Further Reading: Capstone

On the citation tiers, see how-to-use-this-book.md.

This chapter has almost no new material and therefore almost no new reading. Everything it assembles was sourced in the chapter that built it, and the honest recommendation is to re-read the further-reading files of Chapters 25–30 rather than anything below.

What is new is the method — failure injection, the absence test, and the defence — and that has a real literature, in other fields.

One caution. The injection method is borrowed from industries where plans are tested against consequences far more serious than a wedding, and the borrowing should not be dressed up. A tabletop exercise for a hospital's mass-casualty plan and a planner spending forty minutes attacking a run sheet are not the same activity, and the second one is worth doing anyway.

Tier 1 — Verifiable published sources

Testing plans by breaking them

• Chaos engineering, from software operations. The principle — deliberately inject failures into a working system to discover fragility before it discovers you — is §40.3 exactly, and the literature on it is clear, free, and thoughtful about the ethics of when not to inject. Search: chaos engineering principles, and the original Netflix material.
• Tabletop exercise design, from emergency management and public health. This is the closest formal discipline to §40.6's simulated day, and its guidance on injects — the term is theirs — is directly usable. Free guidance is published by most national emergency-management agencies.
• Any material on premortems — Klein, Gary, who is also Chapter 27's recommendation. A premortem imagines the failure and works backwards; an injection specifies the failure and works forwards. They are complementary and the premortem is faster.
• Failure Mode and Effects Analysis (FMEA), from engineering and increasingly from healthcare. More systematic than §40.3 and considerably more work — but the concept of scoring each failure by severity, likelihood, and detectability is a better ranking method than this chapter offers and is worth borrowing if you run large events.

Why reviews miss things

• Any current work on inspection and review effectiveness, from software or safety engineering. The consistent finding is that reviews are good at conformance and poor at absence — which is Case Study 40.1's four reviewers, formalised.
• Reason, James. Human Error and Dekker, Sidney. The Field Guide to Understanding "Human Error." Recommended in Chapters 28 and 34; here for the specific point that a correct plan with an unexamined dependency is a latent condition, not an error.
• Any material on the availability heuristic and on hindsight bias. §40.4's "defend the decision, not the outcome" is a direct application, and Kahneman's treatment is the accessible one.

Handover, continuity, and the absence problem

• Any current guidance on clinical handover — SBAR, ISBAR, or your national equivalent. The four-minute ambulance call in Case Study 40.2 is a handover, and medicine has spent thirty years working out what one must contain. Read one protocol; it will improve every handover you ever give.
• Business-continuity planning material, at any scale. The concepts — single points of failure, recovery time, the person-dependency audit — transfer directly, and most of the small-business guidance is free.
• Aviation and maritime handover practice, for the discipline of a structured verbal handover on top of a written record, which is exactly what the three extra sentences were.

Simulation as a learning method

• Any material on simulation-based training from medicine, aviation, or the military. The finding that matters here: simulation's value is in the debrief rather than in the simulation, which is why §40.6's output is the marks and not the run.

Tier 2 — Attributed professional practice

• The ten-section production book. An assembly of this book's own artefacts, and other planners' books differ. Exercise C.4 asks you to compare.
• The twelve completeness-audit questions. The author's, and question 12 is the one that finds things.
• The ceremony-hour sheet. The author's, closing a Chapter 29 finding, and the eleven-minute claim is an estimate.
• The six-step injection method, and the five-injection set. Adapted from chaos engineering and tabletop practice, and the specific set is the author's.
• "A good injection finds a gap and then finds a collision." Observation.
• The three defensible forms of a design decision, and the fourth that is not a defence. The author's, and D.4 argues the fourth is a loophole.
• The absence test and its six questions. The author's, and the strongest single technique in this chapter — and the one nobody will do, because it is uncomfortable and requires somebody else's ninety minutes.
• "Assemble → inject → fix → read through → distribute." Case Study 40.1's finding, and it is not in the chapter's own index — which the case study says out loud.
• The nine-section post-event report. Chapter 30's method, assembled.

Tier 3 — Illustrative and constructed

Kwabena Osei-Duah and the Thornfield gala; the Reyes–Whitfield day run by Adriana Fonseca-Marín. Constructed.

Three notes.

Case Study 40.1's central claim is the load-bearing one and it is deliberately unflattering to review: four competent people read a correct plan and none of them could have found the fragility, because the fragility was an assumption rather than a discrepancy. The case study is careful that this is not a criticism of the reviewers, and Kwabena says so himself.

Case Study 40.2 is the only chapter of this book in which the planner is absent, and it is constructed to test Chapter 39's boundary claim under laboratory conditions. The result — four calls in seventeen hours, all about judgments concerning people — is what the theory predicts, which is either a validation or a construction that flatters the theory. A reader is entitled to treat it as the second. What is not constructed is the mechanism: everything with a right answer was in a document, and the questions that were not could not have been.

And the case study's honest limit is stated in it: the four calls required the planner to be reachable. A version in which they were in surgery produces four unanswered questions. A system reduces the irreducible part and does not eliminate it.

Where to go next

Read one clinical handover protocol — SBAR or your local equivalent. Ten minutes, and it will improve every handover you give for the rest of your career.

Read the chaos-engineering principles. Short, free, and it is §40.3 with better discipline and a clearer account of when not to do it.

Then run one injection (B.5). Forty minutes on a plan you already have, traced on paper, without solving until step five.

And do the absence test (B.9). It is the only thing in this chapter that cannot be self-administered, it costs somebody else ninety minutes and you a lunch, and it found eleven gaps in a plan built across thirty-nine chapters.

Then name your three sentences. For whatever event you are working on now: what are the three things somebody would need that the book cannot make salient?

If you cannot name them, you do not yet know where your plan's weight sits.

Chapter 41 preview

One chapter left, and it asks what none of the other forty have.

This book has counted decisions, hours, Saturdays, dollars, kilograms, guests, and findings.

It has never asked what the work costs the person doing it, how long anybody can do it, or what it is for.

Chapter 41 asks all three — and it begins from a detail in Chapter 37 that was left deliberately unresolved: a planner who got six Saturdays back and went to two weddings as a guest for the first time in five years.