When the Holes Line Up: Why Empowering Workers to Stop Work Is a Critical Safety Control

Accidents rarely result from a single failure. Instead, they occur when multiple layers of defence each develop weaknesses, and those weaknesses align 

Most organisations today have what they would describe as solid safety systems in place. Risk assessments are completed, Safe Systems of Work are approved, and controls are clearly documented. On paper, the job is safe. 

And yet incidents still occur, often during routine work that has been done many times before. Not because the system didn’t exist, but because the reality of the task no longer matched the assumptions it was built on. 

The Swiss Cheese Model and What It’s Really Telling Us 

James Reason's Swiss cheese model is familiar territory for anyone working in health and safety. It reminds us that accidents rarely result from a single failure. Instead, they occur when multiple layers of defence each develop weaknesses, and those weaknesses align. 

Each layer of defence has holes in it. But unlike actual cheese, those gaps are not fixed. They are in continuous motion, they are opening, closing and shifting from place to place. 

Only when a series of holes align does an accident trajectory pass through the defences and cause harm to people, assets or the environment. These windows of opportunity are not always present; they require the right circumstances to allow them to line up. 

James Reason repeatedly emphasised that accidents emerge from the interaction of latent conditions within systems, not simply from frontline errors. The model was never intended to suggest static barriers, but dynamic systems that degrade over time if not actively managed. 

Layers of Defence: Necessary, but Never Perfect 

Risk assessments form one layer. Safe Systems of Work another. Engineering controls, supervision, training and PPE add further protection. Every layer matters, but none are perfect, and any of them can contain latent weaknesses. 

Reason described these weaknesses as latent conditions, the hidden problems embedded in systems long before an incident occurs. They often remain unnoticed until local circumstances allow them to combine with active failures. 

Once you step away from the diagram and into the workplace, those holes are constantly moving. 

Work Is Dynamic but Safety Systems Often Aren’t 

Safe Systems of Work are created based on assumptions about conditions, equipment, access and task scope. But work is dynamic. Weather changes. Equipment is substituted. Guarding is removed temporarily. Access routes are altered. Tasks evolve. 

What was once a robust control can quietly weaken without anyone formally noticing. 

As these small changes accumulate, the gap between work as imagined and work as done begins to grow. This is precisely the space where Reason warned organisations are most vulnerable, where systems appear compliant, but reality has moved on. 

(An AI illustration of a worksite, not a real Cotecna worksite). As small changes accumulate over time, the gap between work as imagined and work as done begins to grow. 

This is where the role of the worker becomes critical. 

Stopping Work Is a Decision, Not a Procedure 

Most organisations state that workers can stop work if it is unsafe. In principle, that permission exists. In practice, the decision to pause is rarely straightforward. 

People don’t just assess risk, they assess expectations, time pressure, and how their actions will be perceived. They ask themselves whether the change is serious enough, whether they are overreacting, and what the consequences of stopping might be. 

If those questions don’t have clear, reassuring answers, the final layer of defence becomes fragile. 

Reason was clear that human behaviour is shaped by organisational context. When systems reward speed, output or compliance over questioning, people adapt accordingly, even when they recognise risk. 

Worker Empowerment as an Active Safety Control 

Worker empowerment is often described as confidence or courage. In reality, it is about system design and leadership behaviour. 

Empowerment means workers understand what a degraded or missing control looks like, recognise when a safe system no longer fits the task, and know exactly what to do next. Crucially, it also means they trust that stopping work will be supported and not questioned or quietly penalised. 

In the context of the Swiss cheese model, this matters because people are not a last‑minute fail‑safe. They are an active safety control. When a worker pauses, questions a change, or reports a missing control, they are preventing the holes from lining up. 

The Most Overlooked Layer: Permission 

One of the most overlooked layers in the model is permission. 

• Permission to say, “This isn’t what we assessed.” Permission to stop without fear of blame or frustration. 
• When that permission is real and consistently demonstrated, missing controls are identified early and incidents are prevented. When it isn’t, work continues and the model fails exactly as it predicts. 

Stopping work is always visible. It delays the task and draws attention. The cost of not stopping is often hidden, until it isn’t. Injuries, investigations, lost trust and long‑term cultural damage frequently trace back to a moment where someone noticed that something had changed but didn’t feel able to act. 

A Leadership Question Worth Asking 

If we genuinely accept the Swiss cheese model, then we also have to accept this: empowering workers to pause, question and speak up is not a “nice to have”. It is one of the most important safety controls we have. 

Safe systems matter. Procedures matter. Controls matter. But safety ultimately depends on whether people feel able to say, “This doesn’t look right ... we need to stop and check.” And whether the organisation truly supports them when they do. 

Ask yourself this: when was the last time you checked whether your workers genuinely feel able to stop work? 

Because empowerment isn’t proven by a procedure. It’s proven by whether people believe they will be supported when they use it. 

Written by Dean Tillbrook, Cotecna Global HSE Officer

About Cotecna

For over 50 years, we have been supporting agriculture, food and pharma, minerals and metals, and consumer products supply chains all over the world. We provide testing, inspection, and certification services to help our clients navigate evolving regulations, ensure product compliance, and support their sustainability journey.