On Blame & Broken Systems
ANNOTATED
The printed text is the standard account of accountability — how organisations are supposed to find and fix what went wrong. The handwriting is what it looks like when they don't: when a company facing a broken system goes looking for a broken person instead. I've watched this from both sides of the desk. This chapter is about telling the two apart.
The Nature of Accountability
The textbook is clear that accountability and blame are not the same thing, even though the words are often used interchangeably. Accountability asks a forward-looking question — what needs to change so this does not happen again? Blame asks a backward-looking one — whose fault was this? The first produces a better system. The second produces a culprit. An organisation can have a great deal of one and almost none of the other.
Healthy accountability rests on a specific belief about failure: that in a well-run organisation, most bad outcomes are produced by the system, not by the moral character of the people inside it. A missed deadline usually reflects an unrealistic plan, an unclear owner, or a dependency no one tracked — not laziness. A quality defect usually reflects a process that permitted the defect, not a worker who wanted to produce one. This is not a soft or forgiving view. It is simply the more accurate one, and accuracy is what lets you fix things.
The discipline that formalised this is root-cause analysis: the insistent habit of asking why enough times that you pass through the person who touched the failure and arrive at the condition that made the failure possible. The person is where the failure became visible. The system is where it was made.
Commercial aviation is the safest complex system humans have ever built, and it got that way by doing the exact opposite of what instinct suggests. When something goes wrong, the investigation is deliberately blameless: pilots and crew can report errors, even their own, without punishment, because the goal is to find the systemic hole — the confusing checklist, the badly-designed alarm, the fatigue-inducing schedule — that would eventually catch a different, equally competent crew. The insight: punishing the individual would only teach everyone else to hide the next error, and hidden errors are the ones that kill people. Safety came from refusing to hunt.
I've now watched the other version twice. Early in my technology years, I saw a senior leader — the most capable technical mind in the building — walked out the door when a product stumbled, as though one person's removal could fix what was plainly a whole-company problem. And far more recently, I sat on the receiving end of it myself: steadily handed the blame for things going wrong across a business, whether I had touched them or not, until leaving felt like my own idea. Both times the system that actually produced the trouble stayed exactly where it was. — A.P.
Accountability removes the fault. Blame removes a name and keeps the fault. Only one of them prevents the next failure.
The Appeal of the Culprit
Blame is fast, cheap, and satisfying, and systemic change is none of those things. When something goes badly wrong, an organisation is under pressure to demonstrate that it has responded. Rebuilding a broken process is slow, expensive, and admits that the problem was structural — which implicates the people who built the structure, often the very people demanding a response. Naming a culprit, by contrast, can be done by Friday. It produces the appearance of resolution without the cost of change, and it locates the fault safely outside the leadership that would otherwise have to look in the mirror.
There is a well-documented cognitive bias underneath this, which the textbook calls the fundamental attribution error: the human tendency to explain other people's failures by their character, and our own failures by our circumstances. When you miss a deadline, it was because the brief kept changing. When someone else misses one, it was because they are disorganised. Organisations institutionalise this bias. A bad outcome gets attributed to the flawed individual, because that story is simpler and more emotionally satisfying than the true story, which is usually a diffuse, unglamorous mess of structural causes with no single villain in it.
Blame also serves a darker organisational function: it manufactures a reason to remove someone the organisation already wanted to remove. Here the sequence runs backwards. Rather than a failure leading to the search for a cause, a pre-existing desire to be rid of a person leads to the search for a failure to pin on them. Any failure will do, and in a complex business there is always one available. This is the mechanism by which "your role isn't working out" gets dressed up as "look at everything that went wrong on your watch."
The term is literal. In the ancient ritual, a community would symbolically load its collective sins onto a single goat and drive it into the wilderness, and having done so, feel cleansed — though of course nothing about the community had actually changed. The mechanism survives intact in modern organisations because it does the same psychological work: it discharges a group's anxiety about a systemic failure by concentrating it into one expelled individual. The catch is the same too: the ritual makes everyone feel better and fixes nothing, because the goat was never the cause.
The tell, both times I saw it, was that the "evidence" was assembled after the decision, not before. A healthy investigation gathers facts and then reaches a conclusion. What I watched — and later experienced — ran the other way: the conclusion came first (this person goes), and then the reasons were collected to justify it. Once you've felt that reversal, you never mistake it for accountability again. Accountability is curious about what happened. A hunt already knows the answer and is shopping for a reason. — A.P.
Blame is chosen for convenience, not accuracy. When the cause of a systemic failure fits neatly onto one removable person, treat the neatness as a warning, not a relief.
The Price of the Hunt
The textbook catalogues the second-order costs of a blame culture, and they are severe. The first is the disappearance of information. In an organisation where mistakes are punished by expulsion rather than examined for cause, people stop surfacing mistakes. Problems get hidden until they are too large to hide, at which point they are far more expensive to fix. The blameless aviation post-mortem exists precisely because the alternative — punishment — teaches everyone to conceal exactly the information the organisation most needs.
The second cost is the flight of the capable. The people most able to leave a toxic environment are precisely the ones with options — the strong performers, the ones other organisations want. When a company demonstrates that competence offers no protection, that a good record can be overwritten by a convenient narrative, its best people update their view of the risk and begin to leave. The organisation is left with those who could not leave, which is rarely the group it would have chosen to keep. A hunt does not just remove its target. It quietly informs everyone watching, and the watchers with options act on it.
The third and most insidious cost is that the actual problem survives. This is the point that ties the chapter together. Because the blame was a substitute for diagnosis, the systemic fault that produced the original failure is never addressed. The organisation has spent its energy, damaged its culture, and lost a person — and the broken system that started the whole thing sits exactly where it was, waiting to produce the same failure again, at which point a new culprit will be required. A blame culture is therefore not a one-time injustice but a recurring one, structurally guaranteed to repeat, because it never once touches the thing that is actually wrong.
When the account-fraud scandal surfaced, the initial response reached for the lowest-level people — thousands of branch employees were dismissed for opening fake accounts. But the accounts existed because of a sales-quota system, designed and rewarded from far above the branch, that made the fraud the rational way to keep one's job. Firing the branch staff removed the people where the fraud became visible and left the system that manufactured it fully intact. Predictably, the reckoning only deepened once it became clear the fault was structural — exactly the diagnosis the early blame had been deployed to avoid.
Here is the part that should reassure anyone going through it: the hunt is a confession of weakness, not strength. An organisation confident in its own systems doesn't need a scapegoat — it can afford to look honestly at what broke, because the answer doesn't threaten it. Reaching for a person to blame is what an organisation does when it can't afford the real answer. Understanding that doesn't make being the target pleasant. But it does reframe it: what's on display is the organisation's fragility, not your failure. — A.P.
The hunt costs three things the organisation can't see it losing: the truth (mistakes go into hiding), its best people (competence stops feeling safe), and the fix itself (the real fault survives to strike again).
The Diagnosis, and What to Do
The distinguishing tests are not about the language used but about the direction of the process. Genuine accountability moves from evidence to conclusion: it gathers what happened, traces the causes, and only then decides what must change and who owns the change. A hunt moves from conclusion to evidence: the outcome — this person's removal — is fixed in advance, and the process exists to manufacture its justification. If the verdict is known before the investigation, it is not an investigation.
A second test is scope. Genuine accountability is proportionate and specific: it identifies a particular decision, a particular gap, a particular owner, and a particular change. A hunt is expansive and vague: it attaches a diffuse, ever-growing cloud of fault to a person — everything that went wrong becomes, somehow, connected to them, whether or not they were near it. When the charge sheet keeps growing and generalising rather than sharpening to specifics, the process is building a case against a person, not diagnosing a failure in a system.
For the organisation, the prescription follows directly from the diagnosis: when a serious failure occurs, discipline yourself to complete the root-cause analysis before discussing individuals at all. Ask what conditions made the failure possible, and whether a different but equally competent person in the same seat, under the same system, would have produced the same result. If the answer is yes, the fault is in the seat, not the person — and removing the person is not a fix, it is a way of avoiding one. Fix the seat.
For the individual on the receiving end, the guidance is narrower but no less important. Recognise the reversal early — the conclusion-first process — because recognising it is what lets you stop absorbing blame that was never really about your performance. Keep your own record of what actually happened, in specifics, since specifics are the natural enemy of a vague and expanding charge. Protect your reputation and your evidence, because the hunt will not do it for you. And understand that leaving an organisation that has decided to hunt you is not a defeat; it is an accurate reading of a system that has told you what it is. Staying to win an argument against a predetermined conclusion is effort spent on the one problem you cannot solve — because it was never really a question.
On the Toyota production line, any worker can pull a cord to halt production the moment they see a defect — and the culture treats that pull as a service to the system, not an admission of personal failure. The genius is that it makes surfacing a problem safe, so problems surface early, get traced to their cause, and get engineered out. It is the precise inverse of the witch hunt: instead of punishing the person where a fault appears, it thanks them, and then it fixes the fault. The result is the same one this whole chapter points at: the system that treats failure as information, not sin, is the system that actually gets better.
If this manual has one throughline, it's the Six Sigma reflex to blame the process before the person — and this chapter is that reflex applied to the most human situation it touches. I've been the observer and I've been the target. What I know now that I didn't then: the organisations worth building, and worth staying in, are the ones curious enough to ask what broke rather than who to expel. The rest tell you what they are. Believe them the first time, keep your record clean, and go build somewhere the question is honest. — A.P.
Accountability runs from evidence to conclusion and grows more specific; a hunt runs from conclusion to evidence and grows more vague. Fix the seat, not the person — and if the seat won't be fixed, read the system accurately and leave with your head level.