Challenger: When Risk Becomes Normal
Challenger: When Risk Becomes Normal
The Space Shuttle Challenger disaster did not begin when an O-ring failed. It developed as repeated warning signs, known deviations and unresolved technical concerns gradually became familiar enough for the organisation to continue operating around them.
Organisations rarely learn that a risk is safe. More often, they learn that they survived it last time.
Failure often develops through repeated success
Organisations rarely drift into failure overnight. They drift through repeated success.
A shortcut works. A control is bypassed. A technical limit is exceeded. A warning is raised, but the expected consequence does not occur.
Work continues.
The absence of immediate failure begins to influence how the organisation understands the risk. What was initially treated as an exception becomes familiar. What was familiar becomes tolerated. What was tolerated eventually becomes part of normal operations.
On 28 January 1986, the Space Shuttle Challenger broke apart 73 seconds after launch. All seven crew members were killed: Francis “Dick” Scobee, Michael Smith, Ronald McNair, Ellison Onizuka, Judith Resnik, Gregory Jarvis and Christa McAuliffe.
The immediate technical cause was the failure of the sealing system in a field joint of the right solid rocket booster. Cold conditions reduced the ability of the rubber O-rings to respond quickly enough as the joint moved during ignition. Hot gas escaped, eventually contributing to the structural destruction of the launch vehicle.
But the weakness in the joint had not appeared for the first time that morning.
Evidence of O-ring erosion and hot-gas effects had appeared on previous shuttle missions. Engineers had raised concerns. The organisation possessed information showing that the system was not behaving as originally intended.
Yet previous missions had returned safely.
Challenger was not simply a story about an unknown risk. It was a story about a known risk that had become operationally familiar.
Normalisation of deviance
Sociologist Diane Vaughan later used the term normalisation of deviance to describe the organisational pattern surrounding the Challenger launch decision.
The term does not mean that people deliberately chose to behave recklessly. It describes a gradual process through which performance outside an original standard becomes accepted because repeated departures do not immediately produce disaster.
The organisation does not necessarily stop caring about safety. Instead, its definition of acceptable performance slowly changes.
A component behaves outside its intended design expectation, but the mission succeeds. Engineers investigate, explanations are developed and additional monitoring is introduced. The next mission also succeeds.
Over time, the question shifts.
It is no longer:
Why is this system departing from its design?
It becomes:
How much departure can we continue to accept?
That shift is subtle, but profound. The deviation stops being treated as evidence that the system requires correction. It becomes a condition the organisation learns to manage around.
Six dimensions of Leadership Under Load revealed by Challenger
Known deviation
Evidence of O-ring erosion and blow-by had appeared before the final Challenger mission. The behaviour was abnormal, but no previous occurrence had produced catastrophe.
Success redefined safety
Successful missions encouraged the belief that the observed damage remained manageable, even though the joint was not performing as originally intended.
Evidence carried unequal weight
Engineering concerns competed with schedule, program and management pressures inside a decision process that did not give uncertainty enough influence.
The burden of proof shifted
Instead of requiring evidence that launch conditions were safe, engineers were increasingly expected to demonstrate conclusively that they were unsafe.
Risk became fragmented
Different groups held parts of the technical history, but the full seriousness of the risk was not carried coherently through the decision system.
Pressure narrowed interpretation
Schedule expectations and the desire to maintain operations shaped how incomplete and uncertain evidence was assessed.
The warning signs already existed
The Challenger investigation found that the solid rocket booster joint problem was rooted in the history of the shuttle program.
The field joints connected separate booster sections. O-rings were intended to prevent hot combustion gases from escaping through those joints. During ignition, however, the joint could rotate and create a gap that the seals had to close quickly.
Evidence accumulated that the seals were not consistently performing as expected. O-ring erosion had been observed on previous missions. Soot had been found beyond a primary seal. Engineers also identified a relationship between colder temperatures and reduced sealing performance.
These were not merely abstract possibilities developed after the disaster. They were operational signals available before the launch.
The difficulty was that the evidence was incomplete. Previous damage had varied. The exact relationship between temperature and failure had not been fully established. The system had continued to return successful outcomes.
That combination—visible abnormality without previous catastrophe—is precisely where organisations are vulnerable to normalising risk.
A warning does not become less important because the organisation has survived it before.
Success can hide deterioration
Organisations often use successful outcomes as evidence that their controls are effective.
Sometimes that conclusion is justified.
At other times, success simply means the full consequence has not yet occurred.
A project delivered despite repeated governance shortcuts may be recorded as a success. A cybersecurity vulnerability that has not yet been exploited may appear tolerable. A fatigued team that continues meeting deadlines may be treated as adequately resourced. Deferred maintenance may be interpreted as harmless because equipment remains operational.
In each case, the outcome can conceal deterioration in the system producing it.
The absence of failure is not the same as evidence of control.
Challenger’s previous flights had landed safely, but safe return did not prove that O-ring erosion was acceptable. It proved only that the observed damage had not yet aligned with conditions severe enough to produce catastrophe.
Success is a poor measure of risk management when the system is succeeding despite its controls rather than because of them.
Exceptions become precedents
An exception is usually approved because the organisation believes the circumstances are limited.
The decision may be reasonable in isolation. A temporary workaround protects service delivery. A control is deferred until the next funding cycle. A risk is accepted for one release. A senior leader provides an approval outside the normal process because time is limited.
The structural risk appears when the exception becomes evidence supporting the next exception.
“We did this last time.”
“The issue has existed for months.”
“It has never caused a serious problem.”
“We already know how to manage around it.”
The organisation gradually builds an operating history that appears to validate the deviation. Each successful outcome makes the boundary easier to move again.
Eventually, nobody experiences the practice as exceptional. New employees learn it as the normal method. Reporting reflects the workaround rather than the original control. Leaders inherit a risk acceptance they never consciously made.
Every repeated exception teaches the organisation something about what its stated standards really mean.
The burden of proof can quietly reverse
On the evening before the Challenger launch, engineers from solid rocket booster contractor Morton Thiokol raised concerns about launching in the forecast cold conditions.
The available data was not complete enough to predict failure with certainty. It did, however, indicate that low temperature could affect the ability of the O-rings to seal.
The launch decision exposed a critical change in the burden of proof.
In a precautionary decision system, those proposing launch under unprecedented conditions would need to demonstrate that the system remained acceptably safe.
Instead, concern was challenged partly because engineers could not conclusively prove that the launch would fail.
This reversal appears throughout modern organisations:
- A team must prove that excessive workload will cause failure before additional capacity is approved.
- A cybersecurity specialist must prove that a vulnerability will be exploited before remediation receives priority.
- An operational manager must demonstrate that a control gap will cause harm before a project is paused.
- A frontline employee must provide complete evidence before a senior decision can be challenged.
Uncertainty becomes a reason to proceed rather than a condition to examine.
When consequences are serious, uncertainty should not automatically favour continuation.
Engineering concerns lost organisational influence
Challenger is often described as a case in which engineers warned management and management ignored them.
The reality is more organisationally complex.
Technical concerns moved through multiple groups, meetings, contractors and management levels. The available information was interpreted differently by people carrying different responsibilities. Engineers focused on component behaviour and uncertainty. Program managers also carried schedules, mission commitments and broader operational expectations.
The problem was not that management considerations existed. Complex programs always require technical, operational, financial and strategic factors to be balanced.
The problem was that evidence did not retain sufficient influence as it moved through the decision system.
Technical concern became one input among many, even though the potential consequence was catastrophic and the launch conditions fell outside the organisation’s previous experience.
Leadership Under Load asks not only whether information reaches senior decision-makers, but whether the structure preserves the significance of that information when it arrives.
Information has not been successfully escalated if it reaches the decision but loses the power to shape it.
Pressure rarely announces itself as pressure
It is easy to imagine organisational pressure as an explicit instruction to ignore risk.
More often, it is embedded in the environment.
A launch schedule has already slipped. Public expectations are high. Multiple teams have prepared for the mission. Delays create downstream consequences. Leaders have made commitments based on the existing timetable.
Nobody needs to say, “Safety is less important.”
The system communicates pressure through the consequences attached to delay.
Evidence that supports continuation receives a warmer reception. Evidence that requires another delay must overcome operational, reputational and managerial momentum.
The same dynamic appears when:
- commercial targets depend on a product release
- government commitments depend on a program milestone
- school delivery relies on already stretched staff
- a board has publicly endorsed a transformation timetable
- a founder has promised a customer that the team will deliver
Pressure does not always change the evidence.
It changes how willing the organisation is to accept what the evidence requires.
Organisational pressure is often most powerful when nobody needs to state it aloud.
Risk language can conceal risk migration
Organisations frequently manage concern through classification.
A defect becomes an accepted condition. A recurring exception becomes a known issue. A workaround becomes an interim control. A risk is transferred to a register and assigned an owner.
These practices can improve visibility and accountability.
They can also create the appearance that the risk has been controlled when it has merely been renamed, documented or transferred.
The critical question is not whether the risk has an entry, rating or owner.
It is whether the underlying exposure has changed.
If the same technical deviation continues, the same workload remains excessive or the same control is routinely bypassed, the risk has not disappeared. It has become administratively familiar.
Familiar language can make an unresolved risk feel more managed than it actually is.
Normalisation is usually collective
Normalisation of deviance should not be reduced to one reckless leader making an obviously irresponsible decision.
Organisational drift is usually collective.
Engineers adapt around known weaknesses. Managers develop processes for accepting exceptions. Leaders balance risks against schedules. Review bodies receive information in fragmented form. Successful outcomes reinforce confidence in the adapted system.
Each person may be acting rationally within the boundaries of their role.
The problem emerges from the interaction between those roles.
Because responsibility is distributed, no individual necessarily experiences themselves as the person accepting the full risk. One group understands the technical deviation. Another approves the schedule. Another owns the operational outcome. Another monitors the formal risk.
The organisation collectively carries a decision that nobody appears to have made alone.
Structural risk grows when responsibility is distributed but understanding of the total exposure is not.
Where normalised risk appears in modern organisations
Deferred maintenance
Equipment remains operational, so maintenance is postponed again even as the probability and consequence of failure increase.
Chronic understaffing
Teams continue delivering through overtime and individual effort, teaching the organisation that inadequate capacity remains workable.
Cybersecurity exceptions
Known vulnerabilities remain unresolved because no breach has yet converted technical exposure into visible organisational harm.
Governance workarounds
Decisions repeatedly bypass formal controls until the workaround becomes the organisation’s real approval system.
Technical debt
Temporary fixes accumulate because the product or service continues operating, while fragility grows beneath the visible performance.
Leadership dependency
One leader repeatedly rescues difficult situations, normalising a system that cannot operate safely or effectively without them.
What leaders should examine
Normalised risk is difficult to identify from inside the system because familiarity reduces its visibility.
Leaders should therefore look deliberately for the gap between formal expectations and actual operations.
Which exceptions have become routine?
Identify temporary approvals, manual workarounds and repeated departures that are now treated as ordinary operations.
What succeeds despite the system?
Examine outcomes delivered through individual effort, luck or recovery work rather than through reliable organisational design.
Which controls exist mainly on paper?
Compare documented policy with what people actually do when time, workload or commercial pressure increases.
Where has the burden of proof reversed?
Test whether people raising serious uncertainty are expected to prove failure before the organisation will pause.
What would surprise a new employee?
New people often recognise abnormal practices that experienced employees have learned to regard as unavoidable.
What worries experienced staff?
Ask what people closest to the work believe the organisation has become too accustomed to accepting.
Healthy organisations preserve the meaning of an exception
An exception should remain visibly exceptional.
That requires more than recording it in a register. The organisation must define why the exception exists, who accepted it, what additional controls apply and when normal operating standards will be restored.
Effective exception management includes:
- a clear expiry date
- an identified decision owner
- visible consequences if the exception continues
- additional monitoring proportionate to the exposure
- independent review where consequences are serious
- a funded path back to the intended standard
Without these disciplines, temporary acceptance becomes indefinite accommodation.
The purpose is not to eliminate all risk. Every organisation operates with uncertainty, constraints and trade-offs.
The purpose is to prevent repeated survival from being mistaken for evidence that the underlying risk is acceptable.
A managed exception has a path back to standard. A normalised deviation simply becomes the new standard without being named.
The lesson is not that managers should always defer to engineers
Challenger is sometimes simplified into a conflict between technically correct engineers and managers who prioritised schedule.
That framing can obscure the deeper organisational lesson.
Complex decisions require leaders to integrate technical evidence, operational realities, strategic commitments and uncertainty. Engineering expertise does not remove the need for accountable management judgement.
But accountable judgement depends on a decision structure that treats the consequence, quality and uncertainty of technical evidence appropriately.
When potential consequences are catastrophic and operating conditions fall outside demonstrated experience, uncertainty must carry more—not less—weight.
Leadership is not demonstrated by making the evidence fit the timetable.
It is demonstrated by allowing the evidence to change what the organisation is prepared to do.
Expertise does not make the final decision by itself, but the final decision must remain answerable to expertise.
The Leadership Under Load lesson
Challenger reminds us that organisations rarely fail simply because a risk appears.
They fail because a risk becomes familiar.
Repeated success changes how warning signs are interpreted. Exceptions become precedents. Technical deviations become accepted conditions. Operational pressure alters the burden of proof. Information reaches decision-makers but loses enough influence for momentum to continue.
Nobody needs to decide that safety, quality or governance no longer matters.
The organisation only needs to continue adapting around the deviation until the deviation no longer feels unusual.
That is why Leadership Under Load examines more than visible failure.
It asks what the organisation has learned to tolerate while everything still appears to be working.
Leadership Under Load asks whether today’s operations remain within a consciously accepted standard—or whether yesterday’s exception has quietly become today’s normal.
Where the Leadership Load Diagnostic fits
The Leadership Load Diagnostic helps organisations identify where repeated workarounds, unresolved risks, overloaded roles and informal decision practices are becoming embedded beneath apparently stable performance.
It examines where organisational success depends on excessive individual effort, where exceptions have lost effective ownership and where leadership pressure may be changing how evidence, risk and operational limits are interpreted.
The objective is not to remove every exception or eliminate all uncertainty.
It is to ensure the organisation still knows what is exceptional, who is carrying the risk and whether the conditions supporting today’s success remain sustainable.
Related Leadership Under Load insights
Frequently asked questions
What caused the Challenger disaster?
The immediate technical cause was failure of the sealing system in the aft field joint of Challenger’s right solid rocket booster. Cold conditions impaired the O-rings’ sealing performance, allowing hot gas to escape and contribute to the structural destruction of the launch vehicle.
What is normalisation of deviance?
Normalisation of deviance is the gradual process through which practices or technical conditions outside an original standard become accepted because repeated departures do not immediately produce failure.
Were concerns raised before Challenger launched?
Yes. Engineers raised concerns about the performance of the solid rocket booster O-rings in the unusually cold forecast conditions. Morton Thiokol initially recommended against launching before its management reversed that position during the pre-launch decision process.
Why did previous successful launches matter?
Previous missions had experienced abnormal O-ring erosion without catastrophic failure. Those successful outcomes contributed to increasing organisational acceptance of behaviour that was outside the original design expectation.
How does normalised risk appear in workplaces?
It can appear through recurring governance exceptions, deferred maintenance, chronic understaffing, unresolved cybersecurity vulnerabilities, technical debt and repeated reliance on individual heroics or informal workarounds.
How can leaders prevent normalisation of deviance?
Leaders can preserve the visibility of exceptions, set expiry dates, identify risk owners, monitor cumulative deviations, protect independent challenge and ensure successful outcomes are not treated as proof that controls remain effective.
Risk becomes most dangerous when it stops feeling unusual.
Repeated survival can make unresolved exposure appear controlled. Resilient organisations continue testing whether their standards still govern operations—or whether familiar exceptions have quietly rewritten them.