Hudson 2007

Safety Science 45 (2007) 697–722
www.elsevier.com/locate/ssci
Implementing a safety culture in a major

multi-national
Patrick Hudson *
Department of Psychology, Leiden University, The Netherlands
Abstract
This paper reports on the implementation of an advanced safety culture in a major oil and gas
multi-national. The original proposal came from the company after it had become clear that expec-
tations had been raised after the successful implementation of Health, Safety and Environment
(HSE) Management Systems subsequent to the Piper Alpha disaster. The proposal made by the com-
pany, to develop a workforce intrinsically motivated for HSE, was operationalised as the develop-
ment of an advanced safety culture after a review of the literature on motivation. The model used
was the HSE Culture Ladder that had become the industry standard accepted by the OGP (Interna-
tional Association of Oil and Gas Producers). This model was intended to show that there were con-
siderable opportunities for improvement even after HSE-MS had been implemented and that the
more advanced cultures were ones people felt were desirable and achievable for themselves. Once
top management had provided the initial support for the development of a more advanced safety
culture, a number of supporting tools were developed, under the Hearts and Minds brand, and a
strategy for implementation was developed that relied more on bottom-up ‘pull’ rather than top-
down ‘push’ – the standard implementation model for new initiatives. The tools were designed to
provide a clear direction, a road map to an advanced culture defined in terms provided by people
within the industry, to support lasting changes in attitudes and beliefs, to promote an increased feel-
ing of control when solving HSE-specific problems – all components of a more advanced culture.
The tactics employed, using a pull rather than a push approach, had to allow for local variation
within the general limits set by the strategy that eventually became a mixed top-down and
bottom-up approach. Next there is a discussion of the current status and the lessons to be learnt
from the implementation so far: moving away from command and control is hard for large organi-
zations; such programs have to be driven by different performance indicators; managers have to
*
Tel.: +31 5273630.
E-mail address: hudson@fsw.leidenuniv.nl
0925-7535/$ - see front matter 2007 Elsevier Ltd. All rights reserved.
doi:10.1016/j.ssci.2007.04.005
698 P. Hudson / Safety Science 45 (2007) 697–722
learn to disperse their control; it is essential to communicate both successes and failures. Finally
there is a discussion about the respective roles of academia and the industry in such endeavours,
the requirement to concentrate on more than a single cultural characteristic such as reporting,
and the difficulties of evaluating such programs in a worldwide environment that is continuously
changing.
2007 Elsevier Ltd. All rights reserved.
1. Introduction
The problem of safety culture – What is it and how do you become one? – is probably
the main issue in modern thinking about safety (Turner and Pidgeon, 1997). Since the
IAEA report (IAEA, 1991) on the Chernobyl disaster, which introduced the concept of
a safety culture to a wider world, failures arising from the culture of an organisation have
become seen as the reason why major accidents happen, such as the loss of the space shut-
tle Columbia (NASA, 2003) and many recent railway disasters such as Clapham Junction
(Hidden, 1989), Ladbroke Grove (Cullen, 2001) and the Waterfall disaster (McInerney,
2005). Most attention has been paid to the issue of safety climate (Zohar, 1980), a concept
easier to measure (e.g. Flin et al., 2000), but the underlying expectation is that the best and
safest organisations have a culture of safety, and that safety climate is an indirect measure
of how close an organisation approximates to that.
This paper reports on one program intended to implement a safety culture in a major
multi-national oil and gas company. This is a different problem from implementing a
safety culture in a single, physically distinct, organisation for a number of reasons. While
implementing a safety culture in a small, bounded organisation can be done by the cre-
ation of a clear and simple vision and single-minded commitment to that vision from the
top, large organisations are much harder to steer, even with full commitment. In a small
organisation there will be a more restricted range of operations, leading to a restricted
organisational structure; most people can know, or know of, each other. Even a large
international company with a limited focus, such as a petrochemical company like
DuPont or Dow Chemical, or an aircraft manufacturer like Boeing or Airbus, does
not have all these issues to contend with. A modern vertically integrated Oil and Gas
Major, like Shell, BP or Exxon, covers a wide range of activities including exploration,
oil and gas production, shipping, refining, chemical production, transport and sales. Each
of these distinct operations has their own hazards and, often, a set of histories that may
result from long practice or be the results of the acquisitions that made them as large as
they are. In multi-national organisations there will be a wide range of operations, people
will be physically dispersed over a range of time-zones, will operate in different national
settings and will also speak a variety of languages. In large organisations there will be a
large number of sub-organisations, each with their own history, having a potentially dis-
tinct culture and run by managers with their own vision of where to go, and how. The
sheer size of the problem and the very nature of such organisations mean that a close
range hands-on approach is not feasible. Another factor that has to be considered is
the interaction of national with organisational culture. The academic literature has con-
centrated primarily upon a limited number of types of organisation and studies have been
typically carried out in Western environments (Guldenmund, 2000). We have little to
P. Hudson / Safety Science 45 (2007) 697–722 699
guide us when we step outside the comfort zone, the Western cultural environment that
has been studied in some detail.
This paper sets out the problem as initially posed by the company, as this was not orig-
inally an explicit request to change the culture, although it was soon reframed as such.
Then follows an outline of the strategy for implementation that has been developed and
that is being carried out, followed by a description of the tactics being employed to
develop the culture in specific locations. I will then attempt to assess the difficulties encoun-
tered and evaluate the current status of what is still an early stage in the program – a
10-year lifespan is not an unreasonable estimate of how long it may take to acquire a
highly developed culture.
2. The history
2.1. Understanding the causes of accidents
The program to be described here forms the continuation of an earlier research pro-
gram, for the same company, on understanding accident causation that went back as
far as 1985. Initially intended to replace an accident taxonomy (Wagenaar and Hudson,
1986), this program developed into a model of how accidents happen (Wagenaar, 1986;
Wagenaar and Groeneweg, 1987; Reason et al., 1988; Wagenaar et al., 1994; Reason,
1990, 1997) that has become widely known as the Swiss cheese model. Within the company
this program and the associated model of accident causation became known as Tripod and
served to support two tools; Tripod Beta became an accident investigation and analysis
tool, while Tripod Delta was a tool for the proactive identification of how accidents might
happen (Hudson et al., 1994).
2.2. Safety management systems
The oil and gas business has always had a long tradition of technical integrity and, sub-
sequent to the Piper Alpha disaster in 1988, there was the requirement, usually mandatory
(Cullen, 1990), to improve the management of safety by the use of safety management sys-
tems (SMS). As it became clear, within the industry, that the management of safety could
be extended to occupational health and environmental management, this then led to the
implementation of integrated health, safety and environment management systems
(HSE-MS). At this point it became clear that, while classic indicators of safety perfor-
mance, such as the fatal accident rate (FAR), lost time injury frequency (LTIF) and total
recordable case frequency (TRCF), had all reduced significantly from previous years, none
of these had reduced to zero. In fact they typically reached a plateau.
Fig. 1 shows, schematically, how the technology and the systems approaches each reach
a plateau, in terms of incident rates. By the late 1990s it became clear that such a plateau
was about to be reached after the implementation of the systems approach and that ‘more
of the same’ would no longer be sufficient to achieve the improvements in performance
that had become to be perceived as desirable. The mechanical application of safety
management systems was never going to achieve the levels of performance people had
become to expect. As those very systems had produced such significant improvements
Fig. 1. The developmental line, culture becomes the next wave after systems safety.
in performance compared to the late 1980s, so did the expectations about what could and
should be achieved become more stringent.
2.3. After systems: What comes next?
After the development of the accident tools, while primary attention within the company
was paid to getting SMS in place worldwide, a number of specific human factors topics were
investigated, including work on procedures and rule-breaking (Hudson et al., 1997, 2000c,
2002a), cost–benefit analysis of HSE (Hudson and Stephens, 2000) and a study into why
some HSE tools appear to work while others do not (Hudson et al., 2000b). This latter pro-
ject highlighted, for the first time, problems associated with both the safety culture and the
national culture. In particular it had become clear that certain tools were only effective in
specific safety cultures that were more or less advanced. At the same time the issue of
national culture arose, as an issue that needed to be confronted because so many tools
and concepts appeared to be culture bound; tools and approaches developed in one
national culture all too often failed to deliver the promised benefits in other countries.
A group brought together within the company in 1998, to consider the problem of what
to do once HSE-management systems were in place, made a proposal that was aimed at
what was felt to be the missing component, the people, rather than the technology or
the systems. The evidence was clear by this time that while the implementation of manage-
ment systems had made a significant contribution, the target of zero accidents was not
being reached and was unlikely to be reached, even by the more rigorous or rigid applica-
tion of the management systems approach. The organisational accident work, that had
become a common understanding within the company, had succeeded in taking attention
away from front-line individuals. This concentration upon the organisational aspects
rather than on individuals, whether high or low in the organisation, had been strengthened
by the implementation of the management systems approach. The advisory group felt that
it was now time to redress the balance1; individuals should no longer automatically be
blamed, as they were previously, but they could be required to carry responsibility for
those actions over which they had a measure of control.
The original proposal made by this group was to create a workforce that was intrinsi-
cally motivated for safety. This proposal was handed to the researchers, all psychologists,
to develop (it was felt that motivation would be interesting for psychologists to study). It
soon became clear, right at the start of the project, that this was difficult, at least if one
went along the pathway of simply trying to improve peoples’ motivation. A simple idea,
like getting people to behave in the same way that they put on their safety belts in cars,
essentially without coercion or policing, is hard to generalise if one starts from the idea
that such people are motivated by self-interest and that similar approaches to motivation
would provide broad gains. The proposal had been framed, by engineers, to be attractive
to psychologists, with whom there had been a long-standing relationship in the area of
health, safety and the environment. Unfortunately this was done without realising that
tackling the problem of motivation is probably even harder than that of creating a culture.
A review of the theories and evidence underlying concepts of motivation, and in partic-
ular intrinsic motivation, nevertheless showed up a number of common themes found reli-
ably in the research literature (Hudson et al., 1998). This report argued that:
The scientific literature is extensive and often contradictory. Many of the experi-
ments used to measure intrinsic motivation are trivial and have no long-term com-
ponent. Nevertheless there are a number of consistent conclusions that can be
drawn:
• Highly motivated people feel in control or feel powerful, competent and high on self-
efficacy. These people are intrinsically motivated to do their job. The downside is that
these feelings may be biased (‘unrealistic optimism’; ‘illusion of control’).
• Less motivated people don’t feel in control or feel powerless, less competent and low on
self-efficacy. These people show less initiative. These feelings may be biased too
(‘learned helplessness’).
• Extrinsic rewards can move the locus of control from internal to external, praise and
reward for quality of performance may increase the internal locus of control.
• Under certain circumstances rewards and incentives may change behaviour, but it is
also true that intrinsic motivation may be hampered. Simple application of rewards
may be attached to the wrong behaviours.
• Although behaviour may be changed, underlying beliefs may remain unchanged. This
suggests that reversion to old behaviour patterns is very likely.
• Belief is a crucial factor in determining how and why people will behave. Values may be
acceptable but expectations will be driven by beliefs.
Any system to increase intrinsic motivation for HSE will actually be changing the
way people behave so that their behaviour is attributed to intrinsic motivation.
While the term intrinsic motivation may be clear within Shell, it is less so in the aca-
demic literature. A behaviourist definition seems acceptable (People are intrinsically
1
This analysis has been made with the benefit of hindsight, but it certainly reflects the reality that has developed
from their proposal. Knowledge of the individuals making up the advisory group precludes the interpretation that
they wanted to return simply to blaming individuals.
motivated for HSE when they consistently behave safely (etc. for environment) with-
out external control). The characteristics of highly motivated individuals are gener-
ally those found in the more evolved safety cultures in which people are self
determining rather than driven externally.
As a result of this position on intrinsic motivation and safety the problem was recast as
follows: What would a workforce that behaves as if it were intrinsically motivated look
like? and, What would you have to do to create such a workforce? The answer was that
in an advanced safety culture it would probably look as if the individuals were intrinsically
motivated and, to get there, it would be necessary to get people to change their attitudes
and behaviours such that they wanted to become what they were changing to. This meant
that the initial stages of the project first involved moving from a vague concept of a safety
culture to one sufficiently explicit to drive a program involving many engineers worldwide,
and secondly this had to be combined with defining an approach to change in individuals,
both high and low in the organisation, that would serve to propel whole organisations to
change how they thought and acted.
The remaining story describes a collaborative effort and the decisions about implemen-
tation made jointly between the academics and those involved on the company side
(Hudson et al., 2000a, 2004; van der Graaf and Hudson, 2002).
3. The culture model
The concept of a safety culture is frequently treated as part of a dichotomy, an organi-

sation either is or is not such a culture; discussion has centred round issues such as whether
an organisation has or is such a culture, and what are the characteristics that make such a
culture (Hale, 2000; Guldenmund, 2000; Reason, 1997, 1998). If one merely wishes to
describe such a culture this is a natural way to proceed, but should one wish actually to
make an organisation become such a culture, especially a large organisation, this repre-
sents too large a leap. A more promising theoretical alternative would be an evolutionary
model, in which there was more of a continuum between organisations from those that
were quite clearly not safety cultures up to those that were agreed to be advanced, such
as the high reliability organisations (Rochlin et al., 1987; Weick, 1987). Allowing interme-
diate stages allows progress to proceed in manageable steps, rather than requiring a major
leap into what might be the unknown.
The model chosen for safety culture was to be a extension of a model of organisational
communication originally proposed by Westrum (1988, 1991). This distinguished three
types of organisation – pathological, bureaucratic and generative. Early on in the project
that led to the development of the organisational accident model for Shell, as the Tripod
model (Reason et al., 1988), Westrum’s original model had actually been extended to some
eight stages, including the incipient reactive and early proactive stages, in presentations
made within the company in the late 1980s (Reason, pers. comm.). But, while the concept
of a safety culture had been known to some people in the company, no use had ever been
made of these ideas. By 1991 these three levels of organisational culture, with the label
bureaucratic (that would be hard for engineers to accept) replaced with calculative, had
already been introduced to the wider petrochemical industry (Hudson, 1991).
The model was extended from three to five stages in a sequence, replacing the label
bureaucratic with calculative and introducing just two extra stages, the reactive and the
proactive. With the cooperation of Westrum a possible internal structure was first fleshed
out past the original communication model to a number of dimensions covering both Talk
(what people say) and Walk (what they actually do) factors, as well as the role and status
of the HSE department in the organisation as a whole. A preliminary study in the Middle
East (Hudson et al., 1999) was followed by a study of a large number of concrete potential
indicators of safety culture2 at a Dutch air force base (Croes, 2000). While the number of
respondents in the air force study were not a large as one would wish, being limited by the
size of the air force base, that study produced a consistent factor structure. The concepts
of an advanced safety culture, in particular descriptions of the generative culture, were
then published widely within the company at this stage (van der Graaf et al., 2000a,b).
In 2000 a working group on Human Factors from the International Association of Oil
and Gas Producers (OGP), including most major producers, met with a small group of
interested academics3 that served as the basis for the OGP culture study (Hudson and
Parker, 2001). In this study a range of experienced industry professionals, ranging from
a Chief Operating Officer and Senior Vice-Presidents of major oil companies to experi-
enced supervisors and HSE professionals, were interviewed. They were asked to fill in
descriptions, over the five levels from pathological to generative, of 18 main dimensions
identified from the earlier studies. The descriptions selected for each factor were those that
were consistently mentioned by interviewees over the five stages, giving a high degree of
content validity. While at this point it would have been possible to continue researching
and refining the concepts, it was decided that what had been produced was sufficiently
clear and robust to proceed to the next stage, developing such an advanced culture as
described by the proactive and generative stages on the ladder. This structure has been
further tested by Lawrie (2003) and appears to be robust and reliable (Parker et al., 2006).
3.1. A model for creating lasting change
The HSE Culture ladder (Fig. 2) helps define a pathway from less to more advanced
cultures. But it was clear that simply pointing out which direction to go would not be
enough to actually induce progress up that ladder, for that some way of creating lasting
change was necessary. The next stage in the project therefore required the development
of a process model that defined how people could be brought to change and, it was felt,
it would be best if this change was what people wanted, not one that they felt had to take
place because they are told to. There are a wide variety of change models available, but
most of these (e.g. Kotter, 1996; Kotter and Heskett, 1992) tend to concentrate on the
details of project management in a change environment; we selected one model from psy-
chology, the transtheoretical model, of Prochaska and DiClemente (1983) (Prochaska
et al., 1998), because it covered the elements felt essential to cover the requirement that
people should want to change. In particular this model laid much more emphasis on get-
ting those involved to have an active personal desire to change rather than a passive
2
The intention here was to move as far as possible from ‘soft’ perceptual judgments towards ‘hard’ auditable
indicators that a particular stage on the ladder had been reached. This was to shift from climatic indicators (‘‘how
we feel’’) to cultural ones (‘‘what we do round here’’).
3
Those present from universities included Rhona Flin (Aberdeen), Sue Cox (Lancaster), Dianne Parker
(Manchester) and myself (Leiden). Companies represented included Shell, BP, Exxon, Chevron, Schlumberger
and the International Association of Geophysical Contractors.
GENERATIVE (HRO)
HSE is how we do business
round here
ed
PROACTIVE
rm
fo Safety leadership and values
ity
drive continuous improvement
In
bil
gly
nta
CALCULATIVE
sin
ou
We have systems in place to
cc
ea
manage all hazards
dA
cr
In
ant
REACTIVE
us
Safety is important, we do a lot
Tr
every time we have an accident
ing
as
re
PATHOLOGICAL
Inc
Who cares as long as
we're not caught
Fig. 2. The HSE Culture ladder.
requirement to meet the goals of management. Fig. 3 shows the five main stages of the
change model, with its special emphasis on acquiring awareness and, once behaviour
change has been effected, of maintaining that change.
This change model represents where the essential elements for creating intrinsically
motivated individuals and groups are to be found (Lawrie et al., 2006). The five stages
Fig. 3. The change model based on the transtheoretical model of Prochaska and DiClemente (1983).
identified in the original model were, while scientifically reliable, unfortunately too vague
to serve as the basis for creating real change in a major organisation. It is not sufficient, for
example, to refer to awareness as being developed in the contemplative stage, even if that
stage represents the best that can be isolated in controlled studies. The five-stage model
was therefore extended, making reference to the motivation literature (Hudson et al.,
1998), to 14 stages (Hudson and Parker, 1999; see Table 1). In particular awareness was
separated into developing a personal need to change and providing people with the belief
that what they wanted to do was realistic, feasible and achievable. Awareness should also
include information about successes elsewhere where possible. This extension of the con-
cept of awareness now included the requirements for feelings of control, self- and collec-
tive-efficacy central to intrinsic motivation.
Taken together these two, the culture ladder and the change model, define (i) where an
organisation might go and (ii) how it might go there. The culture ladder, developed from
within the industry, provided people with a way forward, a picture of what a more
advanced organisational safety or HSE Culture might look like. The change model speci-
fied how the progress up the ladder might be implemented. These two, therefore, formed
the basis for an implementation strategy. This would have to be applied worldwide with a
workforce totalling many more than 100,000 individuals, up to 250,000 when contractors
are taken into account. There would be no way that individual scientists and corporate
managers could do any more than design and steer with a light hand on the tiller. Further-
more it had become clear that, consistent with the requirement for a safety culture and for
intrinsic motivation, people would have to get there by themselves. Help could be avail-
able, but this would not be a major project driven top-down by conventional means.
3.2. The support of top management
An initial, and critical, step along the path to implement an advanced HSE Culture
involved obtaining explicit permission and support from top management. This was done
by interviewing most of the members of the current management team, asking (i) how they
personally saw the culture at that time and (ii) what they would like to see it become. What
came out of these interviews was a unanimous desire to improve, even at the cost of some
pain within the organisation as well as the realisation that simple compliance would not be
enough to achieve the performance they all wanted for their organisation. One member
was quite explicit about wanting to create a culture where there would be compliance to
rules and requirements, but where this was done in an atmosphere of continual challenge
(‘‘I’ll do it this time, but there’d better be a good reason why I have to comply before the
next time’’). Another member made a particular plea that, whatever was to happen, the
tools should be small, simple and easy to use – in contrast to the earlier Tripod tools that,
while accepted and used, had become anything but simple. There was a clear consensus for
an advanced HSE Culture, one like the generative culture already identified, and a path to
that culture that involved small steps supported by small tools, not a large goal based on a
single big idea and an associated large, complex and unwieldy tool.
3.3. The tools
One of the breakthrough thoughts, one that arose from the requirement for simplicity
of tools explicitly stated in one of the interviews with top management, was the idea of a
706
Table 1
The detailed change model with 14 stages
Pre-contemplation to contemplation – AWARENESS
P. Hudson / Safety Science 45 (2007) 697–722

1. Awareness – simple knowledge of a ‘better’ alternative than the current state
2. Creation of need – active personal desire to achieve the new state
3. Making the outcome believable – believing that the state is sensible for those involved
4. Making the outcome achievable – making the process of achieving the new state credible for those involved
5. Personal vision – definition by those involved of what they expect the new situation to be
6. Information about successes – provision of information about others who have succeeded
Contemplation to preparation – PLANNING
7. Plan construction – creation by those involved of their own action plan
8. Measurement points – definition of indicators of success in process
9. Commitment – signing-up to the plan of all involved
Preparation to action – ACTION
10. Do – start implementing action plan
11. Review – review progress with concentration upon successful outcomes
12. Correct – reworking of plan where necessary
Maintenance – MAINTENANCE
13. Review – management review of process at regular (and defined in advance) intervals
14. Outcome – checks on internalisation of values and beliefs in outcome state
micro-tool (Hudson and Parker, 1999). The proposal was that such a tool should be sim-
ple, one sheet of paper, one hour in use and requiring no special training or the interven-
tion of external consultants. This was intended to contrast with many HSE tools that are
anything but short and simple and certainly require the services of expensive outside sup-
port. The idea arose that micro-tools could help individuals and parts of the organisation
to improve by tackling small problems. This again coincided with the requirement to pro-
vide individuals with a feeling of control and self-efficacy.4 Given the size of the target
audience these tools had to be useable by individuals who were not psychologists.
The notion of a micro-tool eventually became subsumed into small, targeted workshops
or activities that can be run stand-alone. These now form parts of the individual Hearts
and Minds tools, or more accurately toolkits, most of which consist of 4–6 such micro-
tools structured to follow the requirements of the change process. Most such micro-tools
are practical exercises intended to change attitudes by creating demonstrable improve-
ments, creating new beliefs and building feelings of self- and collective-efficacy. A current
example of such a tool is the ‘‘Rule of Three: Achieving Situation Awareness in 5 Min-
utes’’, one of the Hearts and Minds tools (see www.energyinst.org.uk/heartsandminds).
At the same time as the picture about a direction and process became clear, another
insight was developed about any tools that would have to be made available to support
the climb up the ladder. In large organisations people are used to a high standard of pre-
sentation; this is regardless of the inherent quality of the product, so a well-researched
product will often be cast aside in favour of a well packaged product that looks as if it will
solve their problems painlessly. This helped to explain why the work on violations and rule-
breaking had never achieved any effects. Despite a take-up of hundreds of reports (Hudson
et al., 1997, 2002a,b) over a short period, there was no measurable use of the scientifically
reliable information and proposals for improvement. The product was seen as interesting,
but typically ‘academic’, by just those who could best use the information about how and
why people break the rules. In a competitive market for self-improvement, most tools have
to rely on face validity when those selecting them have little or no training in human factors.
Experience had shown how well-researched approaches were easily cast aside, typically by
managers responding to the immediate pressure after an incident and wanting to be seen to
be committed to safety, in favour of slick well-packaged tools that promised to solve all
such problems. Given that such tools often have little or no justification other than face
validity and professional packaging, it seemed that the best tools would be less likely to
be rejected if they looked good as well as being scientifically validated. The fact that a tool
is scientifically well motivated, and provides some guarantee that it will work, is not
enough; those who are going to pay want to feel that there is a commitment behind the
product, and they tend to infer this from the quality of the packaging, rather than from
reading the scientific literature. The lesson learned was, if you cannot beat them, join them.
4. The strategy
The story here is written with the benefit of a degree of hindsight, but hopefully the les-
sons can serve to develop more foresight in future. Much of the strategy was developed as
4
There was also the slightly wicked idea that it would be hard, and probably embarrassing, for a manager or
supervisor to tell their boss that they were not (even) able to implement a micro-tool.
the program progressed, from frequent small field trials in many different parts of the
world, followed by extensive examination of progress and what was identified as working,
both well and badly. Most of the actual program was driven by the development of new
tools and the accumulation of experience as a result of the field trials; this contrasts to pro-
grams that have a fully developed suite of tools, a clear picture enhanced with video pre-
sentations and a project-managed roll-out.
It was nevertheless clear from the start that developing an advanced safety culture in a
major organisation is a very different task from establishing one in a single location, such
as a nuclear power plant, an aircraft carrier or an Air Traffic Control centre. In such sit-
uations academics can maintain a high degree of day-to-day control over what happens,
adapting the program as needs be. In a large multi-national organisation such control is
beyond the resources of any university team. One approach to implementing a culture
change program, therefore, would be to hire a major consultancy organisation, one with
the capacity to manage large, simultaneous projects in a variety of countries. This is a very
expensive route, but even if it might be argued that it would be worth it to ensure that a
specified result would be achieved, the very use of an external body goes against the con-
cepts that we had discovered are inherent in the more advanced cultures. So, while it might
well be appropriate to use major external advisors when making the transition from the
pathological right up to the calculative stages, moving towards the proactive and genera-
tive levels absolutely requires that those within the culture raise themselves up. This may
sound like emulating the Baron von Munchhausen, but there appears to be no alternative.
Furthermore the divergent nature of advanced cultures means that the individuals and
groups within the culture must design their own culture, one appropriate for their niche
in the world. At earlier stages external facilitation may be appropriate, as every calculative
organisation is very similar, so lessons can be transferred.5 But every generative organisa-
tion is quite distinct and requires a differentiated approach.
The strategy taken involved thinking in terms of ‘marketing’ the ‘product’ – an
advanced HSE Culture – rather than trying to force an idea down the throats of an unwill-
ing public. The product had to be constructed out of what may be described as ‘industrial
strength theory’, using concepts and understanding about human behaviour and attitudes
that could stand the test of implementation without continuous oversight. This program
could then only be started once initial permission and commitment had been obtained
from top management. Taking the marketing approach led immediately to taking a num-
ber of quite different approaches from the normal way in which an initiative would be run
in a major company.
4.1. Initiatives and change
Initiatives in modern organisations are a fact of life. As situations change, new insights
appear and competition exerts its effects, those within the organisation are frequently
5
Even so, maximum benefits are still gained when an organisation implements its own management system as a
way of making the transition from reactive to calculative. Typically bought-in management systems, implemented
by outsiders, are a reaction to regulatory pressure and the threat of loss of license, rather than because the
organisation really wants to get systematic about safety. Such systems are unlikely to make a reactive
organisation more advanced and will, frequently, be rejected by a reactive organisation’s immune response – wait
until something really goes wrong and then fix it.
required to change what they do and how they do it. Six Sigma, Lean Manufacturing,
Business Process Re-engineering and many more are typical initiatives (dare one say fads?
see Furnham, 2004) that are inflicted on an all too often unwilling workforce (and this
includes managers at least as much as anyone else). The requirement is for individuals
to change, their response is typically to maintain a low profile and hope it goes away.
In many cases such initiatives emanate from an individual who may well see great benefits
for the organisation, but who also has a personal benefit if the initiative is successful.
There is not, however, any reciprocal benefit for those who have to put in the hard work
many initiatives require.
It was in this context that the change model, that stressed the requirement for people to
want to change rather than being forced to change, was developed. As stated in the intro-
duction to the Making Change Last tool: ‘‘When people have a personal interest in the suc-
cess of a project, its management is easy’’. Conversely, people are unlikely willingly to
expend personal effort for the benefit of another, typically a remote individual, unless they
can see that ‘there is something in it for me’. The marketing approach means that people
can become willing to acquire a product, typically one they did not know about or believe
they wanted. Along with this newly created demand there may be a variety of products in
competition, and the lesson from the marketers here has been that branding provides a way
to attract and support potential customers.
4.2. Branding the product
Branding provides a single memorable focus that usually covers a range of related prod-
ucts and provides customers with information about expectations; brands like Nike or
Adidas cover much more than the original footwear, including a lifestyle image and expec-
tations about product quality. The Hearts and Minds logo (Fig. 4) was registered world-
wide as a trademark, signifying the brand. What this provides is a level of control over the
quality and nature of the products that was felt to be essential when there was going to be
little or no top-down corporate control possible in a program deliberately intended to be
driven bottom-up. Trade-marking means that others may use the materials and adapt
them, but can only use the logo on non-standard material if the changes and altered mate-
rials are approved by the trademark holder. This is also intended to allow the kind of
improvements from the user community that Linux and Mac OS X run on. Less scrupu-
lous consultants, eager to cash in on an established name, have at least to comply with the
materials or risk the consequences if they alter them but continue to use the name. The
adventurous, however, may apply their initiative and can see that taken up in later ver-
sions as the program evolves.
4.3. Replacing push with pull
Taking the marketing approach implies that the traditional push approaches to pro-
gram implementation, with all the panoply of roll-outs, project planning and the common
expectation that the program will have to be revived after a short time when the initial
impetus runs out, is not always the best way to achieve results. Running a push project
is nevertheless, especially for those to whom project management is their speciality, quite
straightforward. The components and the resources must become available at the right
time, deadlines and milestones can be set etc. A common problem with such projects, when
Fig. 4. The Hearts and Minds logo and the accompanying legal warning. (Note: The Hearts and Minds logo is a
Trademark of Shell and can only be used with written permission from SIEP, EP-HSE. Documents with the
Trademark have been checked for correctness and effectiveness.)
they are intended to create or alter attitudes and change people, rather than projects
involving designing, constructing and operating equipment, is that the failure modes are
multiple and often hard to control for those used to more docile hardware. Building a
refinery, or a Liquefied Natural Gas plant, although massive undertakings. are in many
ways easier and less complex than altering an organisation’s culture. Pull, in contrast to
push, depends upon people wanting the product. For a project manager pull is actually
more complicated for a number of reasons: the size of the pull from the customer is hard
to estimate, so resources are harder to plan; the exact nature of the customer’s perception
is not entirely under your control, so expectations may need to be managed; the apparent
quality of the product is crucial because modern consumers typically equate external
appearances with quality; old habits die hard and push can replace pull.
A major advantage of using pull management is that not everyone need be targeted.
Marketing studies identify a group of early-adopters who feel comfortable with new prod-
ucts, actively seek them out and are more willing to put up with blemishes. For instance,
this is the group that buys new generation mobile phones while the rest of us wait to see if
the newer ones are really what we want. Thinking in terms of early-adopters led us to tar-
get locations where success would be easy to achieve and which could be left in the care of
‘believers’, those who had signed up to the principles and were willing to work towards
success. An early metaphor involved ‘fishing’, suggesting that the best way forward was
to fish the deep pools, those where the fish were, in contrast to unselective approaches that
ran the risk of being unsuccessful and therefore tainting the product – a common failure in
push projects. As a result the strategy has centred round developing success and avoiding
the more obvious failures, while learning about what needs to be altered and improved
from those willing to help improve a product they see as partly embodying their own ideas
and aspirations.
All these arguments led us to develop a number of tools targeted to meet potential
requirements identified from incident reports and audits, in addition to the HSE Culture
ladder (Tool: HSE – understanding your culture) and the change model (Tool: Making
Change Last). These involved repackaging the material on violations (Tool: Managing
Rule-breaking), providing support for non-technical skills in supervisors (Tool: Improving
Supervision), and providing a generic structure for ensuring safe working practices (Tool:
Working Safely). Early on the term Hearts and Minds had become used to describe how
we intended to operate and this became the brand identity when a logo was designed and
trademarked. One existing tool, the Risk Assessment Matrix, was ‘re-badged’ and brought
into line enabling us to answer questions about whether any of the tools were already
being used. The HSE Culture tool was deliberately styled to look like a pre-existing
HSE-management system self assessment tool, well known to most managers, so that it
was felt to be easy to use. One extra tool, Driving for Excellence, was developed for road
safety, based on the structure used in Working Safely. Fig. 5 shows all the tools currently
available, with brief descriptions of what they can do and what their use involves.
The tool development work was carried out in a collaborative effort between Shell
International Exploration and Production, and the University of Leiden, in the Nether-
lands, and Manchester and Aberdeen Universities in the UK. Later on other parts of
the Shell Group collaborated, especially with Shell International Oil Products supporting
the development of the tool for driving. The program had several design criteria from the
start of the project:
– any tools developed should be small, micro-tools, small tools to alter behaviour, and
subsequently attitudes, that should be documented on one page, taking a maximum
of one hour;
– the tools should fit into day-to-day activities such as safety meetings and toolbox talks
rather than requiring extensive time off work;
– the tools are designed to be used by supervisors as facilitators with their crews;
– the programme should run itself as far as possible and require no consultants and min-
imal external facilitation;
– the tools should be based on facts about human behaviour.
Most important of all, the tools should be fun, as well as effective, naturally encourag-
ing people to use them.
Fig. 5. The full set of Hearts and Minds tools.

Fig. 6. The set of Hearts and Minds brochures.
By the time a top-level public commitment had been made, most of the total product
line, the tool-kit (actually a collection of apparently similar toolkits), was already in circu-
lation. Fig. 6 shows how the tools look like as a package, with the common elements of the
brand. By this time the brand had achieved some level of penetration around the world
and it was possible to organise a workshop for selected believers to attend to create a user
community and fine-tune methods.
5. The tactics
With the strategy laid out above the next stage involves learning how far back one can
stand and how, and how often, one has to intervene physically to ensure that the program
is not derailed or loses impetus. The strategy involving pull rather than push means that
much control is taken out of the hands of the Centre and of the small group who devel-
oped the whole program. Strategy involved creating a product, an advanced HSE Culture,
that people actively wanted and then providing them with the tools to achieve that culture.
The tactics are concentrated upon managing two particular problems that are more inher-
ent to large organisations. One set of requirements involves ensuring that the strategy is
followed and not, as is very likely in such a large organisational environment, diluted
or subverted to the more familiar push model, making it yet another initiative to be
avoided. The other requirement involves supporting and guiding those who enthusiasti-
cally run ahead of the pack.
5.1. Making sure the program follows the strategy
In a major West African country, with a workforce in excess of 25,000, an ambitious

plan to train literally thousands of facilitators has had to be contained, especially as the
first trainers were imported from the US and diluted the concepts with their own products.
A researcher from Leiden now travels regularly and audits and supervises the local con-
sultancy company that is providing first level training. This means that most use of the
tools is still done by the workforce and local supervisors, but it is important to keep some
control over those who train the facilitators. Enthusiasm in the workforce is not a prob-
lem, but it is important to ensure that there is not too much deviation from the original
intentions. For the most part delivering small 2–3 day workshops, training a limited num-
ber of facilitators in places as diverse as Hong Kong, Johannesburg, Houston and Sakh-
alin Island, has proved sufficient. The rule, however, is that these facilitators should not
cascade their skills more than one level further down, in order to avoid a dilution of
the understanding observed with other implementation projects.
5.2. Make the tools fit the local environment
While the original plan had the tools only written in English, it has soon become clear
that a workforce-oriented toolkit had to be in the local languages to penetrate effectively.
Most of the tools are now available in languages such as Spanish, Russian, French, and
Arabic, with some tools in Portuguese, Farsi, Dutch, Norwegian and Bahasa Malaysia,
with the whole set in Chinese in the near future. In all of these it has proved vital to ensure
that the translations are of the highest quality, using back-translation and retranslation to
ensure that the spirit as well as the letter is carried over in translation. In one case an entire
translation into Russian was rejected because it had the wrong, ‘old-fashioned’ flavour and
was irredeemable.
The branding concept has also been localised, for different countries, with the same logo
picture but local words reflecting the meaning of the term Hearts and Minds. After the
term was taken over for the Iraq conflict we had to adapt to avoid some negative conno-
tations in certain parts of the world. The common physical presentation of the tools as
brochures, with high quality printing and a consistent style shown in Fig. 3, also ensures
that the Hearts and Minds brand is recognisable, even in different languages. Originally it
was felt that tools might need to be adapted to be useable in different national cultures,
especially those that differ on the individualism–collectivism scale, but this has proved less
of a problem than expected. The experience has been that sensitivity to these issues during
tool design appears to make extra steps unnecessary. The main differences are that collec-
tivist cultures, such as the Arabic culture, need more emphasis on group benefits and activ-
ities, whereas more individualist societies, such as in the USA, need to be slanted more
towards individual actions and rewards. The differences are, however, small because most
activities are still centred round changing the environment rather than being directly and
obviously aimed at changing individuals.
5.3. Both top-down and bottom-up approaches are both necessary
While the majority of tools are intended to be used in a bottom-up mode, with local
supervisors often acting as facilitators, one tool has be used primarily top-down. Seeing
Yourself as Others See You, an upward appraisal tool, in which a manager rates him or
herself on their attitudes and behaviours towards HSE and they are then confronted with
how others, typically their direct reports, view them. Based originally on the upwards
appraisal in the Step Change program (Step Change, 2002; Flin et al., 2000; Bryden,
2006), this tool confronts mangers, especially senior management, with the difference
between their perceptions of themselves and the view created by the perception of their
actions by others.
This tool provides an example of the interaction between organisational and national
cultures and how the potential differences are approached. The tool requires a manager
who has been appraised to confront the ‘top’ two of the four dimensions on which they are
evaluated (Walk the Talk, Informedness, Trust and Priorities). These two are those that
show the greatest disparity between their own and their evaluators’ scores, indicative that
their overt behaviours are incompatible with their own professed values and beliefs about
themselves. The tool uses a confidential email system that ensures that the manager being
evaluated is the only person who gets to see their scores, apart from a university-based
confidential moderator. The only public requirement made by the tool is that they come
up with three action items, intended to close the gaps that have been identified, and relay
these to their superior. Explanation is not required and the process can, in principle, be
done entirely privately; this is intended to support those for whom the loss of face involved
in admitting that they are less than perfect would form a major barrier to using the tool in
the first place (e.g. some Chinese cultures). Equally, for those in more open cultures, there
is no reason why a manager cannot post his or her results and invite those who have par-
ticipated to explain why they gave the results that they did and make public suggestions
for improvement. The control of the process is in the hands of the individual being eval-
uated, the only public requirement is that they must do something to generate improve-
ment in their scores.
In general managers must support, and be seen to support, activities within their organ-
isations. As the Hearts and Minds program has become a major HSE priority, all senior
staff will need to be seen to be involved. To this end the HSE component of every man-
ager’s scorecard, which is a significant part of the whole evaluation and bonus system,
now consists of 50% TRCF, a reactive measure, and 50% activity within the Hearts and
Minds program, a self-selected proactive measure. Consistent with the ideals of the pro-
gram, managers can do what they feel they can and should do, this is not intended to
be defined from on high.
5.4. Cognitive dissonance as a mechanism to induce change
A safety culture is a set of attitudes, with those of senior and middle managers being
particularly crucial to the success of a program intended to develop a more advanced cul-
ture. It therefore follows that there will be those whose attitudes have yet to advance.
A key assumption, not a very well kept secret, is that it is possible for such people to ‘fake
commitment’, just so long as their behaviour is consistent with the advanced culture and
they can learn how to look good with the upward appraisal tool.6 The second part of the
assumption is that cognitive dissonance represents a particularly strong factor in inducing
the required attitudes, when there is no choice about how to behave in public. What is
essential in allowing people to set their own targets within the context of cultural change
is that, once they have defined their targets, they will be held to them. Setting stretch tar-
gets is seen as commendable, if set on oneself, but those targets should again meet the
requirements of being credible, feasible and achievable. In this way extrinsic motivators,
salary, bonuses and promotions, are used to create the situations for intrinsic motivation,
involving self-efficacy and a feeling of control.
6
If you can fake commitment and get away with it, then there is no real issue – if it looks like a duck, it walks
like a duck and it quacks like a duck, it is a duck (Groucho Marx, n.d.). Cognitive dissonance ensures that people
who are that successful at faking start to believe their own speeches.
6. Current status
There has been a considerable take-up and the Hearts and Minds program, in one form
or another, is in operation in almost all parts of Shell Group. In 2004 implementation of
the Hearts and Minds program became one of the HSE priorities for the Group. This pri-
ority was set by the Group HSE Committee that is chaired by Shell Group’s CEO. Almost
all management teams have at least gone through the HSE Culture exercises, in which they
identify where their operation is on the ladder and select one or two improvements that
they personally will carry out to move the organisation up the ladder. By being used at
all levels within the organisation, the concepts of the HSE ladder, from pathological to
generative, are becoming part of the everyday vocabulary. In only one function, tradition-
ally rather distinct from the rest of the Group and run from the US rather than Europe,
senior management has preferred to concentrate on more traditional behaviour-based
management approaches. Nevertheless there are a number of initiatives within that func-
tion to use some Hearts and Minds tools and their management has also gone through all
the HSE Culture exercises.
As well as doing the HSE Culture exercise, 2830 senior managers have also gone
through the upwards appraisal process and more than 700 have already done it more than
once (the expectation is twice a year). This has involved more than 17,500 appraisers. The
upwards appraisal has been led by the CEO of the exploration and production function
and the aggregated results are reported to the top layers of management. Almost all the
other functions within the Group have followed this lead and are making it a habit, thus
ensuring that the program does not become a typical one-off initiative. At lower levels the
Managing Rule-Breaking tool has been used extensively, this was where the requirement
to have material translated into local languages first became clear. Working Safely and
Improving Supervision are used more sporadically, while Driving for Excellence has only
recently been made available. This is consistent with the advice not to use all the tools, but
to select and use properly the one or two that are most relevant and easy to implement in a
specific location.
For other reasons Shell Group had a major problem that led to the dismissal of two
top managers and the resignation of a third. The new chairman of the Committee of
Managing Directors, now the CEO of Royal Dutch Shell plc, identified a major problem
with the organisation’s culture. He instituted a return to ‘enterprise first’ that is seen by
top management as completely consistent with the proactive and generative cultures.
This has provided a major impetus to ensuring the commitment of those top managers
to the success of the Hearts and Minds program in a wider context than just
HSE.
In 2005 a small steering group covering all the functions was formed to co-ordinate
activities. Consistent with the strategy this steering group does not lead the process, but
provides support and advice for those who do. It grew out of a worldwide workshop held
in The Hague that brought together ‘believers’ from different functions and representing
all the continents. The wider support community has a web-based network on the com-
pany intranet, although that does not appear to be used as much as the personal contacts
that form the real support infrastructure.
At the time of writing in excess of 150,000 brochures and 4000 full toolkits (starter
packs) have been distributed. Activities range from active use of the tools, to change atti-
tudes and carry out improvements, to large-scale awareness exercises. These usually
involve using the HSE Culture tool to assess the local organisation’s position and often
include contractors, especially their senior management. In several cases the contractors
have been asked to rate the local Shell company and come up with recommendations
about how Shell can become better as well as supporting the contractors to improve them-
selves. Contractors have typically been surprised to discover that the tools are given to
them, essentially for free. The next stages will probably involve asking people, gently at
first, to pay more attention to the implementation of their intentions. The message being
propagated is that in the Hearts and Minds program you can freely choose what level you
wish to attain and what you are going to do, as an individual or as an organisation, but
once these choices have been made, they must be carried out. To this end the Hearts and
Minds program is embedded in a wider approach also involving clearer definitions of per-
sonal responsibility and accountability and definitions of the individual consequences to
be attached to success as well as failure.
What is noticeable is how parts of the program have become interwoven into more gen-
eral programs. For instance, in Russia the driving tool, Driving for Excellence, was spon-
taneously used while in development and is being integrated into a wider program
involving improving road safety in the island community where the company operates.
Every country where there is an operation now has some take-up, but this is consistent
with the strong advice given not to do everything, but to select what fits local conditions
best.
At the end of 2004 all the tools were stripped, as far as possible apart from the logos on
the front cover and the copyright information, of references to the company and were then
made available to all who wanted to use them through the Energy Institute. This again
represented a major public commitment to the program, setting up a situation where it will
be difficult to go back on the program (Bryden and Hudson, 2005). As a result a number of
major companies, in a wide range of industries, have started to experiment with using the
tools and buying into the descriptions of the advanced cultures. Industries involved
include commercial aviation, the mining industry, electronics manufacture, shipping, oil
and gas service providers as well as health care. The upwards appraisal tool has been made
available and is being used by a major gas company, which is requiring all its senior exec-
utives to go through the process. In 2006 the company logo was removed from the front
cover, being replaced by the Energy Institute’s logo in order to reduce the threshold for use
by other companies.
7. Conclusion
The question that needs to be faced is: Is it working? Is the culture being changed and is
the approach described here effective? The answers to these questions seem to be generally
positive, but in some ways it is too early to tell. Unlike the descriptions of the high reli-
ability organisations this is not a state that has already been achieved, but rather one that
is aspired to. Certainly every experience with asking people what kind of culture they
would like has led to people selecting a proactive culture with the comment that the gen-
erative is ideal but too far for the immediate future. In short, the advanced culture are gen-
erally seen as desirable and, ultimately, attainable. The best time to truly evaluate progress
will be about 2010, with a program that started as a research program in 1998 and went
‘live’ in 2004.
7.1. Moving away from command and control is hard: more than just compliance
What can we learn from this early experience in taking the concept of an advanced
safety culture and actually trying to apply it in practice in a very large company? The
approach taken in the company forms an alternative to the command and control
approach to managing the human factor that is prevalent in many companies. In such
approaches individuals have to be coerced into safe behaviour. Winning the Hearts and
Minds, in contrast, requires the creation of a culture in which a proper understanding
of conditions that create ‘‘unsafe’’ behaviour, and their elimination, is considered more
important than just enforcing compliance. As was to be expected, old habits die hard,
and many managers have to be persuaded that there is an alternative to the command
and control approach they grew up with. A crucial stage will have been reached when there
is a full and common understanding of the roles played by individuals, both at lower and
at senior levels, as defined for the proactive culture. Some still have to learn that compli-
ance in itself, is a two edged sword – Managing Rule-Breaking stresses that the rules and
procedures need to be of a sufficiently high standard that they will be complied with, nat-
urally, rather than by force of authority. This stage has yet to be reached, although there
are many who have been won over.
7.2. The need for an organisational structure to drive the program
What has been learned is that it is harder than people expected to hand over responsi-
bility to those who actually do the work. Managers can feel they lose authority, supervi-
sors may feel their position is threatened, workers often also feel that they would rather let
those above them carry the responsibility, despite their complaints that they know better.
One solution being tried is to define explicit key performance indicators (KPIs) that mean
that people are rewarded for relinquishing power and to supporting the process of getting
the best from the best people. Such KPIs include the number of procedures challenged and
altered, the number of Improving Supervision workshops carried out, the number of times
managers are challenged.
Setting up KPIs has shown that it is necessary to define an organisational structure to
drive the entire process. Those at the top need to have a clearly expressed need to hear that
action is taking place, even if what come out of that action is personally embarrassing for
those very top managers. What is essential for managers to create an advanced safety cul-
ture is an appetite for bad news, that the only really bad news is an unrestricted diet of
good news. The good news culture that led to the reserves debacle has had to be reversed,
for good business reasons, at the same time as the Hearts and Minds program started to be
implemented. An organisational structure that rewards more advanced behaviours is dif-
ficult for those who are still, essentially, reactive or early calculative, especially when there
are no obvious and immediate benefits in terms of reduced incident rates, which is what
they expect.
7.3. This type of change requires managers to shed some basic business skills
The program, as designed, was intended for people to implement themselves. This has
meant that where people are keen, they will want to run with it. Some managers want to
have everything in place immediately, failing to realise that such systems have to be
designed and continuously adapted while they are in operation (Rochlin et al., 1987).
Advanced cultures are nothing like LNG Plants, so the project management skills required
to construct and run such a plant are different from those required to construct and run an
advanced HSE Culture. As many managers possess the former skills, it will be some time
before they feel at all comfortable with managing a change that has to be run in a different
way.
7.4. Both success and failure need to be communicated
It remains one of the difficulties associated with pull programs that many activities are
pursued without feedback to the centre, so that we only hear when things go wrong. This
was the experience in the implementation of the early Tripod Delta program, where com-
plaints were distributed and brought the program into disrepute, while successes were
enjoyed quietly. The network established at the first workshop does, however, appear to
be working and is using the lesson that both successes and failures need to be reported.
Reporting successes is essential, and the lesson was applied when there was a number of
negative emails about the upward appraisal process; it became necessary to broadcast that
there were two managers who were unhappy about some aspects (the reliability of the
email software and the wording of one question out of 17), but that there were at that time
more than 500 managers and 3000 evaluators who had experienced no problems at all.
7.5. An advanced safety culture is more than just a reporting culture
There is a powerful view that a safety culture is an informed culture, one based on free
and open reporting (Reason, 1997; Weick and Sutcliffe, 2001). There is little doubt that
knowledge and understanding of what might go wrong is vital to a culture of safety,
but the experience reported here suggests that this view may be too simple in practice.
The problem is, how exactly does one get to the point that the culture is a reporting
one? If one wants to create an advanced culture, it takes a lot more than just getting
near-miss reporting to work – or rather a fully working near-miss reporting system will
be found at the end of the trajectory, not at the beginning. The problem really resolves
to the proposal that it may be that a reporting culture does not make a safety culture,
but rather that a safety culture makes a reporting culture possible.
Reason (1997) distinguished the need to support and create a culture of informedness
by ensuring that there were four sub-cultures; a just culture, a flexible culture, a learning
culture and a reporting culture. Experience with this program suggests that even more
than these are needed. The 18 dimensions used in the HSE Culture tool, based on a num-
ber of empirical studies and depth interviews, cover far more than just Informedness, in
particular there appears to be a level of professional trust necessary, some of which is sup-
ported by a clear structure of accountability, and active participation by all levels of the
organisation. An alternative, but complementary, view is that an advanced safety culture
is one that is highly skilled at doing what needs to be done, so that progression up the lad-
der is a matter of acquiring and honing the management skills of both individuals and the
organisation as a whole, and not just skills of safety management. The skills acquired at
one level of the ladder provide the basis for making the leap to the next rung on the ladder;
reactive organisations learn to take safety seriously, calculative organisations learn to use
the information they possess to manage professionally, proactive organisations build on
these skills to focus on what is important, including what has yet to occur. All of these skill
sets are composed of many individual elements that need to come together to become an
integrated ability.7 This more dynamic approach to defining safety culture allows one to be
more opportunistic, advancing where advance is possible, bringing up what is difficult at a
later stage. This also means that if near-miss reporting is likely to be hard to get in place,
then there are alternative routes to creating an advanced culture to the point where the
previous impediments to informedness no longer apply.
7.6. Combining industry and academia requires flexibility on both sides
The program described, going back to 1985, represents an almost unique collaboration
between industry and academia. An earlier phase of the program spun off the organisa-
tional accident model (Reason, 1997; Wagenaar et al., 1994), the current phase seems to
have considerable success with the evolutionary Culture Ladder, which is now appearing
in a wide range of settings, far beyond its original form in the oil and gas industry. Look-
ing back on nearly 20 years one can see both a number of strengths and a number of prob-
lem areas in such a collaboration.
There is an advantage to well-grounded scientific theories and, at the same time, there is
a problem with academics. Academics have a strong tendency to sit on the sidelines, to
focus on their one specific area of interest, to observe and then to measure. A natural ten-
dency, especially in the social sciences, is to continue to refine measuring instruments
rather than moving on to using those instruments or, even, accepting that measurement
is only part of the total process if one wants to see major insights turned into practice
rather than just observing practice from the sidelines. Such detachment may be what is
necessary to move on to new theoretical heights, but at this level of operation, industrial
strength theory is required; the predictions and consequences of actions have to be highly
predictable, but such theories are already well established and therefore not very interest-
ing, scientists want to try something new. But, while explaining 3–5% of the variance may
be enough for a scientific publication, it may not be enough to bet someone’s life on. Fine
distinctions of theory, the daily fare of the fundamental scientist at the cutting edge, are
too fragile to base a system on if that system is to work. If an approach does not work
in the long run there will be a lot of problems created, including the believability of the
academic world. So this means that we need to reframe the role of the scientist as imple-
menter as more like that of the engineer, who knows how to take a wide range of estab-
lished scientific knowledge, plus hard won experience, and design and construct something
people can bet their lives on.
Industry, in contrast to academia, has a natural tendency to action – shoot first, aim
later. Just as academics need to come down from the trees and become involved, even if
it means creating a new discipline, so do industrialists need to learn to respect the value
7
I like to think of a parallel with learning to ride a bicycle. The initial skills involve steering and pedaling, only
once these are acquired can one remove the side wheels and acquire the balance skills that become integrated with
steering and propulsion. Once one is sufficiently skilled, one can learn new skills of cycling on public roads, and
finally, in high traffic density urban environments. This helps explain why organisations will find it hard, if not
impossible, to jump straight to the generative.
of theory and seek the confidence a well-founded, empirically justified theory will certainly
bring. The strength of the collaboration in these projects has been based on the long-term
vision from the company, supported by the feeling that the human factor had to be tackled
at some point and the realisation that it was not going to be easy.
7.7. Evaluation is a problem
Evaluating a program such as this, especially one carried out on a global scale, has
proven to be difficult. Both reactive and proactive measures have their problems. Of
the two approaches to evaluation, the low incident rates that led to setting up the
program in the first place mean that it will take several years, even with the sample sizes
available, to demonstrate conclusively from reactive measures if there was to be a signif-
icant reduction in fatality or personal injury rates. It would also be almost impossible to
make a definite statistical link to one, or even two, major incidents such as Exxon’s
Longford (Hopkins, 2005) or BP’s Texas City. In the case of such major incidents the
evaluation of the safety culture, and thereby the effect of such a program, would have
to be done on an individual basis. The classic problem with reactive measures is, never-
theless, that failure to have an accident remains weak evidence, while a number of inci-
dents may be explained as statistical catch-up. Proactive indicators, such as the numbers
involved in programs or climate surveys, may also be driven by superficial satisfaction
rather than true cultural change. Evaluating such large-scale programs will probably
always be open to the Hawthorne effect. At present proactive indicators will have to form
the main source of evidence.
The intention is to perform detailed reviews not just of what is reported to have hap-
pened and changed (the original Talk element of the safety culture), but also looking at
what has actually changed physically and is capable of being audited, such as numbers
of procedures improved, numbers of challenges accepted or changes in working practices
implemented. One major problem that comes along with evaluating this kind of program
is the lack of an adequate control group. No company would be bold enough to take the
medical approach and leave a number of sites and a cohort of individuals alone, in order
to see if they have more accidents or disasters than those being treated. What is more the
speed of movement and of information transfer within such an organisation means that
rapid osmosis of cultural change is likely, removing the distinctiveness a control group
should have. This is not to say that some degree of evaluation is not possible, but that
it is likely to be heterogeneous in approach and unlikely to deliver clear results in any short
term. In the long term we have to predict positive effects on a range of measures. In as far
as was possible, the program has incorporated as many insights as possible from those
studies that have attempted to describe the ideal organisation within which the perfor-
mance approximates to the target of zero accidents.
References
Bryden, R., 2006. The Organisational Antecedents of Individual Safety Behaviour in the U.K. Offshore Oil and
Gas Industry. Ph.D. Thesis, University of Aberdeen.
Bryden, R., Hudson, P.T.W., 2005. Because we want to. Safety and Health Practitioner 23, 51–54.
Croes, S.A.E.W., 2000. Onderzoek naar veiligheidscultuur Koninklijke Luchtmacht Basis Volkel [Study of the
Safety Culture at Royal Dutch Air Force base Volkel]. Master’s Thesis, Department of Psychology, Leiden
University.
Cullen, The Hon. D., 1990. Report on the Piper Alpha Disaster. Her Majesty’s Stationery Office, London.
Cullen, The Hon. D., 2001. The Ladbroke Grove Rail Inquiry. Her Majesty’s Stationery Office, London.
Flin, R., Mearns, K., O’ Connor, P., Bryden, R., 2000. Measuring the safety climate: identifying the common
features. Safety Science 34, 177–192.
Furnham, A., 2004. Management and myths: challenging the fads, fallacies and fashions. Palgrave Macmillan,
London.
Guldenmund, F.W., 2000. The nature of safety culture: a review of theory and research. Safety Science 34, 215–
257.
Hale, A.R., 2000. Editorial: culture’s confusions. Safety Science 34, 1–14.
Hidden, A., 1989. Investigation into the Clapham Junction Railway Accident. Her Majesty’s Stationery Office,
London.
Hopkins, A., 2005. Safety, Culture and Risk: The Organisational Causes of Disasters. CCH, Sydney.
Hudson, P.T.W., 1991. Prevention of accidents involving hazardous substances: the role of the human factor in
plant operation. Discussion document prepared for the OECD Workshop, Tokyo, 22–26 April 1991.
Hudson, P.T.W., Parker, D., 1999. Micro-tools for the management of change. Micro-tool Manual 1. Report for
Shell International Exploration and Production.
Hudson, P.T.W., Parker, D., 2001. Profiling safety culture: the OGP study. Report for the Oil and Gas Producers
Association OGP, London.
Hudson, P.T.W., Stephens, D., 2000. Cost and benefit in HSE: a model for calculation of cost–benefit using
incident potential. Proceedings of SPE International Conference on Health Safety and Environment in Oil
and Gas Exploration and Production. Society of Petroleum Engineers, Richardson, TX (CD-ROM).
Hudson, P.T.W., Reason, J.T., Wagenaar, W.A., Bentley, P.D., Primrose, M., Visser, J.P., 1994. Tripod Delta:
proactive approach to enhanced safety. Journal of Petroleum Technology 46, 58–62.
Hudson, P.T.W., Verschuur, W.L.G., Lawton, R., Parker, D., Reason, J.T., 1997. Bending the rules II. Report
for Shell International Exploration and Production, p. 88.
Hudson, P.T.W., Verschuur, W.L.G., Parker, D., Lawton, R., 1998. Intrinsic motivation for HSE: The Hearts
and Minds Program. Report for Shell International, p. 13.
Hudson, P.T.W., Verschuur, W.L.G., Croes, S., Parker, D., Lawrie, M., 1999. Hearts and Minds. Report on
Field Trial 1999 for Petroleum Development Oman.
Hudson, P.T.W., Parker, D., Lawton, R., Verschuur, W.L.G., van der Graaf, G.C., Kalff, J., 2000a. The Hearts
and Minds project: creating intrinsic motivation for HSE. Proceedings of SPE International Conference on
Health Safety and Environment in Oil and Gas Exploration and Production. Society of Petroleum Engineers,
Richardson, TX (CD-ROM).
Hudson, P.T.W., van der Graaf, G.C., Parker, D., Lawton, R., Verschuur, W.L.G., 2000b. HSE tools: Which
tools are appropriate?. Proceedings of SPE International Conference on Health Safety and Environment in
Oil and Gas Exploration and Production. Society of Petroleum Engineers Richardson, TX (CD-ROM).
Hudson, P.T.W., Verschuur, W.L.G., Parker, D., Lawton, R., van der Graaf, G.C., Kalff, J., 2000c. Bending the
rules: violation in the workplace. Exploration and Production Newsletter, EP2000-7001, Shell International
Exploration and Production, The Hague, pp. 42–44.
Hudson, P.T.W., Parker, D., Lawton, R., van der Graaf, G.C., 2002a. Managing non-compliance: moving
from theory to practice. Proceedings of the 6th SPE International Conference on Health Safety and
Environment in Oil and Gas Exploration and Production. Society of Petroleum Engineers, Richardson, TX
(CD-ROM).
Hudson, P.T.W., Parker, D., van der Graaf, G.C., 2002b. The Hearts and Minds Program: understanding HSE
culture. Proceedings of the 6th SPE International Conference on Health Safety and Environment in Oil and
Gas Exploration and Production. Society of Petroleum Engineers, Richardson, TX (CD-ROM).
Hudson, P.T.W., Parker, D.P., Lawrie, M., van der Graaf, G.C., Bryden, R., 2004. How to win Hearts and
Minds: the theory behind the program. Proceedings of the 7th SPE International Conference of Health, Safety
and Environment in Oil and Gas Exploration and Production. Society of Petroleum Engineers, Richardson,
TX (CD-ROM).
IAEA, 1991. Safety culture. Report 75-INSAG-4 International Nuclear Safety Advisory Group of the
International Atomic Energy Agency, Vienna.
Kotter, J.P., 1996. Leading Change. Harvard Business School Press, Boston, MA.
Kotter, J.P., Heskett, J., 1992. Corporate Culture and Performance. Free Press, New York, NY.
Lawrie, M.J., 2003. Developing Measures of Readiness to Change and Safety Culture in an Organisation. Thesis,
Department of Psychology, Manchester University.
Lawrie, M.J., Parker, D., Hudson, P.T.W., 2006. Investigating employee perceptions of a framework of safety
culture maturity. Safety Science 44, 259–276.
McInerney, The Hon. P.A., 2005. Report of the Special Commission of Inquiry into the Waterfall Rail Accident.
Department of Transport, New South Wales, Australia.
NASA, 2003. Report of the Columbia Accidents Investigation Board, NASA, Houston.
Parker, D., Lawrie, M.J., Hudson, P.T.W., 2006. A framework for understanding the development of
organisational safety culture. Safety Science 44, 551–562.
Prochaska, J.O., DiClemente, C.C., 1983. Stages and processes of self change in smoking: toward an integrative
model of change. Journal of Consulting and Clinical Psychology 5, 390–395.
Prochaska, J.O., Johnson, S., Lee, P., 1998. The transtheoretical model of behaviour change. In: Shumaker, S.A.,
Schron, E.B., Ockene, J.K., McBee, W.L. (Eds.), The Handbook for Health Behaviour Change. Springer US,
Cambridge, MA.
Reason, J.T., 1990. Human Error. Cambridge University Press, Cambridge, UK.
Reason, J.T., 1997. Managing the Risks of Organisational Accidents. Ashgate, UK.
Reason, J.T., 1998. Achieving a safe culture: theory and practice. Work and Stress 12, 293–306.
Reason, J.T., Wagenaar, W.A., Hudson, P.T.W., 1988. A new approach to safety: TRIPOD. Report for Shell
International Petroleum Maatschappij, The Hague.
Rochlin, G.I., La Porte, T.R., Roberts, K.H., 1987. The self-designing high-reliability organization: aircraft
carrier flight operations at sea. Naval War College Review 40, 76–90.
Step Change, 2002. Changing Minds: A Practical Guide for Behavioural Change in the Oil and Gas Industry,
second ed. Step Change in Safety, Aberdeen.
Turner, B.A., Pidgeon, N.F., 1997. Man-Made Disasters. Butterworth-Heinemann, Oxford.
van der Graaf, G.C., Hudson, P.T.W., 2002. Hearts and Minds: the status after 15 years research. Proceedings of
the 6th SPE International Conference on Health Safety and Environment in Oil and Gas Exploration and
Production. Society of Petroleum Engineers, Richardson, TX (CD-ROM).
van der Graaf, G.C., Kalff, J., Hudson, P.T.W., 2000a. Intrinsic motivation for HSE: The Hearts and Minds HSE
Research Programme (Part 1). Exploration and Production Newsletter, EP2000-7004, Shell International, The
Hague, pp. 41–42.
van der Graaf, G.C., Kalff, J., Hudson, P.T.W., 2000b. Moving towards a generative safety culture: The Hearts
and Minds HSE Research Programme (Part 2). Exploration and Production Newsletter, EP2000-7006, Shell
International, The Hague, pp. 38–40.
Wagenaar, W.A., 1986. The cause of impossible accidents. The sixth Duijker lecture, Netherlands Royal
Academy of Science, Amsterdam.
Wagenaar, W.A., Groeneweg, J., 1987. Accidents at sea: multiple causes and impossible consequences.
International Journal of Man Machine Studies 27, 587–598.
Wagenaar, W.A., Hudson, P.T.W., 1986. The analysis of accidents with a view to prevention. Paper for Shell
International Petroleum Mij. Leiden University, Department of Experimental Psychology.
Wagenaar, W.A., Groeneweg, J., Hudson, P.T.W., Reason, J.T., 1994. Promoting safety in the oil industry.
Ergonomics 37, 1999–2013.
Weick, K.E., 1987. Organizational culture as a source of high reliability. California Management Review 29, 112–
127.
Weick, K.E., Sutcliffe, K.M., 2001. Managing the Unexpected. Jossey-Bass, San Francisco, CA.
Westrum, R., 1988. Organisational and inter-organisational thought. In: World Bank Workshop on Safety
Control and Risk Management, Washington, DC, 16–18 October 1988.
Westrum, R., 1991. Cultures with requisite imagination. In: Wise, J., Stager, P., Hopkin, J. (Eds.), Verification
and Validation in Complex Man–Machine Systems. Springer, New York.
Zohar, D., 1980. Safety climate in industrial organizations: theoretical and applied implications. Journal of
Applied Psychology 65, 96–101.

Hudson 2007

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Hudson 2007

Uploaded by

Copyright:

Available Formats

Safety Science 45 (2007) 697–722

Implementing a safety culture in a major

Department of Psychology, Leiden University, The Netherlands

2.1. Understanding the causes of accidents

2.2. Safety management systems

2.3. After systems: What comes next?

3. The culture model

The concept of a safety culture is frequently treated as part of a dichotomy, an organi-

3.1. A model for creating lasting change

manage all hazards

Fig. 2. The HSE Culture ladder.

3.2. The support of top management

3.3. The tools

P. Hudson / Safety Science 45 (2007) 697–722

4.1. Initiatives and change

4.2. Branding the product

4.3. Replacing push with pull

Fig. 5. The full set of Hearts and Minds tools.

Fig. 6. The set of Hearts and Minds brochures.

5.1. Making sure the program follows the strategy

In a major West African country, with a workforce in excess of 25,000, an ambitious

5.2. Make the tools ﬁt the local environment

5.3. Both top-down and bottom-up approaches are both necessary

5.4. Cognitive dissonance as a mechanism to induce change

7.2. The need for an organisational structure to drive the program

7.4. Both success and failure need to be communicated

7.5. An advanced safety culture is more than just a reporting culture

7.6. Combining industry and academia requires ﬂexibility on both sides

7.7. Evaluation is a problem

You might also like