Every once in a while, there occurs a major accident that brings into question—at least momentarily—our dependence on, and hence the dependability of, organizations to safely operate complex hazardous technologies. The explosion on the oil rig Deepwater Horizon in 2010 is a recent addition to the catalog of instantly recognizable organizational accidents such as the partial meltdown of the nuclear reactor in Three Mile Island and the explosions of space shuttles Challenger and Columbia. As such, it presents a useful, even if unwelcome, occasion for updating our understanding of the limits to collective organizing under demanding conditions.

To recall the basic facts, the oil company BP had leased the Deepwater Horizon rig, which was owned and operated by offshore-oil-drilling company Transocean. The rig was positioned in the Macondo oil prospect in the Mississippi Canyon over an oil well located 4,993 feet below the surface on the seabed and extending about 18,000 feet into the rock. On the night of April 20, 2010, a surge of natural gas blasted through a concrete core that had been recently installed by contractor Halliburton in order to seal the well for later use. The resulting explosion killed eleven employees, injured several others, and resulted in the largest marine oil spill in the history of the petroleum industry (one estimate put the discharge at 210 million US gallons). The full extent of the adverse impact on the local economy and marine life in the Gulf of Mexico remains unknown.

In their well-written and informative book, Boebert and Blossom present one of the first detailed accounts of this accident. They set out to use a “scholarly mindset to consider both the accident that was and the accidents that might have been, seeking all factors with potential to combine into a disaster” (7). To this end, they piece together a detailed description of the context, decisions, and events leading up to the blowout using data from a federal non-jury trial known informally as MDL2179, which included 4000 trial exhibits and expert reports, 172 sworn depositions, and transcripts of testimony in open court. Given the authors’ engineering backgrounds, it is not surprising that their account, analysis, and conclusions consistently emphasize the technical aspects of the sociotechnical system of oil drilling (the book includes a 42-page appendix of technical notes and figures).

Adopting a systems engineering perspective (Leveson Reference Leveson2012), they propose that the oil rig operations are best viewed in the context of a larger system of interconnected components that includes multiple organizations, people, and procedures. A key distinguishing feature of such a system is the potential for emergent events arising from interactions among components. Detecting and forestalling emergent events is essential for safety management or, as the authors frame it, for keeping the system away from “The Edge” (a term that they borrow from an unlikely source, Hunter S. Thompson’s description of a motorcyclist seeking high-speed thrills riding along a twisting dangerous highway!). The Edge is where complex systems that appear to be operating in safe states can suddenly experience catastrophes in ways that are unpredictable, abrupt, and irreversible. The ability of a system to respond effectively to emergent events depends critically on the timely aggregation and interpretation of information from disparate sources. This ability is enhanced by the operators’ tacit knowledge of the system or fingerspitzengefül: “the feeling in the tips of one’s fingers” (6).

The authors’ main conclusion is that the Macondo blowout was systems failure, and its lessons are systems lessons. In their telling, the explosion on the night of April 20, 2010, was an emergent event that cannot be attributed to the failure of a single component (e.g., operator negligence); rather, it was the result of decisions, actions, and interactions among employees, organizations, and technologies that were temporally and geographically far removed from the oil rig. The information that would have enabled the crew on the oil rig to detect and mitigate the event remained fragmented across organizations. For instance, BP had exclusive access to the information on the geology penetrated by the well, Transocean was aware of the status of the rig, and Halliburton had proprietary information about the technology for cementing a well. Absent formal mechanisms for combing these bits of information, the crew had little chance of accurately interpreting the swiftly unfolding events. The crew was functioning within what had become “a manifestly ad hoc system” of disparate groups assembled together with little forethought to the possibility of emergent events (11). BP’s failure to analyze the emergent properties of the ad hoc system that was being implemented was a major reason for the eventual outcome that was entirely unanticipated at the time but seems inevitable in retrospect.

Boebert and Blossom then turn to the question of how this got to be an ad hoc system. In essence, their answer is that BP’s preoccupation with meeting shareholder expectations adversely impacted people who are responsible for keeping the corporation away from The Edge. They trace the origins of the ad hoc systems back to the “fateful reorganization” that was initiated by the corporate headquarters in 1990 and quote a business journalist who said “BP was no longer a technical company, but a commercial one. Its primary role was to decide which projects to back, and where possible to have others do the actual work” (18-19). Previously, BP had been organized by function, such as drilling, cementing, and other specialties. This functional structure enabled BP to develop and retain institutional memory and expertise in safety-critical areas of operations. However, with a view to cutting costs and increasing flexibility, BP switched to a structure where most technical support for oil drilling was outsourced to subcontractors. The few remaining experts within BP became “sector specialists” with no authority over individual projects.

The authors argue that the new structure was misaligned with the demands of operating oil rigs, which calls for a “strong and pervasive engineering discipline” imposed from and enforced by the highest levels of the organization (183). Cost pressures also led to understaffed subunits where operators were assigned responsibilities that exceeded their experience and deprived them of mentoring. Taken together, these corporate decisions to grant procedural independence to low-level corporate entities, decentralize responsibility, rely heavily on outsourcing, and operate with minimal levels of staffing created a brittle organization that was incapable of responding effectively to unanticipated events.

Inexplicably, after presenting this well-argued case, the authors stop short of elucidating the implications of their analysis for policy and practice. In the brief chapter 15 titled “Lessons of Macondo,” they call for various changes, most of which seem technical (e.g., the need for comprehensive and survivable equipment for recording data during safety-critical events, enhanced roles for project managers, and adoption of checklists). They also make a brief reference to the need for “an engineering culture”—which they do not define but describe as consisting of methodical decision making, contextual review, and management of change —as a necessary complement to “a safety culture,” which they essentially equate to what they call methodical wariness. Taken together, these lessons and recommendations do not explicate the several interesting and important questions that are strongly implied by the preceding analysis.

A careful reading of this book points to several important questions for organizational research. First, how can organizations effectively manage the tradeoff between corporate profits and systems safety? Although this is a familiar question in the study of organizational accidents, the data presented in this book lend more specificity and urgency to this question. For instance, all companies in the oil industry, not just BP, routinely face escalating performance pressures. Yet, thankfully, we have had very few large-scale oil spills to date. Even in the case of BP, the authors note that BP and Transocean had previously worked together on almost fifty rigs without any incident. One possible explanation for the low accident rates, of course, is chance; it is perhaps likely that more companies are operating closer to The Edge more often than we realize. It is also plausible, however, that low accident rates could be a result of formal and informal processes that many companies have implemented to manage the tension and tradeoffs between profits and safety. Given that we cannot realistically expect profit pressures to go away, understanding how these tradeoffs are managed in the context of systems design is critical for future research and practice.

Second, a noteworthy feature of the Deepwater Horizon disaster is that it represents one of the first truly large scale interorganizational accidents (Roe and Schulman Reference Roe and Schulman2016). The Marine Investigation Board named seventeen “parties in interest” who had a direct stake in the outcome of the investigation and were therefore allowed legal representation and right of cross examination. These included BP, Transocean, seven other corporations, eight individuals, and the Republic of the Marshall Islands, whose “flag of convenience” was flown by the Horizon. Yet, the book’s explanatory focus is almost exclusively BP-centric. What are the interorganizational structures and processes that contribute to safe outcomes in interorganizational operations? It is time for us to go beyond the organizational level of analysis and examine the reliability and safety of interorganizational networks.

Third, what does corporate responsibility and accountability mean in the context of work that is intensely interorganizational? Interestingly, as the authors note, the presiding judge in the non-jury trial MDL 2179 found that BP was guilty of gross negligence and that Transocean and Halliburton were guilty of ordinary negligence, assigning BP 67 percent of the responsibility for the event, Transocean 30 percent, and Halliburton 3 percent. But he concluded that neither Transocean’s maintenance practices for the rig as a whole nor BP’s process safety management systems were causal factors. Setting aside the judicial basis for such determination, it does point to important questions about how, in such interorganizational networks, the defensive tendency to avoid blame can coexist with the collaborative demands of responding effectively to emergent events.

Fourth, this case also raises questions about the role of regulatory oversight. The book discusses all too briefly the role of the Minerals Management Service (MMS), which was established during the Reagan administration with three charters: to generate revenue by leasing offshore federal land for drilling, to enforce safety regulations, and to protect the environment. The authors note that the performance of MMS with respect to the last two charters has been less than impressive. In the years preceding the Macondo blowout, MMS seemed to take a minimalist approach to oversight, approving all applications that BP submitted including a project plan that did not consider a blowout and included an outsourced oil spill response plan. Following the Macondo oil spill, MMS was split into three new agencies: the Office of Natural Resources Revenue, the Bureau of Ocean Energy Management, and the Bureau of Safety and Environmental Enforcement. Nevertheless, the question remains: What role should regulatory agencies play in ensuring that organizations do not subordinate safety to other priorities, especially in the context of interorganizational work that presents opportunities for blame-shifting in the aftermath of accidents?