Death at Dreamworld: Ten pathways to disaster and failure to learn

Abstract

Deaths in workplace incidents – of both workers and members of the public – normally spark a number of official responses, including coronial inquests. In many instances, however, these investigations have examined the incident in isolation from the wider context of hazards in that industry and are rarely informed by the extensive research literature on health and safety, and death and disaster, at work. In this examination of a tragic theme park disaster in 2016, we demonstrate that applying a wider lens and drawing on the ‘ten pathways model’ not only provides a more compelling explanation of how and why safety measures failed but may also inform more fatality and injury prevention measures. Drawing on James Reasonʼs concept of latent failures, the ten pathways model identifies latent failures that are repeatedly associated with death and disaster in workplaces across different industries. Using the Dreamworld coronial inquest findings and other related source material, this paper finds that at least nine and possibly all ten pattern failures were present in the Thunder River Rapids ride disaster at the Dreamworld theme park and contributed to the deaths of four visitors. In particular, it highlights the corroding effects of poor maintenance, inadequate management systems, and regulatory failure. The paper also raises questions about why theme parks as high-hazard workplaces marked by injuries, deaths, and ‘near misses’ were not subject to more rigorous oversight prior to the event and how regulatory failures might best be addressed.

Ten pathways analysis and theme parks

In October 2016, a malfunction on the Thunder River Rapids (TRR) ride at Dreamworld in south-east Queensland, Australia’s largest amusement park, caused the deaths of four visitors on the ride. An investigation into the deaths took evidence from park managers, staff, witnesses, regulators, and union representatives, and, almost four years later, Queensland coroner, James McDougall (2020), released his findings. The coroner’s report revealed a litany of failures surrounding the park operator’s duty of care to customers and employees.

The Dreamworld disaster was by no means the first fatal incident at a theme park or on an amusement ride in Australia. For example, at the Royal Adelaide Show in September 2000, 37 people were injured when a gondola on a ride called the Spin Dragon collapsed onto patrons queueing to get on it and, only a few months later and also in South Australia, an 8-year old girl was killed at a carnival in Kapunda, when the inflatable carriage she was in, broke free from the ride – 11 others were injured (SBS News, 18 April 2017). Around the world, there has been a string of multiple-fatality theme park incidents dating back decades in Europe, North America, and elsewhere, a number sparking debates over the adequacy of regulation (Reiss 1986). In a one-year period, Woodcock (2019) identified 182 theme and amusement park incidents in 38 countries, 51 of which involved fatalities. Woodcock found the occurrence rate was higher in Latin America and lower in North America and attributed this difference to stronger regulation and higher standards in the latter. Regulatory oversight has not been sufficient, however, to stop the death count from rising in Australia. Since Dreamworld, similar incidents have occurred elsewhere – in 2017, the Queensland Office of Industrial Relations (OIR) prosecuted a case involving a jumping castle becoming dislodged (McDougall 2020, 172) and, in December 2021, six children were killed and three badly injured when a jumping castle at a Devonport school in Tasmania became airborne and flipped, an incident for which charges have now been laid against the operator (ABC News 16 November 2023).

Theme park rides typically entail thrills and a sense of danger, but customer expectations are that hazards will be well controlled. Mohun (2001) argues that the commodification of ‘ersatz risk’ characterised early amusement park rides, where consumers could purchase the excitement of great speeds, heights, and ‘the sensation of being at risk’, safe in the knowledge or at least the delusion that the rides they took had no ‘physical consequences’ (Mohun 2001, 294). In his examination of ride design and construction, Mohun (2001, 298) argued rides needed to be reliable while in operation and easy to maintain, with the capacity to remain in operation safely under the oversight of low-skilled, low-paid operators. That said, the industry had a reputation for unconventional mavericks and unregulated inventors (Mulvihill and Rossen 2020). A review of incidents in the USA by Avery and Dickson (2010) identified a lack of recognised national standards. A more detailed analysis of US rollercoaster fatalities between 1994 and 2004 (28% of the victims were employees) by Pelletier and Gilchrist (2005: 309) concluded that prevention depended on establishing effective surveillance systems for amusement ride injuries, engineering rides to better protect both patrons and employees, and improving training and supervision of employees regarding safety precautions.

Workplace incidents occasioning multiple deaths typically result in official inquiries into their causes and the prevention of future incidents – at least in wealthy countries. In those with English legal traditions, these inquiries may take a number of forms (royal commissions, boards of inquiry, etc), and include coronial inquests. These investigations vary in scope and rigour but may well be conducted in isolation from wider questions of safety in the industry where the incident occurred, and do not consider the now extensive body of research on the causes of workplace death. At one level, this is understandable. The investigations are bound by terms of reference and tend to focus on the ‘facts’ or evidence most directly pertinent to the incident, lest they be seen to be tainted by predetermined views. However, this approach militates against identifying whether the problems identified were symptomatic or common in the industry, whether there were more generic failures that could be addressed, or whether there are broader lessons to be drawn in terms of policies, regulation and practice. There are exceptions to this generalisation. For example, the wardensʼ inquiry into a coalmine disaster at the Moura No.2 mine in 1994 made explicit reference to two earlier mine disasters affecting the same district (in 1975 and 1986) in framing its findings, which then served as a template for a major overhaul of mine safety legislation in the state of Queensland (Queensland Coal Mining Board of Inquiry, 2021). Similarly, the especially thorough Royal Commission into the 2010 Pike River mine disaster placed this incident in the wider context of prior coalmine disasters in New Zealand – again this led to a major overhaul of mine safety and more general occupational health and safety (OHS) legislation (Quinlan 2014). In road transport, a number of coronial inquests into the death of truck drivers in Australia have drawn attention to underlying causal factors in the incidents examined, especially kilometre-based payment systems and other commercial pressures (Quinlan et al 2006). These cases tend to be conspicuous because they are exceptional but they demonstrate the explanatory power of a wider lens, something reinforced by research indicating that affected families are often frustrated by what they see as inadequate coronial investigations into the causes of death at work (Ngo et al 2019).

Beyond the debate over the scope of investigative processes, there is also the question of the extensive body of academic research into the origins of workplace fatalities, especially those incidents entailing multiple fatalities. An array of injury causation models have been developed, some of which have, like bow ties, been used in official investigations, especially those conducted by OHS inspectors. It is beyond the purview of this paper to review this literature in detail. Rather, we wish to examine one trajectory of this research, which is particularly revealing regarding the underlying causes of workplace fatalities and has more apparent implications in terms of remedial measures. It also shows how this research aligns closely with the findings of the Dreamworld coronial inquest even though this connection was not a deliberative part of the investigation process.

Leading disaster researcher James Reason (1990, 2008) developed his ‘Swiss Cheese model’ using the concept of latent failures to explain how catastrophic events occurred, notwithstanding multiple layers of defensive measures designed to avert such outcomes. Latent failures in the safety regime were latent in the sense that they did not immediately precipitate an event but compromised existing layers of defence. Like slices of Swiss cheese, all the defensive layers contained holes (latent failures) and if the holes aligned, an incident could occur. Reasonʼs research illustrated the effectiveness of remedying upstream latent failures rather than focusing on actions immediately preceding the incident, like operator errors. It called into question investigative approaches that tended to highlight individual rather than organisational causation. Reason’s work has proved influential but left one important question unanswered, namely whether certain latent failures, or groups of them, recurred in multiple disasters. If that were the case, then a failure to learn from earlier incidents that happened due to pre-existing system flaws that should have been detected prior to an incident or ‘near miss’, especially in the light of clear warning signals, is the obvious conclusion. This finding was central to the work of Andrew Hopkins (1999, 2008, 2012) who undertook a series of detailed investigations into mine, refinery, and oil rig disasters.

Following the approach of Barry Turner’s (1978) Man-made Disasters, Michael Quinlan (2014) sought to systematise the analysis of repeat latent failures by examining 14 multiple and nine single mine fatality incidents in five countries between 1992 and 2010. Drawing on official investigations, Quinlan found ten pattern failures. At least three were present in every incident and five or more were present in the vast majority. The book Ten Pathways to Death and Disaster also examined 30 serious incidents in other high-hazard workplaces (refineries, chemical factories, oil rigs, aviation, shipping, and road transport) and found the same ten failures present. The approach used was deliberately conservative as official investigations vary in scope and quality. The ten pathways or latent failures repeatedly associated with workplace fatalities were:

1. 1. Engineering, design, and maintenance flaws

2. 2. Failure to heed warning signs

3. 3. Flaws in risk assessment

4. 4. Flaws in management systems

5. 5. Flaws in system auditing

6. 6. Economic, production, or reward pressures compromising safety

7. 7. Failures in regulatory oversight

8. 8. Concerns by workers, supervisors, and others that were ignored

9. 9. Poor communication or trust between those responsible for risk and those exposed to it

10. 10. Flaws in emergency and rescue procedures

Quinlan subsequently applied these ten pathways to a wider array of catastrophic events, as well as incidents where subcontracting had undermined OHS (Quinlan 2020, 2024). He argued that while a single pathway could result in a fatal incident, the presence of more pathways made such an outcome even more likely. The ten pathways model was confirmed by two subsequent studies of the mining industry (in Western Australia and New South Wales, respectively) using different research methods, notably surveys and an examination of death registers (Jenke et al 2022) and a detailed examination of 51 serious incidents (Jackson 2023). Gregson and Humphrys (2020) also applied it to a historic construction incident – the 1970 West Gate Bridge disaster – finding all ten pathways were present.

In this article, we use Quinlan’s (2014) ten pathways framework to analyse a different organisational setting with implications for both workplace and public safety – theme parks – through an examination of the 2016 Dreamworld tragedy that draws primarily on the ensuing coronial report (McDougall 2020) as well as other sources. We find that the applicability of all ten pathways is exemplified in this case. The remainder of the paper is divided into three sections. The incident is briefly described followed by an analysis of the incident in terms of underlying causes and the alignment of these with the 10 pathways. The next section discusses the wider significance of the findings to understanding and addressing fatal incidents at work in terms of investigations, and preventive measures, especially improving regulation and enforcement.

A brief account of the Dreamworld incident

On 25 October 2016, a Gold Coast amusement park ride called ‘Thunder River Rapids’ malfunctioned and four park visitors in one of its rafts – Cindy Low, Luke Dorsett, Kate Goodchild, and Roozbeh Araghi – were killed. The thirty-year-old ride contained nine rafts – the maximum number permitted for a two-operator model – and could reach a speed of 45 kilometres per hour. A pump designed to regulate water levels had stopped operating, water levels dropped, and a raft became grounded on the conveyor belt rails. A second raft ploughed into the stalled raft, which flipped over and all the adult occupants were thrown into the ride’s machinery and killed. Two of Ms Goodchild’s children, also in the second raft, survived. The ride was being operated by two staff – one senior and one junior operator. The junior ride operator closest to the emergency stop button did not press it and the senior ride operator pressed a stop button that responded much more slowly. Dave Turner, who witnessed his wife and brother-in-law’s death, screamed at the Dreamworld staff moments later, ‘Why didn’t you stop the ride?’ The fast emergency stop button was not labelled. The incident sparked considerable media coverage, which was overwhelmingly critical of Dreamworld’s senior management and park safety. Reports of the impact on families added to public outrage. The Dreamworld CEO, Craig Davidson, resigned and the company faced multimillion-dollar civil suits.

Under the Coroners Act 2003, s.45(2), the inquest was tasked with identifying what caused the victims’ deaths through an examination of ‘the circumstances and cause of the fatal incident’, the TRR ride’s ‘construction, maintenance, safety measures, staffing, history and modifications’, and how well staff were trained to operate this particular ride. The findings, it was hoped, would then suggest specific workplace safety measures and regulatory changes that might assist prevention of similar incidents. The coronial inquest entailed 31 days of testimony (including evidence and submissions from a range of experts including human factors authorities), detailed analysis of an array of records (including those pertaining to prior incidents), and comparison with another theme park operator’s safety regime. The final coronial report was a thorough assessment that identified many (though in our view not all) of the causal factors leading to the incident.

Ten pathways: coroner’s findings and other evidence

The evidence presented to the Dreamworld coronial inquest closely aligned with the ten pathways model and indicated that almost if not all pathways were present and contributed to the incident. To mount a case regarding the applicability of the pathways to the Dreamworld disaster, we have not included an exhaustive account of every failure, each of which entailed multiple dimensions, but we do highlight the evidence that most explains how the tragedy happened, and best illustrates the benefits of using the pathways analysis to identify potentially dangerous organisational practices.

Engineering, design and maintenance flaws

Previous research indicated that engineering, design, and maintenance flaws were amongst the most common pathways to disaster, with Jackson (2023) finding these were present in 94% of the 51 mining incidents she examined. These pathways also played a significant role in the Dreamworld incident. The coroner (McDougall 2020, 15–123) identified multiple failures with regard to all three elements – design, engineering, and maintenance – and the following discussion identifies only some examples. The TRR ride was built in-house during 1985–1986 and extant records related to its construction and later modifications are few (McDougall 2020, 15). The speed of the ride meant that the major structural and technological components of the ride were what Perrow (1984) described as ‘tightly coupled’ ie time critical, non-variable sequences with very little slack for human intervention if there was a system failure. A naval architect engaged by the coroner found that the design of the rafts was not a significant contributing factor but that ‘there was a critical rate at which water needed to be pumped into the TRR ride, to maintain adequate height of the water above the steel supporting rails to allow rafts to remain buoyant and not become stranded’ (McDougall 2020, 255). The regulator, the OIRʼs own investigation, had engaged in expert testing of the seatbelts which concluded those used had considerable variability in performance and ‘an industrial seatbelt in accordance with SAE J386, along with an automatic lock retractor ought to have been used’ (McDougall 2020, 255). The design also made it difficult for operators to act quickly and in concert if problems arose. For example, approximately 12 metres separated the operator at the main panel from the unloading area where another operator assisted patrons. The two employees did not have a clear line of sight between them, nor did they have access to communication technology (McDougall 2020, 18). The coroner noted automation incorporating basic and relatively inexpensive engineering controls like an interlocking shutdown function for the conveyor in the event of a water pump failure and a single emergency stop button may have prevented the incident (McDougall 2020, 263).

Considerable attention was given to the maintenance regime at Dreamworld and many deficiencies were found, including a shortage of engineering expertise on-site. A senior OIR mechanical inspector inspected the site after the incident and found the ride ‘to be in generally poor condition, with significant corrosion evident throughout the steel components of the ride and concrete degradation in two of the tunnels’ (McDougall 2020, 184). The coroner also identified a degree of disorganisation in maintenance activities and reviews, and confusion amongst staff about correct and safe procedures. The former Dreamworld head of safety, Angus Hutchings, gave evidence of ‘siloing’ that prevented sharing of safety knowledge. ‘For some risks in the park’, he said, ‘everyone thought it was someone else’s responsibility’ (Bunch 2018). Evidence given to the inquest indicated the ride had broken down twice on the day of incident, which according to Dreamworld’s breakdown procedure should have resulted in a closure of the ride for maintenance. Instead, a technician (due to workload demands, this was not an electrician as should have been the case) reset the ride, a practice later revealed to be a routine ‘workaround’ amongst electricians (ABC News, 18 October 2018, SBS News, 18 June 2018).

…it was evident that there was a lot of confusion amongst experienced members of the E&TDepartment as to what the applicable policy was in relation to ride breakdowns. It appears that some members of the E&T Department had not seen the formal written Procedure for some time prior to the incident, and were relying on verbal accounts… Furthermore, in relation to ascertaining what may constitute ‘immediate danger’ for a particular ride, including the TRRR, there was no specific training provided to staff nor any guidance outlined in the Procedure. During the inquest, evidence was given that staff were not provided with training as to any particular risks or dangers, which might be present for a ride, or any particular component of a ride (McDougall 2020, 91).

In sum, pathway 1 significantly contributed to the Dreamworld incident and these failings were later found to extend beyond the TRR ride indicating these flaws were systemic. Two further points are worth making in this regard. First, this flaw undermines the emphasis often given to behaviour controls (like behaviour-based safety) in workplace safety (see Jackson 2023), including implementing additional behavioural/administrative controls in response to an incident. Second, engineering, design, and maintenance regimes may be weakened by other flaws, perhaps most notably financial cost-cutting that compromises safety (Pathway 6) and the Dreamworld incident is suggestive of this connection (see below).

Failure to heed warning signs

Perhaps the most common warning signals are prior incidents – what may be termed ‘near misses’ or high-potential incidents (HPI) that could have easily with a slight tweaking of circumstances caused fatalities. In high-hazard industries like mining, the importance of reporting and thoroughly investigating HPIs to prevent fatal events is well-recognised and an integral part of legislation governing oil rigs, mines, aviation, and the like. While the notion of ‘Black Swan’ incidents has gained some popularity, investigations into workplace incidents frequently find they were preceded by clear warning signals of serious deficiencies in the safety regime (see for example Hopkins 1999, 2008, 2012; Quinlan 2020). These pre-incident indicators or warning signals are not gifted hindsight but events or evidence that should have caused serious concern from those in charge of managing hazards.

There was a series of HPIs on Dreamworld rides prior to the TRR ride disaster. Inquest witnesses testified that the TRR ride in particular had been beset with recurring safety incidents, which the coroner’s report (McDougall 2020, 60–72) detailed. In a 2001 incident that bore a striking resemblance to the 2016 tragedy, moving and stationary rafts collided, causing one raft to flip – this occurred prior to any guests boarding. An investigation attributed the incident to poor communication and training; the coroner found that no consideration had been given to ride design (McDougall 2020, 63). Following this incident, General Manager of Special Projects, Bob Tan, sent an email to the leadership team that made reference to a rollercoaster fatality in Texas and some ‘peak relevant incidents’ on similar Dreamworld rides, concluding ‘I shudder when I think if there had been guests on that ride’. In October 2004, a moving raft collided with a stationary raft when passengers were disembarking, causing one woman to fall into the water and sustain minor injuries. The investigation attributed the incident to raft spacing, engineering controls, and operational factors (the operator was relatively new and struggled to meet unloading times). Additional engineering controls and a reduction in the number of rafts were implemented, although the latter decision was later reversed. The coroner stated he could not determine whether Dreamworld’s Engineering and Technical (E&T) Department had been consulted over these measures, but he did find that not all the recommended engineering controls were implemented and no risk assessment of the changes (more below) was ever performed (McDougall 2020, 67). In August 2005, an employee noticed an extended gap between the rafts during operation that was subsequently determined to be due to a raft taking on water. The investigation also identified gaps in CCT coverage. Again, additional administrative controls were recommended, including the installation of a second CCT screen to assist operators ‘who must perform numerous tasks simultaneously – many of which are cognitively draining’ (McDougall 2020, 168) and, in the longer term, the fitting of sensors on rafts.

In February 2008, a faulty sensor prevented rafts from being dispatched and they banked up. An E&T employee attended and, because of continued concerns over inadequate spacing, four rafts (one with patrons on board) were released. Another jam occurred and guests were forced to disembark via the emergency procedure. Dreamworld’s investigation identified a breach of operational procedure and recommended modifications to the electrical/mechanical controls that would release one raft at a time. Additional procedures were recommended to govern the handover of control from operators to engineers (McDougall 2020, 68–69). In November 2014, an incident occurred when an experienced operator allegedly failed to follow the correct procedure for a ‘Loss of Air Pressure Alarm’ and subsequently restarted equipment without authorisation resulting in significant risk to guest safety. The operator was terminated, with the coroner noting there was no evidence the operator’s actions ‘were discussed or redressed by way of training with other Ride Operators’ (McDougall 2020, 71).

In sum, there was a pattern of incidents or HPIs on the TRR ride from at least 2001 that were evidence of ongoing deficiencies and the potential for a multiple-fatality event, but for which there was little evidence of sufficient learning. Piecemeal adjustments that overemphasised administrative/procedural controls dominated incident response. Attributing prior incidents to operator error or deviations from procedure is not uncommon in incident investigations but can be superficial and misleading because, as at Dreamworld, it locates blame with workers and emphasises individual errors that fail to account for more deep-seated problems including design/engineering/maintenance flaws and overburdened operators. Had Dreamworld management been more reflective and cognisant of their duties under Work Health and Safety (WHS) legislation or had the park been subject to more stringent regulatory oversight, the warning signals of impending disaster may have led to more effective preventative measures.

Flaws in risk assessment

OHS legislation in Australia and many comparable countries contain a significant emphasis on risk management, including requirements to undertake risk assessments to address hazards and update/revisit standards in particular circumstances, such as a major change in work processes or staffing levels (Walters et al 2011). A notable exception is the USA but even here similar requirements are mandated under the process safety standard applying to high-hazard industries.

The coroner identified a series of serious shortcomings in risk assessment at Dreamworld, including hazard identification and record keeping, which are basic steps in risk assessment. So numerous were the incidents that we cannot be exhaustive here but the potted historical record pertaining to the TRR ride suggested a clear pattern – that after incidents occurred, responses were haphazard and little assessment was made of whether changes had been effective or not. Critical of the E&T Department’s lack of oversight, McDougall observed (2020, 80):

It does not appear that ‘risk assessments’ of rides within the park were carried out by members of the E&T Department prior to the incident. Evidence provided by staff within the Department suggests that the team were [sic] delegated to develop and implement controls for a potential hazard, once this had been brought to the attention of the E&T Department. According to Mr. Deaves, he recalls participating in a few ride risk assessments in relation to components of rides at the request of other Departments, however, describes them as ‘very ad hoc’. He was unaware if there was any documentation to reflect that such an assessment had taken place.

The absence of records is a critical shortcoming, as documenting a risk assessment provides the basis for determining how decisions were made and future monitoring, review and revision tasks. Further, regulators and coroners now commonly assume that no risk assessment took place if there is no documentary evidence to substantiate it (Quinlan 2014). Again, this evidence of pathway 3 is not exhaustive. Risk assessment is an essential component of an effective OHS management system (OHSMS) so these failings contributed to pathway 4 but the flaws in the OHSMS went beyond this.

Flaws in management systems

Australian Model WHS legislation like that in Queensland places a duty on principals like Dreamworld to adopt a systematic approach to securing the healthiest and safest workplace (a duty that extends to customers and other visitors) including identifying and assessing hazards for risks, as well as implementing and monitoring appropriate controls, such as adequately training and supervising staff (Walters et al 2011). Unlike mine safety legislation, the Queensland Act does not specifically require an OHSMS but in practice, an organisation of any size would find it impossible to meet its duties without having one. Further, having an OHSMS is of itself not enough. The system needs to be effective and demonstrably so. Evidence given to the coronial inquest indicated the OHSMS at Dreamworld contained significant flaws and allowed decision-making that compromised safety.

The coroner identified several critical flaws in Dreamworld’s OHSMS as it pertained to the TRR ride including poor communication between different departments (including the Safety Department and E&T Department), reporting and analysing incidents, learning from problems/incidents, operating procedures, training, and significant loads on operators. The absence of adequate engineering expertise on-site (raised in audits) was also highlighted (McDougall 2020). At a number of points, witnesses and the coroner made comparisons with the OHSMS at another theme park operator (Village Roadshow) to highlight how rudimentary and deficient were Dreamworld’s practices, including use of external engineers (McDougall 2020, 76, 270). Safe operating procedures are a critical component of any OHSMS and with regard to this the coroner found:

Operating Procedures for the rides at Dreamworld were drafted by members of the Operations Department, with minimal input from E&T Department staff or Safety Department. They were supplemented by Memorandums, which were drafted by unknown authors. Those prepared for the TRRR, particularly with respect to the use of the E-Stop at the Unload area, were ambiguous and poorly worded, with relevant terms often left undefined (McDougall 2020, 265).

The risks associated with operating procedures that are overly complicated, confusing, or ambiguous have been identified in other research (Hopkins 2005) and also highlighted in Kerin’s (2020, 2) assessment of the Dreamworld incident. The coroner labelled the largely informal training regime that had operated for years as improper, leaving operators unqualified to perform their tasks (not just the new and young operators on the day of the incident). The TRR ride standard operating procedures, ‘supplemented by further memorandums were extensive and confusing’ (McDougall 2020, 266). Finding the operators’ duties excessive and unsound, the coroner nonetheless noted regardless of training ‘it would never have been sufficient to overcome the poor design of the TRRR, the lack of automation and engineering controls’ (McDougall 2020, 266). Flaws in hazard identification/risk assessment described elsewhere were also evidence of a flawed system because they are critical components of an effective OHSMS system, affecting its creation and updating/revision when risks change or new systemic risks are detected. In sum, there was clear evidence the Dreamworld safety management regime contained serious deficiencies in areas critical to the fatal incident. Since many of these issues were longstanding, a rigorous independent audit (entailing checking procedures/paperwork, staff, physical plant, and operations) should have identified these failings and underpinned rectification efforts. However, as the next section indicates, this work was not done.

Flaws in system auditing

Even robust OHSMS or safety-critical procedures can corrode over time and need to be reviewed to ensure they are operating according to plan. This normally entails two distinct practices, namely internal monitoring by the organisation itself, which should be ongoing, and episodic independent auditing by an external party. Commonly the term ‘auditing’ is used to refer to both processes, even though strictly speaking auditing should only be applied to the latter. Leaving this point to one side, flaws in the auditing of systems or safety-critical procedures are a common pathway for serious events, one that can lead to a false sense of confidence in the safety of a workplace (Jenke et al 2022). In high-hazard industries like mining, undertaking independent audits every two to three years is mandatory under the legislation but this requirement does not normally extend to workplaces covered by general OHS legislation. To be effective, auditing must be comprehensive and rigorous, and the organisation must adopt the auditor’s recommended improvements. In the case of the Beaconsfield goldmine, where there was a fatal incident, an external audit was undertaken prior to the mine collapse but it was far from comprehensive and even then management failed to adopt all its recommendations, especially one relating to worker involvement in safety (Quinlan 2014).

Flaws in auditing were also present at Dreamworld. Between 2003 and 2013, US-based company, JAK, had undertaken several external audits at the park. The coroner (McDougall 2020, 144) concluded, however, that they lacked rigour. ‘[W]hilst seemingly thorough, [they] were largely focused on the aesthetic issues associated with rides and attractions at Dreamworld, rather than a proper safety assessment against the applicable Australian Standards (AS-3533)’. In 2013, a company called DRA Safety Systems undertook audits, with Dreamworld receiving a low score of 41.7%, mainly due to deficiencies in its safety system documentation (McDougall 2020, 150). The score only marginally improved (46.1%) in the 2014 audit, and improved to 61.7% in 2015 – still short of the 75% score deemed as indicating compliance. The coroner also noted evidence that not all audit recommendations were implemented (McDougall 2020, 157). In August 2016, engineer Tom Polley was engaged to carry out annual inspections of Dreamworld rides and on 29 September conducted a visual inspection of the TRR ride, which was limited to its mechanical and structural aspects and did not include the electrical or operational systems. The coroner was critical of Polley’s conduct because he issued ‘annual plant renewal certification for the TRRR and other amusement devices at Dreamworld, without any documentation pertaining to the ride being supplied by the Park’. The coroner stated that Polley’s failure to properly inspect the ride fell ‘below the industry standards’ and referred him to the Board of the Professional Engineers of Queensland (McDougall 2020, 274). Overall, auditing at Dreamworld failed to identify or adequately address longstanding flaws in both systems and plants.

Economic or reward pressures compromising safety

A common mantra in organisational statements about OHS intones its priority status that will never be compromised by production or profit concerns. The reality, as is apparent in a wealth of evidence across a range of industries, is rather different, indicating that safety has been compromised by production pressures, profit imperatives, or low/incentive pay regimes that encourage unsafe work practices (see for example Nichols and Walters 2013; Sheldon et al 2020; Jackson 2023; Jenke et al 2021). During the Dreamworld inquest, evidence was given on how financial cutbacks/budgetary savings had compromised safety, especially with regard to maintenance and having an adequate number of OHS professionals on site.

In his report, the coroner (McDougall 2020, 25–38) noted several instances where cost considerations influenced decisions relating to the history and modification of the TRR ride (also an interplay with Pathway 1). Dreamworld’s safety manager at the time of the disaster, Mark Thompson, said there had been budgetary cutbacks on maintenance spending. When hired in March 2016, the maintenance budget was already $125,000 over-spent, Thompson told the inquest (Sibson, 26 June 2018). Minutes from a March 2016 engineering management team meeting were submitted to the inquest. They stated ‘revenue is up but profit is down, cutbacks are now being enforced’ and that ‘[r]epairs and maintenance spending needs to stop’. but that capital expenditure on new attractions would be maintained (Sibson, 26 June 2018; Jackson 2018). Other evidence of compromises was provided. For example, Group Safety Manager Angus Hutchings described the document control systems in place at Dreamworld as ‘quite poor’ and that funding was never available for a proper risk management system with appropriate recordkeeping (McDougall 2020, 75). Further, the coroner’s report found (post-Robens) changes in OHS regulation had failed to prevent safety being traded off:

The move to self-regulation is fraught with danger. Self-interest and the drive to contain costs leads to the issues, which arose with the internally unqualified engineer, and the type of investigation undertaken by Mr. Polley. The Regulation lacked diligence in these matters (McDougall 2020, 269).

Overall, there is some evidence that cost considerations affected the safety of the TRR ride but it is not identified as a pivotal issue in the coroner’s report. A number of questions such as the extent to which Board decisions on expenditure impacted safety were not examined. The Dreamworld Board (Ardent Leisure) received severe media coverage following the incident but while the organisation was prosecuted, the Board or individual Directors were not. Whether this should change is addressed in a later section.

Failures in regulatory oversight

Failures in regulatory oversight represent another common pathway leading to fatal incidents (Quinlan 2014; Jackson 2023). These failures can take several forms, including the failure of inspectors to provide feedback to an organisation on their level of compliance, regulatory gaps, and under-resourced or poorly targeted inspection/enforcement.

As already noted, one apparent gap was the failure to fully regulate theme parks like Dreamworld as high-hazard workplaces. The inspection regime, including the training of inspectors, came in for serious criticism following the incident. Dreamworld’s mandatory ride registration inspections were more than nine months overdue, and they had twice received extensions. The coroner became frustrated at the slowness with which the Office of Industrial Relations was responding to requests for evidence that Dreamworld’s rides were properly registered and had been inspected once per year by an independent engineer, as required by workplace health and safety laws. In its defence, Dreamworld’s legal representative, Bruce Hodgkinson, said that the company had been conducting internal inspections and filling out the regulator’s online forms (Wolfe 2018).

Considerable public criticism had been directed at not only the adequacy of government inspection activities at Dreamworld but also the regulatory framework. In the light of Dreamworld and another fatality at Eagle Farm, and evidence emerging at the coronial inquest, OIR accepted that the regulatory framework was not fit for purpose and embarked on a number of measures before the coroner handed down his findings, details of which were incorporated into the final report (McDougall 2020). The coronial inquest played a significant part in these reforms, including more rigorous inspection and plant registration/licensing requirements and a safety case regime better recognising that theme parks are high-hazard workplaces. In short pathway, 7 failures in regulatory oversight were manifest. We return to this issue later in the paper.

Worker, supervisor, or other concerns that were ignored//

In addition, warning signals already mention another failure point is where workers, supervisors, consultants, or others have raised serious and relevant concerns about safety prior to the incident. These concerns are known to have preceded fatal incidents that should have warranted investigation but little action was taken. For example, both workers and supervisors raised concerns about ground conditions at the Beaconsfield goldmine prior to the fatality in April 2006, the key consultant on Hydro mining at Pike River was sufficiently concerned to depart the mine before the November 2010 explosion, and miners had expressed concerns at the Upper Big Branch mine in the USA prior to an explosion (Quinlan 2014). Similar concerns can be identified regarding incidents in other industries. However, it needs to be noted that often investigations fail to ask workers if they had concerns prior to the event, perhaps because they feel this evidence might be tainted by hindsight (although as Beaconsfield demonstrated it can often be corroborated with other evidence). With regard to Dreamworld, the coronial inquest included evidence from workers, supervisors, and consultants of concerns regarding the safety of rides for some time prior to the event. Apart from the odd aside, evidence of workers’ concerns was not discussed in the final report. For example, Peter Nemeth, the senior operator on the TRR ride at the time of the incident, told the inquest it was extremely stressful to operate because of the multiple tasks to be undertaken over short periods of time. The coroner’s report notes that Nemeth was the safety representative for riders and submitted reports to supervisors and the Safety Department (McDougall 2020, 90). What they dealt with, and if issues raised, were actioned is not discussed.

Another piece of evidence is worth identifying and quoting at length. For some time prior to the event, the Australian Workers Union (AWU), which represented Dreamworld staff, held concerns about safety, which had been communicated to it by members, and had tried repeatedly to raise those issues with park management but was met with resistance (Marin-Guzman, 26 October 2016). On 6 February 2015, 20 months prior to the event, the AWU sent a note to the Queensland WHS inspectorate summarising its concerns and asking the inspectorate to follow up on the matters raised. The notice (document obtained by the ABC under Freedom of Information (FOI) stated:

Dreamworld has cut back its ride attendants on all its major amusement rides to a single operator. This practice began around 15 months ago with just a few rides but now has begun on all rides. In November 2014 the Cyclone Rollercoaster was released from the station with its safety harnesses up. This was from a direct impact of having one operator working this ride. Dreamworld fired the operator, they put the sole blame on him. Dreamworld called this a MAJOR SAFETY BREACH but did nothing to rectify the problem. In February this year the same thing happened again and this operator was also suspended. This has caused great concern to the Australian Workers Union. The operators made contact with the union, one operator who had been an instructor for 17 years has said that it is a disaster waiting to happen. The pressure on a single operator is too much. I have also been informed that the Madagascar Rollercoaster was released with its safety harness unlocked WITH PASSENGERS however it was stopped on the conveyor. The major concern to the union is that these rides should not be able to depart without the harnesses being locked, there should be a device that shuts or locks the ride down till they are locked, so it is impossible for the ride to start. Also the stress and pressure that is put on our members and employees due to single operator. The AWU tracked down from overseas the manufacturers manual for the Cyclone rollercoaster. It clearly states that ride should and I quote ‘have one person operating but 2 but preferably more persons on the loading and unloading operation of the ride’…The AWU would ask that a full investigation into Dreamworld’s dangerous practices be done asap (as soon as possible). Dreamworld’s response to the AWU is that they have conducted a risk assessment. However, they also admit that what happened at the Cyclone Rollercoaster was a major safety breach, yet they still continue to operate rides with a single operator. It should also be noted that the ride operators do not get rotated around. Dreamworld management say they do, but our members have told us different. ¹

No reference is made to this note in coronial inquest report. Indeed, the AWU is only mentioned as being consulted in the course of a second major audit of major theme parks by the OIR in October–November 2017 (McDougall 2020, 199). This is perplexing on a number of grounds. First, the note referred to serious incidents involving other rides and argued the inordinate stress on operators applied to all rides. The note also raised more general concerns about how safety was being managed and the depth of investigation undertaken by Dreamworld when issues were raised. The general thrust of these concerns was largely confirmed by the coronial inquest. Second, the note called for a major investigation by the inspectorate. Unions or health and safety representatives raising OHS issues with inspectorates are not uncommon, especially when direct approaches to management have not succeeded. Participation and worker ‘voice’ is a central component of WHS legislation. The AWU was reporting issues referred to it by workers and had also undertaken its own research on manufacturer’s specifications for the Cyclone roller coaster. When a complaint is raised (including those by workers made anonymously via helplines), it is incumbent for inspectors to investigate, test their veracity, and if found, to take appropriate action. A study of Australian Inspectorates (including Queensland) that entailed interviews as well as accompanying and documenting inspectorate workplace visits included instances where union or worker complaints about serious faults with plant and equipment were invariably confirmed (Walters et al 2011). In some of these visits, additional serious safety breaches were identified in the course of the inspection. The question then becomes how did the Queensland Inspectorate respond to this note? Were both managers and operators interviewed, were the rides inspected while both stopped and operating, and were maintenance records checked? A rigorous investigation should have identified weaknesses in Dreamworld’s OHS regime (which were found to be so manifest and longstanding after the incident) and possibly even problems with the TRR ride. Third, assuming Dreamworld management learned of the AWU note, what actions did it take?

In sum, prior concerns had been raised by workers, consultants, supervisors, and the union prior to the incident to both Dreamworld management and the inspectorate but were either ignored or did not yield an adequate response. The failure of the inspectorate to conduct a thorough investigation in response to the AWU note can be seen as another aspect of the regulatory failure Pathway 7.

Poor worker or management communication and trust

Poor communication and mistrust undermining essential flows of safety information can take a number of forms ranging from the failure of information to be transmitted between different groups of workers (including contractors); between technical staff/consultants/managers and workers; failures to exchange information during shift changes; or more entrenched opposition to union or Health and Safety Representative (HSR) input (Quinlan 2014, Jackson 2021). As with Pathway 8, the coroner’s report makes limited reference to workers’ communication with management although the importance of participatory mechanisms under OHS legislation is referred to with regard to post-incident developments. There is evidence that implies communication with workers was lopsided, emphasising procedural observance and ignoring concerns about the task load on operators. The Group Safety Manager indicated the incident database and tracking system ‘was not used as widely as he would have hoped as it was not sufficiently user friendly’ (McDougall 2020, 75). Drawing mainly on grey-literature sources, Kerin (2020, 5) argued behavioural control of sanctioning workers rather than addressing more fundamental problems with plant and operations weakened communication and created a climate of fear amongst operators. This is consistent with the AWU memo to the inspectorate (see Pathway 8). Legislatively strengthening union access to the workplace and the powers of HSRs would have helped to mitigate these problems, something evident in high-hazard industries like mining and offshore oil production (see for example Walters et al 2016).

Flaws in emergency and rescue procedures

Effective emergency and rescue procedures can mitigate the harm occasioned when preventative measures fail. The well-executed rescue at the Beaconsfield mine saved two trapped miners following a rockfall that killed their workmate Larry Knight. More than two could have died in the 1998 ESSO Longford refinery explosion had not operators taken evasive action when they observed a haze of hydrocarbons and realised (correctly) it would find a point of ignition. On the other hand, placing the main ventilation fan underground at Pike River coalmine meant it was destroyed by the explosion and seriously undermined any attempt at rescue. Similarly, fire-fighting equipment was entirely inadequate when the Imperial Sugar Refinery in Georgia caught fire in 2008 (Quinlan 2014).

The coroner’s report raised concerns about the heavy focus on administrative controls in emergency situations, the problems of coordinated action by operators (McDougall 2020, 191–93), and the training and knowledge of operators in this regard. McDougall (2020; 248–54) also detailed the evidence of human factors expert Professor Penelope Sanderson who identified the time-sensitive decision-making load on operators as they sought to balance multiple tasks/procedural requirements, noting issues with the layout of screens/displays and controls that could, in combination, become challenging and lead to deviations from procedure in emergency situations. Kerin (2020) reached similar conclusions pointing to the multiplicity of tasks (as many as 36), the complexity of the emergency stop system, and location of emergency stop button (separate from the control panel).

Learning from the past

The coronial inquest into Dreamworld clearly identified seven of the 10 pathways (Pathways 1–5, 7 & 10) and it can be argued there is persuasive evidence of two other pathways not specifically mentioned in the final report (namely Pathways 8 & 9). With regard to Pathway 6 (economic and production pressures compromising safety), witness testimony covered in the media suggested that cost-cutting had compromised safety in terms of staffing levels, engineering, and maintenance. With notable exceptions (like the Pike River Royal Commission and Board of Inquiry into the methane explosion at the Grosvenor mine in May 2020), Pathways 6, 8, and 9 are seldom rigorously investigated (Quinlan 2014). Pathway 6 is especially contentious and labelled by one former senior mines inspector, the Voldemort pathway, as none shall speak its name. ² Belying corporate assurances that building a safety culture is a priority, evidence has been collected over many years that production/profit have, on occasion if not frequently, trumped safety (for an overview Nichols & Walters 2013). Further, Jackson (2023) argued Pathway 6 was often critical because cost-cutting/production pressures contributed to other pathways by, for example, encouraging compromises/second-best options in design/engineering/maintenance. This could also have been an underlying reason for the pressure on operators noted in this paper.

Even ignoring the presence or not of Pathway 6, the broader point is that the coronial inquest identified seven pathways and there was clear evidence of another two. Jackson’s review of 51 mine incidents found that in 75% of these incidents, 5–7 pathways were present while in the remainder, 8–10 pathways were present. Dreamworld therefore was by no means exceptional, fitting more into the category where the vast majority of pathways were present. This assessment is conservative because as noted by Jackson (2023) and other officials, investigations and coronial inquests vary in quality and comprehensiveness; indeed, Hopkins (2015) noted that the more thorough the investigation, the more pathways tended to be found. Without diminishing the value of government investigations and inquiries, if the lessons of past tragedies are ignored, especially the common or pattern causes of failure, there will be little prospect of systematic measures to address them.

In validating the ten pathways analysis in mining, Jenke et al (2022) argued it should be used as template for companies’ self-auditing safety regimes, safety education, investigation, and enforcement. The Western Australian mines inspectorate has applied 10 pathway surveys as part of its annual road-shows since 2017, the most recent (2023) indicating that all the pathways aligned with regulatory requirements, especially those applying to management systems requirements and the right of the HSR to request a risk assessment/audit. ³ The same alignment can be found in relation to mine safety legislation in New South Wales and Queensland (and almost certainly other high-hazard industries with mandatory OHSMS requirements) and the Australian standard on OHSMS. ⁴ This alignment extends beyond high-hazard industries though the coverage is more limited. At least some of the pathways (1, 3, 4, 5, & 10) align with the general duty provisions found in model WHS legislation for safe plant and equipment, adequate supervision and training, and a safe system of work. We would suggest that had Dreamworld undertaken a self-audit (or engaged in an independent audit) using 10 pathways template prior to the event, there is a strong likelihood that the manifest failings in its safety regimes would have been revealed. A similar observation would apply to oversight by the regulator.

Turning specifically to the question of safety regulation of theme parks, some additional points can be made. The coroner (McDougall 2020, 270) noted that following the incident, Dreamworld made a number of significant changes in its safety regime ‘including the audit and inspection of the amusement devices by qualified engineering firms, consideration of WHS practices, reviews of operating procedures, changes to the training regime with emergency drills being introduced, as well as the introduction of a safety management system to control safety risks’. However, the coroner added this highlighted how rudimentary and deficient the pre-existing regime had been. Ardent Leisure Ltd was also fined $3.6m after pleading guilty to three charges under section 32 of the Work Health and Safety Act 2011 (Qld). While a comparatively substantial fine, Anthony and Crofts (2024) argued the legal framework failed to reflect the culpability of corporations or provide real deterrence that would prevent a return to business as usual. To reinforce their argument, Anthony and Crofts pointed to the profound impact of workplace death on families and the latter’s frustration at the regulatory response in terms of timeliness/information flows, holding responsible parties accountable (including penalties that really deter egregious behaviour) and meaningful measures to ensure such tragedies wonʼt recur (Matthews et al 2019a). Three of the four victims had children, all had relatives, and wider circle of workmates and friends so their deaths impacted a large number of others. The impact on families is especially acute. Research indicates traumatic workplace deaths have profound and long-term psychological effects (PTSD, major depressive disorder and prolonged grief disorder), financial impacts including children and frustration with aspects of the coronial process (Matthews et al 2019b; Ngo et al 2021; Matthews et al 2022).

Theme park incidents can entail multiple fatalities as Dreamworld and other incidents stretching back decades amply demonstrate. The potential for multiple fatalities has been used to designate mines, chemical refineries, factories processing flammable materials, and the like as high-hazard workplaces. In Australia and many other countries, safety in theme parks is primarily regulated as workplace safety (which incorporates public safety of customers/clients and others visiting the workplace) under OHS legislation. Under this principle, theme parks should be designated as high-hazard workplaces and subject to a more stringent regulatory regime (amongst other things mandating OHS management systems that identify all hazards and implement effective controls in relation to the most serious ones). As a result of Dreamworld and another incident, the OIR undertook a Best Practice Review whose recommendations were summarised by the coroner, and included retaining the annual registration of plant otherwise due to be shelved as part of a Council of Australian Governmentsʼ review of WHS legislation (McDougall 2020, 204). This reversal highlighted the danger of removing prescriptive regulatory requirements deemed historical anachronisms, especially in high-hazard industries. An especially important recommendation was for large theme parks to come under a safety case regime. Safety case regimes originated as a regulatory response to disasters in high-hazard workplaces often entailing serious risks to the surrounding community. It essentially requires a licence to operate whereby the organisation must demonstrate it has a comprehensive safety program in place addressing all significant hazards, which the regulator then needs to accept (this does not constitute formal approval as responsibility still rests with the operator). Workplace Health and Safety Queensland issued a guide for amusement parks on preparing a safety case outline (precursor to a safety case) in 2019, a guide for preparing a safety case (2021) and a code of practice for amusement parks (2023). Other important OIR recommendations referred by the coroner included the introduction of major inspections of amusement devices, that competent persons be nominated to operate specified amusement devices, and that details of statutory notices are recorded in amusement device logbooks (McDougall 2020, 204). Safety case regimes have proved effective but they require highly skilled inspectors with the resources to do detailed assessments of systems (both paperwork and physical inspection) and have limitations, including being slow to adapt to significant workplace changes and can corrode over time (Walters et al 2011). A moot point is whether other Australian jurisdictions followed suit.

Conclusion

The Dreamworld disaster, sadly, follows a familiar pattern – the implementation of adequate workplace policies and processes around safety was not undertaken until a disaster occurred. Without the public attention attracted by multiple deaths, corporate interests decry the imposition of ‘too much red tape’ as an unnecessary drag on commercial activities. Under the pressure created by increased public scrutiny when workers, customers, or both are killed, governments commit to belated regulatory activity to deflect criticism. In the wake of the deaths at Dreamworld, chief safety engineer, Michael Chan, from the state’s Workplace Health and Safety department admitted to the inquest that a recommendation to tighten the enforcement process was advisable. He supported expanding the scope of annual safety inspections to include a risk assessment and, further, recommended a full and mandatory risk assessment every 10 years. He recognised that this would constitute an ‘imposition’ on ride operators that should not be circumvented.

However, the failures, lessons, and policy solutions go well beyond this. All ten pathways were arguably present at Dreamworld to some degree. Theme parks are high-hazard workplaces with a real and demonstrable risk of multiple-fatality events and they should be regulated accordingly, including requirements for an OHSMS addressing principal hazards and periodic independent and rigorous auditing together with more stringent oversight by regulators and a stronger system of duly trained and empowered HSRs. There is also a strong argument for implementing the ten pathways framework to guide activities. As argued by Jenke et al (2022), 10 pathways should be used by employers as a self-audit tool and to guide questions being asked when undertaking serious incident/HPI investigations. Unions and HSRs could also use ten pathways to guide their workplace inspections and recommendations. Ten pathways could also be used by regulators/inspectorates in their activities including when conducting incident investigations, especially as the pathways largely align with existing regulatory requirements and the ISO standard on OHS management. The Western Australian mines inspectorate has already made moves in this direction, using ten pathways to benchmark OHS performance as part of its annual road shows since 2017 (Quinlan 2023). Finally, it would be valuable if official investigations into serious workplace incidents ensured the causes identified by the ten pathways model were at least interrogated and where appropriate informed the findings and recommendations. If these measures were taken, it is more likely in our view that failures like Dreamworld will lead to changes that would appreciatively reduce the prospects of similar incidents in theme parks in the future.