The Five Principles of HOP Explained

They sound simple. Applying them is not. The value of the five principles is not in memorizing them.

It is in using them to change how we:

• design work,
• respond to mistakes,
• investigate events,
• manage controls,
• talk with employees,
• make operational decisions, and
• learn from everyday work.

Let's look at what each principle means—and what it changes in practice.

Where Did the Five HOP Principles Come From?

The five principles in this form are commonly associated with modern HOP practice and the work of Dr. Todd Conklin. They are not OSHA regulations. They are not an ISO standard. They should not be treated as five mandatory requirements for becoming a “HOP organization.”

The ideas also have deeper roots. Human factors, resilience engineering, systems thinking, organizational learning and Human Performance Improvement all contributed to the development of modern HOP thinking.

For example, the U.S. Department of Energy's Human Performance Improvement framework identifies principles including:

• people are fallible,
• error-likely situations can be predicted and managed,
• individual behavior is influenced by organizational processes and values,
• people achieve high performance through encouragement and reinforcement, and
• events can be avoided through understanding and learning.

The modern five-principle HOP framework provides a practical way to carry many of these ideas into everyday operations.

Principle 1: Error Is Normal

Everyone makes mistakes. That statement sounds obvious.

But many safety systems are still designed as if mistakes can be eliminated primarily through:

• training,
• procedures,
• rules,
• reminders, and
• discipline.

Those tools have value. They do not eliminate human fallibility.

A highly experienced employee can:

• miss a step,
• misunderstand information,
• select the wrong control,
• forget something,
• become distracted,
• misread a display, or
• make an incorrect assumption.

So can a supervisor. So can an engineer. So can an executive.

The HOP principle Error is Normal asks us to design work with that reality in mind.

What Error Is Normal Does Not Mean

It does not mean:

Errors are acceptable.

It does not mean:

Standards do not matter.

It does not mean:

People should not be accountable.

And it certainly does not mean:

There is nothing we can do about mistakes.

It means:

Human perfection is not a reliable control.

That changes how we think about risk.

Design for Prevention, Detection and Recovery

Suppose an employee enters the wrong value into a control system.

You could simply say:

“Employees must enter the correct value.”

That is true. But it is not much of a control strategy.

A stronger system asks:

Can we prevent the error?

Can the interface make incorrect entry more difficult?

Can we detect the error?

Can the system flag a value outside an expected range?

Can we recover?

Can the employee correct the mistake before harm occurs?

Can we reduce the consequence?

If the error reaches the process, are there independent controls that prevent a serious outcome?

That is what designing for human fallibility looks like.

Ask This Question

When reviewing important work, ask:

“What happens if a good employee makes an ordinary mistake here?”

If the answer is:

“Someone could die.”

you probably need a stronger control strategy than telling people not to make mistakes.

Principle 2: Blame Fixes Nothing

This may be the most controversial HOP principle. It is also one of the most misunderstood. Imagine an employee makes a mistake and equipment is damaged.

The investigation concludes:

Employee failed to follow procedure.

The employee is disciplined. Case closed.

Did the organization learn why the procedure was not followed?

Maybe not.

Did it learn whether other employees perform the work the same way?

Maybe not.

Did it examine whether the procedure matches the equipment?

Maybe not.

Did it evaluate the controls?

Maybe not.

Did it discover whether supervisors knew about the practice?

Maybe not. Blame may identify someone associated with the outcome. It does not automatically explain the outcome.

Blame Is Not the Same as Accountability

HOP does not require eliminating accountability.

There are meaningful differences between:

• an unintended error,
• a misunderstanding,
• a routine adaptation,
• an at-risk decision,
• an intentional violation,
• reckless behavior, and
• deliberate harmful conduct.

Those differences matter. But an organization should understand the context before deciding how to respond. Accountability informed by evidence is stronger than accountability driven primarily by outcome severity.

Outcome Severity Can Distort Judgment

Consider two employees who make the same mistake. Employee A makes the mistake and nothing happens. Employee B makes the same mistake and someone is seriously injured. Organizations may react very differently. But if the behavior and surrounding conditions were essentially the same, the difference may have been the outcome—not the quality of the decision.

This is one reason investigations should examine more than consequences.

Ask:

“How would we evaluate this decision if the bad outcome had not occurred?”

That question can expose hindsight and outcome bias.

What Leaders Should Do Differently

Before asking:

“Who is responsible?”

ask:

“What happened?”

Then:

“What conditions influenced what happened?”

Then:

“How is this work normally performed?”

Then:

“What controls were supposed to prevent this outcome?”

Accountability decisions can still follow. But now they are informed by a better understanding of the event.

Principle 3: Context Drives Behavior

People make decisions inside situations. Those situations matter. Imagine a technician skips a required step. The procedure clearly says the step must be completed.

From the investigation room, the answer seems easy:

The technician violated the procedure.

Now go see the work.

You discover:

• the step requires equipment that is frequently unavailable,
• the procedure was written for an older machine,
• the workaround is commonly used,
• supervisors have observed it,
• the workaround usually succeeds,
• the official method adds significant time, and
• production planning assumes the shorter duration.

The technician's action now looks different. That does not automatically make it correct. It makes it understandable. And understanding gives the organization something it can improve.

Context Is More Than Production Pressure

When people hear “context,” they sometimes think only about rushing. Context is much broader.

It can include:

• equipment design,
• weather,
• lighting,
• noise,
• staffing,
• fatigue,
• training,
• procedures,
• tool availability,
• customer expectations,
• supervision,
• experience,
• workload,
• communication,
• incentives,
• previous success,
• physical layout,
• competing priorities, and
• organizational culture.

Behavior occurs inside all of these conditions.

Behavior Often Makes Sense Locally

A decision that looks irrational afterward may have looked completely reasonable beforehand. That is because the employee did not know the outcome.

They had:

• incomplete information,
• limited time,
• competing demands,
• previous experience, and
• expectations about what would happen next.

The investigator has something the worker did not:

hindsight.

A good investigation tries to reconstruct what the situation looked like before the outcome was known.

Ask Better Questions

Instead of:

“Why did you do that?”

try:

“Walk me through what was happening.”

Instead of:

“Why didn't you follow the procedure?”

try:

“How is this job normally performed?”

Instead of:

“Didn't you know that was dangerous?”

try:

“What were you expecting to happen?”

Instead of:

“Why were you rushing?”

try:

“What demands were you managing at the time?”

The questions change the information you receive.

What Leaders Should Do Differently

Spend more time where work happens.

Ask employees:

• What makes this task difficult?
• What changes from job to job?
• Where do you have to adapt?
• Which controls help?
• Which controls make the work harder?
• What do experienced employees know that the procedure does not capture?

Context is difficult to understand from a conference room. Go see the work.

Principle 4: Learning Is Vital

An organization cannot improve what it does not understand. But many organizations wait for something bad to happen before becoming curious. Someone gets hurt. Equipment is damaged. A vehicle crashes.

Then everyone wants to know:

“What happened?”

HOP asks another question:

“Why weren't we learning about this work yesterday?”

Learning Does Not Require an Incident

You can learn from:

• normal work,
• difficult jobs,
• close calls,
• unexpected conditions,
• successful recoveries,
• employee concerns,
• operational changes,
• equipment problems,
• weak signals, and
• work that consistently requires adaptation.

This allows learning to become proactive. You do not have to wait for an injury.

Learn From What Goes Right

Most work succeeds. Think about that. Employees perform thousands of tasks without serious incidents. That success is not necessarily evidence that the system is perfect. Workers may be actively creating that success.

They may:

• compensate for poor equipment,
• communicate informally,
• notice subtle changes,
• slow down at critical points,
• help one another,
• improvise,
• reposition equipment,
• catch mistakes, or
• recover before problems escalate.

Those actions are part of how the system performs. If you study only failures, you may never see them.

Ask Why the Event Does Not Happen More Often

This is one of the most powerful questions in operational learning:

“Why doesn't this happen every day?”

Suppose an investigation discovers a weak control that has existed for years.

Instead of only asking why the control failed during the incident, ask:

“What has normally prevented this weakness from producing an event?”

Perhaps employees have been compensating. Perhaps another control usually catches the problem. Perhaps conditions were different. Perhaps the organization has been relying on luck. You need to know which.

Learning Teams

Learning Teams are one practical method for applying this principle.

A Learning Team brings together people familiar with the work to explore:

• how the work normally happens,
• where it becomes difficult,
• what changes,
• what adaptations occur,
• which controls help,
• which controls fail, and
• what could improve the system.

Learning Teams can be used after an event. They can also be used proactively. The important part is not the meeting format. The important part is creating conditions where people can describe work accurately enough for the organization to learn from it.

What Leaders Should Do Differently

Do not ask only:

“What went wrong?”

Also ask:

• What normally goes right?
• What makes success possible?
• Where are employees compensating for weaknesses?
• What worries the people performing the work?
• What are we learning before an incident forces us to learn?

That changes safety from primarily reactive investigation to continuous operational learning.

Principle 5: How Leaders Respond Matters

Imagine an employee immediately reports a mistake. The supervisor becomes angry. The employee is embarrassed in front of coworkers. Management begins discussing discipline before understanding what happened. Other employees are watching.

What did they learn?

Probably not:

“Report mistakes quickly.”

They may have learned:

“Keep your mouth shut.”

Now imagine a different response.

The supervisor says:

“Thanks for telling me. Let's make sure everyone is safe, then help me understand what happened.”

That response does not promise immunity from accountability. It communicates that information has value.

Leader Response Shapes Information Flow

Leaders cannot manage risks they do not know about.

Workers often know about:

• difficult procedures,
• unreliable equipment,
• recurring workarounds,
• weak controls,
• close calls,
• schedule conflicts, and
• emerging problems

before senior management does. Whether that information travels upward depends partly on what happens when employees share it. If bad news consistently produces punishment, humiliation or dismissal, the organization should not be surprised when bad news stops traveling.

Response Does Not Mean Ignoring Serious Conduct

A learning response is not the same as permissiveness.

Leaders may still need to respond to:

• reckless behavior,
• deliberate violations,
• harassment,
• sabotage,
• intentional misconduct, or
• other serious conduct.

But even when accountability is appropriate, the organization can still ask:

“What else should we learn from this?”

Discipline and learning are not mutually exclusive.

The First Response Is Powerful

When an event occurs, leaders often want immediate answers. Resist the urge to announce the cause before the investigation.

Instead:

1. Make the situation safe.
2. Care for affected people.
3. Preserve evidence.
4. Avoid premature conclusions.
5. Ask what is known.
6. Ask what remains uncertain.
7. Learn how the work normally happens.
8. Evaluate controls.
9. Respond based on evidence.

That sequence protects the learning process.

What Leaders Should Do Differently

When someone brings you bad news, begin with curiosity.

Try:

“Thank you for telling me.”

Then:

“Help me understand.”

That small change can influence whether you hear about the next problem before or after someone gets hurt.

How the Five Principles Work Together

The principles are most useful as a system.

Error is normal

So design work that anticipates human fallibility.

Blame fixes nothing

So understand the event before deciding who deserves accountability.

Context drives behavior

So examine the conditions surrounding decisions.

Learning is vital

So learn from normal work, success and failure.

How leaders respond matters

So create conditions where useful information can travel.

Together they shift the central question from:

“How do we make workers stop making mistakes?”

toward:

“How do we build a system that is more successful even though people are human?”

That is a fundamentally different approach.

Example: The Missed Inspection

Imagine a driver leaves a facility without completing a required vehicle inspection. The organization discovers it later.

How might the five principles shape the response?

Error is normal

Do not assume memory and attention are flawless controls. Ask whether the process makes the inspection easy to remember and complete.

Blame fixes nothing

Do not stop at:

“Driver failed to inspect vehicle.”

That describes the deviation. It does not explain it.

Context drives behavior

Ask:

• When is the inspection supposed to happen?
• What else happens at that time?
• Is the driver waiting for paperwork?
• Is dispatch calling?
• Are customers waiting?
• Is the inspection tool available?
• How is the process normally completed?

Learning is vital

Talk with other drivers.

Is this an isolated event?

Or is the formal process different from everyday work?

How leaders respond matters

If the first driver who admits missing an inspection is immediately humiliated, how likely are other drivers to reveal similar problems?

Now the organization has a much richer understanding. Retraining may still be appropriate. But it is no longer the automatic answer.

HOP and Critical Controls

The five principles become particularly important around high-consequence hazards.

If a task can produce a serious injury or fatality, ask:

What control must work?

Then ask:

How dependent is that control on perfect human performance?

A control that requires a person to:

• remember,
• notice,
• interpret,
• decide correctly, and
• act correctly

every time may be less reliable than it appears.

Where practical, stronger systems:

• remove hazards,
• engineer protections,
• create independent layers,
• detect failures, and
• provide opportunities for recovery.

HOP does not replace control management. It can make control management more realistic.

Do Not Turn HOP Into Another Compliance Program

There is an irony organizations should avoid. They discover HOP. They become excited.

Then they create:

• mandatory HOP forms,
• HOP audits,
• HOP completion metrics,
• HOP observation quotas,
• HOP checklists, and
• HOP compliance scores.

Soon employees are performing HOP paperwork instead of learning about work. The principles should improve existing processes. They should not automatically become another administrative burden.

Ask:

“Is this helping us understand and improve work?”

If the answer is no, reconsider the process.

Five Questions to Take Into the Field

You do not need to carry a textbook.

Start with five questions:

1. What makes this job difficult?

This reveals context.

2. Where are mistakes likely?

This recognizes human fallibility.

3. What normally keeps the job from going wrong?

This reveals controls and successful adaptations.

4. What would make this work better?

This creates learning.

5. What happens when someone reports a problem?

This reveals leadership response. Those five questions can teach you a great deal about an operation.

The Five Principles Are a Starting Point

HOP is deeper than five slogans. The principles are useful because they are memorable. But the goal is not to recite them. The goal is to change how we think.

When something goes wrong:

Do we judge first?

Or learn first?

When workers adapt:

Do we automatically call it noncompliance?

Or understand why the adaptation exists?

When an error occurs:

Do we rely on another reminder?

Or improve the system?

When employees bring bad news:

Do we punish the messenger?

Or become curious?

When work succeeds:

Do we ignore it?

Or learn why?

That is where the five principles become operational. They stop being statements on a presentation slide. They become a way of leading.

For a closer look, read What Is Human and Organizational Performance (HOP)?.

Supporting resources

Related commercial publications are disclosed under Authorship & disclosures below.