The Swiss cheese model of safety incidents: are there holes in the metaphor?

Background Reason's Swiss cheese model has become the dominant paradigm for analysing medical errors and patient safety incidents. The aim of this study was to determine if the components of the model are understood in the same way by quality and safety professionals. Methods Survey of a volunteer sample of persons who claimed familiarity with the model, recruited at a conference on quality in health care, and on the internet through quality-related websites. The questionnaire proposed several interpretations of components of the Swiss cheese model: a) slice of cheese, b) hole, c) arrow, d) active error, e) how to make the system safer. Eleven interpretations were compatible with this author's interpretation of the model, 12 were not. Results Eighty five respondents stated that they were very or quite familiar with the model. They gave on average 15.3 (SD 2.3, range 10 to 21) "correct" answers out of 23 (66.5%) – significantly more than 11.5 "correct" answers that would expected by chance (p < 0.001). Respondents gave on average 2.4 "correct" answers regarding the slice of cheese (out of 4), 2.7 "correct" answers about holes (out of 5), 2.8 "correct" answers about the arrow (out of 4), 3.3 "correct" answers about the active error (out of 5), and 4.1 "correct" answers about improving safety (out of 5). Conclusion The interpretations of specific features of the Swiss cheese model varied considerably among quality and safety professionals. Reaching consensus about concepts of patient safety requires further work.


Background
James Reason proposed the image of "Swiss cheese" to explain the occurrence of system failures, such as medical mishaps [1][2][3][4][5]. According to this metaphor, in a complex system, hazards are prevented from causing human losses by a series of barriers. Each barrier has unintended weaknesses, or holes -hence the similarity with Swiss cheese. These weaknesses are inconstant -i.e., the holes open and close at random. When by chance all holes are aligned, the hazard reaches the patient and causes harm ( Figure 1). This model draws attention to the health care system, as opposed to the individual, and to randomness, as opposed to deliberate action, in the occurrence of medical errors. The Swiss cheese model is frequently referred to and widely accepted by patient safety professionals. This was summarised by safety expert Ronald Westrum in a testi-mony before a United States Advisory Committee on Blood Safety and Availability on April 25, 2000 [6]: "Reason's model has become the common language through which complex accidents can be understood. I remember being at one conference where six speakers in a row got up and showed Swiss cheese diagrams as a kind of academic overkill. The popularity of this model obviously comes from its wide application. It's generally felt, as I said, this provides a common ground for discussing system safety." There is no clear evidence, however, that the Swiss cheese metaphor is understood in the same way by all concerned. In this study, I explored the understanding of the Swiss cheese model by professionals who work in healthcare quality improvement.

Samples and data collection
The data for this cross-sectional survey came from two sources: paper questionnaires filled by conference delegates, and online questionnaires. A self-completed questionnaire ("the Swiss cheese quiz") was handed out to attendees of the 20 th conference of the International Society for Quality in Health Care (Amsterdam, October [19][20][21][22]2004), at the booth of the International Journal for Quality in Health Care. Completed questionnaires were collected in a ballot box. The same questionnaire was also posted on the internet [7]. Links to this site were placed on the access page of the International Journal for Quality in Health Care and the home page of the International Society for Quality in Health Care between November 2004 and January 2005.

Questionnaire
The questionnaire displayed the picture of the Swiss cheese model, as published in the BMJ [1], but with the words "hazards" and "losses" hidden. The figure was followed by this statement: "As with many metaphors, there are several ways of interpreting this model. We would like to know your own interpretation. There are no right or wrong answers." The first questions probed the familiarity of the respondent with the model and its perceived usefulness. Further questions addressed the interpretation of various aspects of the Swiss cheese model: what is represented by a slice of cheese, by a hole, and by the arrow, how is an active error represented, and how would one make the system safer (Table 1). Each question was followed by 5 statements, and respondents were asked to check all that applied. Answer statements were classified a priori by the author as being compatible or incompatible with the model (Table 1). There were 11 compatible statements and 12 incompatible statements. Two additional statements were initially rated as incompatible with the model, but this was revised to "ambiguous" following advice from other experts: a) a health care professional could indeed be considered as a barrier if her or his role was primarily to prevent the occurrence of errors or of patient harm, and b) the arrow would represent the series of events leading to a medical error if the error was concomitant with patient harm. The questionnaire ended with questions about descriptive characteristics of the respondents.

Analysis
Because the goal was to explore the understanding of respondents who believed that they knew the model, only respondents who said they were "very much" or "quite a bit" familiar with the model were analysed. There was no statistically significant difference between those who filled the questionnaire at the conference and those who filled it online, thus the samples were pooled for the analysis.
The analysis consisted of simple frequencies of endorsement for each proposed answer. Endorsement of an item that was compatible with Reason's model according to the author, and non-endorsement of an incompatible item, were treated as "correct" answers. Sums of endorsed compatible and incompatible items were computed, as well as the number of "correct" answers out of 23. The two ambiguous items were left out of this analysis.

Sample characteristics
Forty-eight usable questionnaires were collected at the conference (4 others were incomplete), and 111 on the internet (11 others were empty, duplicated, only partially filled, included only "I have no idea" answers, or had all answer options checked). Eighty-five respondents (53.5%) stated that they were "very" (N = 45) or "quite" (N = 40) familiar with the Swiss cheese model. Only these respondents are reported on in the analyses.
Participants were 44 years old on average (SD 9, range 25 to 70, 5 missing), and comprised 42 women and 42 men (1 missing), from 31 countries representing all continents. Most job titles were in health care policy and quality management, but respondents included also health care professionals (doctors, nurses and pharmacists) and academic researchers. Sixty-three (74.1%) respondents had worked in quality management in the past 5 years, 31 (36.9%) in risk management, and 19 (22.6%) in safety science (several answers were allowed; one person did not answer).

Interpretation of the model
Respondents endorsed on average 5.3 of 11 statements that were compatible with the Swiss cheese model (SD 2.2, range 1 to 10), and 2.0 of the 12 statements that were incompatible (SD 1.7, range 0 to 9). The mean number of "correct" answers was 15.3 (SD 2.3, range 10 to 21) out of 23 (66.5%). This was significantly more than 11.5 "correct" answers that would expected if answers were given at random (p < 0.001). Respondents gave on average 2. number of "correct" answers: sex, age, previous experience in quality management, risk management or safety science, familiarity with the model (very familiar versus quite familiar), perceived usefulness of the model, and knowledge of patient safety.

Specific items
Most respondents interpreted the slice of cheese as intended by J. Reason (barrier that protects patients from harm), and inferred correctly that this would include a defence that prevents the occurrence of an error (Table 1). However, only few recognised that procedures that alleviate consequences of an error may also appear as barriers.
Majorities interpreted a hole as suggested by Reason -a weakness in defences, but only few respondents understood that a hole is either a latent error or an unsafe act. The most obvious interpretation of the arrow (path from hazard to harm) was chosen by only half of the respondents. The majority choice (series of events leading to an error) is not entirely correct, as it is patient harm, not an error, that is represented by Reason at the tip of the arrow (however, the error may be equivalent to patient harm, as in wrong site surgery). Only three out of ten respondents identified correctly an active error as one of the holes. Making the system safer by plugging a hole was correctly selected by most respondents, but the solution of adding a barrier (a slice of cheese) was not.

Discussion
This survey shows that among quality improvement professionals, the meaning of the Swiss cheese model of medical error is far from univocal. On average, respondents gave answers that were compatible with the model to about two thirds of the proposed statements. This is better than half -the proportion that would be expected by chance -but far from a general consensus. This suggests that invoking the Swiss cheese model will not necessarily lead to effective communication, even among quality and safety professionals. murkiest notion appeared to be the representation of the medical error itself. Few of the respondents recognised that an active error is a type of weakness in defences against patient harm within the health care system, represented by a hole in the Swiss cheese model (a "hole" is either an active or a latent error). The model is almost too successful in placing emphasis on systemic causes of patient harm, as opposed to an individual's failure.
The variability in interpretations revealed in this survey is more understandable if one considers the evolution of Reason's model between 1990 and 2000. In the first rendition of the model (Figure 2), what was predicted was an accident, latent errors were placed as antecedents of the accident trajectory at the far left, and unsafe acts (i.e., active errors) were represented by a separate "slice" [2]. Two subsequent models place the set of barriers between harm and the patient (the "slices of Swiss cheese") in a more global context (Figure 3 and 4). In particular, these models attempt to show causal chains that lead up to patient harm. For the sake of clarity, it should be noted that these more complete models have not been dubbed "Swiss cheese models." The model of 1995 ( Figure 3) shows a sequence of conditions and events leading to an accident, and defences and barriers are represented as intervening only after the occurrence of an error or a violation [3]. The model published in 1997 (Figure 4) depicts the Swiss cheese model as leading to human losses, not accidents [4]. This supports the view that patient safety interventions should focus on patient harm, rather than errors [8,9]. Importantly, the 1997 model also displays unsafe acts and workplace factors as orthogonal to the arrow leading from hazards to losses -presumably, each weakness in the system has its own set of causal or contributing factors. The current version of the Swiss cheese model (Figure 1), published in 2000, appears to be a simplification of the previous model, from which the causal pathways have been removed.
While no model ever claims to represent fairly a complex reality, it is possible that the latest rendition of the Swiss cheese model has become too simplified to remain effective in promoting patient safety. More realistic alternatives include the model of 1995 (Figure 3), which clearly separates the event, or accident, from patient harm, and has remained in use [10], and that of 1997 (Figure 4), which suggests that the occurrence of a system failure cannot be easily represented by a simple linear sequence. In this Reason's model rejoins Haddon's matrix, a successful epidemiologic model for investigating injuries [11]. The relevance of Haddon's matrix for investigating medical mishaps has been recognised by others [8]. The integration of Reason's and Haddon's models may be a worthwhile next step toward a comprehensive model of patient safety.
More generally, the diversity of views documented in this study raises questions about the current status of a "culture of safety" among quality and safety professionals. A culture is a set of values, concepts and beliefs that are shared by a social group [12,13]. The Swiss cheese model is the leading candidate for a common understanding of how harmful events occur and how they can be prevented. Until most or all actors agree on what the model means, the emergence and dissemination of a shared culture of safety may prove difficult. The danger is that people today use the label "Swiss cheese model" without realising that its meaning varies from one person to the next.
This study has several limitations. The main concern is that the sample of respondents was self-selected, and may not represent fairly the broader community of patient safety and healthcare quality professionals. It is likely that those who were most interested and most knowledgeable about patient safety are over-represented among participants. Secondly, it is possible that respondents misrepresented their level of familiarity with the model, and that results would have been better among true experts. Nevertheless, the discrepancy between self-perceived familiarity with the model and variable interpretations of the model features is striking. Finally, the questionnaire was developed ad hoc, and its reliability and validity are untested.
In summary, this study has shown that quality and safety professionals vary considerably in their interpretation of various components of the Swiss cheese model applied to medical mishaps. This finding echoes the variability in interpretation that exists even for basic terms of patient safety, such as "incident," "error," "mishap," etc. [14]. Recent proposals of a comprehensive taxonomy of patient safety illustrate the necessity of a global conceptual model [15]. Good models and clear concepts are required for a common terminology, and a common terminology is a pre-requisite for effective communication and progress in the field of patient safety.