Swiss cheese model

James Reason's model pictures an organisation's defences as slices of Swiss cheese standing between hazard and loss. No slice is solid: active failures and latent conditions put holes in every one, and the holes move. An accident is not one failure but an alignment — a trajectory that finds a hole in every slice at once.

Its enduring lesson is that single-barrier confidence is misplaced. Any one defence will fail sometimes; safety comes from independent layers whose holes rarely align, and from actively hunting the latent conditions — the deferred maintenance, the normalised workaround, the training gap — that quietly widen holes across many slices at once.

The bowtie is the Swiss cheese model made operational. Slices become named barriers on specific threat and consequence lines; holes become degradation factors with controls of their own; and the model stops being a metaphor and becomes a register someone can verify. If you have ever explained Reason's diagram to a board, a bowtie is the version they can act on.

Reason's caution travels with it: the picture is static but the holes are not. A bowtie kept in a slide deck decays exactly the way the cheese predicts — which is the argument for keeping it connected to live effectiveness ratings and verification evidence.