What HOP Got Right
An honest accounting of Human and Organizational Performance — and where it often goes wrong in the field.
I have been working with Human and Organizational Performance principles for most of the last decade, and I have come to a settled view that I do not see articulated often enough in our profession. HOP is one of the most important developments in occupational safety thinking in fifty years. And much of what passes for HOP implementation in industry today is not actually HOP. It is the old culture wearing new vocabulary.
Both things are true. The discipline of separating them is worth the work, because the cost of pretending otherwise is high.
Let me start with what HOP got right, because the contribution is real and lasting.
The intellectual lineage matters. HOP draws on multiple streams of work: James Reason's research on organizational accidents and the "Swiss Cheese" model of latent failures, Sidney Dekker's writing on safety differently and the field guide to understanding human error, Erik Hollnagel's distinction between Safety-I and Safety-II, David Woods's resilience engineering, and Todd Conklin's twenty-seven years inside Los Alamos National Laboratory translating these ideas into a usable industrial framework. Conklin's five principles — error is normal, blame fixes nothing, context drives behavior, learning and improving are vital, and how leaders respond matters — are now widely taught. They are deceptively simple and operationally radical.
The first thing HOP got right is the rejection of the human error explanation. For decades, our profession defaulted to a model in which incidents were explained by the failure of a person — inattention, complacency, violation, poor decision-making. The investigation produced a name, a discipline action, and a training requirement, and the organization moved on. HOP made a careful and devastating case that this model is not just incomplete. It is wrong. As Conklin and Dekker have both argued in different language, workers do not produce incidents through error. Systems produce incidents, and workers are the visible point at which a system's accumulated flaws surface. Dekker has summarized the principle in one line that I quote often: "People are not the problem to control; people are the solution."
This reframing changed how I do my work. When I lead an investigation today, I am not looking for the worker's mistake. I am looking for the system's gap. The worker's action becomes data about how the system actually behaves under real conditions, not evidence of individual deficiency. The investigation gets longer. The findings get more useful. The next incident gets harder to produce, because we have addressed something real rather than punished someone available.
The second thing HOP got right is the concept of operational learning. Traditional safety models treat the gap between work-as-imagined and work-as-done as a deviation to be eliminated. HOP treats it as information to be studied. The procedure says one thing. The work actually happens another way. The question is not, "How do we force the work to match the procedure?" The question is, "What does the difference tell us about the conditions the worker is operating in?" Almost always, the gap exists because the procedure is missing something the worker has had to figure out — a missing tool, a missing time, a missing piece of information, a competing pressure. The gap is not the problem. It is the diagnosis.
The third thing HOP got right is the emphasis on error tolerance. Systems that are intolerant of error produce catastrophes when error inevitably occurs. Systems that are designed to absorb error — through defenses in depth, recovery paths, and engineering that assumes human variability — produce smaller events that get caught earlier. This is not new science. James Reason was making this case in the 1990s. But HOP made it central to the way safety professionals think about design, and that centrality has been a real contribution.
The data supports the operational impact, though carefully. ISN's analysis of SIF trends noted a 16 percent decrease in SIF cases from 2022 to 2023 and credited the decline in part to the spread of HOP and similar prevention philosophies. Suggestive rather than conclusive, but the direction is consistent.
Now the harder part. What HOP gets wrong, often, in the field.
The first failure mode is treating HOP as an alternative to accountability rather than a different model of it. I have sat in too many post-incident discussions where the HOP framing was used to short-circuit any conversation about what an individual decision-maker contributed to the event. "Workers don't fail, systems fail" is true at the systemic level. It is not a free pass for the supervisor who knew about a hazard and did nothing, the manager who approved a workaround, the executive who deferred the capital investment. Accountability in a HOP-informed organization is not weaker than in a traditional organization. It is more accurate. It lands where the actual decisions were made.
When HOP is used to evacuate accountability altogether, the organization loses the connective tissue that holds the system together. Workers can see the difference between an organization that has matured into systemic thinking and one that has decided no one is ever responsible for anything. The first is empowering. The second is corrosive. I have seen both, and the second is a category of damage that takes years to repair.
The second failure mode is mistaking philosophy for practice. HOP is a way of thinking. It generates principles, not procedures. When HOP gets rolled out as a program — a training curriculum, a deck, a poster campaign, a vocabulary that workers are expected to repeat — it tends to die quickly. The workers who attend the training notice that the underlying system has not changed. The incentives still reward production over caution. The investigations still locate fault wherever it is most convenient. The vocabulary becomes corporate jargon, and the deeper insight is lost. Conklin himself has been candid about this risk: the principles, he has said, were originally written to manage worker error, and even the architects of HOP have had to update them as the field has matured.
Real HOP implementation is slower and less visible than program rollouts. It requires senior leaders to change how they ask questions after incidents. It requires managers to change how they respond when a worker raises a concern. It requires the safety function to change how it writes procedures and follows up on near-misses. It is, in the language of the Bradley Curve, an interdependent practice — and it cannot be installed by training. It has to be lived into, decision by decision, over years.
The third failure mode is using HOP to displace technical rigor. I have seen organizations that, in the enthusiasm of adopting HOP, quietly let go of the discipline of engineering controls, robust procedures, and serious technical investigation. The logic, sometimes explicit, sometimes not, is that since systems fail and humans are variable, the answer is to invest in culture and let go of the more mechanical work. This is a serious mistake. HOP does not replace the hierarchy of controls. It contextualizes it. The engineering control still matters most. The procedure still needs to be right. The technical understanding of the work still needs to be deep. HOP adds a layer about how those elements interact with the humans who use them. It does not subtract.
What does honest HOP implementation actually look like? In the organizations where I have seen it work, it looks like this.
Senior leaders genuinely change how they respond to incidents. The first question is not, "Who messed up?" It is, "What did the system do to put a person in a position where this outcome was possible?" That question gets asked publicly, repeatedly, until it is the only question anyone expects.
The investigation discipline gets deeper, not shallower. Investigators map the conditions, not the culprits. They produce findings that are uncomfortable for management, and management treats those findings as the point of the exercise rather than the threat.
Workers are involved in designing the procedures they will use — not consulted at the end, but involved at the beginning. The gap between work-as-imagined and work-as-done shrinks because the imagining is done by people who also do the work.
Accountability gets sharper, not softer. The organization is honest about who made which decisions and what those decisions produced. The honesty is paired with humility — a recognition that most decision-makers were doing their best inside a system that did not give them what they needed.
Technical rigor is preserved. Engineering controls remain the first line. Procedures are written carefully. Training is real. HOP is the layer that makes all of this more effective, not the layer that replaces it.
When this is what HOP looks like in practice, the results are extraordinary. When it is the vocabulary without the substance, the results are not just unhelpful — they are actively harmful, because the organization has convinced itself that it is advancing when it is not. Workers can tell the difference. Senior leaders, often, cannot.
Our profession has been given a real gift in HOP. The work of the next decade is to use it honestly — and to refuse the comfortable substitutes.
Sources & Further Reading
• Conklin, T. (2019). The 5 Principles of Human Performance. Pre-Accident Investigation Media.
• Dekker, S. (2014). The Field Guide to Understanding 'Human Error' (3rd ed.). CRC Press.
• Dekker, S. (2015). Safety Differently: Human Factors for a New Era (2nd ed.). CRC Press.
• Reason, J. (1997). Managing the Risks of Organizational Accidents.
• Hollnagel, E. (2014). Safety-I and Safety-II: The Past and Future of Safety Management.
• Edwards, B. & Baker, A. (2020). Bob's Guide to Operational Learning.
• ISN. (2025). Serious Injury & Fatality Insights 2017–2024.
