The iceberg model organizes a recurring problem into four levels: events, patterns, system structures and mental models. Start with the comparison table, follow the missed-deadline example, then use the worksheet to separate observations from assumptions. The model helps you ask better questions; it does not prove a hidden cause.
One bad reading, four levels deep
The National Commission on the BP Deepwater Horizon Oil Spill could have stopped at the event. It went down through every level of the iceberg:
Swipe sideways to see the full table.
| Level | Question | Deepwater Horizon | Evidence the Commission used |
|---|---|---|---|
| Events | What happened? | An anomalous negative-pressure test was accepted; the well blew out | Rig records and witness accounts |
| Patterns | What keeps happening? | A similar near miss on a Transocean rig in the North Sea four months earlier; earlier BP accidents at Texas City and Prudhoe Bay | Incident histories and Transocean’s own advisory |
| System structures | What arrangements produce it? | No procedures or formal training for interpreting the test; compartmentalized decisions; a regulator that both collected drilling revenue and enforced safety | Company procedures and the agency’s mandate |
| Mental models | What beliefs hold the structure in place? | A passed test means a safe barrier; revenue first; voluntary safety practices are enough | Internal documents, emails, and industry lobbying |
The details are specific. BP and Transocean “had no internal procedures for running or interpreting negative-pressure tests, and had not formally trained their personnel in how to do so.” After the North Sea incident, Transocean wrote an internal presentation warning that “[t]ested barriers can fail” and that “risk perception of barrier failure was blinkered by the positive inflow test.” The Commission found Transocean failed to adequately communicate that lesson to its crew. Halliburton’s cement for the well had repeatedly failed its own laboratory tests. In an email about the cement job, a BP engineer wrote, “But, who cares, it’s done, end of story, [we] will probably be fine.”
At the structure level, the Minerals Management Service had what the Commission called “a conflicting and ultimately disastrous mandate: to both regulate offshore energy leases and collect the revenue they generated.” Its conclusion: “the root causes are systemic and, absent significant reform in both industry practices and government policies, might well recur.”
Related: Systems thinking · Feedback loops · First-principles thinking
The deeper levels decide whether it happens again
Firing the people in the drill shack would have addressed the event. The Commission pointed out that three companies, BP, Halliburton, and Transocean, made the errors together. Officials made “a series of decisions that saved BP, Halliburton, and Transocean time and money—but without full appreciation of the associated risks.” When different organizations fail in the same direction, the cause usually sits below any one of them.
Each level calls for a different kind of fix, on a different timescale:
Swipe sideways to see the full table.
| Level | Example fix | What it changes | How fast it shows |
|---|---|---|---|
| Events | Stop work, cap the well | This incident | Hours to months |
| Patterns | Share near-miss lessons across every rig | Whether the next crew hears about the last one | Weeks |
| Structures | Written test procedures and training; separate safety enforcement from revenue | What people are equipped and required to do | Months to years |
| Mental models | Treat a passed test as evidence, open to challenge | What counts as “safe enough” | Years |
The government did act on the structure. In 2010, the Interior Department announced it would split the agency into separate bodies for leasing, safety enforcement, and revenue. The Commission still warned that the reorganization did not fully insulate safety from “the pressures to increase production and maximize lease revenues.” Changing the org chart addressed a structure. The belief beneath it was harder to move.
For the wider idea of stocks, flows, and delays, see systems thinking. The “bladder effect” explanation is also a textbook case of fitting an anomaly into what you already expect, which the confirmation-bias guide covers.
How to use the iceberg on your own problem
Pick a recurring problem specific enough to observe. “Communication is bad” is too broad. “Approval requests wait until all technical work is finished” is usable.
- Record one event without explaining it yet. State what occurred, when, and who was affected.
- Look for a pattern in relevant records. Include normal cases, exceptions, and near misses. One memorable incident is not a pattern.
- Map the arrangements. Identify queues, responsibilities, incentives, information flows, capacity, and delays.
- List candidate assumptions. Separate what people explicitly say from what you suspect they believe.
- Test one link. Find an observation or small change that could show the explanation is wrong.
- Review unintended effects. A fix at one handoff can create a new queue at the next.
For each level, write down how confident you are and what evidence is missing. A neat four-layer diagram makes guesses look like findings. The inversion mental model helps ask what would make your proposed fix fail before you try it.
When the iceberg backfires
The iceberg is a questioning tool, not a complete causal model. It does not measure how strong a relationship is, prove what someone believes, or guarantee that a deeper fix is worth more.
An urgent safety issue can require an immediate response. The spill had to be stopped before anyone redesigned a regulator. Act on the visible hazard and investigate in parallel.
Boundaries also matter. A team’s problem may depend on a vendor, a customer deadline, or a law it cannot change. Write down what is inside your investigation and what you are treating as an outside constraint.
MIT’s systems-thinking explanation emphasizes interconnected parts and consequences across a system. That perspective is a reminder to check whether improving one level creates a problem elsewhere. When a recurring relationship becomes clear, draw it as a feedback loop.
Questions
What are the four levels of the iceberg model?
Events, patterns, system structures, and mental models. The Donella Meadows Project’s iceberg resource uses this progression. Other versions use slightly different names; the questions behind them matter more.
Is a mental model always the root cause?
No. Several structures and constraints usually contribute. A belief may support a structure, but that link needs evidence, such as the Transocean presentation, not a guess about motives.
Can I use the model for a one-off problem?
Yes. Deepwater Horizon was a one-off disaster, and the patterns level still turned up a near miss months earlier. If you find no pattern, say so. Do not invent repetition to fill the worksheet.
Your 5-minute iceberg
Event (what happened, when):
Pattern (has this, or a near miss, happened before?):
Structure (what rule, incentive, or missing information made it likely?):
Mental model (what belief makes that structure seem fine?):
How sure am I at each level? What evidence is missing?
One fix at the deepest level I can actually change:Take it into a five-minute block in Slow Down after your next incident review, before the action items are written.