Managing the Unexpected

A planned fire escaped its plan

On May 4, 2000, National Park Service personnel ignited the Upper Frijoles prescribed burn in Bandelier National Monument, New Mexico. A slopover led them to declare it a wildfire the next day. Crews contained the fire on May 6 and early May 7, but rising winds carried it beyond control and toward Los Alamos. By May 10, 18,000 residents had been evacuated and 235 homes destroyed. By May 24, the Cerro Grande Fire had burned more than 47,000 acres, including land at Los Alamos National Laboratory, Santa Fe National Forest, San Ildefonso Pueblo, Santa Clara Pueblo, and private properties. ¹

These are findings from the federal independent review, not from Managing the Unexpected. The review concluded that federal personnel had failed to plan and implement the prescribed fire properly. It called for dedicated safety oversight, stronger management responsibility, open review of burn plans, continual cross-agency coordination, and contingency resources whose availability had been assured in advance. It also insisted that prescribed fire remained an essential land-management tool. The failure did not make all deliberate burning irrational; it exposed how an approved plan could create confidence without creating control. ²

The 2007 edition of Karl Weick and Kathleen Sutcliffe's book opens with Cerro Grande as a “brutal audit.” They interpret the episode through five practices of high-reliability organizing. Their account is not a second accident investigation and does not establish the counterfactual that five practices would certainly have contained the fire. It asks a different question: what qualities of collective attention were absent as a hazardous operation moved from expectation into surprise? ³

The framework came from observing organizations that rarely got a first mistake

The book belongs to a research tradition that began at the University of California, Berkeley, in the 1980s. Todd La Porte, Karlene Roberts, Gene Rochlin, and collaborators studied aircraft-carrier flight operations, air-traffic control, and nuclear power—systems expected to perform hazardous, complex work without learning through catastrophe. Their methods included field observation, interviews, documentary analysis, and surveys. Rochlin, La Porte, and Roberts described carrier flight operations as a self-designing organization: formal hierarchy persisted, but dense cross-checking, redundant communication, continual training, and authority to halt unsafe work let the operating system adapt as tempo and conditions changed. ⁴

Weick and Sutcliffe synthesize that field tradition with accident reports, health-care cases, firefighting, the interpretive tradition developed in Sensemaking in Organizations, and managerial experience. The five practices are therefore author interpretations across a body of heterogeneous evidence, not five variables manipulated in one study. They name recurring processes that appeared to keep consequential information available. ⁵

On that reading, preoccupation with failure prevents an accident-free run from becoming evidence that the system is invulnerable. Near misses, small deviations, and awkward anomalies remain news. Reluctance to simplify keeps a single reassuring category from erasing conditions that do not fit. Sensitivity to operations maintains contact with workload, equipment, weather, workarounds, and handoffs as they actually exist. These three practices make surprise more likely to become visible before it becomes unmanageable. ⁶

The remaining two concern response. Commitment to resilience means having relationships, competence, reserves, and rehearsed ways to contain a problem that prevention missed. Deference to expertise lets decision authority migrate toward whoever has the most relevant contact and knowledge for the problem at hand, rather than requiring information to climb the ordinary org chart before action begins. Hierarchy is not abolished; its operating rule changes when the situation changes. ⁷

Cerro Grande gives the abstractions weight. The official review found weak links among plans, policies, landowners, agencies, weather information, and assured contingency resources. Weick and Sutcliffe treat those gaps as a pattern of simplified expectation, weak operational sensitivity, and insufficient containment. The mapping is illuminating, but the official findings and the authors' conceptual diagnosis remain different kinds of claim. ⁸

Reliability depends on labor, reserves, and permission—not exhortation

The framework is often reduced to a checklist. That loses the organization inside it. A near-miss system matters only if people can report without retaliation and someone has time to investigate. Operational sensitivity requires leaders to trust information that contradicts a dashboard. Resilience requires staffing, maintenance, spare capacity, training, and relationships built before crisis. Deference requires real stopping and decision authority, not an invitation to advise a superior who may ignore it. ⁹

Frontline participants experience these conditions materially. A firefighter asked to improvise without contingency resources is not evidence of a resilient institution; that person is absorbing its underinvestment. A nurse who can identify a hazard but cannot pause a procedure is not working in a system that defers to expertise. The carrier studies also came from military organizations with extraordinary resources, selection, discipline, and mission authority. Practices observed there do not transfer intact into a hospital, utility, platform company, or precarious workplace. ¹⁰

The cases further create a selection problem. Researchers went looking for organizations with unusually strong safety records and then described their processes. Rich comparative fieldwork can generate theory and reveal mechanisms; it cannot by itself show that each observed feature caused the record, that the record will persist, or that an organization displaying the feature in another setting will obtain the same result. The five names are memorable because they compress a complex literature. Memorability is not validation. ¹¹

Safety is not the same as reliable production

High-reliability theory developed partly in argument with Charles Perrow's normal-accident theory, which holds that some tightly coupled, interactively complex systems make serious accidents difficult to eliminate. Weick and Sutcliffe emphasize the possibility of organizing vigilance; Perrow keeps open the political question of whether a catastrophic technology should be operated at all. ¹²

Nancy Leveson, Nicolas Dulac, Karen Marais, and John Carroll sharpened the disagreement in a systems-safety critique. They argue that both traditions use ambiguous concepts and can confuse reliability with safety. A system may reliably meet its production target while maintaining an unsafe constraint; operator mindfulness cannot repair every hazardous architecture, incentive, regulator relationship, or design decision. They propose treating safety as a property of the whole sociotechnical control system rather than as the sum of reliable components or attentive people. ¹³

The HRO vocabulary has nevertheless traveled widely, especially into health care. A 2020 systematic review found culture to be a foundational theme across the literature, while also showing how varied the definitions and applications have become. Declaring a hospital or company an HRO says little unless the claim is tied to observed practices and safety outcomes over time. ¹⁴

Cerro Grande also keeps the affected public in view. The operation served a legitimate ecological and fire-management purpose, yet residents, Pueblo lands, ecosystems, workers, and future land users bore consequences of decisions made elsewhere. Managing the Unexpected helps explain how an organization might notice and contain danger more faithfully. It does not decide which risks are legitimate, whose land may be exposed, or how much catastrophic potential a community should accept. Those questions belong inside reliability governance, before the next weak signal appears. ¹⁵

The author profile for Karl E. Weick and Sensemaking in Organizations provide intellectual context. The Columbia Accident Investigation Board Report, the Apollo program, and U.S. Navy nuclear propulsion offer contrasting safety settings. The conceptual links to learning, quality, and reliability, culture, trust, and voice, organizational intelligence, and benefit for all life are editorial tests of how attention, authority, and consequence fit together, not claims of direct influence or equivalent performance. ¹⁶