Extracts from How Complex Systems Fail  by Richard I. Cook:

[it is] impossible for [complex systems] to run without multiple flaws being present. Because these are individually insufficient to cause failure they are regarded as minor factors during operations …  complex systems run as broken systems. 

Organizations are ambiguous … [and that] ambiguity is resolved by actions of practitioners at the sharp end of the system.

Safety is an emergent property of systems …  continuous systemic change insures that hazard and its management are constantly changing.

… all practitioner actions are actually gambles, that is, acts that take place in the
face of uncertain outcomes … after accidents … post hoc analysis regards these gambles as poor ones. But … successful outcomes are also the result of gambles …

Image: https://flic.kr/p/7TxmXk