After an incident, the typical inquiry asks: what procedural tightening prevents the next occurrence? The answer lands in the report, is implemented as a measure, and formally closes the learning cycle. What the inquiry in this form does not ask is a different question: which assumption about the organisation itself made it possible for the conditions of this incident to come into being in the first place? Both questions are legitimate. They lead to different consequences.
Chris Argyris introduced this distinction in 1978 together with Donald Schön in Organizational Learning and offered one of the more precise diagnoses of organisational learning behaviour. Single-Loop, Double-Loop, Triple-Loop have been the vocabulary of learning research ever since. What Argyris described is, in the lived practice of many incident reviews, still rare. What follows is an answer to the question of why.
Single-Loop, Double-Loop, in brief
Argyris’ model can be shown with a trivial example. A thermostat measures room temperature and switches on the heating when the temperature falls below the set target. That is Single-Loop learning: the system corrects its action in order to achieve a given goal. Asking the thermostat whether 21 degrees is the right goal is asking something different. That question touches the underlying assumption, not the action. That is Double-Loop.
In organisational translation: Single-Loop asks whether the action was appropriate and how to correct it. Double-Loop asks whether the assumptions, values, and rules that structured the action are still sound. The third loop, Triple-Loop, goes one level further and asks whether the system by which the organisation learns in the first place still fits. More on that at the end.
The value of the model lies precisely in this distinction. In practice it blurs regularly: a report from a Single-Loop inquiry and a report from a Double-Loop inquiry often look similar in form, because both produce findings and recommend measures. They differ in the opening question. An organisation that does not actively make the distinction stays in Single-Loop. That is the default of the inquiry. The Double-Loop question has to be brought in; it does not arise from the standard routine of incident investigation.
Why incident reviews typically stay Single-Loop
The observation that most incident reviews stay Single-Loop is old. It has structural reasons, which Argyris himself described precisely in his later work on “defensive routines”.
A Single-Loop finding is anchorable. It says what needs to change, in what form, by whom, by when. It produces a list of measures that fits the existing steering format of the organisation. It does not touch the distribution of responsibility and competence, because it does not put the assumptions on which that distribution rests up for discussion. It costs no one political capital.
A Double-Loop finding does exactly that. It says: this assumption about our organisation helped make the incident possible. If the assumption belongs to executive leadership, it is an assumption of executive leadership. If it belongs to strategy, it is an assumption of strategy. Whoever formulates the finding has to mark the assumption as such. Whoever accepts it has to be willing to change it. Both come at a cost.
The phenomenon that organisations typically use to respond to this requirement Argyris described as defensive routines: unspoken agreements not to open certain topics because opening them is uncomfortable. Defensive routines are not malicious; they are functional. They protect participants from confrontations no one wants. At the same time they are the most precise mechanism by which organisations limit their own learning.
Single-Loop changes the action. Double-Loop changes the assumption. Without the distinction, after an incident an organisation always ends up changing what was easiest to change.
What Double-Loop would concretely mean in an inquiry
In a concrete inquiry the difference can be pinned to a single question. The standard question of an incident investigation reads, in variations: what procedural tightening prevents the next occurrence? The Double-Loop variant of the same investigation asks: which assumption about our organisation made it possible for the conditions of this incident to come into being at all?
Examples of such assumptions, which in investigations often remain unspoken: “We have enough staff because the statistics back it up.” “We can rely on escalation from the line because we have psychological safety.” “Our compliance processes capture what counts for safety.” Such assumptions are the foundations on which the procedures that failed in the incident were developed. When the assumptions are not put up for discussion, the investigation corrects the procedures and leaves their foundation untouched.
A constructed example makes the difference tangible. A hospital reconstructs a medication mix-up. A nurse gave a patient a medication assigned to another patient on the ward. A Single-Loop review typically arrives at the following finding: the barcode verification was not performed, the verification step has to be emphasised in training and supplemented by an additional double-check. The measure is describable, it lives in the procedural repertoire of the organisation, it lands in the report as a result.
The Double-Loop variant of the same review starts with a different question. Which assumption about the ward’s nursing day put the verification step under pressure? In the reconstruction, the answer is usually present, but it does not get raised into the finding in the Single-Loop format. In this example it might read: staffing rested on the assumption that nurses can prepare medication for several patients in parallel without the verification step suffering. The verification procedure was structurally sound. It relied on conditions that no longer held under real workload.
The procedural adjustment from the Single-Loop finding (additional double-check) does not solve the problem. It adds an activity to a staffing plan that was already not carrying the original procedure. The Double-Loop answer requires reviewing the staffing assumption that should have made the verification sustainable. The two answers cost different amounts. They address different parties. They have different chances of success.
A Double-Loop inquiry names these assumptions explicitly. Its leading question sits one level beneath the procedural question: was the procedure based on an assumption that did not hold under real conditions? If so, the thing to change sits on the level of the assumption, and the procedural consequence is a second question.
Preconditions for Double-Loop
For a Double-Loop inquiry to be possible in an organisation at all, a number of preconditions have to be met that are not trivial.
First, sanction logic and learning logic have to be clearly separated. When the review at the same time prepares the sanction, no one can speak openly about the assumptions that structured their own action. This point links back to restorative just culture and need not be developed further here.
Second, psychological safety in the precise sense in which Amy Edmondson defined it in 1999. An organisation in which questioning an assumption of executive leadership is personally risky cannot perform Double-Loop, no matter what the inquiry procedure formally looks like.
Third, a setting in which the acting persons, those responsible for the structural assumptions, and those conducting the review can sit together without anyone having to take the position of one of the other groups. That is less standard than it sounds.
Where Triple-Loop becomes useful
Argyris’ model has been given a third loop in the follow-up literature, one that is rightly discussed with less prominence. Triple-Loop asks whether the system by which the organisation learns in the first place still fits. The loop grips where the learning architecture as a whole is up for discussion: how incidents are captured, which forums exist for testing assumptions, which voices have access to those forums. Here it is the frame in which assumptions are examined at all; individual assumptions recede into the background.
In the running incident review of most organisations, Triple-Loop functions as a reflective offering for organisational development. It becomes relevant in specific moments, for instance after a series of incidents that procedural adjustments could not close. For the running safety work, distinguishing Single- and Double-Loop sharply and applying them in the right place is enough.
What this changes
Argyris’ model sits one level upstream of the review work, at the question with which the investigation comes to the matter. Whoever, after an incident, recommends a procedural tightening without naming the assumption that should have made the old procedure sustainable has a clean Single-Loop finding. Whoever names the assumption and puts its soundness up for discussion has a Double-Loop finding. Both have their place. Both are legitimate. Only, the organisation should know what it is doing. Without the distinction it learns and reflexively channels the learning back into the familiar. The familiar helped make the incident possible.
Sources
- Chris Argyris & Donald A. Schön – Organizational Learning II: Theory, Method, and Practice, Addison-Wesley 1996
- Chris Argyris – Strategy, Change, and Defensive Routines, Pitman 1985
- Chris Argyris – On Organizational Learning, 2nd ed., Blackwell 1999
- Amy C. Edmondson – “Psychological Safety and Learning Behavior in Work Teams”, Administrative Science Quarterly 44 (1999)
- Donald A. Schön – The Reflective Practitioner: How Professionals Think in Action, Basic Books 1983