Residual Capacity, Governance, and the Second Event | Part 3 of 3

This is the third and final article in a three-part Forge Journal series exploring vulnerability in safety risk management. The first article introduced vulnerability as a missing dimension in safety. The second explored how controls and paperwork can create false comfort. This final article turns to what remains after failure begins: residual exposure, leadership accountability, and the wider consequences that can follow a serious event.

In the first article in this series, I argued that vulnerability helps explain why the same hazard can produce very different outcomes. In the second, I explored how controls, paperwork, and risk assessments can create false comfort when safeguard strength is assumed rather than tested. But vulnerability does not disappear simply because a system appears strong, or even because a court later accepts that it was.

Strong Systems Are Not Immunity

Vulnerability cannot be reduced simply to poor systems or weak documentation. Sometimes the opposite kind of case appears: situations where a court accepts that a company’s systems were robust, appropriate, and in some respects ahead of legislative requirements, yet the organisation is still prosecuted, convicted, and sentenced.

In at least one such prosecution, liability did not arise from any broad failure in policy, procedure, training framework, or emergency design. On the contrary, the court accepted that the company’s systems for managing the relevant risk were strong. Conviction followed because a senior employee, acting within the scope of his work, made a series of unreasonable decisions, and those acts were legally attributable to the company. What reduced sentence was not the absence of liability, but the court’s acceptance that the systems were robust, that the business had tried to stand ahead of minimum requirements, that it was not complicit in the unreasonable decisions, and that the conduct appeared to be a one-off aberration rather than evidence of deeper organisational failure.

This is an important counterpoint, because it shows that vulnerability is not always located in an obviously weak system. Residual exposure may still sit in human judgement at the edge of operations, in the limits of direct supervision, and in the legal reality that a PCBU may remain liable for unreasonable acts or omissions carried out on its behalf by those acting within their authority. Strong systems matter greatly. They may reduce exposure, improve response, and mitigate sentence. But they do not eliminate vulnerability entirely.

That is a difficult truth for leaders, but an important one. Safety maturity is not the same as immunity from harm, prosecution, or attribution. Even robust systems can still be tested by the decisions of individuals operating in live, time-sensitive conditions.

After Failure Begins: HMS Thetis and USS Squalus

Vulnerability is not only about what starts an event. It is also about what remains possible once failure begins.

A powerful illustration of that point is found in the sinking of HMS Thetis in 1939. During sea trials, the inner door of a torpedo tube was opened while the outer door to the sea was also open. A small amount of paint had blocked a test cock used to confirm whether the tube was flooded, contributing to a false indication. Water entered the submarine, flooding the forward compartments and causing it to sink.

AI-generated artistic interpretation of HMS Thetis, 1939.]

The example matters because the initiating failure, grave though it was, was not instantly unsurvivable. Air remained in the rear compartments. Rescue was possible in principle. Men survived the flooding. But rescue depended on signalling the surface, managing the atmosphere inside the vessel, making sound decisions under severe stress, and external responders understanding the situation rapidly enough to act effectively. Carbon dioxide rose. Time narrowed. Options diminished.

Of the 103 men on board, 99 died.

What makes Thetis particularly instructive is the contrast with USS Squalus, which had sunk only a week earlier. In that case, crew were successfully rescued. One of the important differences was not simply the initiating failure, but the condition in which the submarine came to rest. Squalus settled on an even keel, allowing a diving chamber to be used. Thetis came to rest at a severe angle, which made that method impracticable.

That distinction is critical. Vulnerability is not only about what causes the initial event. It is also about what remains possible once the event has begun. It concerns the residual capacity left within the system after failure. Can the system stabilise? Can rescue reach it? Can people communicate? Can they breathe? Can emergency plans still function? Can failure be contained, or does it rapidly become catastrophic?

Two similar events can produce very different outcomes because vulnerability and capacity are different.

This has direct relevance to safety. A fall may be survivable or fatal depending on arrest systems, rescue readiness, communication, suspension trauma management, and access. A vehicle rollover may be survivable or catastrophic depending on restraint, terrain, speed, isolation, and retrieval capability. A hazardous atmosphere may be escaped or become fatal depending on detection, alarms, procedural discipline, rescue planning, and the realism of emergency arrangements. A control failure is never the whole story. The condition of the system after failure begins is often what determines the magnitude of harm.

The Second Event: Financial Vulnerability

There is another dimension of vulnerability that is rarely discussed in safety, yet it matters deeply, particularly for business owners and smaller enterprises. That is financial vulnerability after an incident.

In one industry sample we reviewed, the average fine endpoint after discounts following a health and safety prosecution was approximately $388,000. For a business operating on a 5% profit margin, that equates to approximately $7.7 million in revenue required simply to recover the cost of the fine. Put another way, the business would need to generate revenue equivalent to about twenty times the fine just to return to where it started. That is not a minor commercial inconvenience. It is a second event.

More concerning still, our review of prosecutions within that sample showed that approximately 38% of defendants advanced evidence of financial incapacity or were unable to meet the fine that would otherwise have followed. Around 17% of companies were recorded in the case material as being in liquidation, or moving into liquidation, during the prosecution process.

The first event is physical, human, and operational. The second is legal, financial, emotional, and organisational. Investigation begins. Lawyers are engaged. Time passes. Projects are disrupted. Relationships strain. Insurers become involved. Directors experience prolonged uncertainty. Operational confidence may falter. Reputation can suffer. The prosecution timeline may run for years rather than months.

These patterns matter because vulnerability does not end with the moment of injury. It propagates. A company already operating with tight margins may have very little capacity to absorb prosecution costs, interruption, delay, and stress over a long period. Suppliers may be affected. Workers may leave. Maintenance and investment may be deferred. Pressure may spread into the wider market. In that sense, vulnerability can move beyond the incident itself and into the economic life of the business and the sector around it.

For many owners, this is not abstract. A business may represent years of personal risk, long hours, financial trade-offs, family sacrifice, and the dream of creating independence, security, and a better future through successful ownership. A serious event therefore does not simply create statutory consequences. It can destabilise the economic and emotional foundation of the enterprise itself, and threaten the very future the business was meant to secure.

That too belongs in the vulnerability conversation.

Different Questions for Leaders

For leaders, introducing vulnerability into safety changes the nature of the questions that need to be asked.

• Have we identified the hazard?

• Have we completed a risk assessment?

• Do we have procedures?

• Have we trained people?

But rather:

• Where are we most exposed?

• Which hazards involve the greatest transfer of harmful energy and the least margin for error?

• What controls are we relying on most heavily, and how strong are they in practice?

• How much variation, pressure, or change can this system tolerate before vulnerability increases?

• If we add, remove, stretch, or relocate something — plant, people, contractors, supervision, or production demand — what happens to capacity?

• How would we know the system was drifting or operating close to its limits?

• If a key control failed tomorrow, could we still contain the event, rescue effectively, and recover?

Those questions shift due diligence away from paperwork alone and towards verification, integrity, system condition, and tolerance. They move leadership from asking whether a system exists to asking whether it remains trustworthy under pressure, variation, and change.

This is particularly important because many of the most serious events do not arise in areas of complete ignorance. They arise in areas the organisation believed it understood. That is why vulnerability matters so much. It challenges assumption. It reveals overconfidence. It distinguishes between stated protection and real protection.

The task for leadership is therefore not to eliminate all vulnerability. No complex system can do that. The task is to understand vulnerability more truthfully, especially where hazardous energy, exposure, and consequence converge. It is to know where capacity is strong, where it is thin, where it is being eroded, where tolerances are narrowing, and where administrative confidence may be outrunning operational reality.

What Would a Stronger Approach Look Like?

If vulnerability is a missing dimension in safety risk management, what would a stronger approach look like?

It would begin by recognising that hazards, controls, and residual scores are not enough on their own. It would examine the susceptibility of what is exposed to harm, the strength and integrity of barriers, the degree of behavioural dependence within the system, the effect of pressure and drift, and the real capacity available if prevention fails.

It would distinguish more clearly between controls that prevent energy transfer and controls that merely influence behaviour around the hazard.

It would treat verification as a central discipline rather than an administrative afterthought.

It would pay closer attention to degradation, fatigue, maintenance, substitutions, adaptations, contractor realities, and the gap between what is documented and what is reliably done.

It would challenge the comfort created by long control lists and low residual scores where those ratings are based on assumption rather than demonstrated performance.

It would also accept that vulnerability exists at multiple levels: within people, within plant, within interfaces, within contractor arrangements, within emergency systems, and within the commercial resilience of the organisation itself.

Most importantly, it would accept that safety is not strengthened by optimism. It is strengthened by accuracy.

Serious harm events rarely occur because a hazard was completely unknown. More often, they occur because vulnerability existed within the system and was not fully understood, not fully respected, or not truthfully seen. Controls were assumed to be stronger than they were. Capacity was assumed to be greater than it was. The organisation believed the system would hold. Then reality tested it.

That is why vulnerability deserves far greater attention in safety.

It helps explain why two organisations facing similar hazards can experience very different outcomes. It helps explain why extensive documentation can coexist with serious failure. It helps explain why a green box on a risk register may conceal fragile assumptions. It helps explain why the condition of the system after failure begins can determine whether an event remains survivable or becomes catastrophic. It even helps explain why an organisation with robust systems may still be exposed through the unreasonable decisions of those acting on its behalf, and why legal liability can remain even where broader system strength is judicially recognised.

Most of all, it moves the conversation from administrative comfort to practical truth.

The question is not simply whether hazards exist. Every meaningful operation contains hazard.

The deeper question is this:

How vulnerable are we to the hazards we already know about, and what real capacity do we have when our controls are tested?

That, perhaps, is the missing dimension in safety risk management.

Read the complete Forge Journal series:

The Missing Dimension in Safety Risk Management | Part 1 of 3

When Controls Create False Comfort | Part 2 of 3

Author Note

Perennia Forge is a New Zealand risk advisory business focused on hazard and vulnerability intelligence, critical risk, and practical judgement about whether safeguards are likely to remain trustworthy when conditions tighten and consequences are real.

References

United Kingdom Parliament. (1939, 5 June). Loss of His Majesty’s Ship “Thetis”. Hansard.

Royal Museums Greenwich. (n.d.). HMS Thetis (1938): Warship; T-Class submarine.

La VO, C. (1988, April). The short life of the Squalus. Naval History.