Defense in Depth: Because Hope Isn’t a Safeguard

Let’s talk about an important concept in preventing incidents: Defense in Depth.

You may also know it as Barrier Analysis or LOPA (Layer of Protection Analysis)—but in the TapRooT® System, we call these Safeguards. Each Safeguard is a layer of protection designed to stop a hazard from becoming an incident.

Take a look at this diagram (courtesy of TapRooT® RCA creator Mark Paradies). It shows how incidents happen when multiple safeguards fail.

You might recognize the resemblance to James Reason’s Swiss Cheese Model: every layer has “holes,” but incidents occur only when the holes line up.

That’s why we focus on two things:

1. Do we have enough layers?

2. Are those layers working as intended?

Every safeguard has limitations, so the goal is to minimize the holes and build redundancy that prevents single points of failure.

We can also apply this to corrective actions:

• Should we add more safeguards?

• Can we strengthen the ones we already have?

The concept is straightforward. What’s challenging is deciding what’s “enough.” Risk is the main driver, but business realities matter too.

Let’s walk through it:

• The task is easy, the risk is low. Keep safeguards simple when the risk is low and the potential consequences are not severe, but monitor the task.
• The task is easy, and the risk is high: Deceptively dangerous! It feels safe because it’s simple. But if that simple task goes wrong, the consequence is severe. These situations often get underestimated, requiring careful judgment about what safeguards are needed.
• The task is difficult, and the risk is low. Since the risk is low (and potential consequences are not severe), you might not need expensive or engineered safeguards. Written procedures and training might be good enough. These are quasi-safeguards because they rely on human behavior and aren’t foolproof.
• The task is difficult, and the risk is high: You need multiple robust safeguards when the risk is high for a mistake with potential severe consequences. Remove or reduce the hazard, remove or guard the target, or create engineering controls (automated or built-in protections that don’t rely on people remembering or choosing the right thing).

You can create defense in depth proactively or reactively. Proactively, audit your existing layers to make sure they’re functioning. After an incident, think in terms of safeguard performance, not just what went wrong, but what failed to protect.

Want to build stronger systems? Join our 5-Day TapRooT® Advanced Root Cause Analysis Team Leader Training. Learn advanced tools like Safeguards Analysis, Change Analysis, CHAP, and how to use TapRooT® RCA for audits.

Don’t rely on hope! Keep those layers strong.