Two people checking a high-consequence action independently catch what one person alone would miss

What it is

Two-person verification has two qualified people separately and independently check the target, prerequisites, and key parameters of a high-consequence action before it is allowed to take effect, so that one person's omission, misreading, or wrong selection cannot go through unintercepted. Its value comes from a second, independently obtained piece of evidence — not simply from having two people present. If the second person only looks at the first person's answer and nods, headcount doubled but protection did not.

Why it happens

Intercepting an error depends on the second person reacquiring information from the source, not checking the conclusion the first person already reached. Omission and misreading errors tend to be random and situation-specific, so a second person independently repeating the acquisition process is unlikely to fall into exactly the same trap the first person happened to hit — but if the second person is shown the first person's answer first, anchoring pulls them toward confirming it rather than re-doubting it. At that point the two judgments are no longer two independent samples; they have been artificially linked, and interception drops sharply. The process must also state explicitly what happens when the two disagree — return to source evidence, or escalate to a third party — because a process that only requires "reaching agreement" without specifying how disagreement gets resolved quietly pressures the weaker party to abandon their own judgment and defer, exactly cancelling the protection two-person verification is meant to provide.

Where it stops holding

The two-person process costs extra time and staffing and cannot, and should not, be applied to every action — using it where consequences are not severe enough only produces organizational fatigue and erodes how seriously people take it where it truly matters. If both people share the same interface, the same written procedure, or the same set of sensor readings, an error in that shared input produces the same wrong conclusion for both of them independently — a common-cause error, not the random slip two-person verification is designed to catch. A genuine emergency exception — no time to complete the full process — must be authorized in advance through risk analysis, not decided on the spot when the moment arrives.

Applying it

Select which actions genuinely need dual verification by consequence severity, require each person to independently enter the target and key parameters they judge to be correct, have the system compare them automatically, and force a stop with a return to source evidence on mismatch rather than letting discussion smooth the disagreement over.

• The verification record should state whether the check happened before or after the action executed — a signature added afterward cannot intercept an error that already took effect and caused consequences; such a record has archival value only, no protective value.
• How to check: seed a wrong unit, a wrong object identifier, and a piece of data that has expired but not yet been updated, and test whether the two-person process catches each one before the action actually takes effect.

Related

• Same group: Y4.03.2 Ritualized checking · Y4.03.3 Independence in dual verification
• Nearby: Y1.09 Multi-operator coordination and division of responsibility · Y4.07 Emergency reach and inadvertent-activation protection
• Search terms: Two-person verification · functional safety · safety-critical systems