Psychological Safety After the Release Incident
At a 300-person payments software firm, two product groups share a platform. Group A has a lead time of four days and a change-failure rate near 5%. Group B averages 19 days and 28% failed deployments. After a payment outage traced to a configuration change in Group B, the engineering director held a two-hour review. The meeting ended with a named engineer receiving a formal warning. Since then, Group B's deployment approvals have increased, incident reports have fallen by half, and release lead time has risen to 26 days. Group A's manager has started refusing shared-platform changes. HR runs annual performance reviews with forced ranking across each group and requires managers to identify the bottom 10%. Engagement scores in Group B dropped 22 points. The VP of engineering wants to 'fix the culture' but has been told by HR that forced ranking is a global policy and by legal that incident records must be retained. She asks you to facilitate a 90-minute leadership session next week.
1. Diagnose the cultural dynamics behind the symptoms in Group B. Be specific about what is cause and what is a false signal of improvement.
Read the worked answer
The formal warning after an outage taught the group that speaking up or making an error has personal consequences. The fall in incident reports is therefore not evidence of safety; it is evidence of silence, and it coincides with a rise in approval steps and lead time. The approval increase is a control response that pushes risk into later stages. Group A's refusal to accept shared changes shows the blame event has spilled beyond Group B.
Forced ranking adds a second threat: managers must identify a bottom 10%, which encourages individual defensibility and discourages sharing weak signals. Psychological safety is not 'being nice' or removing accountability. Accountability means clear standards, ownership, and consequences for wilful violations; safety means people can report mistakes, ask questions, and challenge decisions without humiliation. The director's review confused the two by personalizing a system failure. The engagement drop and turnover risk are lagging indicators. I would test the diagnosis with a short, anonymous pulse on whether people can raise risks and whether they know what good looks like, then compare with near-miss reporting, not just recorded incidents.
2. Design the 90-minute leadership session. State the objectives, sequence, and one activity that surfaces the data without triggering defensiveness.
Read the worked answer
Objectives: agree on the problem, separate accountability from blame, and commit to two experiments with owners. Sequence: (1) contract on confidentiality and purpose-learning, not a disciplinary review; (2) present anonymized system data: lead time, change-failure rate, approval steps, incident reporting, and the 22-point engagement drop; (3) facilitated sense-making in pairs-'what makes it hard to raise a risk here?'-then cluster themes; (4) teach the distinction between psychological safety and accountability using a 2x2 of high or low standards and high or low safety; (5) choose two experiments, for example a 48-hour blameless incident review and a manager commitment to ask for dissenting views before release decisions.
Activity: a data walk with anonymized quotes and metrics on flip charts. Participants add questions, not defend positions. Do not name the engineer or relitigate the outage. Close with a written commitment from each leader and a 30-day check.
3. The VP says HR will not change forced ranking and legal requires incident records. What do you recommend she negotiate, and what can she do without policy change?
Read the worked answer
Separate three things: the global rating policy, the incident record, and the learning process. Legal retention does not require public blame; records can be retained in a restricted system while the operational review is blameless and focused on conditions. Ask HR for a local calibration approach within the global policy: role-based competency expectations, evidence from outcomes, and a review of how the bottom 10% is determined-especially whether it penalizes people for reporting. Offer to pilot for one cycle and compare engagement, regretted attrition, and incident reporting.
Without policy change, the VP can: model non-punitive responses in her own reviews; require incident reviews to produce system actions, not names; create a near-miss channel with no disciplinary use except wilful misconduct; train managers to separate performance issues from error reporting; and track whether reporting rises. She should not promise confidentiality she cannot keep. If HR refuses even calibration, escalate with data on the cost of silence: the outage, the lead-time increase, and turnover risk.