How ideas from aviation, healthcare, and emergency services shaped a different kind of safeguarding system
You’ve probably noticed that the Jigsaw system doesn’t work like other safeguarding tools. It doesn’t give you a checklist. It doesn’t score your policies. It doesn’t audit you once a year and hand you a certificate or accreditation.
Instead, it monitors whether your safeguarding system is working — continuously across 26 elements, producing a rating that updates as your team works. Monitoring coverage. Review cycles. Meeting rhythm. How concerns are surfaced and resolved. Whether vigilance is sustained or has gone quiet.
People keep asking: Why does it work like this?
I started my career designing insurance policies for hard-to-insure exposures at Lloyd’s. Nearly two decades ago, I helped place the first stand-alone sexual abuse insurance policies for the Catholic Church — but the most important part of that work wasn’t designing the product. It was reading the claim files. That experience changed everything.
Meeting with organizations afterward, I saw three patterns:
- Organizations that had faced allegations managed sexual abuse risk with a seriousness that others didn’t.
- The most proactive organizations asked questions their tools couldn’t answer — How do we know this is working? Will it hold up as things change? What do staff do when the rules don’t cover the moment?
- Too many “safe environment” programs faded within a few years because they weren’t delivering enough value to sustain investment.
Those patterns revealed the real problem: the tools most organizations had been given to manage sexual abuse risk weren’t fit for purpose. Abuse kept happening in organizations that were following all the prescribed steps. And it wasn’t just me who saw it.
Insurers had every reason to make the existing model work — resources, data, actuarial expertise, and every commercial incentive to sustain coverage for long-standing clients. Faced with claims, they tried to build defensible positions from the evidence available: policies in place, training completed, background checks conducted, accreditations achieved. None of it was enough. They withdrew because they couldn’t build a sustainable defense from evidence that the right things were in place.
The tools didn’t prevent abuse, nor did they create defensibility. I realized organizations didn’t need better tools. They needed a system — one that was dynamic, defensible, and designed for how sexual abuse risk actually works. That’s why I built Jigsaw. This piece explains how I built it — the ideas from other industries that shaped every design decision in the system.
The Field That Studies How Safety Actually Works
There’s a discipline called resilience engineering. It emerged in the early 2000s from the work of researchers like Erik Hollnagel, Sidney Dekker, David Woods, and Nancy Leveson — people who spent their careers studying catastrophic failures in aviation, healthcare, emergency services, and space exploration. Not by studying failures after the fact, the way most investigations do, but studying the systems that produced them — the organizational conditions, the human factors, the gaps between what was supposed to happen and what actually did.
What they found, again and again, was counterintuitive. The organizations that suffered the worst failures were rarely the ones that lacked rules. They had rules. They had policies, procedures, training programs, and compliance frameworks. Often, they had more of these things than the organizations that avoided failure.
The difference wasn’t in what was written down. It was in what happened in the space between the rules and reality — in the moments where a person had to make a judgment call, under uncertainty, with incomplete information, and no one watching to see how it went.
That finding changed safety science. And it has profound implications for safeguarding.
You might think resilience engineering doesn’t apply here because it’s often seen as concerned with the unknown. With sexual abuse, the hazard is known. It’s been studied, documented, and legislated against. But resilience engineering isn’t really about whether the hazard is known. It’s about how systems work when people have to exercise judgment under uncertainty. And that is central to safeguarding.
It is also why Jigsaw is grounded in Enterprise Risk Management (ERM) — risk management best practice. In ERM, risk is defined as the effect of uncertainty on objectives. Seen through that lens, sexual abuse risk is not only about preventing harm before certainty arrives. It is about understanding how uncertainty affects the organization’s ability to achieve its goals — and strengthening judgment where that uncertainty is greatest.
Lesson 1: Work as Imagined vs. Work as Done
Erik Hollnagel drew a distinction that should be framed on the wall of every organization that takes safeguarding seriously. He called it work as imagined versus work as done.
Work as imagined is what the policy manual describes. It assumes that conditions are stable, that people follow steps in order, that information is available when needed, and that the person making the decision has the time, clarity, and support to make it well.
Work as done is what actually happens. It’s the youth program volunteer who notices something unsettling but can’t articulate what it is, and there’s no procedure for “I have a feeling.” It’s the new staff member who completed the training but doesn’t yet have the relational capital to raise a concern about a senior colleague. It’s the after-school program where the supervision ratio is met on paper, but a facilities change three months ago created sightline gaps that nobody reassessed. It’s the care home where the reporting system exists, but concerns have dwindled to a trickle — not because nothing is happening, but because the last person to raise one felt the process led nowhere.
The gap between these two is where risk lives. Not in the absence of policies, but in the distance between the policy and the reality. Traditional safeguarding tools — policies, training, background checks, accreditations — all describe work as imagined. None of them measures whether the actual operation is working as intended.
The mismatch is straightforward. Compliance tells you whether the right things are in place. Risk management tells you whether those things are working. They answer different questions. And when you rely on one to do the other’s job, you get a gap that no amount of effort can close.
Lesson 2: Track What Goes Right
Traditional safety thinking — what Hollnagel called Safety-I — focuses on what goes wrong. Incidents. Failures. Near-misses. Most safeguarding frameworks follow the same logic: something bad happened or might happen, so we build defenses against it.
Safety-II asks a different question: What makes things go right?
In any organization working with children or vulnerable adults, the vast majority of days go well. The natural assumption is that nothing happened because nothing was going to happen — that most organizations simply aren’t targeted, and safe days are just the default. There’s truth in that. Sexual abuse is rare in any single organization. But Safety-II research across other high-risk sectors found something important: even in environments where incidents are rare, the difference between organizations that stay safe and those that don’t isn’t luck. It’s the presence of small, often unconscious, everyday actions — someone noticing something early, a team discussion surfacing a concern before it festers, a supervisor checking in with a new volunteer at the right moment, a parent’s offhand comment taken seriously rather than dismissed. None of these is heroic. Most aren’t even deliberate. But they are the ordinary, ongoing conditions of a system that’s working.
If those things stop happening — if the meetings get shorter, the concerns dry up, the check-ins fade — the organization doesn’t look less safe. It looks exactly the same. Until it isn’t.
Safety-II says: don’t wait for the system to fail. Track the conditions that make good outcomes possible, and watch for signs that those conditions are eroding.
Lesson 3: Drift Into Failure
Sidney Dekker’s concept of drift into failure is perhaps the most important idea in resilience engineering for anyone responsible for safeguarding — and the hardest to accept.
Dekker studied disasters and found that in nearly every case, the organization hadn’t suddenly become unsafe. It had drifted there — slowly, through small, individually reasonable decisions that collectively moved the system away from the conditions under which it was designed to operate.
A supervision arrangement not adjusted for a staffing change. A review cycle postponed for a higher-priority task. A concern noted but not logged because it seemed minor. A training session condensed due to a tight schedule. A new program launched without the safeguarding framework being updated.
None of these felt dangerous. Each was a reasonable response to a real constraint. But together, over months or years, they moved the organization away from the conditions keeping people safe, without anyone being aware of the cumulative effect. The policies didn’t change. The training records looked current. The compliance framework still achieved accreditation. But the living system underneath — the one where human judgment actually operates — had shifted.
Dekker’s insight: this drift is normal. It happens in every complex system. It isn’t caused by negligence — it’s caused by the ordinary pressures of running an organization. The question isn’t whether drift happens. It’s whether the organization has a way to see it.
How These Lessons Shaped Jigsaw
Every feature in the Jigsaw system traces back to one of these three lessons. Together, they produce the Governance Maturity Rating (GMR) — a letter grade from A+ through NR that tells the organization, and anyone who depends on its safeguarding, whether the system is working.
Monitoring coverage closes the gap between imagined and done. Each of the 26 elements gets monitored on a recurring schedule — not “does the policy exist?” but “is it working on the ground, in practice?” When the gap between the written system and the lived system widens, the rating sees it.
Review coverage catches drift. Reviews are longer-cycle, deeper evaluations: is this still the right control, given how the organization has actually changed? New programs, new facilities, new staff profiles — any of these can make a previously adequate control inadequate.
Rhythm sustains attention over time. The system tracks whether the safeguarding team is meeting at the cadence it committed to — because sustained, rhythmic attention is one of the strongest predictors of system health in resilience engineering research. When meetings are skipped or shortened, it’s often the first sign that attention is migrating elsewhere.
Responsiveness measures whether the system can convert a signal into action. When a concern is surfaced, the system tracks whether it progresses toward resolution. A system that generates signals but can’t process them isn’t a working system. It’s a filing cabinet.
Emergence is the Safety-II dimension, and of all the differences, it’s the one that most distinguishes Jigsaw from other safeguarding tools. It tracks whether new uncertainties are being surfaced — not incidents, but observations, questions, unease. These are the signals that judgment under uncertainty is actually being supported — that people are noticing things they can’t yet explain, raising questions that don’t have clear answers, and trusting the system enough to share what they see. When those signals go quiet, most organizations feel reassured. The emergence modifier is designed to challenge that assumption. Silence isn’t evidence of safety. It might be evidence that the conditions supporting vigilance have eroded — and that the organization’s capacity to exercise judgment under uncertainty has gone quiet with them.
The GMR moves. That’s by design. It’s not a score you earn once and keep — it’s a continuous measure of system health, like a vital sign. Every movement is traceable to source data — meeting records, monitoring dates, flagged item lifecycles, calculation logs. This is evidence, not opinion. It can be shown to boards, regulators, insurers, and families. Not “we have policies” but “our system is working, and here’s the data.”
It’s also what makes Jigsaw more than a framework. Frameworks can help organizations think more clearly. Jigsaw also gives teams a place to work, monitor, review, learn, and build evidence over time. And because learning is captured and synthesized, it works as a platform — not just for one organization’s safeguarding, but for building a deep body of knowledge about how sexual abuse risk is actually managed well.
A System Built for How Sexual Abuse Risk Actually Works
Sexual abuse risk doesn’t announce itself. It develops in the spaces between policies — in the moments where judgment meets uncertainty, where someone notices something that doesn’t quite fit, where the question isn’t “has a rule been broken?” but “does this feel right?”
The tools safeguarding has traditionally relied on were designed for a world where the first question is sufficient. They answer it well. Policies, training, background checks, and accreditations describe what’s in place, and that description matters.
But the questions that determine whether children and vulnerable adults are actually protected are different: Is the system working? Are the conditions that support good judgment being maintained? Is attention being sustained? Is drift being caught? Are signals flowing?
These are the questions resilience engineering taught other industries to ask. And they are the questions the Jigsaw system was built to answer — continuously, with evidence, for every organization that has already done the hard work and deserves a way to know it’s making a difference.
And because the system produces that evidence as a natural byproduct of doing the work — meeting records, monitoring dates, flagged item lifecycles, calculation logs — defensibility isn’t something you build separately. It’s already there. Not because you manufactured it for that purpose, but because your protection system was genuinely working, and the data shows it.
The problem with protection was never the commitment. It was the tools.
