychol. 49, 447–477.
Morrison, E.W., 2011. Employee voice behavior: Integration and directions for
future research. Acad. Manage. Ann. 5, 373–412.
NAIIC 2012. The official report of the Fukushima Nuclear Accident Independent
Investigation Commission. The National Diet of Japan.
Nembhard, I.M., Edmondson, A.C., 2006. Making it safe: the effects of leader
inclusiveness and professional status on psychological safety and improvement
efforts in health care teams. J. Org. Behav. 27, 941–966.
 G. Grote / Safety Science 71 (2015) 71–79
Nicolini, D., Waring, J., Mengis, J., 2011. Policy and practice in the use of root cause
analysis to investigate clinical adverse events: mind the gap. Soc. Sci. Med. 73,
217–225.
Paté-Cornell, E., 2012. On ‘‘Black Swans’’ and ‘‘Perfect Sorms’’: risk analysis and
management when statistics are not enough. Risk Anal. 32, 1823–1833.
Perrow, C., 1984. Normal Accidents – Living with High-risk Technologies. Basic
Books, New York.
Pian-Smith, M.C.M., Simon, R., Minehart, R.D., Podraza, M., Rudolph, J., Walzer, T.,
Raemer, D., 2009. Teaching residents the Two-Challenge Rule: a simulation-
based approach to improve education and patient safety. Simul. Health. 4, 84–
91.
Power, M., 2007. Organized Uncertainty – Designing a World of Risk Management.
Oxford University Press, Oxford.
Rasmussen, J., 1997. Risk management in a dynamic society: a modelling problem.
Saf. Sci. 27, 183–213.
Renn, O., 2008. Risk Governance – Coping with Uncertainty in a Complex World.
Earthscan, London.
Schein, E.H., 1996. Three cultures of management: the key to organizational
learning. Sloan Manage. Rev. 38, 9–20.
79
Schöbel, M., Manzey, D., 2011. Subjective theories of organizing and learning from
events. Saf. Sci. 49, 47–54.
Senge, P.M., 1990. The Fifth Discipline: The Art and Practice of the Learning
Organization. Doubleday, New York.
Shafir, E., LeBoeuf, R.A., 2002. Rationality. Annu. Rev. Psychol. 53, 491–517.
Simon, H.A., 1955. A behavioral model of rational choice. Quart. J. Econ. 6, 99–118.
Suchman, L., 2002. Located accountabilities in technology production. Scand. J.
Inform. Syst. 14, 91–105.
Sundström, G., Hollnagel, E. (Eds.), 2011. Governance and Control of Financial
Systems: a Resilience Engineering Perspective. Ashgate, London.
Taleb, N.N., 2007. The Black Swan: The Impact of the Highly Improbable. Random
House, New York.
Thompson, J.D., 1967. Organizations in Action. McGraw-Hill, New York.
Weber, E.U., Johnson, E.J., 2009. Mindful judgment and decision making. Ann. Rev.
Psychol. 60, 53–85.
Weick, K.E., Sutcliffe, K.M., Obstfeld, D., 1999. Organizing for high reliability:
processes of collective mindfulness. Res. Org. Behav. 21, 81–123.