The Ratcheting in the Rivers

On the Canterbury Plains, the Waimakariri River is a shadow of its former self. Hemmed in by stopbanks, its gravel harvested daily by diggers and trucks, its banks overrun by exotic willows planted decades ago to combat erosion, it remains in a constant state of tension. Constrained by humans to such an extent that it cannot flow freely. Nature’s only permitted course, the one we have deemed acceptable.

"It has been intervened in so much at this point," says Fred Brooks, a river engineer with Environment Canterbury, "you have to keep intervening."

The same pattern is increasingly present in how organisations manage occupational health and safety. Not immediately obvious. Not all at once. But gradually, through one rational decision at a time, until the system we’ve built demands constant intervention just to stay stable. We have lost sight of whether it was ever genuinely safe.

The braided river as a system

Braided rivers are rare. They originate in alpine ranges, cascade down slopes, and as the gradient lessens, fan out across broad gravel plains into numerous constantly expanding, contracting and changing channels. They are not as chaotic as they first appear; they are just organised dynamically. A major flood forces the river to explore new paths; a drought forces it to consolidate its flow into a single route. The system handles disturbance by reorganising itself. No single channel is permanent. The river's resilience is in its structure: distributed, adaptive, and endlessly variable.

Canterbury's braided rivers have been progressively narrowed by human hand over 170 years. Gravel beds have been excavated for flood protection and road construction. Water has been drawn for intensive dairy farming. Landowners have been legally allowed to encroach on riverbeds as the water retreated, and when the river tries to return, they invest in protective works to prevent it. A study of nine Canterbury rivers found they had narrowed by 50% on average, and by more than 90% in some segments.

Jo Hoyle, a geomorphologist at Earth Sciences New Zealand, describes the mechanism precisely: "There is this ratcheting in, and the river becomes narrower and narrower."

The river does not become safer as it is constrained. The flood energy that once spread across a wide braided plain now travels faster, and the barriers needed to contain it must be ever larger. When the inevitable failure occurs and stopbanks are breached, the impact is catastrophic. Each intervention that looked like flood control was, in part, risk concentration in disguise. The system demands rigid controls; there is no space for adaptability, nuance, or resilience. Just pass or fail.

The same ratchet, in a different system

Occupational safety management systems have their own version of this dynamic. Each serious incident generates a new control: a procedure, a permit, a checklist, a mandatory sign-off layer. Each new bowtie assessment adds a critical control to the register. Audit findings lead to corrective actions that generate their own compliance requirements. The system grows more elaborate with each cycle.

As with the Waimakariri, at some point, the controls no longer manage the risks presented by the work. They manage how we want the work to be: neat, tidy, and constrained.

This is not an argument against safety management systems. Stopbanks have prevented real floods. Safety procedures, in the right context, prevent real harm. Individual interventions are almost always locally rational. The problem is cumulative and structural. Each individually rational intervention, added to all the others, produces a system whose stability depends entirely on the continued and ever-increasing application of management effort. We are progressively losing the distributed capacity that once allowed the system to absorb variability naturally.

Like the narrowed river, this approach does not make the system safer. It concentrates risk. A workplace that has transferred all judgment into documented procedures has not eliminated the variability of real work; it has only removed the adaptive capacity workers once had to manage it. When conditions exceed the procedures' design envelope, there is nothing left to absorb the shock.

The willow problem

Willow trees were deliberately planted to address bank erosion on the braided rivers. A specific problem, a targeted solution, a committee decision made with confidence that the outcome was known before the first tree was planted. There were no carefully designed parallel experiments, no probes to test how the intervention would behave at scale. The willows worked in the short term. Their impact, however, extended far beyond the original scope. They are now, in the words of Environment Canterbury's biodiversity manager, “exploding”. The dense root systems blocking rivers from flowing naturally, increasing rather than reducing risk. A solution became a new constraint demanding its own ongoing interventions to manage.

Occupational health and safety systems generate willows constantly. Checklists introduced after an incident become ritualised rather than cognitive; workers tick boxes without engaging with actual conditions. PPE mandated for one hazard creates new ergonomic or visibility hazards. Lockout/tagout procedures become so complex they incentivise workarounds. Incident reporting systems generate so much data that any signal is lost in the noise.

The pattern is the same as the willows: a solution selected and broadly applied, with the outcome assumed in advance rather than tested. Each intervention is considered a legitimate response to a real problem. How many of these good intentions now add to the management burden without improving the underlying safety of the work?

Mapping the operating context

Braided rivers are complex systems. They have, however, been managed as if they are merely complicated. The assumption is that sufficient expertise can fully map how the river would respond to each intervention and produce a predictable outcome.

The distinction matters. A complicated system, an aircraft engine or a legal contract can be fully understood by experts and optimised accordingly. A complex system cannot. Cause and effect are only visible in retrospect. Multiple agents interact in ways that produce emergent, unpredictable outcomes. The appropriate response is not to impose a predetermined solution but to understand the conditions under which the system can navigate safely, and to treat interventions as experiments rather than fixes.

Estuarine mapping, a framework for working with complex systems, asks precisely this question: given that you cannot eliminate complexity, under what conditions can the system operate safely? The geomorphologist Hoyle asks it of the river: "How much room do these rivers actually need to be a river?" The OHS equivalent is: how much space and what support does a worker need to exercise judgment, respond to variability, and actually manage risk?

In OHS, the conditions that define safe operation are constantly renegotiated by the people doing the work. Bowtie diagrams and static risk assessments define boundaries as if they are stable. In many workplaces, this assumed stability is a myth we have convinced ourselves to be true.

A system that has been as thoroughly constrained as the Waimakariri or a high-risk, compliance-heavy operation running on tight operational margins may always be working on the boundary of failure. Any attempt to design an intervention to improve the system's resilience itself requires significant time, skill and resources. The rigidity means that even the slightest change in operating context can produce unexpected outcomes that the system no longer has the resilience to absorb. Modern workers, often with less accumulated industry experience and organisational knowledge, do not automatically recover adaptive capacity when given space. That knowledge has already been eroded. Like the degraded river, you cannot simply remove constraints and expect the system to recover without an extended period of instability. The capacity for self-correction has itself been damaged.

The knowledge that gets excluded

Workers have contextual knowledge of hazardous conditions that managers and regulators often lack. That knowledge, though eroding due to reduced low job security and workforce mobility, is real, current, and systematically underweighted in most safety management systems. This is a genuine and significant failure.

But worker knowledge is not uniformly reliable. Workers also normalise risk, develop habituated blindness to familiar hazards, face social pressure not to raise concerns, and sometimes collude in practices that would be classified as unsafe by any outside observer. Experienced workers are not necessarily the same as workers with reliable hazard intelligence. The argument for including worker knowledge in safety system design is strong. The argument that worker judgment is an adequate substitute for a structural understanding of an organisation's operating context is not.

The same tension appears in how we treat indigenous and relational knowledge of complex systems. Ngāi Tahu's understanding of Canterbury's waterways. Beautifully captured in the principle that "the river goes where it will"this represents a genuinely different and arguably more adaptive relationship with a complex system than the engineering paradigm has produced. Their legal case against the Crown, seeking recognition of their governing authority over South Island waterways, is partly a claim that the dominant management approach has systematically excluded contextual knowledge that evidence now suggests is more ecologically sound. 

The parallel for OHS is direct. The people closest to the work hold knowledge that the system needs but is structurally designed to ignore. Formalising that knowledge, not as a compliance exercise but as a genuine epistemological input, is not optional. It is the only reliable correction to a system that otherwise reflects only managerial and technical assumptions about how work happens.

It does not follow, however, that suddenly relying solely on relational or worker knowledge is an adequate response to a degraded, complex system on its own. The river needs room. It does not need abandonment.

The feedback problem

Erik Hollnagel's Safety-II framework argues that traditional safety management, generally focused on what goes wrong and adding controls to prevent recurrence, gradually degrades workers' adaptive capacity. The outcome is a system that functions effectively only under the specific conditions for which it was designed. His concept of the Efficiency-Thoroughness Trade-Off describes how workers in tightly controlled environments are constantly forced to choose between following procedure and getting work done. It is therefore implied that the gap between those two things is where serious incidents actually live, not in a single bad decision, but in the accumulated normalisation of small adaptations that no procedure anticipated.

Sidney Dekker's concept of drift into failure makes the same point structurally: organisations do not suddenly become unsafe. They drift, through individually rational decisions, until the system is far from its safe operating boundary. The drift is invisible until a large event makes it retrospectively obvious.

Both frameworks are compelling. Both share a significant weakness: they work best on timescales where feedback is rapid enough to be sensed and responded to. Much of the most serious harm in occupational health, however, operates on timescales of decades. Asbestos exposure. Silica dust. Cumulative fatigue. Long-term chemical exposure. The feedback loops are too slow for probe-sense-respond to work before irreversible thresholds are crossed. You can be running a sophisticated Safety-II programme while occupational disease rates compound silently in the background.

This is not an argument against Safety-II thinking. It is an argument that Safety-II is necessary but not sufficient. The profession needs explicit mechanisms for long-latency harm that do not depend on rapid feedback. An effective system needs longitudinal health monitoring, systematic exposure tracking and proactive epidemiological surveillance. These concepts need to be built alongside the adaptive capacity frameworks not replace them. 

The number of salmon counted in the Canterbury region has dropped from over 20,000 in 1996 to just 608 in 2024-25. The causes are genuinely complex and have not been fully attributed to river management alone. But that is precisely the point. A system can look managed and stable while an underlying indicator deteriorates over decades toward near-irreversibility. By the time the signal is unmistakable, the threshold may already have been crossed.

What this is not arguing

This is not an argument for removing well-designed, contextually appropriate controls or indeed entire health and safety management system approaches. It is not a claim that compliance is pointless, or that worker, management, executive or even governance judgment can be blindly trusted.

The argument being made here is more limited and likely more demanding. 

It is an attempt to highlight the danger of isolationist thinking.  Each intervention may be locally rational, and each additional control defensible in isolation, yet this approach can produce organisational fragility that no individual decision-maker intended and that no individual intervention can now reverse. 

That fragility is not visible in the indicators we typically measure. We need people with health and safety and due diligence responsibilities to design experiments that allow the system to back away from the edge before the threshold is crossed, not after.

The challenge to OHS practitioners

So what does this actually demand? Here are five questions worth reflecting on honestly.

Control systems: How many of your current controls were added after an incident and have never been reviewed for whether they still address a real hazard, or have become ritual? The willow trees were planted with good intentions. Review your boundaries.

Indicators: Lost time injury frequency rates, leadership walks, critical control verifications and traffic light dashboards, what are they really telling you, what activities are they driving and what narratives are missing? Where is your information about long-latency occupational disease, cumulative fatigue, psychological harm, or the erosion of adaptive capacity in your workforce? Where is the pressure quietly building in the system? 

Worker participation: Worker engagement provisions in the Health and Safety at Work Act 2015 are not a compliance checkbox. They are an epistemological requirement, the only reliable mechanism for getting real-world knowledge into a system that would otherwise reflect only managerial assumptions. What skills, heuristics, and tacit knowledge do you need to manage the risks in your organisation? How do you know they are where you need them to be? If your worker participation process produces no friction, no surprises, and no challenges to existing controls, it is not functioning. 

Context: The next time your organisation responds to a serious incident by adding a new procedure, a new permit, or a new layer of sign-off, ask explicitly: does this increase the system's capacity to absorb variability, or does it narrow the channel further? Both options are sometimes justified. The question should always be asked. If a signature is required, ask who the signature is actually for.

The limits of your model: The Waimakariri was described in a 1920s report as showing "a deficiency of nature, which must be made good by the art of man." The confidence that the system's complexity was a problem to be solved rather than a condition to be navigated is precisely what produced the fragility now requiring endless maintenance. Where does your safety management system rest on equivalent assumptions? Where have you mistaken a complex system for a complicated one, or vice versa?

The river still flows

The braided river is not an example of what safety management should look like. It is a metaphor for what happens to systems when the people responsible for them mistake control for resilience and keep mistaking it, one rational decision at a time.

The river still flows. But 608 salmon where there were once 20,000 is not a managed outcome. It is a managed decline.

The question for every organisation with health and safety responsibilities is simple, and serious: what are you managing, and what are you declining?

This essay draws on reporting by Eva Corlett in The Guardian (May 2026) on New Zealand's braided rivers, and on the theoretical frameworks of Erik Hollnagel (Safety-II, ETTO), Sidney Dekker (drift into failure), Dave Snowden (Cynefin), and Nassim Taleb (antifragility).