Evidence from the record · What it means for leaders
Boeing
The answer was fixed before the question was asked.
Why this case
The decision that stopped being a decision.
Most organisational failures involve information that did not travel. This one is different. The information travelled perfectly well. What had been settled, years earlier, was what the information was allowed to conclude.
A commercial commitment made in 2011 - that pilots moving to the new aircraft would not need simulator training - hardened into a fixed requirement that every subsequent engineering and disclosure decision had to fit around.
Nobody had to suppress anything, because the boundary was already there. People simply worked within a constraint that had long since stopped being discussed as a choice.
How this study is written
346 people died
Two aircraft were lost, in October 2018 and March 2019. This study examines how a commercial premise shaped technical judgement, because that mechanism is transferable to organisations that will never build anything that flies.
The loss of those lives is not material for a leadership framework and nothing here draws on it.
The year the constraint was set, in a contract.
By now it was a core programme requirement, not a preference.
Internal documents recording the problem that were not passed on.
From that contract to the criminal case being dismissed.
The decision that stopped being a decision
Most organisational failures involve information that did not travel. This one is different. The information travelled perfectly well. What had been settled, years earlier, was what the information was allowed to conclude.
A commercial commitment made in 2011—that pilots moving to the new aircraft would not need simulator training—hardened into a fixed requirement that every subsequent engineering and disclosure decision had to fit around.
Nobody had to suppress anything, because the boundary was already there. People simply worked within a constraint that had long since stopped being discussed as a choice.
346 people died
Two aircraft were lost, in October 2018 and March 2019. This study examines how a commercial premise shaped technical judgement, because that mechanism is transferable to organisations that will never build anything that flies.
The loss of those lives is not material for a leadership framework, and nothing here draws on it.
Set as a contract term.
Recast as an engineering rule.
Left unchallenged for years.
The year the constraint was set, in a contract
By now it was a core programme requirement, not a preference
Internal documents recording the problem that was not passed on
Years from that contract to the criminal case being dismissed
What happened
Watch the constraint travel downwards, changing form each time it passes a boundary.
A commercial term
A contract with the launch customer obliges Boeing to discount each aircraft by at least $1 million if regulators require simulator training for pilots transitioning from the previous model. With 200 firm orders and 191 options, the exposure runs to hundreds of millions.
It becomes a design rule
Senior leadership’s core requirement for the programme is that no simulator-based differences training will be needed. A cockpit engineer later describes the effect plainly: no design they created could drive new training that required a simulator. He notes that this was a first.
It becomes a description
Minutes of an internal meeting record a decision to present the new flight-control software as a modification of an existing system rather than as something new—which would not prompt the regulator to require more training.
It becomes an omission
At least six internal coordination documents record that Boeing’s own test pilot took more than ten seconds to respond to an uncommanded activation of the system in a simulator, with potentially catastrophic consequences. Investigators found no evidence this was shared with the regulator, customers or pilots.
And finally a deletion
References to the system are removed from the flight manual. The aircraft enters service with pilots unaware of software that can move the nose down without their input.
Two aircraft are lost
The system activates on faulty sensor data. It had been designed to depend on a single sensor.
Congress reports
An eighteen-month investigation publishes its final report, with access to internal documents and testimony, identifying design assumptions, production pressure, concealment and weak oversight.
A contract term became a design rule, then a description, then an omission, then a deletion.
At no point did anyone decide to conceal a safety risk. Each step was a reasonable local move, given a boundary that had been fixed years earlier and was nobody’s job to revisit.
The size of the thing that
could not be reopened.
Contractual discount owed to the launch customer
200 firm orders, plus options on a further 191 aircraft
This was the financial exposure identified by the congressional investigation as an incentive to forestall any simulator-training requirement.
The clause may not have been the real driver
Reporting since the congressional investigation has suggested that the penalty clause was inherited from an earlier contract template, carried across from a previous generation of the aircraft.
A senior executive at the airline reportedly regarded the sum as minor next to the cost of splitting its fleet across two aircraft types.
If that is right, the binding constraint was never really the money. It was fleet commonality—a promise about what the aircraft fundamentally was. That makes the case more alarming rather than less: a premise can bind an organisation completely without anyone having priced it.
No design they created
could drive new training
requiring a simulator.
Former Boeing cockpit design engineer Rick Ludtke, quoted in the House Committee on Transportation and Infrastructure investigation. He observed that this was a first—a constraint of a kind the programme had not worked under before.
The chain ran backwards
In a healthy organisation, what you have built determines what you must tell people about it. Here that ran the other way.
What we built
What it does
What we must disclose
What we promised the customer
What we may therefore disclose
What we may therefore build
Once the last box is fixed first, every box before it becomes a constraint rather than a finding—and the people filling them in never see the whole chain.
Why bad faith was not required
Each person saw only one box
An engineer asked to design within a training constraint is being given a normal engineering brief. A technical writer asked to describe a system consistently with the agreed training level is doing their job.
Each local decision makes sense when the original commitment is no longer visible as a decision.
The commitment was made once, by a few people.
It was then enforced daily, by everyone.
The moment the constraint
should have broken.
There was a point where the premise met evidence that should have destroyed it, and did not.
Between 2015 and 2018, at least six internal documents recorded that Boeing’s own test pilot had taken more than ten seconds to respond to an uncommanded activation of the system, and that the consequences could be catastrophic.
That finding was incompatible with the claim that pilots needed no simulator training. It was recorded repeatedly by people who understood exactly what it meant—and investigators found no evidence that it reached the regulator, the airlines or a single pilot.
Six documents, no route out
These were not warnings buried by someone hoping they would be missed. They were technical records, in their proper place, doing what technical records do.
The organisation had somewhere for the information to be written down. What it did not have was a route by which a technical finding could challenge a commercial premise. The paperwork worked. The escalation path did not exist.
An assumption that has outlived its evidence
Every organisation carries premises set years ago by people who have since moved on: a pricing promise, a service guarantee, a platform decision, or a commitment to a major client.
They were reasonable when made. The danger is not the premise itself but its status. Once something becomes a given rather than a decision, no evidence can reach it—because nobody is looking for evidence that would overturn something nobody believes is still open.
What was missing
The Shortboard model describes twelve attributes an organisation builds across three cumulative waves.
Wave One is Lean Dependability—the ability to do what you say you will do, honestly and without drama. Wave Two enables scalable growth. Wave Three creates perpetual relevance.
Capabilities in the later waves cannot hold when Wave One is hollow, because there is nothing underneath them to take the weight.
All four Wave One attributes are absent—but unusually, they share a single root. Each gap is the same constraint seen from a different force. That is what makes this case worth studying rather than simply condemning.
Lean Dependability
Scrappy resourcefulness
Using limited resources deliberately while understanding and evidencing how the operation performs.
Healthy
conflict
Surfacing disagreement early and allowing evidence to challenge authority before decisions are made.
Ruthless consolidation
Choosing what to stop so attention, money and capacity remain focused on what matters most.
Distributed ownership
Placing authority and accountability close to the people with the knowledge required to act.
New Growth
Continuous reinvention
Continually renewing propositions instead of treating current success as permanent.
Structural fluidity
Reconfiguring people and resources rapidly around emerging priorities and opportunities.
Strategic optionality
Maintaining several credible paths rather than committing too early to a single answer.
Platform thinking
Building reusable capabilities that make future growth faster, easier and less expensive.
Perpetual Relevance
Pioneer sanctuaries
Protecting emerging ideas from the demands and assumptions of the established organisation.
The awe-driven mindset
Remaining curious about what is becoming possible instead of defending what is already known.
The pioneer’s leap
Acting decisively when evidence is incomplete but the cost of waiting is greater.
Supply-driven optionality
Creating new possibilities from emerging capabilities before established demand is visible.
One premise, four shadows
This is not four separate weaknesses that happened to coincide. It is one closed premise, casting a shadow across all four forces at once.
The fixed training commitment constrained what could be built, what could be disclosed, which risks could be consolidated and who had the authority to reopen the decision.
The same constraint,
four times over.
Each of these assessments is drawn from the congressional investigation and the regulator’s inspector general, not inferred from the outcome.
Healthy conflict
Engineers reported that every time something arose that might raise the training requirement, there was substantial pushback. Challenge was possible within the constraint and impossible against it. An organisation can look extremely rigorous while having one question nobody may ask.
Distributed ownership
Each person owned a box and nobody owned the chain. The premise had been set years earlier by people who had moved on, which left it in the worst possible condition: still binding, and nobody’s to revisit.
Scrappy resourcefulness
The system was designed to rely on a single sensor and did not meet its own design requirements. Those are not failures of capability—this organisation could certainly have built it otherwise. They are what happens when the design space has been narrowed before the engineering begins.
Ruthless consolidation
There was no threshold at which the programme stopped to reconsider. Not when the software’s authority was expanded, not when the response-time finding was recorded, and not after the first aircraft was lost. Nothing was ever allowed to halt the commitment.
In a company with world-class engineering capability and a century of institutional knowledge.
Wave One is not about competence. It is about whether competence is allowed to reach its own conclusions.
Five years of legal process,
and no trial
The legal outcome is itself part of the case, because it shows how long an organisation of this size can hold a position.
A deferred prosecution agreement in January 2021 resolved a charge of conspiracy to defraud the regulator, with a $2.5 billion settlement.
In May 2024, days before the agreement was due to expire, the Justice Department determined that the company had breached it by failing to implement an adequate compliance and ethics programme.
Prosecution suspended
A deferred prosecution agreement is reached, with a $2.5 billion settlement.
The agreement is breached
The Justice Department makes its finding weeks after a door plug departs an aircraft in flight.
A guilty plea is rejected
The court rejects a proposed guilty plea as not being in the public interest.
The charge is dismissed
The charge is dismissed under a non-prosecution agreement. No trial ever takes place.
Families of those killed opposed the final agreement and asked the court to reject it.
In dismissing the charge, the judge noted that the government’s position had moved from prosecution being justified, to a guilty plea and an independent monitor being necessary, to the company retaining a compliance consultant of its own choosing.
Accountability is not a mechanism either
Fourteen years after the contract, five years after the congressional report, there has been no trial. The institution outlasted the process, as large institutions generally do.
For a working leader, the lesson is not about justice; it is about timing. External accountability arrives, if it arrives at all, long after the point at which it could have changed anything. The only correction that operates on a useful timescale is the one you build inside.
Find the premise
nobody may reopen.
The most dangerous decisions in any organisation are the ones that have stopped being decisions.
They do not look dangerous. They look like context—the fixed points people design around, the things everyone knows, the commitments that shape a hundred smaller choices without ever appearing in any of them.
And they are almost impossible to challenge from below, because challenging a given is not a technical argument. It is an act of insubordination against something nobody remembers choosing.
What have we promised a customer that now constrains what our own people are allowed to conclude?
Which of our current givens was a decision once, and who made it?
If someone here found evidence that our biggest commercial commitment could not safely be kept, what would happen to them?
Put an expiry date on your premises
List the five assumptions your current plan rests on. For each, write down who decided it, when, and what evidence would now overturn it.
Anything with no named owner and no overturning condition is not an assumption—it is a belief, and it will outlive the facts that justified it.
How we know this,
and what we don’t.
These studies are only worth reading if the evidence behind them is stated plainly, including where it is weak.
An eighteen-month congressional investigation with subpoena power, drawing on hundreds of thousands of internal pages, interviews and sworn testimony.
Its account is corroborated by the transport department’s inspector general and by accident investigations conducted in two countries under international protocols.
The evidence includes specific, dated internal documents—contract terms, meeting minutes and coordination sheets—rather than reconstructed recollection.
The congressional report was produced by one party’s committee staff in a politically charged environment, and the company disputed elements of its characterisation.
Nothing was tested at trial. The criminal case ended without a court ever weighing the evidence, and the company has not admitted the account in full.
The contract clause’s true significance is contested, as noted earlier in this study.
A cause, not the cause
Serious accidents are never monocausal. Sensor design, maintenance, regulatory delegation, crew procedures and pilot training all feature in the official investigations, and a full technical account would weigh each.
This study isolates one thread because it is the transferable one. It does not claim that thread explains everything, and readers who want the complete technical picture should go to the accident reports themselves.
Final Committee Report: The Design, Development & Certification of the Boeing 737 MAX, US House Committee on Transportation and Infrastructure, September 2020 · US Department of Transportation Office of Inspector General report on the certification process · US Department of Justice case record, United States v. The Boeing Company, 2021–2025 · Official accident-investigation reports.
Subscribe to Notes from the Water
Our weekly newsletter brings readers the latest insights, studies, and observations relating to institutional judgement and the business design