How confidential reporting helps build a mature safety culture

Reviewing its benefits against the ORR’s Risk Management Maturity Model shows CIRAS can help your organisation to reach its next level of safety culture and evidence this.

This blog is based on a presentation by Sue Gray, a stakeholder manager for CIRAS.

First, what do we mean by safety culture? 

Culture is, put simply, ‘the way we do things around here’. A company’s culture starts with its leadership, but it is the sum of everything an organisation and its employees do and how they do it. It’s the shared norms, values, attitudes, beliefs, and practices woven through an organisation. Although it might be revealed through the narratives a company tells, it is often not explicitly stated and can be hard to define – even, sometimes, being at odds with what the company says about itself.

The Health and Safety Executive (HSE) defines safety culture as ‘a product of individual and group values, attitudes, perceptions, competencies and patterns of behaviour that determine the commitment to, and the style and proficiency of, an organisation’s health and safety management.’

Personal experiences shape this culture, from the training and information employees receive and how it is delivered, to the way managers and colleagues talk about safety and respond to ideas, concerns and questions. Psychological safety is central, with people feeling safe to raise concerns, challenge, and importantly being heard.

A company’s safety culture doesn’t happen by accident. It’s a deliberate strategy teamed with action, encouragement, and the belief that it’s the right thing to do.

Both Safety I and Safety II approaches are needed in a mature safety culture, as described below.

Safety I is traditionally seen as more reactive. It’s about compliance. It’s about having targets and using data. It’s about having prescriptive procedures.

Safety II is different. It’s more proactive, it’s about understanding work as it’s actually done, not just work as prescribed. Variability exists. Work may be prescribed a certain way, but the context in which something is being done, the individuals concerned, all bring variability, and this isn’t necessarily a bad thing. It’s seen as a more consultative process, which is about trust and engaging with colleagues.

The Safety Differently philosophy (Safety II) challenges organisations to think differently about the way they define safety, the role of people, and their business’ focus. Starting with professor, author, and pilot Sidney Dekker in 2012, creator of the Safety Science Innovation Lab that also introduced Restorative Just Culture, Safety Differently sees people as the solution, not the issue – using their skills, competencies and knowledge to help build a safer workplace. The emphasis is on creating an environment that promotes safety through working conditions, company culture, and what’s going right.

Both Safety I and Safety II matter. It’s not a case of one or the other. Every organisation has a safety culture and this will be on a continuum, with a mix of the different characteristics.

Why does safety culture matter?

An effective safety culture has an impact in many ways. Employees’ perception of safety culture could be a barrier to them raising concerns or, if positive, may encourage them.

Here are some of the reasons why a good safety culture matters:

Risk Management Maturity Model

There are different ways you can evaluate a safety culture. One suggestion is the Risk Management Maturity Model (RM3) from the Office of Rail and Road (ORR). It helps to manage health and safety risks by providing a range of criteria that you can assess your safety performance against. It can give you an idea of where you are, where you can improve, and give you a way of tracking your performance over time.

There’s a huge number of criteria within RM3’s five categories, some of which will be more relevant to individual organisations than others. The one overarching criteria, which is the orange band around the RM3 wheel, is organisational culture. This has a strong influence on all the criteria.

Where does CIRAS confidential safety hotline fit into safety culture and the RM3?

CIRAS, as the transport industry’s confidential safety hotline, is here to improve health, safety and wellbeing of staff, passengers, and visitors across transport. We do that by listening to people who come to us with their safety concerns. We share this safety intelligence confidentially with the relevant company in a report, with all identities protected.

How might CIRAS, and using CIRAS, help organisations to achieve positive scores on the RM3 criteria? Here we share our suggestions on how CIRAS could be relevant to a range of RM3 criteria*. The ORR has also expressed its view that CIRAS is an enabler to many of the criteria**.

Criteria	How CIRAS may help
SP1 Leadership openness	Listen to all voices inclusively, including those who find it hard to speak up.
SP3 Board governance	CIRAS data adds to the wider picture of independent oversight.
OC2 Management accountability	Encourage managers to embrace confidential reports as insights not failures.
OC4 Internal communications	Offer multiple reporting channels and share stories of safety improvements to build trust.
OC5 System safety and interface	Make supply chain aware of CIRAS. Encourage flow of insights across organisational boundaries.
OC6 Organisational culture	CIRAS collects safety culture data which can reveal staff perceptions of openness and fear.
OP1 Worker involvement	Genuinely listening to your confidential channels empowers broader staff engagement and supports idea generation.
P13 Work planning	CIRAS reports on workload issues, e.g. fatigue and stress, and can provide useful insights.
RCS2 Asset management	Concerns raised by equipment users can inform asset monitoring.
RCS4 Control of contractors and suppliers	Confidential reports can cross organisational interfaces, which could make it easier to hear from your suppliers.
MRA1 Proactive monitoring	Data from CIRAS can help compare other monitoring systems with employee feedback.
MRA5 Corrective action	Look at other CIRAS reports to learn from corrective action taken by others.

Where safety leaders welcome intelligence about work as done, including from confidential reporting, that’s seen as a positive form of proactive monitoring, which is one of the criteria. It’s about learning how things are being done, rather than how they are planned.

Offering multiple reporting channels, including CIRAS, captures a range of safety insights. CIRAS reports tend to be about what could potentially lead to an incident or what could become an issue later.

During times of change, listening to people is important, but employees may be less likely to use conventional reporting channels as a result of uncertainty. Change can have unanticipated consequences, too, and CIRAS is one way people can report these.

If concerns are being raised internally, then that’s great. It’s the quickest way to be heard. CIRAS is there to help capture the concerns that are otherwise going unreported. We also take concerns from people for organisations they don’t work for, such as another contractor, supplier, a client, or site owner. In some of these situations, people may be reluctant to raise concerns with the companies directly in case of repercussions. In this way, CIRAS helps to support collaboration, which is another of the RM3 criteria.

CIRAS provides the ability to learn from risks and reports raised for other companies and transport sectors, so members can apply the learning in other contexts relevant to them. There are also data insights from our reports, which we share with members to facilitate learning. Every year, we share our aggregated annual reporting data, including whether frontline staff feel heard and what they think about the safety culture within their organisation.

From an assurance perspective, CIRAS can help you see whether your targets have impacted on your reporting culture. 

If you get a CIRAS report, it’s a success. You’re gaining insight and you have an opportunity to do something about it.

Next steps

1. Review your use of CIRAS: could you be missing opportunities?

2. Contact us: CIRAS’ stakeholder managers can support you.

3. Use the resources on our website.

*RM3 is owned by ORR. These are CIRAS’ suggestions and not endorsed by ORR. CIRAS does not formally evaluate organisations against the RM3 model.

** Risk Management Maturity Model (RM3) 2019 Annex 1.

Find out more

RM3 Risk Management Maturity Model [ORR, includes e-learning]

Safety Differently and Just Culture [Sidney Dekker]

Psychological safety in practice: when companies work in partnership

Tram Operations Ltd: building a Just Culture

Why don’t people report their concerns?

Why kindness and psychological safety may be the foundation of good teams

To speak up we need psychological safety