Just Culture
in five questions.

See the highlighted block above the contents list. The five questions follow.

Just Culture is the simplest idea in safety management and the hardest one to apply consistently. It states that frontline reporters should be treated fairly based on their intent and behaviour, not on the consequences of their actions. A pilot who makes an honest mistake on a quiet Tuesday afternoon and a pilot who makes the identical honest mistake on a Friday evening that becomes a tail-strike should receive the same response from the organisation. Both reported in good faith. Both deserve the same fairness.

James Reason articulated this in Managing the Risks of Organizational Accidents (1997) and Sidney Dekker extended it in Just Culture (2007, second edition 2012). Both authors are cited by ICAO Doc 9859, EASA guidance, and the EU Reporting Regulation. None of those documents make Just Culture easy to apply when an actual person has made an actual mistake that caused actual damage. The five questions below are the operational tool.

The questions are sequenced. Each one resolves a different facet of the situation. Together they produce a defensible answer to the only question that matters at the moment after an incident: what does the organisation do next?

“You can have a learning culture, or you can have a blame culture. You cannot have both.”Sidney Dekker, Just Culture (2012)

The first question is the easiest to ask and the most decisive. Did the person intend the outcome that occurred?

If the answer is yes — the person intended the harm — this is not a Just Culture conversation. It is a sabotage conversation, a security conversation, possibly a criminal conversation. Just Culture protects honest reporters; it does not protect deliberate harm. Move the case to the appropriate channel and end the safety analysis.

In nearly every aviation occurrence, the answer to Q1 is no. Pilots do not intend hard landings. Engineers do not intend forgotten wrenches. Dispatchers do not intend incorrect fuel figures. The answer to Q1 being “no” is what allows the next four questions to do their work.

Note the precision: the question is whether the action was intentional, not whether the action was conscious. A pilot consciously selected flaps; the consequences of selecting the wrong flap setting were not intended. Q1 cleanly separates intent-to-harm from action-with-consequences.

The second question separates error from violation. An error is a mental slip, a perceptual failure, a memory gap, an attention lapse. A violation is a deliberate departure from a procedure the person knew applied.

Violations are further subdivided in the Reason taxonomy. Routine violationsare ones the team has normalised over time — everyone takes the shortcut, the SOP is treated as advisory. Situational violationshappen when the procedure cannot be followed in the actual conditions (the SOP assumes a circuit breaker exists in a place it doesn't, for example). Optimising violations are taken to do the job better, not to do less work. Reckless violations are taken with conscious disregard for the obvious risk.

Of those four, only the last one — reckless — is a Just Culture sanction trigger. The other three are signals about the system: routine violations point to weak supervision and tolerance of drift; situational violations point to an SOP that doesn't match reality; optimising violations point to a workflow that pays its workers to take shortcuts.

The question to ask: did the person knowingly violate a rule with conscious disregard for the obvious risk? If yes, sanction. If no, look at the system.

This is the substitution test. Hold the situation constant — same time of day, same fatigue, same training, same equipment, same workload, same available information — and replace the person with a peer of equivalent competence. Would the peer have made the same decision?

If yes, the situation is the cause. The error is what the system produced when loaded with a representative human. Sanctioning this person changes nothing systemic. It removes one peer; the next peer in the same situation behaves the same.

The substitution test is the antidote to hindsight bias. After an event, the outcome is known — and the brain reconstructs the decision path as obviously wrong, because we know it ended badly. The substitution test forces us to evaluate the decision against what was knowable at the moment, not against what was learned in retrospect.

Mechanically: gather a panel of three or four peers. Walk them through the situation as it was experienced, not as it ended. Ask each, independently, what they would have done. The answer to Q3 is what the panel says, not what the investigator concludes alone.

This is the recurrence question, and it is sequenced fourth deliberately. A person who makes the same error twice may need additional training, support, or reassignment — but first we need to confirm questions 1, 2, and 3 say what they should say. A pattern of identical errors by the same individual, where peers consistently would not have made the same error, is a competence question.

The danger is jumping to Q4 before Q1–Q3. Recurrence is not on its own a sanction trigger; recurrence in the absence of system fault and where peers would not have done the same is the trigger.

Note: Q4 should be answered against organisational records, not against memory. “I think this person had a similar issue two years ago” is not a basis for action. A documented history of this specific failure mode by this specific person, from the safety system, is.

Almost always, yes — in part. The Reason model frames every accident as the alignment of latent organisational failures (decisions made years ago, far from the operation) and active failures (the immediate human action). Q5 is the search for the latent contribution.

Latent failures show up as: an ambiguous procedure that nobody escalated for five years; a roster that produced the fatigue level on the day of the event; a training programme that covered the rare scenario only as a slide; a checklist whose last revision predated the new equipment; a culture where reporting near misses earned criticism.

Q5 is the question that turns an investigation into a system improvement. If the answer is “yes, the system is at fault” (and it usually is in some part), the corrective action targets the system — not the individual. The individual's role becomes informational: their experience is what made the latent failure visible.

The five questions, sequenced into a tree:

1. Q1 intentional? If yes → criminal / security route, Just Culture analysis ends. If no → continue.
2. Q2 reckless violation? If yes → sanction proportionate to the recklessness, document, and implement the system improvement that prevented earlier intervention. If no → continue.
3. Q3 substitution test passes? If a peer would have done the same → the system is the primary cause. Train, redesign, communicate. The individual is not sanctioned. If no peer would have done the same → continue.
4. Q4 recurrence? First-time event with peers who would not have done the same → coach, additional supervision, document. Recurrent event with the same individual where peers would not have done the same → competence review, possibly reassignment.
5. Q5 system contribution? Always run this analysis. The corrective action plan addresses the latent failures alongside any individual response.

In practice, the vast majority of aviation occurrences exit the tree at Q3 with the system identified as the cause. A small minority exit at Q2 with a sanction. An even smaller minority exit at Q4 with a competence response. Almost none exit at Q1.

Three persistent misunderstandings need to die:

Just Culture is not a no-blame culture. Reckless behaviour is sanctioned. Persistent competence failures lead to reassignment. The fairness is in the application, not in the absence of consequences.

Just Culture is not a get-out-of-jail card for individuals. EU 376/2014 Article 16 protects reporters from criminal proceedings based on the report itself. It does not immunise the underlying conduct. A reckless pilot is still investigated by the prosecutor; the pilot's report just cannot be used as evidence against them.

Just Culture is not a slogan in the safety policy. It is an operational practice that the accountable manager applies, the safety manager facilitates, and the workforce experiences. If frontline staff cannot describe what happens when they file a report, the policy is wallpaper.

The single best test of a Just Culture is reporting volume. If voluntary reports are increasing year-over-year, your culture is healthy. If they are declining, something has chilled the workforce — and no slogan reverses that signal.

• James Reason — Managing the Risks of Organizational Accidents (1997). The original framework for the Swiss Cheese model and the violation taxonomy.
• Sidney Dekker — Just Culture: Restoring Trust and Accountability in Your Organization (2012, second edition). The most accessible operational guide to applying Just Culture.
• EU Regulation (EU) 376/2014. Reporting, analysis and follow-up of occurrences in civil aviation. Article 16 is the legal basis for reporter protection in EU member states.
• ICAO Doc 9859 — Safety Management Manual, fourth edition (2018). Chapter 2.5 on Safety Culture; Chapter 4.6 on Reporting Systems.
• Eurocontrol — Just Culture toolkit. Practical guidance and case studies from European air navigation service providers.
• FAA Order 8000.373 — Federal Aviation Administration Compliance Philosophy. The US implementation closest in spirit to Just Culture.