What Is the Swiss Cheese Model, and Why Do Layered Retail Security Controls Still Fail?
The Swiss cheese model describes a store’s defenses as stacked layers, each with its own weaknesses, much like slices of cheese whose holes keep opening, shutting, and shifting location. A loss gets through only when the holes in several layers line up at once. In a store, those layers are policy, sign-off, exception reporting, and investigation, and a single understaffed shift can open holes in more than one of them at the same time.
Where the Swiss cheese model comes from, and who actually named it
The model dates to 1987-8, when Reason developed it while writing Human Error, according to a report from Eurocontrol. Reason’s own paper describes defensive layers as “more like slices of Swiss cheese, having many holes” (jround.co.uk), and his 1997 book states the same point in a different sentence: “each layer has weaknesses and gaps” (Managing the Risks of Organizational Accidents (p. 29)).
The label itself is contested. A paper in BMC Health Services Research credits Reason with proposing the image, while the Eurocontrol report credits Reason with the model and says the name “Swiss cheese” was probably coined by Rob Lee, then director of Australia’s Bureau of Air Safety Investigation. The same BMC paper warns, “the danger is that people today use the label ‘Swiss cheese model’ without realising that its meaning varies from one person to the next.”
When a training deck cites “Reason’s Swiss cheese model,” check which definition it borrows.
Why do the holes in a store’s controls line up, and why can adding more rules make it worse?
A Des Moines case shows how a narrow layer becomes a permanent hole. A service desk employee knew that loss prevention “only mailed out refund validation cards on no-receipt refunds and did not pay much attention to receipted refunds,” and an investigation later documented $186,000 in loss over seven years (LP Magazine). In Reason’s terms, that scope limit was a latent condition.
Several layers open at the same time under the same pressure. Reason lists the conditions: “time pressure, understaffing, inadequate equipment, fatigue, and inexperience” (jround.co.uk). Eurocontrol, citing Sidney Dekker, adds that layers of defense “can interact, support or erode one another” (Eurocontrol). Under Reason’s shared conditions, a short-staffed shift that makes a manager skip a sign-off can also leave an exception report unread on the same shift.
Piling on rules can widen a hole, though the evidence for that comes from outside retail. UK HSE guidance cites a study of Dutch railways in which 80% of the workforce considered the rules mainly concerned with pinning blame, and 95% thought the work could not be finished on time if all the rules were followed (HSE). Vincent and Amalberti report that “workers in many organisations find that it is often necessary to by-pass or flout rules to get the job done in a reasonable time” (Springer). Alert overload creates a similar effect in medicine: AHRQ’s patient safety network warns that “a proliferation of alerts that are intended to improve safety actually results in a paradoxical increase in the chance patients will be harmed” (AHRQ PSNet). This site’s judgment is that a store’s exception-report queue runs on the same logic. The table below is this site’s application of Reason’s framework to the Des Moines pattern, and its rows are illustrative.
| Layer | Hole | Condition that opens it | Shares root cause with |
|---|---|---|---|
| Refund policy and validation | Fraudulent refunds move to the refund type nobody checks | Validation scoped to one refund type, and desk staff already know which types get checked | Manager sign-off |
| Manager sign-off | Sign-off becomes a rubber stamp | Time pressure and understaffing on a rushed shift | Exception reporting |
| Exception reporting | A flagged report sits unread | Too many flags for one person to clear | Manager sign-off |
| Investigation | Starts only after loss accumulates | Deviation goes unnoticed while nothing visibly breaks | All three layers above |
Use the same four rows as a starting check for any high-value transaction type in the store, including gift card activations and receiving sign-offs, and ask whether a proposed fix only pushes the hole into the layer next to it.
What NRF and ECR’s 2026 data show
NRF’s 2026 survey found “a 12.4% decrease in shoplifting incidents and an 8.1% decline in retail merchandise theft in 2025 compared with 2024” (NRF). NRF Vice President David Johnston said retailers “are beginning to see levels stabilize, driven by investments in technology and employee training to strengthen store security and improve response to these crimes.” The same survey found reports of store-related theft incidents to law enforcement remain low, with 63% of retailers reporting fewer than half of them (NRF). This site’s reading is that a decline in incidents does not show which control produced it, so a program still has to measure each layer.
ECR’s 2026 self-checkout report found losses run 33% higher in stores with self-checkout, a smaller difference than it reported in 2018 (ECR), and that turning off weight scale controls increases loss (ECR). Estimates of how much non-scan activity is driven by malicious customer intent range from 6 to 80% (ECR). The report also warns that audits and age checks, both added to close a hole, can raise abuse and violence against staff (ECR), the interaction problem in a single finding: a fix at one layer opens a new hole in another.
Report near misses, and measure each layer before writing another rule
Reason argues that “effective risk management depends crucially on establishing a reporting culture” (jround.co.uk). He lists “writing another procedure (or adding to existing ones)” among the person-approach fixes he argues against, alongside posters, discipline, and blame. A store that only answers a loss with a new rule is treating a latent condition like an active failure, and it misses the staffing or design problem underneath.
The stronger move is to measure what each layer actually catches: track near misses the way an incident report captures a close call, pull the exception-report queue and count how many flags get reviewed versus ignored, and check whether two layers that failed share one root cause, like the same understaffed shift. For a single store or a small multiunit chain without a dedicated audit team, a one-time consultant review can run that layer-by-layer count, and one source calls it often the most cost-effective way to reduce shrink (Retail Crime, Security, and Loss Prevention).
A training manager can pair that count with getting associates to report a near miss before it becomes a loss.
What to do this week
- Pull last month’s exception-report queue and count how many flagged refunds actually got a manager review, not just a signature.
- Check whether sign-off duties and exception-report review sit on the same short-staffed shift, and fix the staffing gap, not only the policy.
- Plug the documented hole: expand the refund validation check to cover receipted refunds, since a scope limited to no-receipt transactions is already a known hole (LP Magazine).
- Add a near-miss question to the next huddle so associates can flag a skipped sign-off before it becomes a documented loss.
- Before answering a loss with another procedure, name the hole it plugs and the rule or review it replaces.
- Before tightening a self-checkout rule, ask whether it closes a hole or just moves abuse risk onto the associate at the exit.
Frequently asked questions
Is the Swiss cheese model only used in aviation and healthcare?
No single industry owns it. Eurocontrol's report notes that latent conditions exist in all organizations, "regardless of their accident record" (Eurocontrol), which is why a store with a clean record can still carry hidden holes in its refund, sign-off, or receiving layers that have not yet lined up.
What does Reason mean by a 'root cause' in this model?
Reason defines it practically: a root cause is the contributing factor investigators are still working on "when the money or the time runs out" (Eurocontrol). An exception-report review that stops at the first explanation can easily miss a second layer carrying the same hole.
What's the difference between an active failure and a latent condition?
Active failures are the errors made at the register or the service desk, and their specific forms are often hard to foresee. Latent conditions, by contrast, "can be identified and remedied before an adverse event occurs" (Reason), so an unread exception report is a hole a manager can fix today.
Does the Swiss cheese model mean no single employee is responsible for a loss?
No. The model directs a manager toward the layer that failed, alongside the person who made the error. On fixes, a survey of professionals found "plugging a hole was correctly selected by most respondents, but the solution of adding a barrier (a slice of cheese) was not" (BMC Health Services Research). Both are system fixes; what Reason argues against is answering a loss with another procedure aimed at the person.