10. Resilience Engineering — Work as Imagined and Work as Done

The divergence of procedure and practice

David Woods established the fundamental distinction between work-as-imagined, which represents the formal written procedure, and work-as-done, which describes the actual performance of complex tasks. In 2012, Alper et al. measured this gap within two pediatric hospitals by surveying 199 nurses regarding their adherence to medication administration protocols during daily operations. The data revealed that self-reported protocol violations occurred in 8%–30% of routine situations, demonstrating that workers frequently adapt their methods to meet system demands. These findings suggest that the gap is not a sign of individual deviance, but rather a systematic feature of how people navigate real-world constraints. When the formal procedure fails to align with operational reality, staff members must improvise to ensure that the work actually reaches its intended conclusion. By documenting these departures, researchers have shown that systems rely on these informal, unwritten adaptations to maintain performance levels under varying environmental pressures.

The ETTO principle and adaptive safety

Erik Hollnagel introduced the ETTO principle, or efficiency-thoroughness trade-off, to explain how practitioners constantly balance these competing pressures to remain effective in their roles. The research by Alper et al. in 2012 further confirmed this, showing that in emergency situations, self-reported violations rose significantly to between 32%–53% among the 199 nurses. This increase demonstrates that the divergence is highest precisely when formal procedures are most difficult to follow, indicating that adaptation is a functional necessity. Hollnagel’s Safety-I and Safety-II frameworks suggest that removing these informal adaptations can paradoxically reduce safety by stripping the system of its essential, latent flexibility. Rather than viewing these deviations as errors to be eliminated, resilience engineering posits that they are the mechanisms that allow complex systems to continue operating. Attempts to force strict adherence to work-as-imagined may therefore inadvertently undermine the very resilience that keeps the system functioning during periods of high instability.

Evidence and institutional critique

The validity of these approaches remains contested within the safety community, as M.D. Cooper argued in a 2022 critique published in Safety Science. Cooper contends that the Emperor has no clothes, asserting that there is no published, peer-reviewed empirical evidence showing that resilience engineering actually improves safety outcomes. He maintains that these new approaches often rely on traditional Safety-I methodologies in practice, despite their theoretical claims of offering a fundamentally different perspective.

Example: A pilot following the manual precisely in a storm might crash, while one who adapts the procedure to the wind survives.

Verdict. Systems depend on informal adaptations to function, meaning that rigid enforcement of written procedures often masks the true operational risks of the environment.

Overturned if: A series of large-scale longitudinal studies demonstrate that organizations prioritizing strict procedural adherence consistently achieve lower incident rates than those allowing for informal adaptation.

Sources. 2012 · Alper, S.J. et al., "Self-Reported Violations During Medication Administration in Two Pediatric Hospitals" — PMC · 2022 · Cooper, M.D., "The Emperor has no clothes: A critique of Safety-II" — ScienceDirect