Safety II professionals: How resilience engineering can transform safety practice

The safety management literature describes two distinct modes through which safety is achieved. These can be described as safety management through centralized control, or safety management through guided adaptability. Safety management through centralized control, labelled by Hollnagel as ‘Safety-I’, aims to align and control the organization and its people through the central determination of what is safe. Safety management through guided adaptability, or ‘Safety-II’, aims to enable the organization and its people to safely adapt to emergent situations and conditions. Safety-II has been presented as a paradigm shift in safety theory, but it has created practical difficulties for safety professional practice. In this paper, we define the two modes of safety management and explain the challenges in changing the role of a safety professional to support Safety-II. When should safety professionals re-enforce alignment, and when should they support frontline adaptations? We outline specific activities for safety professionals to adopt in their role to move towards a guided adaptability mode of safety management. This will move the safety professional further towards their fundamental responsibility – ‘to create foresight about the changing shape of risk, and facilitate action, before people are harmed.’


Introduction
Every new safety or accident theory contains criticisms of how safety practitioners are performing their roles. Given the proliferation of theories over the past 50 years, practitioners are surrounded by idealised and often apparently contradictory ideas about how safety should be managed. This paper explores the link between safety theory and safety management in the context of the role of safety professionals.
In this paper we define the term 'safety' as 'an ability for a system to perform its intended purpose, whilst preventing harm to persons'. Safety, or the lack of safety, is an emergent property of an operational system. Thus, safety can be thought of as the combined result of the decisions and action of all persons with an ability to interact with the operational system. 'Safety management' is a label that we use to describe practices that can direct, monitor and intervene in core operations for the purpose of generating or maintaining safety. 'Risk' is a term that is linked to safety and we use it to refer to the level of uncertainty that the operational system will generate safety as an emergent property, and the severity of the potential consequences to people of a lack of safety. Finally, the term 'safety professional' is used to describe roles within an organization that exist with the primary purpose of safety management, and that does not have a core operational purpose for the organization.
Safety management, as it is frequently described in the literature and applied in practice, involves a strong focus on standardization and compliance. Safety management systems, behavioral safety, and safety culture are all attempts to align individuals with organizational safety requirements and ideals. This 'centralized control' mode of safety management, labelled by Hollnagel as "Safety-I", begins with central determinations of what is safe, and then works to implement mechanisms to align operational work with this plan through prescribed roles, requirements, and procedures. Accidents and near misses are believed to be the result of deviations from prescribed work, and therefore remedies focus on further increasing pressure for compliance. Safety management then focus on identifying deviations from prescribed work which need to be detected and eliminated.
Over the past fifteen years, this dominant views of safety within organisations has been increasingly challenged by theories of: high reliability organisations [57], Resilience Engineering [31], Safety Differently [13,19], and Safety-II [29]. These theories suggest the importance of a focus on decentralization. Or more specifically, the capacity of organizations to 'guide adaptability' of workers and systems, through understanding and supporting how complex systems usually succeed, but sometimes fail. This alternative mode has been labelled by basic limits of predetermined plans, in a complex, interdependent and changing environment, because responsible people adapt to make the system work. Safety-II focuses on how work is done, looking for the different ways people adapt to gaps, challenges, and surprises, and how they synchronize activities to resolve conflicts and achieve shared goals.
The challenge for safety management in this context, is to guide and facilitate how people adapt to handle complexities and to provide the resources for coordinated joint activity. Safety-II enables people to dynamically align the pursuit of both safety and effectiveness because there are always multiple conflicting goals, limited resources, and pressures to achieve more (i.e. industry's 'Faster, Better, Cheaper' imperative). Safety management focusses on guiding how to, and when to trade-off and re-prioritize across multiple risks and goals when operating in the midst of uncertainties, changing tempos and pressures.
This debate between centralisation and decentralisation is not new within the safety or organisational literature. Perrow [42] argued that the conventional engineering approach to system safety would ultimately fail as systems became increasing complex and new approaches were required. The high reliability organisation literature promoted the need for non-traditional organisational capacities such as: sensitivity to operations and a commitment to resilience [57]. Amalberti [3] discussed the challenges of purely centralised approaches to safety in improving the safety of some industries and technologies. This debate in the safety literature followed and paralleled a similar debate in the organisational literature commencing in the 1960's with understanding management approaches to the motivation and effectiveness of workers. Theory X and Theory Y is one such popular management theory which presents the centralised versus decentralised distinction in relation to organisational management and work performance.
Katz [36] further discussed the need for organisations to manage the paradox of ensuring dependable role performance with encouraging spontaneous initiative to manage emergent situations that were impossible to plan for or not predict. The High Reliability Organisation (HRO) literature expanded this notion of context dependent modes of operation by arguing that for organisations to be safe and reliable they needed to be able to give effect to context dependent modes of operation [57]. More recently Grote [22] argued that organisations needed to focus their safety risk management programs towards uncertainty, and make deliberate choices that establish a balance between stability and flexibility by promoting both control and accountability.
Safety professionals are confused (a) by the apparent divergence in safety management theory, and (b) by the contrast between the Safety-II literature and the existing safety management practices used within their own organizations [52]. The existing literature exploring safety professional practice concludes that the current profession believes in, implements, and performs activities in support of a centralized control mode of safety [43]. Therefore, the safety profession largely operates inconsistently with, and often counter to, a safety mode of guided adaptability. Historically, the Safety-I literature, for all its theoretical shortcomings, has provided a strong practical reference for safety management, and for what it means for safety professionals to "do safety work". Since the safety literature sometimes views the two modes of safety as incompatible, safety professionals do not have a practical reference about how Safety-II can be used to steer their activity in professional practice.
We propose that the fundamental responsibility of safety professionals can be best described as: creating foresight about the changing shape of risk, and facilitating action, before people are harmed [58]. Such that, if we get to count the bad things that have happened to people, then we have already failed. Thus, safety management must be proactive, not reactive, but how do safety professionals achieve this and identify problems before there are obvious failings? This paper answers this question by presenting an outline of the activities and tasks of safety professionals in support of a guided adaptability mode of safety management, which has not previously been attempted in the high reliability organizations, resilience engineering, safety differently or safety-II literature. We do this by: outlining the existing role of a safety professional in a safety management mode of centralized control [43], describing the breakdowns of the safety professional role when operating in this mode, and then providing direction for how the role can be reframed to support a safety management mode of guided adaptability. In addition to the primary purpose of this paper, we also aim to clarify aspects of the resilience engineering theory that have been misrepresented and misunderstood in the literature and practically within organizations.

Safety mode of 'centralized control'
Since the early 1900's, organizations have viewed accidents as undesirable outcomes from unplanned variation of work. Under this view, safety is achieved by reducing the likelihood or consequences of deviation from planned safe work practices. Early 'centralized control' approaches were derived from Taylor's 'Scientific Management' [53]. Taylor suggested that there was "one best way" to perform any task. Whilst Taylor was primarily concerned with efficiency and productivity, companies such as DuPont adapted Taylor's approach for safety, documenting and standardising safe work practices [51]. As scientific management gave way to Total Quality Management (TQM), the idea of "one best way" to perform work was replaced by the idea of continuous improvement. TQM retained an emphasis on documenting rules and procedures as a foundation for improvement however now sought to systemically prescribe the management processes through which operations would be monitored, and deficiencies prevented, identified, and corrected. More recent approaches to systemic control over safety include Safety Management Systems, safety culture, and behavioural safety -make greater allowance for human variability than Taylor, but preserve the idea that safety arises from preventing unsafe variation. The fundamental premise for Safety-I and a centralized control mode of safety management is the belief that the plan for work and safety is substantially complete, and that all will be well if everyone works to the plan and follows the safety management requirements. The organization exerts pressure to 'work to plan, work to role, and work to rule'.

Organizational capacities for a safety management mode of centralized control
In order to create centralized control for safety management, organisations focus their effort on developing their capacity to: analyse hazards, implement controls, monitor conformance, delegate authorities, and standardize safety culture (see Table 1).

Hazard analysis
The starting point for controlling safety is to perform hazard analysis. Hazard analysis combines our understanding of the probabilities, uncertainty and consequences of event scenarios in a way that enables the organization to prioritise resources for monitoring and risk reduction activity [5]. Organizations invest significant resources expanding their hazard analysis processes and therefore hazard and risk understanding. Through processes at both a task (e.g. Job Safety Analysis) and system level (e.g. Hazard and Operability Study), hazards are identified, categorized, assessed and prioritized for action and monitoring. These processes consider known internal and external factors that could cause work to operate outside a tolerable level of safety risk.

Controls
Following the identification and assessment of hazards, controls (both physical and behavioural) are put in place to manage the hazards to an acceptable level of risk. There is an established hierarchy of controls for individual hazards: elimination, substitution, isolation, administrative, and personal protective equipment. These controls will often manifest themselves in engineering changes to systems and equipment, management systems, and procedures. Non-physical controls such as procedures and business processes are documented in Safety Management Systems, supplemented with training programs [48]. Organizations and teams within organizations establish behavioural norms, expectations and rules in relation to work and general safety conduct -often termed behaviour-based safety. Behaviour-Based Safety (BBS) seeks to identify and prescribe safe behaviours in the workplace following the model of -define, observe, intervene, and test [21].

Monitoring
Organizations focus on the monitoring of the controls that are put in place to manage the identified hazards. These monitoring activities include: inspection and testing of equipment, behavioural observations, audits, and other routine surveillance activities. Corrective actions are devised where these monitoring activities identify deficiencies in the application of, or compliance with the controls. The 'Swiss Cheese' model of accidents shows how accidents occur when the protective layers or barriers in place to prevent an incident fail [47]. In addition to the monitoring of controls, safety incident reporting occurs at all levels of the organization. These incidents are events that represent breakdowns in the safety risk controls and therefore knowing how often they are happening, and where, is important to prioritize additional safety management effort. Organizations identify and hold accountable managers and workers who are responsible for risk control and compliance breakdowns.

Authority
Management are ultimately accountable for safety outcomes and therefore have the over-riding authority on safety decisions within their areas of responsibility within the organization [38]. Line management and safety professionals make safety decisions and communicate and implement these within their operations. Front-line employees are responsible for following procedures and requirements to safely conduct their work. Management accountability for safety and safety decision-making is complimented with all workers having an 'authority to stop' their work due to safety concerns [40].

Safety culture
To align and motivate the organization to prioritize and commit to safety, safety culture improvement programs support the hazard analysis, control, and monitoring activities. This aligned safety culture is based on the principle that all incidents are preventable. Leaders create cultures through what they systematically pay attention to [50] and their actions aim to reinforce the organizations priority for safety and care for its workers. This in turn influences workers and teams collectively to prioritise safety themselves, comply with requirements, and report any incidents so that the organization can rectify problems. Although there are a number of ways to define and describe culture [32] the most well-known safety culture model describes five stages of maturity: pathological, reactive, calculative, proactive, and generative [33].

Safety Professional role under a safety management mode of centralized control
The current role and activities performed by safety professionals within organizations are largely aligned with a safety management mode of centralized control [43]. There is a reciprocal relationship between the organisation's mode of centralized control and the role of safety professionals -the safety management mode drives activities and tasks, and these in turn re-enforce the safety management mode.
There is considerable research concerning the tasks and education of safety professionals (e.g. [6-8, 11, 24, 25, 39, 64]. The largest study into the tasks and activities of safety professionals involved a 169 item questionnaire performed with 5495 participants in 12 countries [25]. Hale and Guldenmund [25] identified 22 tasks performed by more than 60% (but usually more than 80%) of respondents in all countries, these included: checking compliance with policy and procedures, workplace risk assessment, develop company policy, make procedures (give instructions and check compliance), investigate accidents, perform physical inspections, conduct audits of workplace behaviour. Despite the research into safety management practices of safety professionals, there is no compelling empirical evidence that safety professionals improve the safety outcomes of their organizations (Borys 2015).
The following safety professional activities have been synthesized from the safety professional literature referenced above, and the organizational capacities outlined in Section 2.1, to support the centralized control mode of safety (See Table 2):

Facilitate task hazard analysis
Safety professionals develop and facilitate processes that enable the safety hazards associated with individual tasks and activities to be analysed and managed. These processes can include: pre-start safety assessments, job safety analysis (JSA), safe work method statements (SWMS), and permit-to-work (PTW). The objective is to ensure that front line employees understand the hazards associated with their work.

Perform system level hazard analysis
Organizations need to understand the hazards at a technology, Table 2 Safety professional activities to support a mode of centralized control.
1 Support the task-based identification of hazards (e.g. take-5) and assessment of risk (e.g. JSA) 2 Facilitate the identification and assessment of system level hazards (e.g. risk registers, HAZOP) 3 Develop controls for tasks (e.g. working at heights) and processes (e.g. contractor management) 4 Monitor controls proactively (e.g. inspections) and reactively (e.g. incident investigation) 5 Provide safety incident and compliance reporting to line management and regulators 6 Support line management decision-making and arbitrate between stakeholders as necessary 7 Promote an 'authority to stop work' for safety across the frontline workforce 8 Develop and promote safety culture improvement programs D.J. Provan, et al. Reliability Engineering and System Safety 195 (2020) 106740 system or business level that may or may not be associated with individual tasks of the front-line workforce. The hazards are assessed using advanced hazard and risk analysis methodologies, including; hazard and operability studies (HAZOP), layers of protection analysis (LOPA), hazard identification (HAZID), failure modes and effects analysis (FMEA), fault tree analysis (FTA), and pre-start up safety reviews (PSSR's), etc. Safety professionals facilitate these hazard assessments and maintain the outputs.

Develop safety controls
Safety professionals develop safety risk controls and requirements to manage safety hazards and the regulatory compliance requirements of their organization's activities. These controls can be physical, procedural, and behavioural. Safety professionals document and operationalize these controls through safety management systems, safety plans, safety procedures and safety rules. Legal regulations, based on diligent work practices, provide a useful framework on which organizations can model their controls.

Monitor safety controls
Organizations monitor compliance with safety risk controls and requirements to prevent safety incidents. The safety professional conducts proactive monitoring activities, including safety audits and behavioural observations. Safety professionals also conduct incident investigations to reactively identify controls that were not complied with. Corrective actions are identified as outputs of these monitoring activities to improve the safety controls or organizational compliance with them. Safety professionals implement and track the completion of corrective actions.

Provide safety reporting
Organizations generate, communicate and review safety reports to make decisions to improve safety. These reports include information about compliance with safety requirements, completion of safety actions (e.g. observations, action closure), and safety incident descriptions, severity, and frequency. This information allows safety professionals to identify the parts of their organization that require additional safety management attention and improvement actions.

Influence and arbitrate decisions for safety
Safety professionals have the technical expertise and safety management experience to facilitate and if necessary, arbitrate safety decisions between stakeholders. This arbitration can be required at times between the workforce and line management of the organization, and with third parties (customers, contractors or regulators). Safety professionals understand the safety risks and safety compliance requirements that apply to work activities and locations, and they can use their authority to make safety recommendations and decisions.

Promote an authority to stop work
Organizations enact their commitment to safety by providing employees with authority to stop work when confronted by an unsafe situation [56]. Safety professionals promote this authority across the workforce and develop processes to support its enactment. If situations arise that are not adequately managed, they are investigated and resolved by adjusting work to conform to existing safety risk controls and requirements or developing new controls for the situation.

Develop safety culture
Safety professionals promote and support a safety culture that aligns the organization on common principles. A safety culture promotes the belief that all safety incidents are preventable by prioritising safety, identifying hazards, complying with safety requirements, and improving through reporting and understanding safety incidents. Safety management needs to be very visible across the organization through ongoing communication, visual material and line management behaviours.

Organizational responses to a safety management mode of centralized control
The activities described in Section 2.2, when reflected in the safety management and safety professional literature are described and practiced as top-down normative requirements. This centralized control approach refers to standardisation, generalisation and administration of safety management practices that are disconnected from the variability of the operational risks of the system or local unit.
Front-line work needs to adapt and deviate from plans, rules, roles and procedures because of the dynamic and emergent nature of complex systems. In a mode of centralized control, this need is not acknowledged or supported by the organization, causing tensions and conflict. The resulting adaptive cycles of front-line work to the emphasis on a safety management mode of centralized control is destructive for maintaining safety and achieving organizational goals. (see Fig. 1). It is important to understand how the role and activities of safety professionals influences their organisation.

Practical challenges and tensions for safety professional work
In the same way as there are adaptive cycles for front-line work (see Section 2.3), there are adaptive cycles for safety professional work as it navigates and responds to the pressures of a centralised control mode of safety management. A number of these adaptations are not desirable for safety in the organisation.

Safety Professional activities are 'Reactive'
Due to the inevitable gap between work as imagined and work as done, there is a constant need for reactive activity to "correct" covert work systems and double binds. Line management asks safety professionals to explain and address incidents and non-conformances. This level of reactive activity prevents proactive exploratory activity to understand and support the current functioning of operations. Safety management within the organization becomes slow and stale, and unresponsive to the changing shape of operational risk. Warning signs of trouble are discounted until there is definitive information (i.e. an incident), at which time it is too late to prevent harm to people.

Safety Professional activities are 'Fragmented'
Safety professionals are focussed on safety management activities that are created and performed separate to the core functioning of the organisation's system of work. The safety management activities are determined as a result of linear oversimplifications of operational problems where the response is either specific local action imposed on operating units, or over-generalised conclusions that are impossible to action effectively (e.g. "communication" and "teamwork"). The everincreasing safety management expectations and programs on the sidelines of the operations create more pressure and more goal conflict (i.e. time and resources), without addressing issues with the overall functioning of the organization. Safety professional work retreats and fragments in a similar way to front-line work.

Safety Professional activities are 'Defensive'
Safety professional activities are defensive, in the sense that they seek closure on behalf of the organisation. In order to avoid being overwhelmed and uncertain about safety risk, safety professionals need to "tick off" tasks faster than they generate new tasks. An activity that raises more questions than it answers generates more new work than it ticks off. Each open item is a personal threat to line management and the organisation, since it will be seen by outsiders as a shortfall in safety D.J. Provan, et al. Reliability Engineering and System Safety 195 (2020) 106740 management. Therefore, there is a strong need to seek closure -ticked boxes, simple answers, and strict processes with well-defined stopping points. Inevitably this leads to blaming operational units or front-line workers, because broader, less-defined answers require broader, lessdefined solutions.
Despite these three destructive adaptations, we recognise that safety professionals may also currently perform valuable safety management work. However, the theoretical limitations of the Safety-I approach for complex systems mean that even when the role is practiced closely aligned to the Safety-I theory, it will not be sufficient to manage safety in a modern complex organization.

The need to redesign the role of safety professionals
The unintended consequences of anchoring safety professionals in reactive, fragmented and defensive activity, ironically intensify as the organization increases its efforts to improve safety management through centralized control; more safety problems are identified to react to, more fragmented solutions are implemented, and more defensive activity is created. The pressure to conform exerted on front-line work teams, create these adaptive responses, and drives a greater distance between work as imagined and work as done.
These consequences can have negative impacts on safety management: blame culture, inappropriate resource allocation, increased goal conflict, mismatched responsibility to resourcing, non-value-adding safety clutter, stale models of risk and operations, adversarial relationships, lack of systemic interventions, single focus on worker compliance, investment in protecting the organization, and manipulated safety reporting metrics.
Are these problems caused by the limits of Safety-I theoretical approaches, or are they practical consequences of poor application of those approaches? We suggest that there is an inevitable link between the two. Safety-I theory does not account for the technical, social and political complexity of organizations and the variability of the work of practitioners in the field. So, when the management and safety theory we describe in Sections 2.1 and 2.2 are extrapolated into front-line work and the role of the safety professional, pressures and tensions inevitably arise. This has been empirically demonstrated in the safety literature over the past 30 years (see Table 3).
In this section, we outlined the centralized control mode of safety management and the role of the safety professionals, as well as how this approach can create unintended destructive adaptations for safety professionals and front-line work. We showed that Safety-I, at the theoretical level, and certainly in practice, is not sufficient to deal with the complexity of managing safety risk in modern complex systems. Safety-I theory cannot compensate for the necessary integration of safety management into the core operations, and decision-making of the organization. Safety-I has limits, and the linear oversimplifications become relevant due to the modern trends in organizations, technology, systems and society. Therefore, the solution is not to add further centralized control safety management practices in an attempt to prevent these breakdowns. Consistent with resilience engineering theory, the solution is to complement control with adaptability, and transition towards guided adaptability as a strategy that considers the increasing complexity of modern organizations. The safety professional role can be redesigned consistent with the theoretical developments in managing safety risk in complex systems if we can reframe the control-adapt paradox that presently exists between Safety-I and Safety-II. In Section 3, we outline the solution to this control-adapt paradox as a safety management mode of 'guided adaptability' and detail the enabling role of the safety professional.

Safety management mode of guided adaptability
During the 1990s and 2000's, through authors such as Rasmussen, Woods, Hollnagel, Dekker, Amalberti, and Leveson, there were increasing calls to pay attention to adaptability as a key ingredient for safety management. These authors acknowledged the importance of control, but since they were writing at a time when safety management by centralised control was entrenched in organizations, they often positioned their work in contrast to existing practice. This reinforced the popular perception that control and adaptability could not co-exist. There appeared to be a stark choice between Safety-I and Safety-II. The mode we present here, 'guided adaptability', is not a new idea, but clarifies the principle that safety comes neither from preventing or encouraging variation, but from recognising that variation is inevitable.
The goal of safety management is to facilitate safe variation. It is people, and only people, who are the ones able to adapt to a complex and changing world, and bridge the gaps in technology, processes, and information to maintain safety.
The safety management mode of guided adaptability understands that plans, procedures, roles, and requirements are inherently flawed and unable to cater for the complexity of work as done. Therefore, it understands that all systems operate in degraded modes, and people and operations will adapt to meet the challenges, pressures, trade-offs, resources scarcity, and surprises that they face. Rather than pressuring front-line operations to conform with stale plans, the organization and safety professionals should provide support and facilitation to constructively guide these adaptations.
As we have shown, the safety mode of centralised control in practice within organisations creates challenges and unintended breakdowns that increase as organizations increase their safety effort. It was these observations of safety management modes of centralized control in practice in organizations that created the need for a diametrically opposed alternative, namely a safety management mode of guided adaptability [10,29].

Organizational capacities for a safety management mode of guided adaptability
In order to create guided adaptability for safety, organisations focus their effort on developing their capacity for: anticipation, readiness to respond, synchronization and proactive learning (see Table 4).

Anticipation
An important capacity for a mode of guided adaptability is being able to 'anticipate' and predict future failure paths [30] and to make trade-offs and sacrifice judgements accordingly. Anticipating future scenarios allows the organization to monitor the conditions and threats associated with these scenarios, as well as to build resources and capacities to respond. Threats to safety are monitored through the detection of operating points within the system that signal where safety margins may be eroding. [9].
Within all organizations there is an omnipresent production pressure, which consistently exerts pressure towards reducing safety margins and therefore the resilience of operating units. Organizations maintain a commitment to safety management in a way that enables safety to be an important consideration in all decisions, as well as actively making sacrifice judgments (trade-offs) when safety is compromised by operational and financial objectives.

Readiness to respond
Organizations maintain flexible capacities and resources to compensate for additional foreseen and unforeseen demands. The ability of organizations to absorb disruptions and maintain safety and operational performance has recently been termed 'graceful extensibility' [61]. Maintaining redundant capacity (slack) in an adaptive system is difficult, as organizations will aim to remove it to improve efficiency. Therefore, an organizations continuously monitor the resources that are able to be re-deployed to keep pace with the changing tempo and demands of work [61]. Sacrifice judgements temporarily relax these acute production or efficiency goals to reduce risks when operations are too close to safety boundaries [59,60]. The organisation supports the flexibility of operating processes to enable adaptive responses to local conditions. Workers have sufficient autonomy to make decisions about their work in real time. This requires employees to have the psychological safety to apply their judgement without fear of repercussion -a 'just culture' [12,20].

Synchronization
To sense and respond effectively to emerging issues, data and information flows freely across boundaries both internal to the  organization (between departments) as well as external (e.g. original equipment manufacturers, contractors, regulators, etc.). This synchronization provides a constant opportunity to: understand the changing shape of the system, the extent to which operations remain within safe operating boundaries, and the opportunity for coordinated action in response to changing demands. This approach combats the structural secrecy, distortion, and deletion of information that can occur across internal and external organizational boundaries through a mode of centralized control [54].

Proactive learning
In all organizations, there is a gap between 'work as imagined' (WAI) and 'work as done' (WAD). Work as imagined is reflected in plans, systems, processes, metrics, and management actions. These do not align with work as it actually happens. Work as imagined, is exactly that, it is not a correct representation of what happens in practice. Rather than interpreting data to fit the existing concept of work and model of risk, proactive learning organizations aim to understand work and then informed by that create a better sense of what it should be [58]. Organizations seek to understand where their operations are becoming brittle and take action to preserve safety margins. This ensures that the system as a whole provides on-going support for people on the front-line to be successful [29]. Organizations adopt a systems view for understanding and managing the safety of their people and technology [37]. With the increasing complexity and interconnectedness of modern organizations, synchronization enables different parts of the organizational system to compensate for unexpected strain on one area of resources or activity [35]. To create proactive learning, organizations embrace and monitor the adaptive cycles of work.

Safety professionals' role under a safety management mode of guided adaptability
A resilience engineering approach to the role of safety professionals was first considered by Woods [59,60] following the Columbia Space Shuttle incident. He described the '4 I's' of a safety organization as 'involved,' 'informed,' 'informative' and 'independent' and suggested that their activities should include: involvement in everyday decisionmaking, generating operational information of work as done, owning technical standards, understanding anomalies and emerging issues, and providing expert advice [59,60]. This framework provides the starting point for the development of safety professional activities under a safety management mode of guided adaptability.
It is important to note that the safety management mode of guided adaptability builds on the foundations of the safety management mode of centralised control. This is consistent with the foundations of Safety II, in that both safety I and safety II offer perspectives that are useful to manage work. Resilience engineering literature emphasis 'plan and revise' and the high reliability organisations literature argues for organisations to move between stability and flexibility as the context demands. The safety management mode of guided adaptability extends from the safety management mode of centralised control.
The following safety professional activities have been synthesized from the resilience engineering and Safety-II literature and the organizational capacities outlined in Section 3.1, to support the creation of an environment to guide the safe adaptation of work (see Table 5). Table 6 further provides examples of potential specific tasks under each safety activity.

Explore everyday work
Safety professionals observe everyday frontline work through their independent safety lens, combined with their organizational understanding, and domain safety management knowledge. Through being a participant rather than an authority, and balancing conformance with guiding adaptability, the safety professional is open to exploring emerging information and threats. Woods [59,60] proposed the role of the safety professional as being 'informed' and actively generating information about how the organization is currently operating. Through performing everyday work observations for safety [26] the safety professional acts as a 'learner', seeking context and understanding about what is needed to support safe adaptation and success on the front line. The safety professional engages with operational units, not to make judgments about the safety compliance of their work, but rather to update their own and the organization's mental models of work, risk and organizational life. Through their role as an inside-outsider, safety professionals can identify the gap and what is occurring within it and bring this to the attention of all stakeholders. A large gap between work as imagined and work as done signals a breakdown in the coordination of the organizational system.
Safety professionals focus their attention on studying the adaptations in the gap between work as imagined and work as done. Through understanding, tracking, and analysing these adaptive and co-adaptive cycles of connected teams in the organization, the safety professional identifies sources of resilience and brittleness. Safety professionals understand how teams are adapting, the sacrifices, trade-offs, resource allocations, and re-prioritisations. They understand what teams are adapting to, the procedures and resources that don't work, aren't sufficient, stale and out-of-date. Informed by this, they coordinate action to respond. Safety professionals resist the pressure from management for work as done to conform with work as imagined, as this only drives the gap further apart. Instead, safety professional role addresses the gap by understanding what is happening and providing paths to move  Table 5 Safety professional activities to support a mode of guided adaptability. 1 Explore everyday work to understand the gap between work as done and Work as Imagined, and facilitate updates to the organizations models of risk 2 Support local practices and balancing the job demands of front-line teams 3 Generate action to reduce goal conflict between production, cost, and safety, and negotiate the redistribution of operational resources. 4 Facilitate the free flow of data and information across organizational boundaries 5 Generate future operational scenarios through monitoring internal and external threats, and system vulnerabilities 6 Facilitate the making of sacrifice judgments for safety 7 Facilitate learning processes from both daily organizational life as well as from unexpected events D.J. Provan, et al. Reliability Engineering and System Safety 195 (2020) 106740 forward. They consider which adaptations they re-enforce, and which they undermine. The safety professional positions themselves at the sharp end of decision-making about the adaptation of work and, facilitates stakeholder alignment through cross information. Safety professionals ensure that the organization is able to sense the early signs of trouble. All systems are operating under degraded conditions, some of which the organization knows a lot about, and some of which are emerging and uncertain. The pressure and tension in the organization in a safety mode of centralised control often discounts these 'weak' signals, in the belief that the existing plans and requirements are comprehensive. In a mode of guided adaptability, increases in 'uncertainty' become a definitive signal of emerging risk. The safety professional takes action to understand the issue, sacrificing production as necessary and probing management and technical expert confidence in the organizational understanding of the situation.

Support local practices and guide adaptations
Woods [59,60] described the role of a safety professional as being 'involved' in the organization's operations by having constructive and targeted involvement in everyday decision-making. The safety professional provides support to frontline teams to dynamically balance job demands, resources and other work organization factors. Supporting the local practices of frontline teams enhances resilience [49]. Rather than passively observing, safety professionals facilitate action through mindful cooperation with the frontline workforce. The safety professional can facilitate planning and communication processes, facilitate alignment between the workforce and management, and enable the making of trade-offs and sacrifice judgments on behalf of safety. The safety professional supports front-line teams to establish their operating norms and processes to create dependable task performance. This cocreation of work methods provides a common direction for work that enables effective and efficient team performance and task interfacesconstraints that de-constrain, a very different perspective on rules [1].
To collectively cooperate, the safety professional models and supports open communication that elicits the expectations of line management and the concrete experiences and needs of the frontline workforce. The safety professional promotes an environment of trust, co-operation, and reciprocity [41]. Safety professionals start to guide adaptations by understanding how front-line teams are currently adapting in the gap between work as imagined and work as done. The safety professional identifies where work adaptations are increasing risk and facilitates action to revise work practices. Safety professionals, at the sharp-end of organizations, guide adaptability by deciding which adaptations they support and which they undermine -when to do Table 6 Safety Professional activities, intent, and example descriptions of tasks.

Activity Intent Example Descriptions of Tasks
Explore everyday work Understand the way the organisation is currently operating and where resilience and brittleness is present.
-Engage with and observe the challenges and problems faced by front-line work as done. Facilitate the identification and implementation of safe adaptations. -Understand the issues and uncertainties being grappled with by technical specialists and the organisational discounting of emerging information. Monitor and enhance the rigor applied to safety-critical decision-making. Support local practices and guide adaptations Support local practices and guide adaptations for safety.
-Understand how disturbances, problems and surprises are being detected, understood and responded to -SNAFU catching. Identify the capacities that are supporting safe adaptation and develop actions to extend proactive learning across organisation. -Guide adaptability by deciding which local practices and adaptations to reenforce and which to undermine. Reduce goal conflict and negotiate redistribution of resources Monitor goal conflict and create action to alleviate it. Facilitate the re-allocation of operational resources.
-Monitor organisational pressures; change, cost, production, schedule, resources, etc. Understand where discounting of safety risk and safety tradeoffs might be occurring due to production, cost and other goal pressures. Identify actions to intervene. -Create system wide action to reduce goal conflict through facilitating adjustments to cost, schedule and production goals. -Maintain an inventory of internal and external deployable resources (technical specialists, key roles, critical equipment). -Monitor the needs and gaps in resourcing (people and equipment) across the organisation. Identify and facilitate the redistribution of organisational resources to support changes in operational demands.

Facilitate information flows and coordinate action
Create mechanisms to transfer information and coordinate action across organisational boundaries.
-Create formal and informal mechanisms to receive information about the current functioning of teams across the organisation. Facilitate the transfer of this information across organisational boundaries where it can enhance decision-making. -Coordinate action and operational support to keep pace with emerging demands across organisational boundaries. Generate future operational scenarios Utilise current understanding of the organisation to predict possible future conditions.
-Facilitate the development of possible future operating scenarios and the associated safety risks based on a multi-disciplinary understanding of the organisation. Facilitate the implementation of contingency plans to detect and respond to these scenarios. -Probe front-line workers and technical specialists to identify the uncertainty associated with current operations and safety risks. Facilitate Sacrifice Judgements Support the understanding of trade-off decisions and the resolution of acute goal conflict.
-Facilitate the development of contingency plans, including flexible deployable resources for high-risk activities to enable justified sacrifice decisions to be made -Identify sources of operational uncertainty and use this as a definitive signal that work needs to be closely supported and implement mechanisms to gather more information to understand and respond to the changing shape of risk.

Facilitate Learning
Create organisational change based on current conditions and future scenarios.
-Continually monitor the culture of the organisation detecting any sources of blame and sanctions in relation to safety and operational performance and implement actions to restore trust and openness. -Develop and conduct training in dealing with anomalies and surprises, to enhance the organisational capabilities for: anticipation, revision, initiative, and reciprocity. which -support change or require conformance. This challenge should not be underestimated, as it requires the safety professional to create change, in responses to information that is not as definitive, as it would seem in the case of an incident. Safety is something that you do (i.e. safety management), it is not something that you have [30]. The tensions and challenges described in this paper remain in the organization, and the safety professional role needs to become the focal point between the pressure for centralized control from above, and the need to guide adaptability below. The safety professional becomes a key facilitator of action -they help plans and adaptation to co-exist rather than to compete.
If we now think of safety professionals as sharp end actors, they are positioned locally, not hidden in back offices. They are close to: operational and line management environments, decision making processes, and sources of data and information. Safety professionals understand the conflicts and trade-offs in the operational environments, they interpret the emerging signals, and they anticipate problems. Safety professionals require management support for guiding adaptation at the sharp end, as in different situations they will sometimes require compliance, and sometime sacrifice production.

Reduce goal conflict and negotiate the re-distribution of resources
The safety professional initiates system-wide action to respond to threats. These actions relate to decisions concerning: continuing operations, reducing goal conflict, and the dynamic reallocation of resources. The safety professional facilitates the adjustment of organizational and operating unit goals when they threaten to trade off safety margins. These goals include: production targets, financial budgets, resource levels, contract requirements, project schedules etc. The safety professional should aim to build safety into the organizational system and the way that it continually operates [37].
Safety professionals are able to directly influence the resource allocation within and across operating units. They create and maintain an understanding of the organizations total deployable reserve resources. The safety professional can claim, negotiate and re-distribute human, financial and technical resources. Investing in safety management is most important when management of an operational unit believes they cannot afford to [59,60], such that the safety professional and local operating units have the authority to requisition additional resources to absorb unexpected demands.
Guided adaptability preserves the idea that planning and proactive coordination is useful. However, always understands that it isn't complete and so the organization constantly searches for new and emerging information. All plans and models of risk are only partially correct, and while work to plan is reasonable in the first instance, organisations have to be able to recognise and adapt as things change. Guiding adaptation is helpful for achieving safety and other organizational objectives. Safety professionals understand, and have their organizations understand the shift from, 'plan and conform' to 'plan and revise.'

Facilitate information flows and coordinate action
The safety professional provides a useful resource to actively facilitate communication across organizational boundaries and therefore limit structural secrecy between departments. The safety professional through their interactions and understanding of all parts of the organization can identify communication needs and gaps across operating units, technical departments, and support teams. The safety professional directly facilitates this information and data flow in the interests of safety, from where it is known, to where it needs to be understood. Not only within the organization, the safety professional identifies and facilitates the organizational understanding of external knowledge about technology (original equipment manufacturers), safety science (academia), safety practices (regulators and industry partners), and specialist activities (contractors). Ensuring that information and data is in the right place in the organization at the right time, enables better decision-making for safety.
The safety professional looks for signs of fragmentation and provides support where problems cross-over and break-down at organizational boundaries. They identify and work to resolve the things that are undermining collaboration, which builds the potential for coordinating in response to future events that are different to those experienced in the past. The safety professional becomes part of making the system work by highlighting where coordination is breaking down, or how it can be enhanced.
Safety professionals establish intelligence-gathering lines of communication to key people and data systems across the organization. This intelligence includes: people changes, resources scarcity, operational shifts, goal conflict, or changes in the external operating context of the organization. This real-time information provides the safety professional with insight for where safety risk may be increasing, tradeoffs occurring, and safety margins eroding. The safety professional validates this system level information with local operating units.
Safety professionals amplify the voice of the frontline and domain experts to compensate for the impact of power, hierarchy and production pressure within organizations. Woods [59,60] also described the role of a safety professional as 'informative' referring to providing information about system vulnerabilities to reframe and direct interventions. Safety professionals are uniquely placed in the organization to provide this information, as they have knowledge of the system as a whole, as well as the functioning of local operating units. The safety professional has experience of life at the 'sharp-end' of the organization as well as with 'blunt-end' decision-making.
Repeated observations of front line activities enable the safety professional to identify operational changes and probe the potential for normalization of deviance [55]. Monitoring these adaptive cycles of workers and teams embedded in the larger organization also provides local data to compare and contrast with system level data. Safety incidents are easy to see, however operational performance is about normal work where the people, technology, and processes within the system sense and respond within safe system boundaries therefore not resulting in incidents. Safety professionals provide fresh insight and actionable suggestions to maintain safety and improve system performance.
The safety professional organization in part, operates like a shadow, parallel, or redundant communication and coordination network throughout the organization. Safety information can be exchanged between safety professionals in different departments with a minimal level of distortion due to their consistent safety vernacular. Safety professionals translate information into ways that their local operating units and functional departments understands -be that operations, project management, engineering, procurement, finance, etc.

Generate future operational scenarios
The safety professional provides information about the changing vulnerabilities of the system gathered through monitoring activities. However, more than providing information, the safety professional creates risk foresight from this information using their domain safety knowledge and their intimate understanding of the organization [43]. Safety professionals facilitate analysis methods to understand the resilience of the organization, that might include: systems-theoretic accident modeling and processes (STAMP), resilience analysis grid (RAG), and functional resonance analysis method (FRAM).
Safety Professionals generate potential future operating scenarios and the safety risks associated with them. Safety professionals model and predict the short, medium and long-term effects of line management decisions and adaptations within the organization. This is much broader activity than safety hazard assessments, and involves sophisticated scenario modeling that plots interdependencies and potential cascades [63]. Creating safety risk scenarios relating to the current decisions and actions of people and the trajectory of the organization will likely challenge conventional assumptions of line management about safety risk [59]. For this reason, Woods [59,60] suggested the safety professional needs 'independence' to perform their role effectively. This cognitive, social and organizational independence allows the safety professional to challenge models of risk, bring this perspective to the organization through an independent voice, and have the dedicated resources to perform monitoring activities, and facilitate change.
Safety professionals are constantly looking for information about where the boundaries are in the system and therefore where brittleness is present. To monitor the organization the safety professional operates and is informed at both the system level as well as the local operational level. The safety professional keeps a discussion about risk alive even when everything looks safe [13,19] and supports the organization to revise mental models of operational risk as new information emerges and evidence accumulates [59,60].

Support and facilitate the making of sacrifice judgments
Safety professionals enable and maintain a commitment to supporting operational performance and safety at the very top of their organization. Their role is to provide a safety lens over the entire system, in a way that promotes a 'devotion to safety' alongside other system and organizational goals [31]. This commitment to safety is maintained alongside the organization's production and financial objectives and compensates for the 'faster, better, cheaper' imperative of modern organizations. The safety professional directly influences the adjustment or cessation of critical operational activity where safety margins are not sufficiently understood. To be effective, this commitment needs to be reflected in all the actions and behaviors of the organization and supported by the creation of a 'just culture' [20]. The safety professional has a critical role in facilitating the understanding of, and role modeling the behaviors present in a just culture.
Safety Professionals create, support and share experiences where safety management is prioritized over production and financial objectives. This can be a situation where workgroups have adjusted their work due to emergent safety concerns, or additional unbudgeted resources have been provided to preserve safety margins. Celebrating sacrifice judgments as a success encourages managers and employees across the organization to do the same. Safety professionals celebrate the tender that was lost because safety was priced in, and the project team that went over schedule and over budget to maintain safety margins that were required for unforeseen and therefore not planned for issues. The organization sees these as successes for safety, and this is very different to other organization's models of success.

Facilitate learning
The safety professional facilitates organizational learning processes at a system, team and individual level, from both normal work as well as from unexpected events. Continuous learning enables the organizational to keep pace and the maintain organizational alignment on a shared model of risk [59,60]. To understand an unexpected situation that occurred within the organization the safety professional facilitates an open, unstructured inquiry with the people involved first-hand. The safety professional enables an exchange of perspectives on the situation amongst the stakeholders that can evolve towards a shared picture of risk and action [43]. What needs to be learned and changed within the system is a judgment of the individuals closest to the point of risk, or experts in the situation, and is not be made by the safety professional and line management alone. The safety professional through their understanding of how the system functions, and how work is done, can own and facilitate these organizational learning processes. The direction of this learning process is 'up and out' [13,19], taking information from the frontline and interpreting it in a way that enables the system as a whole to learn and adapt.
In the safety management mode of centralized control, learning comes from significant safety failures (i.e. accidents) or near safety failures (i.e. near misses). The efficacy of improving the chance of improving safety outcomes through learning from failure is often debated in the safety literature (e.g. [27]). The safety management mode of guided adaptability instead learns from adaptations that create success. These are the situations where surprises and new information emerged, and the organization was able to revise its plans and models, and successfully adapt to the situation [62]. The safety professional supports the organization to understand how this successful adaptation occurs, what information and resources are drawn on, how is it interpreted and deployed, and what further capacities are critical to these situations.
Safety professionals are constantly communicating with and supporting the education of others in respect of safety management and operational performance. To do this effectively, safety professionals have an advanced understanding of many disciplines, including: resilience engineering, systems theory, complexity theory, cognitive psychology, and sociology. They are able to share this knowledge effectively with others in applied situations.

Organizational responses to a mode of guided adaptability
In Section 2.3 we outlined the adaptive cycles of front-line work from a mode of centralized control. There are adaptive cycles of frontline work as it responds to the new pressures of a guided adaptability mode of safety management (see Fig. 2). It is important to understand how the role and activities of safety professionals influences their organisation.
Safety Professionals coordinate and connect organizational activity through: focussing activities at the sharp end, understanding the gap between work as done and work as imagined, probing uncertainty as a definitive signal of pending trouble, and coordinating activity across organizational boundaries. We acknowledge that 'safety differently' professional practice is in its infancy, and hence the descriptions proposed in Section 3.2 and specific tasks in Table 6 are not likely to be a reflection of current practice.

Conclusion
The central theme of centralized control is 'plan and conform', while the central theme of guided adaptability is 'plan and revise'. Resilience engineering theory always specified guided adaptability, but often got misinterpreted as the opposite end of the control-adapt paradox due to the entrenched Safety-I practice in organisations. Consistent with the origins of Resilience Engineering, Safety-II, Safety Differently, and High Reliability Organisation theory, guided adaptability is not about choosing between control or adaptation, but about helping safe variations happen, and helping variations be safe. Managers, safety professionals and frontline workers need to determine when, for a given context, the safe course of action is to comply with standardised practices, and when the safe course of action is to adapt.
Whilst sympathetic to the reality of Safety-I practice within organizations, we have shown the necessity for safety professionals to transition their safety management practice towards enabling a mode of guided adaptability in the interest of improved organizational safety outcomes. This will move the profession closer towards its fundamental responsibility to create foresight about the changing shape of risk, and facilitate action, before people are harmed [58].
The important first step for the safety profession is to acknowledge that their role is presently trapped in a mode of centralized control, where they spend too much safety energy on reactive, fragmented and defensive activity. Alongside the recent theoretical, and empirical research developments in managing safety in complex systems, some safety professionals want to add activities aligned to a guided adaptability mode of safety management, but they are not sure how to startthis paper addresses this problem. Sections 2 and 3 provided the two modes of safety, and the role of safety professionals. Whilst the safety professional role we described in a mode of centralized control (Section 2.2) is strongly informed by current safety practice [43], the role in the mode of guided adaptability (Section 3.2) is more tentative based on the authors' own interpretations of the implications of current safety theory for safety professional practice. The role of any individual safety professional will also necessarily be shaped by their specific role, as well as the domain and operational context of their organisation. The safety professional needs to have the autonomy, flexibility and discretionary resources to reshape their role in response to changing needs within the organization as they move towards guided adaptability.
The safety professional role evolves to be part of helping the organization be successful, not just a 'detect and repair' mechanism for safety compliance problems. The role shifts where is sits in the world, from being an agent on behalf of line management's formal authority, towards being a participant at all levels. In a safety management mode of centralised control, there is no genuine participating, no collaborating, and safety professionals are telling the front-line teams what to do for safety management. In safety-I, together with line management they are part of processes that always results in new injunctions or demands -"we are the safety management authority who speaks to the front-line workers about how it should work". In a safety management mode of guided adaptability, the safety professional is part of what makes the organization successful, that is effectively adapting to emerging situations, and overcoming challenges where things didn't work as planned or imagined. Safety professionals help their organizations be successful in a changing, complex world.
The role of safety professionals in a safety management mode of guided adaptability is very different than in a safety management mode of centralized control. We have described tasks and activities of a safety professional that is within the potential authority of the role, however we acknowledge that it is one that would require significant relational influence over many other roles in the organisation, in particular line management. Whilst the implications for the mindset and capabilities of safety professionals is outside the scope of this paper, they are considerable. Some safety professionals may find moving towards a safety management mode of guided adaptability a tremendous burdenmoving from setting rules, monitoring compliance, investigating incidents, and preparing safety reports, to -being a sharp-end operator, contributing to the success of the company, studying adaptations, making decisions on what to re-enforce or undermine, coordinating activity across boundaries, and openly probing and questioning technical specialists and management. Performing the role of a safety professional in a safety management mode of guided adaptability requires good people, and a mindset and interpersonal capability that is vastly different to that likely to be found among safety professionals currently performing their role in a centralised control mode of safety management [24,43]. As [23] proposed, safety professionals need to evolve from single loop learning regarding reactive correction of deviations, to deutero-learning which concerns themselves as well as managers and operators becoming better learners. Organizational leaders and line managers will play an important role in supporting safety professionals to move towards a safety management mode of guided adaptability. The safety professional needs to be resourced and empowered to change, requiring: investments in inquiring and analysing problems that are not definitive, sacrificing production and other organizational goals to maintain safety margins, and questioning and probing technical specialists and all levels of management. Line management will be resourcing roles to independently question their decisions and actions [59,60].
The key contributions of this paper are: 1 Articulating the two modes of safety -'centralised control' and 'guided adaptability'; 2 Explaining how the two modes creates tensions and adaptations to the role of safety professionals and front-line workers, 3 Enabling guided adaptability by providing a first specification for the safety professional role, and: 4 Clarifying aspects of Resilience Engineering theory in relation to the control-adapt paradox.
We suggest that the next important step in the development of the safety professional role in a safety management mode of guided adaptability is to develop role specifications and case studies for specific industries and levels of position (which will improve, change, and get more specific over time). By re-opening the discussion on the role of safety professionals and the alignment to their organisation's mode of safety management, this paper aims to personalise the Safety-I versus Safety-II dialogue within the safety profession. Are safety professionals supporting and reinforcing a centralized control mode of safety management, or are they dynamically balancing the needs of people on the front-line to sense and respond successfully to emerging situations and changing context though a safety management mode of guided adaptability? Are they the 'controller,' or are they the 'guide?'