Black Box Thinking

The Surprising Truth About Success

By Matthew Syed

The Book That Changed How I Run A Debrief

This is the third of Matthew Syed's books I've reviewed, and it's the one I've used the most.

Not because it's enjoyable. It isn't. It opens with a death and it doesn't let you off for a long time afterwards.

I keep coming back to it because it answers a question I'd been circling for years without having the language for it. Why do some organisations get relentlessly better, and others make the same mistake for a decade and call it bad luck?

It isn't talent. It isn't effort. It isn't intelligence. Syed's examples are full of exceptionally clever, highly trained, genuinely committed people getting it catastrophically wrong.

The difference is what happens in the hours after something goes wrong. Whether the failure gets turned into information, or explained away.

That's the whole book. And the reason it runs to three hundred pages is that explaining things away turns out to be one of the most powerful instincts we have, and almost nobody catches themselves doing it.

If you lead anything, this is the most useful uncomfortable book on the shelf.

A Routine Operation

The book opens with a death.

On 29 March 2005, Elaine Bromiley went into hospital for routine sinus surgery. She was 37, fit, healthy, a mother of two. The procedure was low risk. She was not expected to be in any danger.

Under anaesthetic, her airway collapsed. The anaesthetists could not get a tube in. They tried again. And again. Minutes passed. Her oxygen levels fell to a point where brain damage becomes inevitable.

There was a procedure for exactly this situation. A tracheostomy. Cut the airway open at the throat.

The nurses in that room could see it. One went and fetched the tracheostomy kit and brought it into the theatre. Another had already phoned ahead and booked an intensive care bed.

Neither of them could make the consultants hear it.

The kit sat there. The doctors carried on with what they were doing. Elaine Bromiley died thirteen days later, having never regained consciousness.

Nobody in that room was incompetent. Nobody was negligent in the way we usually mean it. They were senior, experienced clinicians doing their absolute best in a situation that had overwhelmed them. That's what makes it so hard to read.

The hospital's initial position was that it was a tragic one-off.

The Husband Who Wouldn't Accept That

Elaine's husband Martin had spent twenty years as a commercial airline pilot. He had lectured on system safety.

He didn't want anyone prosecuted. He didn't want a scapegoat. He wanted to know what had happened, because in his industry that is simply what you do when something goes wrong, and because he could not accept that the lesson would be buried with his wife.

He asked questions. He wrote letters. He pushed until there was a proper independent investigation, and then he went and founded the Clinical Human Factors Group to change the way British healthcare handles exactly this kind of failure.

His line has stayed with me since the first time I read it: "So that others may learn, and even more may live."

That is the entire book in nine words.

The Same Failure, The Opposite Response

Syed's second chapter is a plane crash.

United Airlines 173, December 1978, approaching Portland. The captain lowered the landing gear and heard the wrong sound. He circled while he worked the problem. He was experienced, competent and completely absorbed in the thing in front of him.

Sixty-four minutes later the aircraft came down in a wooded suburb, out of fuel.

The crew had known. The flight engineer had raised it. Not forcefully enough, not clearly enough, and not in a way that broke through the captain's focus.

Same failure as that operating theatre. Fixation at the top, information at the bottom, and a gap in between that nobody could cross.

Here's the difference. Aviation responded by inventing Crew Resource Management, an entire discipline built to make sure a junior crew member can stop a senior one. It is now standard across the industry worldwide.

Healthcare, in 2005, was still calling it a one-off.

The Numbers

In 2013 there were 36.4 million commercial flights, carrying more than three billion passengers. 210 people died. That's roughly one accident for every 2.4 million flights. Among airlines with the tightest procedures, one in 8.3 million take-offs.

In healthcare, the American To Err Is Human report put preventable error deaths at between 44,000 and 98,000 a year. A 2013 study in the Journal of Patient Safety put premature deaths from preventable harm above 400,000. That places preventable medical error behind only heart disease and cancer as a cause of death in the United States.

Peter Pronovost of Johns Hopkins put it in terms nobody can ignore. It's the equivalent of two jumbo jets falling out of the sky. Every twenty-four hours.

In the UK, a 2005 National Audit Office report estimated up to 34,000 deaths a year from human error.

Same species. Same pressure. Same complexity. Completely different relationship with failure.

It Isn't Culture. It's Design.

This is the part most people miss, and it's the part that matters if you actually lead anything.

Aviation didn't get safe by telling people to be more open. It built a system where openness is the rational choice:

• Investigators are independent of the airlines, the unions and the regulators

• Evidence gathered by the investigation is inadmissible in court

• Reports are published, and every pilot in the world can read them

• Airlines are legally required to act on the recommendations

• Report a near-miss within ten days and you have immunity

  
  

Look at that list again. Not one item on it is a value, a poster or a workshop. Every single one is a structural decision that lowers the cost of telling the truth.

Psychological safety is not what you say in the all-hands. It's what your incentives leave standing when someone has made a mistake and has to decide whether to mention it.

The Error Paradox

Syed cites a study comparing hospital units. One set had a blame culture, where staff were afraid of the consequences of admitting error. The other set were open.

The blame-culture units reported fewer mistakes.

They also had measurably more patient harm.

Read that twice. The units reporting fewer errors were the dangerous ones. Low numbers were not a safety record. Low numbers were a silence.

I think about this every time I look at any dashboard that's going in the right direction. Is this getting better, or has it just got harder to tell me?

Cognitive Dissonance: The Part That Changed How I Coach

The middle of the book leaves medicine and goes into criminal justice, and it's the section I return to most.

Syed looks at wrongful convictions. Men jailed for murders they did not commit, later exonerated by DNA evidence that simply did not permit any other reading.

You would expect the prosecutors to accept it. Many did not. They constructed elaborate theories about why the DNA didn't mean what it obviously meant.

Here is the thing that changed how I work. They were not lying.

Cognitive dissonance is the discomfort of holding two contradictory things in your head at once. Usually it's a belief you're invested in, often a belief about the kind of person you are, colliding with evidence that says it's wrong.

Something has to give. Changing the belief is expensive, because that belief is holding up your sense of yourself. Reinterpreting the evidence is cheap.

So that's what the brain does. Quietly, automatically, and sincerely. The prosecutor genuinely believed his new theory. He did not experience himself as covering anything up.

That's why you cannot argue someone out of it, and why calling it dishonesty guarantees you'll fail. You are not talking to a liar. You are talking to someone whose mind has already edited the evidence to protect something they need to be true.

In coaching, this is most of the work.

A leader tells me his team don't speak up because they lack confidence. The 360 says his team don't speak up because of him. Two versions. One of them is going to survive the next ten minutes, and my entire job is making it survivable for the right one to win.

That means never putting the evidence and the person's character on the table at the same time. The moment someone has to choose between accepting the data and accepting that they're a bad leader, they will protect the second one every single time. And they'll be sincere about it.

Make it about the standard, not the soul. Then people can actually look.

Complacency Always Has A Story Ready

I spent four years running anti-piracy and high-risk security work in the Horn of Africa, West Africa and the Middle East. A lot of that is transits. Long ones. Days at sea in a high-risk area with a team on watch and absolutely nothing happening.

Fortunately, the company I worked for most was made up almost entirely of former Commandos with combat experience. That mattered more than any procedure we wrote. Those men did not get complacent, because every one of them already had a reference point for what the other outcome looks like, and none of them needed reminding of it.

The hard part was the ship's crew.

They supplemented the watch on the bridge wings as part of their normal shift routine. Seafarers doing a job, not operators. For them the lookout was one more task on a rota, and the rota ran identically whether the water was dangerous or empty.

Watch discipline decays in almost perfect proportion to the time since the last contact. Not because anyone is lazy. Because after a week of empty sea the brief starts to feel theoretical, and an hour on a bridge wing in the heat starts to feel like an administrative exercise.

There's the lesson in miniature. The men who had already paid for it didn't need a system to hold the standard. Everybody who hadn't paid for it did.

And here's the part that should bother anyone who leads anything. The risk had not changed. Not by a single degree. Only the feeling of it had.

Watch what that does inside someone's head. They're holding "this is dangerous water and my job is to watch it" alongside "I have stopped really watching it." That's dissonance, and it's genuinely uncomfortable.

Nobody resolves it by admitting they've switched off. They resolve it by quietly revising the threat downward. It's quieter out here than it used to be. Last incident was months ago. The deterrent's working, so we're fine.

Same machinery as the prosecutors. Lower stakes. Identical mechanism.

I now watch the commercial version of it every year. Organisations buy safety and security training in the month after an incident. Budget appears overnight, attendance is full, everyone is engaged. Eighteen months later, with nothing having gone wrong, it doesn't get renewed.

The measure worked. That's why it got cut.

And here's why it belongs in a review of this book. It's the error paradox running backwards.

Prevention done properly produces nothing. No incidents, no reports, no drama. That's the win. And "nothing happened" gets read as "there was never really a threat" rather than "the measure worked."

Prevention is invisible by design. It has to defend its budget against its own success. Security is like insurance. It's at its best when it isn't being used, and that is precisely when people stop paying for it. The same thing happens in voluntary work, where the currency is time rather than money and it drains just as quickly.

Aviation solved this. It does not wait for crashes to generate urgency. It records the near-misses, publishes them, and acts on them. The answer is the same shape wherever you are. Log what every watch, shift or patrol observes, including the nothing. Circulate it. A quiet watch with three recorded observations is data. A quiet watch with no record is just an absence, and absences motivate nobody.

A standard you only hold when it's uncomfortable enough isn't a standard. It's a reaction.

The Debrief Is Your Black Box

We run a hot wash-up at the end of everything we deliver. Immediate, while it's still hot.

What went well. What could have gone better. What we'll do differently next time, knowing what we know now.

With some groups we use I - HU, WU, MU instead. State the intent (I) first. Then: how useful (HU), what was useful (WU), what would be more useful (MU). All of it measured against the stated intent.

I've used that for years without fully understanding why it works better with certain teams. Reading this book gave me the answer.

Stating the intent first moves the target. Nobody has to defend themselves to say something wasn't useful against a stated aim. It takes the assessment off the person and puts it on the objective, which is the same move CRM made in a cockpit and the same move I'm describing above with coaching.

Bigger events get a full after-action review. More detail, more time, more honesty.

None of this is complicated. What's hard is doing it when it went badly, when you're tired, when it was your call that caused the problem, and when everyone would rather go home.

That's the whole discipline. A debrief you only run after a good day is a highlight reel.

Everything We Know, We Learned The Hard Way

I already knew this book before I read it. I just didn't have the language for it.

In the Royal Marines, the debrief is not optional and it is not comfortable. You go through what happened, properly, and rank matters considerably less in that room than it does outside it. Later, running teams in hostile environments across the horn of Africa, West Africa and the Middle East, that habit was the only thing standing between us and repeating something that could get people killed.

Every procedure we followed existed because it had been paid for. Somewhere, someone had learned it at a cost. Sullenberger made exactly this point after the Hudson landing, that everything in the aviation rule book is there because of something that went wrong before.

That is not a military idea or an aviation idea. It's just what learning looks like when the consequences are real enough that you can't afford to pretend.

The question for the rest of us is whether we'll do it before the consequences get that real.

Where I'd Push Back On Myself

My instinct going into this book was that there's no such thing as failure unless you do the same thing twice and don't learn the first time.

I still like the line. And the book showed me what's wrong with it.

The first time isn't automatically learning. It's only learning if the failure gets captured. An error nobody records is not a lesson. It's a repeat with a delay on it.

Syed is very clear that this is not "fail fast, fail often" cheerleading. He isn't celebrating failure. He's arguing for the systems and culture that make failure useful, which is an entirely different and much harder thing.

So the sharper version: failure is data you collected. The real failure is data you had, and binned.

Why This Matters For Every Leader

When your incident numbers drop, do you know whether you got safer or whether people stopped telling you?

When someone brings you bad news, what actually happens to them afterwards?

When was the last time you were shown clear evidence that a decision of yours was wrong, and how quickly did you start explaining why it wasn't?

Does your team debrief the wins and the losses, or just the wins?

And who on your team has information right now that they don't feel able to give you?

Who This Book Is For

Anyone who runs anything where the consequences of getting it wrong are real.

Anyone who has sat in a review that turned into a search for someone to blame, and watched the learning evaporate.

Anyone building a culture and wondering why people agree in the room and say something different in the car park.

If you've read Mindset and Extreme Ownership, this is the bridge between them. Dweck gives you the psychology. Willink gives you the accountability. Syed gives you the system that makes both of them actually work.

Final Thought

Every aircraft carries two black boxes. When something goes wrong, they're opened, the data is read, and the lesson is published so that no pilot anywhere has to learn it the same way again.

Most organisations have a black box. It's in the debrief nobody runs, the near-miss nobody logs, the thing everyone noticed and nobody said.

The data is there. It's always there.

The only question is whether you've built something that opens it.

So that others may learn.