Six of seven foreign-body complaints at one South African ready-to-eat meat plant were closed the same way: “operators reminded to check crates.” Retraining was signed off three times. The complaints kept coming back, because the fragments were not from the crates at all: they were acetal plastic chipping off a slicer guide bought from a non-approved supplier under downtime pressure. “Human error” was never the cause. It was where the investigation stopped instead of where it should have started.
The Conducting a Root Cause Analysis Course (2 days) teaches you to investigate past “human error” to the system causes an auditor will accept, R2 350, no VAT charged, about 16 hours online and self-paced, Advanced level.
Human error and root cause: the key facts
| The core problem | “Human error” is a category, not a cause; it is present on every normal shift, so it cannot explain why this one was different |
|---|---|
| The test | Substitution test: would another trained person in the same circumstances probably have done the same thing? If yes, fix the system |
| Swiss cheese model | James Reason’s model: harm gets through when holes in several imperfect defences line up; active failures sit on latent conditions laid down earlier |
| Error types | Slip, lapse, mistake (rule-based or knowledge-based) and violation (routine, situational or exceptional). Each needs a different fix |
| Just culture | David Marx’s model: human error (console, fix the system), at-risk behaviour (coach), reckless behaviour (discipline is appropriate) |
| Action strength | Every root cause needs at least one stronger or intermediate action; training may accompany it, never replace it |
| Standards | ISO 22000:2018 clauses 8.9.3 and 10.1, BRCGS Issue 9 clause 3.7.2, SQF Edition 9 clause 2.5.3, FSSC 22000 additional requirement 2.5.8 |
| South African law | R638 of 2018 (hygiene) and R607 of 2018 (compulsory HACCP for processed meat) give EHPs a direct interest in the cause |
Why does “operator error, retrain the operator” fail an audit?
Because it names a category of failure, not a cause. It does not explain why the error happened on this shift and not the thousands of others. It allows only punishment or retraining, and it is present on every process with people in it, so it cannot discriminate the affected product from the rest.
Apply the substitution test: put another trained person in the same ambiguous procedure, the same missing relief cover, the same unworkable instruction. Would they probably have done the same thing? If yes, retraining the individual will not stop the next person meeting the trap. Sidney Dekker’s Field Guide to Understanding ‘Human Error’ calls this the new view: human error is a symptom of trouble deeper in the system, where an investigation starts, never where it ends.
What is the Swiss cheese model, and why does it matter here?
Reason’s Swiss cheese model pictures each defence (engineering controls, procedures, supervision, detection) as a slice with holes that open and close as conditions change. Harm reaches the consumer only when holes in several slices line up. The person at the sharp end is the last slice; the latent conditions laid down earlier by designers, buyers and managers are usually the more dangerous ones.
Active failures are unsafe acts with an immediate effect: selecting the wrong programme, skipping a check, fitting the wrong part. Latent conditions are the standing weaknesses that made that act likely: under-staffing, a procedure copied from another line, no management-of-change process for spares, a KPI rewarding fast closure over trending. They create holes long before the shift starts and stay after the worker is retrained. Three questions do more work than “who did it?”: what made the error likely, what made it consequential, and what should have caught it.
What are the types of human error, and what actually fixes each?
Not every error is the same, and neither is the fix. James Reason’s classification splits error into slips and lapses, mistakes (the plan itself was wrong) and violations (a deliberate, usually well-intended departure from a rule). Retraining helps only with knowledge-based mistakes; it does nothing for the rest.
| Error type | What it is | What fixes it |
|---|---|---|
| Slip | Wrong action on a routine task, such as a wrong preset on a look-alike keypad | Design: forcing functions, barcode-driven selection, differentiated controls |
| Lapse | A step forgotten under load, such as missing a check while covering a break | Prompts, alarms for overdue tasks, checklists, proper relief cover |
| Rule-based mistake | A rule applied in the wrong situation, or a bad rule followed correctly | Correct the rule; use management of change |
| Knowledge-based mistake | A wrong diagnosis in an unfamiliar situation with no rule that fits | Decision aids, escalation rules, expertise. Training genuinely helps here |
| Routine violation | Corner-cutting that has become normal, such as skipping a swab with a broken reader | Repair the conditions that make the rule unworkable; ask why supervision accepted it |
| Situational violation | The rule cannot be followed as written, such as no thermometer at a receiving bay | Provide the means; rewrite the rule to match reality |
| Exceptional violation | A one-off under unusual pressure, such as raising belt speed to recover a breakdown | Address the pressure; add interlocks and a post-breakdown procedure |
Classification describes the act, never the person’s character, and it is never the end of the analysis: always ask next what made the error likely.
What is the substitution test, and how does just culture work?
The substitution test asks whether another trained, experienced person from the same work group, in the same circumstances, would probably have done the same thing. If yes, blaming the individual is pointless and the causes lie in the task, equipment or organisation. David Marx’s just culture model sorts behaviour into three bands, each with a different response.
Human error is met by consoling the person and changing the system. At-risk behaviour, a choice where the risk was not recognised or was believed justified, is met with coaching and by removing the incentive behind the short-cut. Reckless behaviour, conscious disregard of a substantial, unjustifiable risk, is where discipline is appropriate. A companion routine-violation test asks whether the rule is routinely ignored and management knows; if so, the violation belongs to the system. Just culture rejects “no harm, no foul”: the same behaviour gets the same response regardless of outcome.
Why is retraining a weak corrective action, and what actually works?
Training fixes a knowledge gap and nothing else. Most food-plant errors are not knowledge gaps. They are slips, lapses and situational violations, which training does not touch. The NIOSH hierarchy of controls and the RCA² action-strength model both rank a physical or procedural change above anything relying on a person remembering and choosing to comply.
“Retrain the operator” survives because it is cheap, fast, visible and closes the file. NIOSH ranks controls from elimination and engineering controls, which act without depending on a busy night shift remembering anything, down to administrative controls and PPE. RCA² (2015, US National Patient Safety Foundation and VA National Center for Patient Safety) grades actions the same way: stronger changes the physical system or makes the error impossible; intermediate adds an independent check; weaker relies on memory (training, memos, posters). Before training goes on a form, ask whether the person was already competent, and whether the procedure was followable with the staffing actually available. Every root cause needs at least one stronger or intermediate action; training may accompany it, never replace it.
What biases distort investigations into human failures?
The biggest obstacle to a correct root cause is often not missing data but the investigator’s own mind. People want a simple story and someone to hold responsible so the file can close. Hindsight bias, outcome bias, confirmation bias and anchoring on a senior person’s first theory all push an investigation back toward “human error” even when the evidence disagrees.
Hindsight bias makes an outcome look predictable once you know the ending; build the timeline forwards from what each person actually knew. Outcome bias judges the result, not the behaviour; investigate near misses with the same rigour as harm. Anchoring lets the first theory voiced, often by the most senior person present, set the frame; silent brainstorming before discussion breaks it. Confirmation bias then keeps the team collecting evidence for that theory alone, so require competing hypotheses tested against the facts. Sunk-cost reasoning defends a CAPA already signed off; a recurrence should trigger a fresh investigation.
Worked example: from “mislabelled allergen pack” to system causes
A chilled ready-meals line runs a soya sauce, then switches to a soya-free SKU on the same filler. QA later confirms a pack of the soya-free product contains soya carried over at changeover. The first close-out reads: “Root cause: operator error, allergen checklist step skipped. Action: operator retrained.” Here is how the investigation should have gone.
- Contain and decide disposition. Hold product made since the last confirmed clean changeover, and assess it against R146 of 2010 labelling requirements before release.
- Run the substitution test. Would another trained operator, under the same time pressure, probably have missed the same step? If changeovers are routinely rushed against a KPI, probably yes.
- Classify the act and map the slices. Skipping a known step under time pressure is closer to a lapse than a knowledge gap; a checklist silent on how allergen-contact parts are cleaned is a rule-based mistake waiting to happen. Check whether the swab is genuinely allergen-specific, and whether there is independent verification before restart.
- Apply just culture. If the step could not realistically be completed in time, this is human error, not at-risk or reckless behaviour. Console the operator; change the system.
- Grade the actions. Stronger: a dedicated allergen-free run order, or a validated changeover clean with positive verification before restart. Intermediate: an independent second check. Training can accompany these, not replace them.
- Verify. Set a verification window, changeovers monitored for the same failure, rather than closing the file the day the instruction is reissued.
Run this approach on your own last “human error” close-out during the Conducting a Root Cause Analysis Course, R2 350, no VAT charged, one running case study.
What does an auditor actually ask for?
Auditors and Environmental Health Practitioners challenge a close-out where “human error”, “negligence” or “insufficient training” is the named cause, especially where the person had already been assessed competent. They expect a record showing how the system was tested, not just who was corrected, with a named cause per layer and an action stronger than a memo.
Under ISO 22000:2018, the base standard behind FSSC 22000, clause 8.9.3 covers corrective actions at operational level and clause 10.1 at system level. BRCGS Issue 9 clause 3.7.2 expects seven elements in every record: correction, root cause, corrective action, read-across, responsibility, timescale and verification of effectiveness. SQF Edition 9 clause 2.5.3 requires documented responsibility and methods, favouring tools such as 5 Whys and fishbone over guesswork. FSSC 22000’s additional requirement 2.5.8 requires a food safety and quality culture plan, the plan that makes it safe to report a near miss instead of hiding it.
For a South African ready-to-eat or processed-meat site, R638 of 2018 gives the EHP an interest in the hygiene conditions behind a deviation, and R607 of 2018, compulsory HACCP for processed meat, gives CCP deviation causes a regulatory audience beyond the certification body. None of these frameworks asks you to discipline the person responsible; doing so works against determining the cause, because people stop telling you what happened.
Frequently asked questions
Is “human error” ever an acceptable root cause on a CAPA form?
No. It describes a category of failure, not a cause, and auditors treat it as a predictable finding. Use it as the prompt for the next question, never as the answer.
Does just culture mean nobody is ever disciplined?
No. It separates honest error and at-risk behaviour, met with system change and coaching, from reckless behaviour, where discipline is appropriate. The substitution test decides which band applies.
Why do auditors reject “retraining” as a corrective action?
Because training only fixes a knowledge gap, and most food-plant errors are slips, lapses and situational violations that training does not touch.
Does the Swiss cheese model replace a why-tree or fishbone diagram?
No. It is a way of thinking about defences and where they failed; a why-tree or fishbone traces a specific chain of causes back through those defences to a verifiable root cause.
Where can I read more on reporting near misses?
See Near-Miss Reporting: Getting Food Handlers to Speak Up for how just culture becomes a working reporting system, and Corrective Action and Root Cause Analysis for Audit Findings for how records hold up at close-out.
Investigate the system, not just the person
If your CAPA form still lets “human error” or “retraining” close a file, the next complaint is a matter of time. The Conducting a Root Cause Analysis Course (2 days) works through the Swiss cheese model, error classification, just culture and action strength on one running case study.
- R2 350, no VAT charged, about 16 hours, self-paced, Advanced level
- 12 modules built around one running case study, Highveld Fine Foods, a recurring foreign-body complaint at a ready-to-eat meat plant
- Interactive activities and practical exercises in every module, with model answers
- An online final assessment: 50 questions, 70% to pass, three attempts
- Certificate of Completion from ASC
- ASC is a FoodBev SETA accredited training provider (587/00337/1900)
Want to compare these methods to other RCA tools first? Read Root Cause Analysis Tools Compared: 5 Whys, Fishbone, Fault Tree, 8D and FMEA, or start with the RCA training hub. Prefer a shorter entry point? See the RCA Overview course (R649) or the 1-Day RCA course (R1 250). Browse all courses, or contact ASC, teams of five or more, get in touch.