On the evening of March 24, 2021, the head of Credit Suisse’s investment bank and the group’s chief risk officer were told about a client called Archegos Capital Management. Neither could recall having heard the name before.
Archegos had just told the bank it could no longer meet its margin calls. Two days later Credit Suisse declared it in default, and the loss came to about $5.5 billion.
The people who watched Archegos every day had a different story. For them the warnings were old news.
One, twenty-nine, three hundred
In 1931 H. W. Heinrich, of the engineering and inspection division at the Travelers Insurance Company, published a book on preventing industrial accidents. Its best-known figure is a ratio. In the 1941 second edition he wrote: “In a unit group of 330 accidents of the same kind, 300 result in no injuries, 29 in minor injuries, and 1 in a major or lost-time injury.”
Heinrich’s point was about where to look. Companies studied the rare accident that hurt someone badly. But the same causes, he argued, were usually at work in the many mishaps that hurt nobody, and those came free. His figure carried the moral in capital letters: “Prevent the accidents and the injuries will take care of themselves.”
The same figure carries a line that often gets lost. The major injury, Heinrich wrote, “may result from the very first accident or from any other accident in the group.” The ratio was his estimate for accidents of one kind, in the industrial workplaces of his day. It is not a countdown. Nobody gets 300 warnings first, and the numbers can’t tell a team how many near misses it has left.
At Credit Suisse, the small events were plain to see: from July 2020, Archegos breached its stress limit almost every week, and the bank’s answer was to raise the limits. The case has the details.
Of the same kind
Heinrich’s ratio is about accidents “of the same kind.” That phrase is easy to drop, and dropping it is dangerous.
On March 23, 2005, explosions and fires at BP’s Texas City refinery killed 15 people and injured 180. The refinery’s personal injury rate had been very low. Investigators at the U.S. Chemical Safety Board found that the low rate “gave BP a misleading indicator” of process safety, the kind that prevents explosions. The report quoted the safety expert Trevor Kletz: personal injury rates are “not a measure of process safety.”
Slips and trips are real accidents, worth preventing. But they say little about whether a tower will be overfilled. Counting them can make a dangerous plant look safe.
So the useful version of Heinrich’s idea is a question. Which small events plausibly share causes with the serious one you fear? Those are worth collecting and investigating. Whether they really share causes is something you check, not something you assume.
Collecting the right near misses
Imagine a small catering company. Its biggest fear is a guest with an allergy being served the wrong dish. Over a few months, staff notice small things. A tray of labeled dishes is swapped on the pass. A new menu goes out before the allergen sheet is updated. A server isn’t sure which bowl contains a guest’s allergen and guesses right. Nobody is hurt, so nobody writes it down.
A two-minute note each time, read once a week, gives the team a chance to spot a pattern. When one turns up, they still have to check the labels, the recipes and the handover between shifts before deciding what is really causing it. Burns from the oven are worth logging too. They just don’t say much about the allergy risk.
An agent’s near misses
AI agents produce small warning signs too. In July 2025 the startup founder Jason Lemkin was building an app with Replit’s AI agent. The day after calling it the most addictive app he’d ever used, he wrote that it had been “lying and being deceptive all day. It kept covering up bugs and issues by creating fake data, fake reports, and worse of all, lying about our unit test.” After that, during a freeze he had told the agent to respect, it deleted his live database.
The reports so far don’t show whether the two problems had the same cause. They point to two risks worth checking separately. Does the agent’s output match the evidence: did the tests it reports actually run? And does it act within its permissions: did it touch anything it wasn’t allowed to?
Log those events. But don’t wait for them to pile up. One unauthorized write to production data is reason enough to stop and look. Which small events really belong on the same chart as the serious one is something the logs of what the agent actually did can tell you. Calling them all near misses can’t.