Practical Drift

Why it matters

Nobody breaks the rules — and the system fails anyway. Over time the way work is actually done slides away from the way it is officially written down, one small, locally sensible shortcut at a time: each deviation saves a minute, fits the real situation, or routes around a constraint the procedure-writers never foresaw, and none of them causes any harm on its own. The danger is that these drifts accumulate invisibly — each unit sees only its own reasonable adaptation — until one day the gaps between the drifted parts line up, and the failure that results is one no single shortcut could ever have produced alone.

For example: a hospital ward’s medication-handoff procedure says the outgoing nurse reads each drug aloud from the chart while the incoming nurse confirms it against the patient. It’s slow, so over a busy year it quietly compresses — outgoing nurses start handing over a written summary instead, incoming nurses skim it, the read-aloud check survives only for “the complicated patients.” Every shift it works fine; the ward is proud of how smoothly handoffs run. Then a patient is moved between two units whose summaries use slightly different shorthand for the same drug, the receiving nurse reads it the way her own unit means it, and a dose is doubled. No one was careless. Two locally rational drifts simply assumed each other’s old conventions, and the assumption stopped holding.

What it reveals. Whether the documented procedure still describes the real work — and where local adaptations have accumulated into a hidden gap between what the manual says and what people actually do.
How it changes the read. You stop asking “who broke the rule?” and start asking “why was this deviation locally rational, and which cross-unit assumption does it quietly depend on?”
When to foreground it. A system that has run “fine” for years without a serious failure; workarounds that no one flags as deviations anymore; an incident that exposes a gap between “what we do” and “what the manual says.”
What you’d miss without it. That the failure is structural and invisible — each unit’s drift is harmless alone, the danger lives only in the alignment of gaps no single vantage point can see, and blaming an individual leaves the system that invited the drift untouched.
Where it misleads. It can slide into hindsight (“they should have followed procedure”) when the deviation was the rational response to a real constraint; and reinstating the original rule without fixing the conditions that drove the drift just makes the same drift return.

How it works

On 14 April 1994, in cloudless skies over the no-fly zone of northern Iraq, two U.S. Air Force F-15 fighters shot down two U.S. Army Black Hawk helicopters, killing all 26 people aboard. An AWACS surveillance plane — a flying radar station whose entire job is to track every aircraft in the area — was watching the whole time. There was no enemy, no equipment failure, no single gross blunder, no villain. By every measure of training and technology it was an impossibly well-equipped operation, and it killed its own people in clear daylight. For years the obvious questions — who screwed up, who do we punish — produced no satisfying answer, because the honest answer was: nobody, exactly.

The sociologist Scott Snook spent years reconstructing it, and what he found was not a chain of errors but a slow, quiet slide. Every unit involved had, over time, drifted from its written procedures in small, locally sensible ways. The helicopters used radio frequencies and identification routines that made perfect sense within their own operation but no longer matched what the fighters and the AWACS crew expected. Who was supposed to talk to whom, and on which channel, had settled into local habits that worked fine inside each unit and had never been tested across all of them at once. None of these adaptations was reckless. Each one saved time, fit the reality on the ground, or worked around a constraint the procedure-writers had never anticipated — and each one, on its own, was harmless. The catastrophe was that on this one day the gaps between the drifted units lined up, and the helicopters fell into a seam that no one could see from inside their own piece of the system. Snook named the pattern practical drift: the slow uncoupling of how work is actually done from how it is officially prescribed, driven not by rule-breaking but by local rationality — the plain fact that each small deviation is the sensible thing to do where you are standing.

That is what makes practical drift so dangerous and so hard to catch: it is structural, and it is invisible from the inside. Each unit sees only its own modest, reasonable adaptation and has every reason to feel good about it — the work is getting done, the shortcuts are paying off, nothing bad has happened. What no one can see is that the cross-unit assumptions that once held silently — they’ll be on this frequency, they’ll identify themselves that way, they’ll expect us to call first — have quietly stopped holding. The drifts don’t announce themselves. And the failure, when it finally comes, is one that no single unit’s drift could have produced alone; it requires the alignment, and alignment is exactly the thing no one is positioned to notice. The sociologist Diane Vaughan found the same pattern wearing a different name when she dissected NASA’s decision to launch the Challenger: she called it the normalization of deviance — the way a deviation, repeated again and again without disaster, gradually stops feeling like a deviation at all and becomes simply “how we do it,” until it is invisible even to the experts who live inside the system.

You do not need a war zone or a space agency to watch it happen. Consider a data center’s backup procedure: nightly full backups, with the off-site copies verified once a week. It is sound, and at first it is followed. Then the full backups start slowing down overnight processing, so the team switches to incremental-only — a reasonable call. The weekly verification check is tedious and always passes, so it slips to monthly, then quarterly, then “when someone remembers.” Nothing breaks. The system runs fine for two years, and the smooth running is itself the trap — it breeds the complacency that lets the drift continue unremarked. Then a ransomware attack encrypts the primary storage, and the team goes to restore from backup and discovers the truth all at once: the most recent clean backup is 11 days old, and the off-site replicas haven’t been verified in four months. No one was negligent on any given night. The procedure simply drifted, one locally sensible decision at a time, until the safety it was supposed to guarantee had quietly evaporated. The name for that slide — the one this lens is built to catch before the attack comes, not after — is practical drift.

Framework & implementation

Origin and evidence

The originating analysis is Scott Snook’s Friendly Fire: The Accidental Shootdown of U.S. Black Hawks over Northern Iraq (2000), which reconstructs the 1994 shootdown and coins the term practical drift for the slow uncoupling of practiced from prescribed behavior under local rationality. Its essential companion is Diane Vaughan’s The Challenger Launch Decision (1996), whose study of NASA’s 1986 launch decision names the parallel mechanism — the normalization of deviance, by which a repeated deviation that never (yet) causes disaster comes to feel normal and turns invisible to those inside the system. Both sit inside the broader frame of James Reason’s Managing the Risks of Organizational Accidents (1997), which describes organizational accidents as the product of latent conditions — dormant weaknesses, built in long before, that lie quietly in a system until active failures and circumstances line them up. The lens sits beside its own family: normalization of deviance (what drift becomes once it turns invisible to insiders), the Swiss cheese model (what aligns when drift erodes multiple units’ assumed safety properties), and normal accident theory (the structural property of complex, tightly-coupled systems that makes aligned drift catastrophic).

Applications and common uses

Practical drift is a working tool wherever a documented procedure governs real work and time has had a chance to bend the two apart.

Safety post-mortems and accident investigation. Its native ground: explaining a failure that has no single culprit by tracing the accumulated local deviations whose gaps aligned — and resisting the pull toward individual blame.
Safety audits and pre-mortems. Catching the drift before the accident — auditing standard procedures against actual practice precisely while the system is still running “fine,” because the smooth running is the complacency that hides the gap.
Organizational risk and high-reliability operations. Diagnosing where cross-unit assumptions have quietly stopped holding in hospitals, aviation, finance, and infrastructure, where coordinated work depends on each unit’s implicit conventions.
Process documentation and improvement. The use that brings it here: mapping the real, current-state process rather than the policy fiction, and producing a deviation register that gives each drift an explicit accept-and-fold-in or reject-and-redesign disposition.

In every case the payoff is the same: the gap between the documented and the lived process is made visible, each deviation is read for local rationality rather than treated as a rule violation, and the silent assumptions that drifted units depend on are surfaced before they can align.

Failure modes and when not to use it

The lens’s characteristic ways of going wrong are catalogued in its Common Failure Modes:

Individual blame. Attributing drift to the negligence of specific actors. The tell: the post-mortem fingers individuals rather than the system. Correction: trace the local conditions that produced the drift — the deviation was almost always the rational response to a real pressure.
Re-enforcement without redesign. Reinstating the original procedure without addressing why the drift occurred. The tell: the same drift returns within months. Correction: revise the procedure to accommodate the conditions, or remove the conditions that force the workaround.
Drift-as-improvement amnesia. Losing track of which drifts are genuine improvements and which are latent risks. The tell: no documented disposition for each observed deviation. Correction: produce a deviation register with explicit accept/reject decisions.

When not to reach for it. When no documented procedure exists, or it was never actually followed, there is no baseline for drift to depart from — the question is design, not deviation. When the system has a single actor and no cross-unit coordination, the lens’s core danger (aligned gaps between drifted units) can’t arise, and a simpler look at one person’s habits suffices. And the lens explains and surfaces drift; it is descriptive, not causal — when the task is to establish why a specific outcome occurred as a chain of causes, that is root-cause analysis’s job, and forcing the drift frame onto it overreaches.

Process Mapping — the analysis this lens informs; documents a process’s real, current-state flow (steps, actors, dependencies, bottlenecks, hand-offs), where practical drift is the discipline that surfaces the gap between the documented procedure and actual practice.
Normalization of Deviance — Diane Vaughan’s companion model: what drift becomes when repetition without disaster makes a deviation feel normal and turns it invisible to those inside the system.
Swiss Cheese Model — the alignment picture: what lines up when drift erodes the assumed safety properties of multiple units, so a hazard passes clean through every layer of defense at once.
Normal Accident Theory — the structural backdrop: the property of complex, tightly-coupled systems that makes aligned drift not just possible but catastrophic when it comes.