1 Introduction

1By definition (Hollnagel, 2009, 2011), organisations are resilient if they are able to adjust their functioning to ensure the continuation of operations under both expected and unexpected conditions. Four abilities characterise resilient organisations: 1) ability to respond to current challenges; 2) ability to monitor incoming critical situations; 3) ability to anticipate the occurrence of future events; 4) ability to learn from the past (Hollnagel, 2009).

2There is the need, by organisations interested in the Resilience Engineering approach for safety management, for conceptual tools for “doing something about resilience”. This means that organisations should be provided with means to evaluate and manage the four above mentioned abilities. One of the means can be the Design for Integrated Safety Culture (DISC) model (Reiman & Oedewald, 2009; Oedewald, Pietikäinen & Reiman, in press). This paper explores to which extent the DISC-model can contribute to engineer the required abilities in resilient-wannabe organisations and it illustrates how the abilities can be evaluated through the use of the DISC-model.

2 Resilience Engineering in Practice

3For a thorough explanation of the reasons why the four abilities are considered necessary and sufficient to ensure resilience, it is possible to refer to Chapter 6, authored by Erik Hollnagel, of the book Resilience Engineering perspectives, Vol2. Preparation and Restoration (Nemeth et al, 2009). In this paper, we instead want to address what an organisation can operationally do to develop them. It is therefore worth to briefly describe what the four abilities consist of.

• Ability to respond refers to the ability of an organisation to detect that something has happened, to recognise that it is relevant, and finally to respond to it. The existence of this ability implies that the organisation defines, in a systematic manner, a set of events to which it should be capable of responding, and then allocates appropriate resources (e.g. staff, technology, competences, etc.) to actually respond in case they actually occur.

• Ability to monitor refers to the ability of an organisation to understand when a situation, in the short term, is going to become critical, and therefore to start preparing for dealing with it. The existence of this ability implies that the organisation defines and updates a set of valid and meaningful indicators, and it performs sound measurements of significant changes.

• Ability to anticipate refers to the ability of an organisation to look far ahead in time to identify events that need to be prevented from occurring. The existence of this ability implies that the organisation looks at the future with appropriate imagination and performs safety assessment with methods able to account for emergent phenomena.

• Ability to learn refers to the ability of an organisation to analyse and understand both successful and unsuccessful past events. The existence of this ability implies that the organisation adopts a plan for continuous learning which includes the analysis, communication and sharing of the reasons of its (successful/ unsuccessful) performance.

4In the objective to help organisations in enhancing their resilience, Resilience Engineering should provide them with concrete suggestions for how to develop these four abilities. When an organisation aims at being resilient, how should it be organised? What should it do? Which activities should it carry out?.

3 Design for Integrated Safety Culture model

5The DISC-model (see Figure 1) describes safety culture as organisational potential for safety. This potential requires different types of abilities and characteristics from the organisation and thus the logic of DISC theory resembles Hollnagel’s (2009) discussion of resilient systems. Safety culture is not only correct values and responsibility, but also proper organisational structures, processes and resources, which are based on a thorough and systemic understanding of the hazards of the activities. According to the DISC model an organisation has good safety potential when the following six criteria are met: 1) Safety is a genuine value in the organisation which reflects to decision making and daily activities; 2) Safety is understood as a complex and systemic phenomenon; 3)Hazards and core task requirements are understood thoroughly; 4) Organization is mindful in its practices; 5) Responsibility for the safe functioning of the entire system is taken; 6) Activities are organised in a manageable way.

6Ten organisational functions, according to the DISC-model, are needed to meet the above mentioned criteria and to ensure the potential for safe functioning of the organisation.

3.1. Organisational functions to ensure safety potential

7The organisational functions represent those key activities that the organisation has to carry out in order to ensure safety and achieve a high safety potential. The outer layer of Figure 1 illustrates these functions.

1. Work conditions management refers to how the work is structured in terms of constraints and requirements it puts on the workers. This function refers to the management of the physical conditions (e.g. workspace, lighting), the structural means necessary for carrying out the work (e.g. tools, instructions) as well as .human resources

2. Work process management refers to how cooperation and communication as well as information flow are managed in the organisation.

3. Safety management and leadership refers to how safety considerations are included in management decision making. Safety management and leadership comprehends gathering feedback and information, making standards and expectations clear, and ensuring that management is up to date on the way work is actually conducted in the field. This function requires the establishment of open communication on both positive and negative safety issues, and to honestly address safety-related questions and worries from the personnel as well as to openly discuss uncertainties and risks.

4. Supervisory support for safety refers to whether the work in the immediate work environment is organised in such a manner that it can be safely accomplished. It includes positive feedback on the safety-conscious behaviour of the personnel, fair treatment of subordinates, and monitoring of the subordinates’ coping skills, stress and fatigue levels, as well as technical skills.

5. Proactive safety development refers to how utilise operating experience, leading safety indicators, and condition monitoring of equipment (where appropriate), as well as continuous development of practices, and constant vigilance for weak signals. Proactive safety development deals with how learning takes place and it supports the ability of the organization to recognise the boundaries of safe performance.

6. Hazard control refers to how known risks are prevented from actualising. This function deals with the provision and implementation of barriers (e.g. quality assurance, back-up-systems, checklists and physical barriers) to prevent unwanted human and technical variance. Hazard control typically involves hazard identification, risk assessment, control measures and feedback.

7. Competence management refers to how the skills and knowledge of the personnel are developed and maintained. It requires a system for the identification of competence needs in the organization. Competence management also includes the training and socialization of newcomers and transfer of knowledge from the experienced personnel to the less experienced.

8. Change management refers to how changes in organizational structures, practices and technology are handled. Change management requires planning of changes and their implementation as well as follow up on changes already implemented. Change management should also take into account incremental changes in the organisation.

9. Contractor management refers to how contractors are selected and trained in safety related issues, and how their know-how in the field of interest is ensured. This function requires a record for subcontractor safety performance to be used in decision making concerning contracts. Contractor management also concerns the practices to facilitate organisational learning from subcontractors as well as subcontractors’ own learning.

10. Strategic management refers to how the management of long-term preconditions for work, long term goals and financial viability are addressed by the organization

4 DISC-model’s contributions to engineering resilience

8To explore to which extent the DISC-model contributes to engineering resilience, the organisational functions of the DISC-model are mapped into the four resilience abilities. The mapping (Table 1) provides insight on which are the organisational functions that can in practice be used to enhance which of the resilience engineering ability, as well as what does each function provide to the four abilities. In other terms, the mapping aims at answering questions like:

"Which tasks (organisational functions) contribute to the ability to respond to what is happening?"

9In this specific case, the answer suggested from the mapping would be:

“Work conditions management, hazard control management, competence management, contractor management, work process management, supervisory support for safe activity, and chance management contribute to the organisation’s ability to respond”

10The mapping of functions’ contributions to the abilities has been done on the basis of the previous descriptions of both functions and abilities. For example, hazard control aims at identifying risks and at providing and implementing safety barriers. The function therefore mainly contributes to identify critical situations in a short term (ability to monitor) and to cope with them (ability to respond). The function has little impact on how past events are analysed (ability to learn), and on how far ahead challenges are considered (ability to anticipate). Another example: safety management and leadership aims at ensuring that the management develops long term plans for assuring safety (ability to anticipate) and at establishing the prerequisites for discussing uncertainties and risks (ability to monitor).The contribution of this function to the ability to learn and on the ability to respond, as previously described, appears non significant.

Table 1 Illustration of what each DISC function provide for engineering resilience abilities

11The actual ability to respond is then dependent on the way in which the above mentioned functions are carried out in the organisation. The ability to respond can be evaluated and developed by focusing on those functions.

12In the following section we illustrate an exercise, for previously conducted case studies, where the evaluation of the organisational functions has been used to deduce an evaluation of the resilience engineering abilities in two safety critical organisations.

5 Engineering resilience with the DISC-model: insight from two case studies

13Two case studies are here presented to illustrate how the DISC-model has been applied in the health care and nuclear domains. For both case studies, the original scope was to evaluate the potential for safety (i.e. the safety culture) of the organisations. The evaluation included an assessment of how the organization was creating the safety potential by means of the organisational functions. The original results are here looked through the resilience engineering lens, to illustrate what the contribution of the DISC-model to engineering resilience can be.

14The first case study consisted of an organisational safety evaluation of a nuclear power plant unit. Data collection took place during spring 2010. The second case study consisted of the evaluation of the prerequisites for patient safety at a central hospital. In this case data collection took place between January 2011 and April 2011.

15At the nuclear organisation, it was judged that the development activities (proactive safety development) were strongly supported by management (safety management and leadership). Though, these organisational functions contributed mainly to improve safety as a value, rather than to improve understanding of safety and to create the organisational preconditions for safety. Further, human performance issues were not integrated with organisational and technological issues. In the original study, it was concluded that, in order to improve their safety potential, the organisation needed to refocus its development activities to be more in line with each other and more strongly oriented towards improving understanding and making work more manageable. From the resilience engineering perspective, and with the use of the mapping (cf. Table 1), it is possible to deduce that the organisation had problems especially in its ability to anticipate what could possible happen and to monitor for critical situations.

16At the hospital, it was originally discovered that the biggest challenges of the organisation were associated with competence management and change management. At the same time the current competence of the personnel was considered good. This result was taken as an indication of possibly worsening situation in future if changes will not be managed adequately and training and recruitment activities will not be sufficient. On the other hand, the hospital was evaluated as having a well-functioning proactive safety development process. From the resilience engineering perspective, and with the use of the mapping, it is possible to deduce that the ability to anticipate, as well as the ability to respond could be problematic for the organisation (cf. Table 1).

6 Discussion

17This brief exercise demonstrates that it is possible to apply the DISC model for engineering resilience in organizations. Two main theoretical and practical issues have nevertheless emerged during the case studies.

18The first issue concerns the ability of the DISC-model in providing answers to several empirical findings. Both case studies provided a lot of information concerning the institutional constraints and pressures that the organizations need to cope with. Currently the interface between the organisation and its environment is explicitly dealt with only in contractor management function and somewhat in the strategic management function. Yet many examples of couplings between safety and organisational environment were discovered, including political decisions and socioeconomic changes in the society.

19The second issue is related to the four resilience engineering abilities and their potential to cover all the necessary aspects for safe organisational functioning. The DISC-model proposes six generic criteria for safety potential. Despite that there is a clear overlap between the abilities and some criteria (e.g. the ability to respond and “activities are organised in a manageable way”), some of the DISC-model aspects (e.g. the understanding of hazards and core task requirements) seem to be undervalued by resilience engineering. Oedewald and Reiman (2003; Reiman & Oedewald 2007) have emphasised the importance to understand the demands of the activities which result from the unique context of the organisation and the requirements of the task, when developing the activities. Although the four resilience abilities suggested by Hollnagel (2009) appear to be sensible characteristics of multiple different types of safety critical organisations the specific objectives and hazards of certain domain may call for specific resilient abilities. Those need to be identified and understood in the organisations.