James Reason’s classic Swiss cheese model is a vivid and memorable way to
visualise how patient harm happens only when all system defences fail. Although
Reason’s model has been criticised for its simplicity and static portrait of complex
systems, its use has been growing, largely because of the direct clarity of its simple
and memorable metaphor. A more general, more flexible and equally memorable
model of accident causation in complex systems is needed. We present the hot
cheese model, which is more realistic, particularly in portraying defence layers as
dynamic and active – more defences may cause more hazards. The hot cheese
model, being more flexible, encourages deeper discussion of incidents than the
simpler Swiss cheese model permits.
