Speeches

The Evolution From a Canadian Perspective

Abstract

The premise underlying this paper is that, from the perspective of the investigator, the operator, the regulator, and the investigator, can all interact and meet their mandates without materially interfering with the work of the others. The paper uses an historical perspective, with some examples, to illustrate an evolution of interactions and relationships. It shows that the interactions can be constructive. It also shows that the relationships resulting from the interactions, to be effective, require a great deal of thought and care.

Text

Based on what we see, the operator carries out business within the boundaries set by the regulator, and in normal circumstances the investigator has no mandate to be involved in their interactions. It is only where there is a failure in the safety system, i.e., an accident or incident, that the investigator enters the picture to analyse the failure. Immediately after an accident, in most cases, both the operator and the regulator are extremely busy. They are dealing with the accident itself, with media demands and, often, with the families of victims. The operator is likely facing a significant loss of business, while the regulator is facing a loss of public confidence. They are also preparing to meet liability claims that are so large that they can injure a government and destroy an operator. It is into this charged environment that the investigator arrives. The requirement to accommodate an air accident investigator is a rare experience for any individual operator, and even for the regulator it is an unusual event.

At the outset, as the investigator, we presume that the organizations of both the carrier and the regulator are populated by highly motivated, well trained, honest people who truly care about their work. Like others who do thorough, careful work, they tend to feel severe discomfort when their errors and oversights are analysed in public. They are also likely to be very sensitive to criticism, whether explicit or implied. For those reasons, we try to make our statements on cause-related findings, or on safety deficiencies that we have uncovered, just strong enough to bring about a change in practice or behaviour that will eliminate or reduce the safety problems that we have identified. We also try to acknowledge in our reports any remedial action that is taken before the investigation report is finalized. This tends to do two things: first, it reduces defensiveness in the responses from both the regulator and the carrier and; second, it encourages very quick action to deal with the safety problem. These, in turn, help to get risks out of the transport system quickly and help avert criticism of the operator or regulator that might otherwise be inferred from the investigation report. The assumptions that we have made about the operator and the regulator, and the actions that we take consistent with those assumptions, form a large part of the base for the interactions that we have with them and also establish the tone of our overall relationship.

Both the regulator and the carrier are normally well equipped, technically and managerially, to analyse and remedy any safety problems that arise. Nevertheless, the Government, reflecting public will, has decided that there should be an independent, objective analysis of transport safety failures. The maintenance of objectivity requires an independent investigation, one that can eliminate, or at least minimize, public concerns that the carrier and/or the regulator, might suppress safety issues that could reflect unfavourably on them.

All accidents where there is significant loss of life, or damage to property or the environment, attract considerable public attention. That attention has increased rapidly over the past 15 or 20 years, and this appears likely to continue. The number of media representatives and their demands affect significantly the investigator's conduct during the critical first days of an investigation. Accident sites are now regularly visited by Ministers responsible for departments, and heads of governments are to be seen at the larger accidents. Such accidents also involve numerous organizations, each of which has, or at least claims to have, a legitimate role in the investigation. Experience tells us that several organizations are likely to perceive themselves to be in charge following an accident. To some degree they are often right. Their different, and sometimes conflicting, mandates put pressure on the various organizations to be competitive--and even confrontational. Major accidents of any kind are rare events, and those with a part to play will change from accident to accident. We find, not unexpectedly, that those who have either an obligation or a desire to be involved often do not have pre-established arrangements for working at the accident site. With the possible exception of accidents that release, or are likely to release, nuclear radiation, aviation accidents gather the most attention. They occur with enough frequency to justify some planning, but they take place in generally unpredictable locations. While those with an interest will vary depending on the particular situation, there is a core group, and at least they can have pre-established working arrangements. The group would include, at the minimum: the carrier, the regulator, the investigator, the manufacturer, the police, the coroner, and emergency services organizations. Such agreements will never cover all the contingencies of a major investigation, but they can usually be worked out in the calm between accidents, and they can "regularize" enough of the interactions that those left over may be managed at the time of an accident.

The interactions of the operator, the regulator, and the investigator are subject to many external influences when there is an accident. To examine the interactions among them, I have chosen to give minimal attention to all the other influences that contribute to the dynamic of an accident investigation. The approach is much like that taken by an economist who might discuss the effects of education on the productivity of the labour force. The nature of the effect of education on productivity, if fairly well isolated, can be seen with reasonable clarity. If mixed with all other forces in an economy, its effect will be difficult to see. Similarly, the interactions of the operator, the regulator and the investigator can be best seen when isolated, to the extent practicable, from the many other factors that may modify or even overwhelm the effects of the particular factors. The result here, too, will show a direction, but there are so many interdependent factors that one cannot produce a reliable vector.

To simplify things further, after reducing the interactions to a universe of three organizations, I will limit consideration of the interactions primarily to those that involve the investigator. That is, I will look at interactions between the investigator and the regulator, the investigator and the operator, and the investigator and both of the others. The points illustrated in this paper do not package the interactions in any neat way. Rather they are generally mixed together and, where suitable, they will be made in the context of examples. I will not discuss the interactions that are only between the operator and the regulator. When using the term operator, unless otherwise stated, I will confine its meaning to that of the air carrier. That gives a tidy little set of responsibilities and relationships to examine.

For illustrative purposes, I will let brevity outweigh completeness in stating objects for the three kinds of organization. Any operator has an object that can be generally described as the safe and timely carrying of people and goods by air with a view to succeeding as a commercial enterprise. The regulator has an object that can broadly be described as ensuring that the operators are fit to enter the business of carrying people and goods and to set and monitor standards that will assure the safe conduct of the operator's business. The investigator has the mandate to produce an objective and competent analysis of safety failures in a timely manner.

From an organizational perspective, at one extreme the operator, the regulator and the investigator may all be part of one entity. At the other extreme, they are absolutely independent of each other. In most states they are somewhere between the extremes, with continuing public pressure to have them become more independent. From within the regulator, there is likely to be a counteracting pressure to keep together what is sometimes referred to as the family, consisting of the operator, the regulator and the investigator. In its Annex 13, ICAO have produced one set of words to establish the independence of the investigator from the regulator. There are no differences filed by any state on that point or on the object of air safety investigations. ICAO has stated that the sole object of the investigation of an accident or incident shall be the prevention of accidents and incidents. It further asserts that it is not the purpose of an investigation to apportion blame or liability. Nevertheless, there are large differences in the way that principle is applied among the signatory states, and a surprising number of states have not signed at all. The more independent the investigator, the easier it is to have clear and consistent interactions with the regulator and the operator.

How did we get to where we are? The investigation of transportation accidents in Canada was, for many years, carried out competently and efficiently by the transportation regulatory agencies. Gradually, the public began to note, particularly in aviation, that the regulator (the Department of Transport) set the safety standards for the industry, operated elements of the system such as airports and air traffic control, licensed the carriers and the crews, and enforced its regulations. At the same time, it analysed the safety failures in the industry in which it had such a pervasive presence. The public began to doubt the appropriateness of the system and later began to ask for some reforms. Officials within the Department of Transport protested that they knew the industry better than anyone else, and that they were competent and objective. This was generally an accurate view. However, the dissatisfaction grew and there were, as one might expect, many studies. Some were done by officials within the Department and some were done by outsiders.

There were two main forces at work. One reflected the growing view that the country's largest air carrier should no longer be a government corporation ultimately responsible to the Transport Minister, and it would do a better job in private hands. The other was that there was a conflict of interest when the regulator operated much of the air transport system and also analysed its failures. Those within the Department saw mostly the advantages of the status quo, the outsiders developed an ever clearer voice that change was required, and not just for aviation. Many recognized that officials were generally competent and objective but worried that they might not always be objective, particularly when the stakes were high. By the mid 1970s the transport safety investigation function was still housed within the regulators' organizations. There had been some attempts to separate the safety investigation function from the rest of the department, but it clearly remained part of the regulatory authority. The public demand for change was significant but certainly not overwhelming. The Government introduced a Bill to establish the office of an independent Commissioner of Transportation Accident Investigation. The Commissioner's mandate would be to investigate fatal air, marine and rail transportation accidents, and also to investigate some nonfatal accidents of particular interest. At that time society saw the consequences of the accident, expressed by the number of fatalities, as the paramount factor in justifying an investigation. Generally, attention was on cause. The importance of discovering the underlying safety problems had not yet caught the attention of most of those who were involved or interested.

By the late 1970s investigators and legislative drafters made some large steps forward in the thinking about accident investigation. It was accepted that the cause of a transport accident probably could not be determined with scientific certainty. It was also accepted that cause so often led to blame that it would be preferable to distance its determination from the responsibilities of the safety investigator. Complicating matters a little was continuing public expectation that something be said by the investigator about cause in investigation reports. To accommodate the several views present at the time, the Commissioner was to be directed to make findings "on causes." That is, the Commissioner would discuss findings that appeared to be related to cause, but would not be directed to state "the cause" or "the probable cause" as had been the custom. The government proposal also included direction to identify system-wide safety deficiencies. In some investigations, this would have the effect of moving the focus of an investigation from the circumstances of the individual accident to symptoms of system-wide problems identified in the investigation and, more importantly, to safety problems that might not be related to cause. From what I have been able to determine, this was the first attempt to put into legislation the explicit object of using safety investigations to uncover systemic transport safety problems. That Bill died on the order paper at the end of a Parliament. The Bill had raised the possibility of the accident investigator being both independent and in possession of a broadened mandate. Those possibilities raised concern in the regulator's organization and tended to magnify any difficulties that there were in the interactions between the regulator and the investigator, both of whom were still within the Department of Transport.

The debate on cause, and its eventual resolution, also had a profound effect on the interactions of the investigator with the operator, the regulator and the public. By moving away from statements of cause, the investigator could concentrate the message of the investigation on the identification of safety deficiencies, or risks; the discussion could be directed towards those things that needed to be changed, and away from blame for what had or had not been done. This gave the regulator more discretion in dealing with the issues, and, with the absence of an explicit cause, there was less concern in the regulator's organization about defending itself. On the other hand, giving the investigator the duty to comment on any safety problems uncovered in an investigation broadened the investigator's mandate. In the new scheme of things, a deficiency need not have led to an accident for it to be raised publicly, for the regulator to deal with. Here was a new and--from the regulator's point of view--not altogether welcome basis of interaction. The regulator was to find the investigator in new areas. The investigator, for its part, had to take care not to go beyond its investigation mandate and become a new level of inspector or enforcement officer.

There was a significant event that let the government resurrect the stillborn Bill that was to create a Commissioner of transportation accident investigation. Such events at times provide governments, an opportunity to pass legislation that would not have had enough public support to be near the top of the legislative agenda. The event was triggered by a February 1978 Boeing 737 accident in western Canada. The aircraft was landing in reduced visibility at an uncontrolled airport in a mountainous area and shortly after touch down the pilots saw snow clearing equipment ahead of them on the runway. They attempted to a go-around but shortly after becoming airborne the aircraft became uncontrollableand it crashed beside the runway. There were numerous fatalities and serious injuries. Not long into the investigation the investigators were accused of incompetence and of destroying evidence. The public reaction was strong and other aviation safety issues were raised and debated to the point where the government appointed a judge to conduct an inquiry into aviation safety in Canada. The high profile inquiry lasted over two years, and its first report, in late 1981, dealt with aviation accident investigation. The inquiry documented a couple of instances where, at higher levels within the Department of Transport, attempts had been made to influence the work of accident investigators. That was sufficient for the judge to recommend an independent federal agency to investigate aviation accidents and incidents.

The government was ready, and proceeded with the drafting of new legislation. The result was the Canadian Aviation Safety Board, which began operations in 1984 as an independent agency with an innovative and comprehensive accident investigation and safety mandate. The new organization was established with a mandate to conduct independent investigations into accidents, incidents and hazards associated with the operation of aircraft. It was to make findings and identify safety deficiencies and make recommendations to eliminate or reduce those deficiencies. It was specifically not the object of the new agency to assign blame or liability. Most of that mandate was plucked, in a rough manner, from the responsibilities of the competent and dedicated regulator. There were obviously some new interactions required, some relationships to repair, and others to build. That is where the real experience began. That is where we made most of our mistakes. That is where we almost failed. That is where we learned most of what eventually became the constructive, professional, independent and businesslike relationships that we enjoy today; relationships that are under constant pressure and take relentless attention if they are to be maintained. That is where we learned much of what made, later, for a smoother transition to the Canadian Transportation Accident Investigation and Safety Board, which took the aviation safety investigation principles and extended their application to marine, rail and pipeline transport in 1990.

Our mistakes were those of an infant organization. We seriously underestimated how difficult it would be to introduce a new concept of air safety investigation. One can go back to the 15th century and the writings of Machiavelli to see the difficulties of introducing a new order of things. And in the 16th century Copernicus explained a new order in the heavens, but articulating the new concept did not guarantee its immediate acceptance. The new concept of air safety investigation had been articulated; it seemed a relatively small administrative change, and we did not expect serious problems. We did not really understand the effects the change would have on people who were competent and dedicated and who saw no good reason for it to take place. We seriously underestimated the sensitivity of those whose actions we were going to analyse. We presumed that the change in the law combined with the logic of the change would bring everyone along with a good degree of enthusiasm. We did not really understand the regulator's dedication to, and firm belief in, the old ways. We did not understand how seriously their feelings would be hurt when part of their job was taken away. We did not think about the combining of forces of those who were opposed to change, with those whose lives would be made more difficult by the new scheme of things. We did not anticipate how variable our relationship with the operators and the regulator would become. We seriously underestimated the work that would be necessary to make our agency known and understood. We saw the legislative change take place, our offices were moved, we got new letterhead and all those things, but few seemed to take note. Many of those who saw the change asserted that there were still connections with the regulator, they just were not obvious anymore. We overestimated our ability to bring about change through our reports and recommendations. We thought that once the new agency had made safety recommendations, the world would want to take them and fix things. We had not expected that we would be told that the recommendations were not practical, or that they were reasonable but not of high enough priority to be implemented. We underestimated the ability of recipients of recommendations to appear to accept them while doing little or nothing about the safety problem. We put a lot of effort into managing the interactions between ourselves and both the regulator and the carriers, but we did not understand the relationships well enough to have managed them as effectively as we might have.

Most independent government boards and commissions are judicial or quasi-judicial and determine or affect the rights and freedoms of individuals. They let you immigrate to the country, or not; they determine you to be a refugee, or not; they say whether you qualify for a pension; they determine whether you have been appropriately dismissed by your employer; they determine whether you should be freed from prison. Accident investigation agencies tend to be different. Most do not decide on rights and privileges. They do not determine what is to be done. They tend to limit their activities to identifying and validating safety problems and recommending that they be resolved.

Both administrative efficiency and fairness can, at times, be best served by distancing some functions from direct political control. I believe that ensuring fairness and public confidence are legitimate reasons for creating an independent transport accident and safety investigation agency. Administrative efficiency, while always desirable, is not sufficient reason to create an unelected, independent body to carry out some of the functions of government. To be clear, our transport accident investigation and safety agency is neither judicial nor quasi-judicial in nature. It is entirely an administrative agency. Thus, it does not determine anyone's rights or obligations. Being administrative rather than judicial or quasi-judicial defines some of its interactions. Of concern in this paper are only those with the operator and the regulator.

To give an incentive--to come forward quickly and openly--to those providing information to the investigator, it is necessary to have a policy that prevents that information from leaking through to the regulator. That policy was so important to the idea of getting safety information in the quickest possible way that it was made part of the law. It does strain the relationship with the regulator from time to time. The regulator has to accept that, in Canada at least, the notion of public interest gives precedence to the accident investigator, over the regulator, in the gathering of information. It means that the accident investigator will interview a witness, normally not under oath, and with assurance of the statement remaining with the safety investigation agency. If the regulator wants information from that witness, it requires the regulator to conduct a separate interview in a regulatory atmosphere. The regulator often feels that the accident investigator has information that he will not or cannot share, and that is so. This tends to put a strain on the relationship between investigator and regulator. However, it is necessary for both public confidence and independence.

In speaking of independence, what is meant in the context of the interactions being looked at? Independence can mean many different things; the notion probably cannot be expressed with universal application, even within the narrow function of transport accident investigation. One thing about the independence of an accident investigation agency is certain: its independence is not absolute. The legislative authority can change the mandate of the agency when its will is sufficient, and can eliminate it if the provocation is sufficient. Investigation agencies may be established by statute and characterized as independent and the members may be appointed with guarantees of independence and security of tenure. However, at the end of the day the arrangement is at the pleasure of the legislator. In our case, that is Parliament. What Parliament formed it can dissolve, and with public support it can carry out the dissolution, certainly not as a matter of convenience, but with the support of both Houses of Parliament it has been done. The path to forcing the replacement of a safety Board is steep and rocky, but one that can be negotiated by Parliament when necessary. Boards may be independent but they are not independent of the will of Parliament. If they misbehave seriously, they will have to answer. Parliament delegates some responsibilities of government to safety Boards, but remains capable of retaking control. We may have an arms length arrangement, but Parliament ensures that the arm is always a little bent at the elbow. For its interactions with others, that reality puts a discipline on the investigative agency.

Since there are limits to independence, and independence has such a large influence on interactions, what must boards do to live within the limits of their independence? Broadly, they must exploit their mission, they must maintain appropriate standards, both operational and ethical, they must develop the human element of their organizations, they must develop and maintain appropriate relationships and, finally, they must be prepared to manage crises.

Boards that carry out less than their full mandate are inviting others, usually departments (particularly the regulator) to move in and start doing some of the agency's work. Once started, the process will be very difficult to reverse. Often it will bring the regulator back into the very activity that the investigation agency was established to replace. When regulators and investigators have the same Minister it is next to impossible for the investigator to keep out senior departmental officials and the Minister's staff, both of whom tend to focus on the requirements of the larger regulatory authority. While it is next to impossible to keep them out, one must make it next to impossible for them to get in. In matters involving Ministerial approval, one must face and resolve the dilemma of the Minister getting advice from his officials, particularly the regulatory officials, on the investigator's proposals for funding, etc. It is a matter that requires unrelenting attention. It is also a matter that must command the attention of both the investigator and the regulator at the highest levels to ensure that the interactions are appropriate.

If the investigator needs resources to meet its mandate, it must find a way. One must not become saddled with an agency that cannot do its job for lack of resources. Even when competing with a regulatory Department through a common Minister, the investigator must be heard. If necessary, it is better to resign on principle that to carry on in circumstances that must lead to failure.

The consequences of the investigator spreading out beyond its mandate are equally fraught with peril. The regulator is usually many times larger than the investigator and will be happy to join battle with any safety investigation body that tries to extend its boundaries. It is also necessary for investigative agencies to review their mission or object reasonably frequently, to ensure that it is still sound. Often there are adjustments and refinements that can be made, without legislative change, to ensure the continuing relevance of the agency's work. Occasionally, legislative change is necessary. This usually involves taking on larger organizations to get it through the system, and it is likely to take several years.

Establishing and maintaining appropriate standards may well be the most important element of maintaining interactions that will assure the independence of a safety investigation agency. This applies to the operational standards associated with process and procedure, and to the ethical standards of the agency. The operational standards must ensure competence and fairness to those affected by the agency's work. The associated procedures must be continually revisited to ensure that they are not creeping toward the complexity of the courts. In my view, ethical standards really define a Board. Exhibiting the highest standards of prudence and probity is vital to the maintenance of an agency's independence. A lapse in ensuring fairness, a hint of profligate spending, anything that brings objectivity into doubt will do serious and long-lasting harm. Not just to the individual involved but to the agency and to a lesser extent to similar agencies. The appointed members and the executive staff must set unquestionable examples of sound behaviour. Departures from those high standards will invite political intrusion and legislative changes that are likely to limit the discretion of the safety investigation agency. Therefore, such lapses limit that independence, which is vital to the maintenance of public confidence and to the effectiveness of interactions with operators and the regulator.

For both regulatory and investigative agencies, our own employees are most often the source of our expertise. Our budgets are tight and government salary scales are generally not competitive for the kinds of abilities, skills and experience that we require. To keep the people that we need, we have to depend in part on their pride in public service and their dedication to the work of the agency. We are in an activity where the technology and the law are continually evolving. We must ensure that those whom we wish would stay with us are offered the training needed to keep current. Our internal promotion opportunities are rare and many of the places where our people can go are cut off or limited by institutional conflicts of interest. If we do not have competent and sufficient staff, we cannot do our jobs. If we do not do our jobs well, we will encourage political interference, and tempt others to move into the activities set aside for us by the legislator. This, too, will impair the effectiveness of the agency's interactions with others.

Appropriate relationships must be developed by those who can speak for the entire organization. For many of us there is a delicate balance between being close enough to those to whom we provide service, and being so close that we arouse suspicions about our independence and objectivity. Often we have to deny some of the civilities of the private sector just to ensure that we do not offend the strict expectations of Canadians concerning independence. This makes our interactions with the regulator more formal, and creates a distance between the regulator and investigator that require a lot of attention if the relationships are to remain constructive. When one remembers that the main task of the investigator involves analysing failures of the regulator and making them public, it is surprising that there can be a constructive relationship at all. The interactions with the operator are subject to similar pressures but they are much less frequent. One can only conclude that the interactions which are generally constructive are so because all three organizations place such a high priority on safety.

The final determinant of independence is the management of crises. Most of us will face one sometime. How we handle it defines our organization for several years. If you take control and manage it you can expect to prosper for some time. If you fail, you can expect a reduction in mandate or even the replacement of your agency. The public does not care whether you are in a fair struggle, they won't care how short of people you are, they only care that you stabilize the situation without breaking the rules.

Let's consider the consequences of failure to maintain competence, objectivity and independence. I will give you some examples of where the public lost confidence in the independence or objectivity of investigations. I have already mentioned what happened at the Department of Transport with the accident in the mountains of British Columbia, which eventually led to the formation of the Canadian Aviation Safety Board. The Government of the Netherlands recently had serious problems with a lack of public confidence in the investigation into the El Al Boeing 747 cargo aircraft. It crashed in 1992 into an apartment building in Amsterdam. Loss of confidence in the objectivity and completeness of the investigation led to a Parliamentary inquiry. Once public confidence was lost, even the Parliamentary inquiry failed to restore it. A news report at the time showed that nearly 60% of Dutch voters believed that the inquiry into events surrounding the El Al accident failed to uncover the entire truth. There were news reports that more than one Minister would be forced to resign, and that the government might even fall. The government did fall, but for other reasons, before the El Al accident investigation could be considered and debated. Similarly, several years earlier there was an Air New Zealand accident when a DC 10 crashed into Mount Erebus on a sightseeing trip to Antarctica; there were many fatalities, and questions were raised about the competence and objectivity of that investigation. This led to a loss of public confidence, which was followed by a judicial inquiry. By that time it no longer mattered whether the investigation was competent or objective. There was turmoil in aviation safety for several years which led, in part at least, to the creation of the New Zealand Transportation Accident Investigation Commission: a multi-modal transport accident investigation body.

The result of a public loss of confidence in the independence, and thus the objectivity, of a safety agency is so serious that it must not be allowed to happen. In Canada, in transportation, we have developed two levels of independence in our investigation activities. First, the Board is independent of any government department. It reports annually to Parliament through the President of the Queen's Privy Council, an ancient title conferred on a senior Minister with no departmental responsibilities. Thus, it is entirely separate from the Department of Transport. The Transportation Safety Board engages its own legal council, which is independent of the Department of Justice. Second--and we believe this is unique--the investigators are independent of the Board. The Board can give direction to the investigators only through its publicly available policies. Those are clearly policies of a broad directing nature and not procedures or techniques. There is a Director of Investigations for each mode and each of them has exclusive authority to conduct investigations within that mode. The result is a separation of the Board and staff. It permits anyone to come before the Board to make representations about an investigation with the same status as the investigators. They come before a Board that can be objective because it did not direct the conduct of the investigation and it has no stake in the outcome of the investigation beyond ensuring completeness and objectivity. This feature affects interactions with both the regulator and the operator, in that it gives them a place to make their representations in confidence, and this is one of the effective tension-reducing mechanisms in place.

We must do our work in such a way that the independence of our agencies, as reflected by both members and staff, is seen and is understood to be both independent and in the public interest. The safety investigation agency's interactions must be effective. Failing that we will become irrelevant. The price of irrelevance for government agencies is what it should be: the public will simply not want to pay taxes to support irrelevant agencies, and their budgets will be reduced until they are absorbed by other agencies or they disappear altogether.