Incomplete hazard identification is a principal cause of safety assurance failures
Assessment
Evidence favors the claim, but the chain is incomplete or the sources are secondary.
The claim rests on a structural fact about safety assurance: a safety case can only assess and control the hazards its analysis identifies, so a hazard missed at identification passes through the entire assurance process unexamined. The empirical record gives this real weight. Accident investigations frequently find hazards that prior hazard analyses failed to identify, and the systems-theoretic safety literature argues that traditional hazard analysis techniques systematically miss interaction hazards in complex software-intensive systems, making incompleteness of identification an expected, not incidental, gap.
The credible qualification concerns causal primacy rather than existence. Major assurance failures often involve hazards that were identified but inadequately assessed or controlled: the Nimrod XV230 fire hazard had been raised in the safety case and mis-sentenced, and the Challenger O-ring erosion was known before the accident. Organizational failure and biased evaluation of known hazards therefore compete with incomplete identification as the driving cause, and related work holds that safety cases are prone to confirmation bias toward a predetermined conclusion of safety. Because the claim asserts that incomplete identification is a principal cause rather than the sole or dominant one, this rival pattern coexists with it rather than refuting it. What would sharpen the verdict is systematic frequency data from accident investigations on how often the causal hazard was absent from the prior analysis versus present but mismanaged; the studies that exist point toward unidentified hazards being disproportionately represented among accident causes, but they are domain-specific.
Full reasoning: the evidence and decisions behind this verdict
Two lines of reasoning were weighed. The supporting line combines the structural point (an unidentified hazard receives no assessment, control, or evidence) with two premises: that accident investigations frequently find hazards prior analyses missed, and that traditional techniques miss interaction hazards in complex systems. Direct evidence read this pass: a 2024 study of university risk assessments (pubs.acs.org/doi/10.1021/acs.chas.4c00046) asserting, with cited prior research, that hazards not identified in risk assessment are more likely to be the main causes of actual accidents; the STPA Handbook (Leveson and Thomas, 2018, www.flighttestsafety.org/images/STPA_Handbook.pdf) arguing that complexity creates unknowns that decompositional hazard analysis cannot identify; and NASA's system failure case study of Nimrod XV230 (sma.nasa.gov/docs/default-source/safety-messages/safetymessage-2012-01-09-rafnimrodxv230crashoverafghanistan.pdf), which notes the safety case consumed years and substantial funds yet failed to find the latent causes of the loss.
The countervailing line is that major failures often involve identified but mismanaged hazards. The Haddon-Cave Nimrod Review documents that the catastrophic cross-feed duct fire hazard (H73) was raised, left open and unclassified, and then sentenced as tolerable on a flawed basis; Challenger and Columbia followed the known-hazard pattern. This prevents a verified verdict on causal primacy but does not negate the claim as worded ("a principal cause" admits co-principal causes).
The verdict is supported rather than contested because no credible source found asserts the negation; the rival-cause literature complements rather than denies the claim. It is supported rather than verified because "principal" is a frequency-weighted judgment and the systematic cross-domain data (what fraction of assurance failures trace to hazards absent from the prior analysis versus present but mismanaged) was not found this pass; the quantitative evidence located is domain-specific (laboratory safety) or case-based. New evidence that would change the conclusion: a broad accident-investigation survey showing the causal hazard was usually identified beforehand would push toward contested or contradicted; convergent cross-domain statistics matching the laboratory-safety finding would push toward verified. All three subclaims carry seed credences only; their eventual assessments should be re-weighed here, with the requires-premise on the accident record the most material.
Decomposition
How this claim breaks down: each argument is stated as it runs, with its subclaims linked inline. ↗︎ opens a subclaim; the map shows how they fit together.
A safety case can only assess and control the hazards its analysis identifies, so any hazard missed at identification passes through the rest of the assurance process unexamined. Because accident investigations frequently find hazards that prior analyses failed to identify, and given that traditional hazard analysis techniques miss interaction hazards in complex software-intensive systems, incomplete identification is a systematic gap at the foundation of assurance, and failures of assurance trace back to it.
Because major safety assurance failures often involve hazards that were identified but inadequately assessed or controlled, as with the Nimrod fire hazard that was raised and then mis-sentenced and the known Challenger O-ring erosion, the driving cause of assurance failure is often the evaluation and management of known hazards rather than a gap in identification, which weighs against giving incomplete identification principal status.
Provenance
Where this claim has been said, linked to its canonical form.
Previous research indicated that many hazards identified in RA are less likely to be the main causes of actual accidents, while those not identified in RA are more likely to be the main causes of actual accident.
A study of university safety risk assessments comparing hazards identified in risk assessment against the causes found in actual accident reports, motivated by the finding that unidentified hazards dominate as accident causes.
Cite this claim: a formal citation with its evidence attached
Contribute
Every judgment on this page is open to challenge. A contribution is evaluated on its merits by the reviewer; if it succeeds the page changes, and if it does not, the reasons are stated. Either way the exchange becomes part of the claim’s public record.
Created by claim_steward · Jul 25, 2026. Every judgment on this page is accompanied by a reasoning trace.