Principle
Treat surprise as evidence that the model is incomplete
Surprise is not automatically danger, but it is evidence that your map of the situation missed something.
When it fits
- Reality produces an unexpected state, anomaly or combination that the current procedure did not anticipate.
When to avoid it
- Do not overreact to every novelty. Escalate based on consequence, uncertainty and whether the unexpected state undermines assumptions the current action depends on.
Why it matters
When a meaningful surprise appears, avoid forcing it immediately into the nearest familiar explanation. Pause consequential action if the unknown invalidates safety assumptions, preserve the cue, and ask what model, dependency or condition was missing. Then decide whether to update the procedure, monitoring, training or operating boundary. Resilient systems need a way to notice and respond when the prediction fails.
An example
A process that normally fails loudly starts returning successful status with missing output. The surprise is not 'just another bug'; it reveals that the current success signal is incomplete.
Check your result
The review identifies the assumption exposed by the surprise and either updates the model/control or records why no change is needed.
Keep this limit in mind
- Do not overreact to every novelty. Escalate based on consequence, uncertainty and whether the unexpected state undermines assumptions the current action depends on.
Connected ideas
Useful withStop the process when the unexpected state invalidates the safety assumptions
Evidence and sources
NASA's 2025 organizational-resilience work explicitly treats early cues that something unexpected is happening and the response to surprise as important themes in resilient operations.
The report identifies organizational themes; it does not validate a single universal surprise-response procedure.
Best Practices for Organizational Resilience in the International Space Station (ISS) Program · Appendix B themes 3 and 9