By Josh Bryant and Rob Ayton
Thirteen of the last nineteen high-potential events at Mitchell Services were saved by luck, not by controls.
That’s not a compliance number or a fail rate ticking in the right direction. It’s thirteen situations where someone could have been killed or permanently injured, and the only reason it didn’t happen was proximity, timing or circumstance. No control did that. Physics did.
When a good outcome hides failed controls
We run critical risk management for a contract drilling business operating across some of Australia’s toughest ground. Over three years we’ve built a verification system that checks whether critical controls are actually doing what they’re meant to do, not just whether they’re fitted. What it surfaced is a distinction most safety data can’t make: the difference between a control that worked and an outcome that got lucky.
We call it fail safely versus fail lucky, and the test for telling them apart is simpler than it sounds.
Fail safely or fail lucky? Here’s the test
Fail safely means a control did the job it was built for. Something went wrong upstream of it, a mistake or a piece of gear that failed, and something designed for that exact moment caught it before it escalated. To test it: name the specific thing that stopped harm, then ask whether it was engineered to do that job and would do it again tomorrow. If yes, it’s fail safely.
Fail lucky means the same kind of failure happened and nothing built for that moment caught it. What stopped it wasn’t a control. It was where someone happened to be standing, how heavy a load turned out to be, or plain timing. Run the same test: if the honest answer is a fact about circumstance rather than something engineered to be there, it’s fail lucky. It doesn’t matter how the report is worded or whether anyone got hurt. What matters is whether the outcome was designed or accidental.
The distinction isn’t new. Todd Conklin and Erik Hollnagel gave the field the underlying idea: a good outcome doesn’t prove a good process. We first heard it applied directly to high-potential events on the HOP Podcast with No Name, where former Aera Energy CEO Erik Bartsch and HSE manager Ron Nunley built it into their board-level scorecard. What we’ve added is anchoring it to the energy pathway rather than the outcome, and wiring it into verification data at scale.
What your safety numbers can’t tell you
In 2025 we ran over 56,500 critical control verifications across our fleet, and the fail rate held at 0.81 percent. On paper, that’s a good year. But a fail rate can’t tell you whether your controls are working, or whether you’ve been fail lucky every time without realising it. Neither can your lost time injury rate, your TRIFR, or any outcome-based measure sitting on a board slide right now. All of them can land on the same number whether your system is genuinely protecting people or running on borrowed time.
The damage was a scratch. The exposure was fatal.
We’ve seen both sides of it. A supervisor ran a pre-start check on a surface rig and found the emergency stop dead. The rig was held, the fault traced to a relay, the relay replaced, before anyone had to rely on it. That’s fail safely: undramatic, and exactly what the system is there for.
Fail lucky looks different. A light vehicle at one of our sites was parked correctly on a slight decline, in gear with the handbrake on. Later, the driver restarted the engine to run the air conditioning, which took it out of gear, and when he shut down and stepped out he didn’t reselect gear. The wheel chock that should have caught that gap wasn’t within reach, buried under other gear. The handbrake, which should have held regardless, turned out to be seized, a fault no pre-start would have caught.
The vehicle rolled 25 metres down the slope and hit an empty bin. Nobody was in its path. Run the energy math rather than eyeball the damage, and that roll carried somewhere between 3,000 and 18,000 joules, well past the 1,500-joule threshold where a person in its path is more likely than not to be seriously hurt or killed. Three separate layers were meant to stop that vehicle: gear, handbrake, chock. All three were compromised at once, and the only reason it ended at a bin instead of a person is that nobody happened to be standing there. The damage was a scratch. The exposure was fatal. That’s fail lucky, whatever the report calls it.
The reason we’re comfortable putting a 13:6 ratio in front of our own board is that we’d rather know it than not. A business that can name its fail-lucky events is in a better position than one that can’t, even when the number is uncomfortable. A business that can’t tell the difference isn’t safer. It’s just found out less.
Would your last 12 near misses pass the test?
If you’re running a critical risk system that only measures outcomes, here’s a way to test what it’s actually telling you. Pull your last dozen high-potential events or near misses. For each one, name the specific thing that stopped it, and ask whether that thing was built to do that job or just happened to be there. A clean track record built on controls and a clean track record built on luck look identical from the outside, right up until the day they don’t. Ask the question now, while you still get to choose when to find out.
By Josh Bryant and Rob Ayton, Mitchell Services
Josh Bryant — General Manager, People, Risk and Sustainability, Mitchell Services. Josh has more than 25 years’ experience in high-risk mining environments, working across critical risk management, operational learning and HOP implementation.
Rob Ayton — Lead HSE Systems and Performance, Mitchell Services. Rob has 15 years’ experience in high-risk, high-tempo drilling environments, with a background in HSE systems, project management and quality auditing.
