i

Description

A vaccine being prepared

Source

Senior Master Sgt. Ted Daigle / Senior Airman Celeste Zuniga · original page

Licence

PD Public domain

Original photo, unretouched. The background is a version of it stylised by the site.

The omission bias

We blame ourselves more for what we did than for what we let happen, and we refrain from acting even when refraining causes more damage.

In brief

• What : with equal consequences, harm caused by an action is judged more harshly than the same harm caused by inaction, so people refrain from acting.
• Why : action makes responsibility visible, omission seems “natural”; anticipated regret and guilt are stronger for what we did.
• Detect : “what if we put it in production and it breaks?” gets discussed, “what if we don't put it out and the incident happens?” never does; the risk of inaction is not documented.
• Avoid : make inaction explicit as an option with its risks, quantify both branches, make actions reversible, decide without fearing punishment for having acted.

On this page

1. Definition
2. How it works
3. Where it shows up
   1. In project management
   2. In management
4. Famous cases
   1. Equifax: the fix that was not applied 2017
   2. Vaccine hesitancy 1990-1995
5. Detection signals
6. Avoidance reflexes
7. With AI: detect, fix, mitigate
   1. Detect
   2. Fix
   3. Mitigate
   4. Prompts to integrate into your practices
   5. How to integrate them
   6. Precautions
8. Limits
9. Sources and verification
10. See also
    1. Combines with, or reinforces
    2. Related biases
    3. Counterweights and related reflexes

Definition#

Fictitious illustration

Fictitious illustration

The omission bias (omission bias) is the tendency to judge harm resulting from inaction as less severe than the same harm resulting from action, and therefore to prefer doing nothing. It was identified by Mark Spranca, Elisa Minsk, and Jonathan Baron in 1991, then studied in vaccine cases by Ilana Ritov and Jonathan Baron (1990).

The distinction between acting and letting things happen has well-known and useful moral foundations: we do not treat “pushing” and “not holding back” as equivalent. The bias begins when we accept an objectively worse outcome only because it occurs through omission.

It differs from The status quo bias: that one concerns preference for the existing state, while omission bias concerns the perceived responsibility for what happens.

How it works#

• Perceived causality : action is the direct, obvious cause of harm; omission is one cause among others (illness, chance, external threat).
• Anticipated regret : we picture more vividly how we'd feel about causing harm than about failing to prevent it.
• Responsibility and blame : the person who acts is identifiable; the person who refrains hides behind the natural order of things. In organizations, the actor is punished more easily than the inactive person.
• Norm heuristic : refraining is the normal situation; deviating from it must be justified (see Loss aversion).
• Diffuse risk vs. concentrated risk : victims of inaction are statistics; victims of action are specific people.

Where it shows up#

In project management#

• Release decision : putting a fix into production exposes the person who approved it if something breaks; not shipping it leaves a known defect, with no named owner. The defect remains, sometimes for months.
• Security fixes : applying a fix can interrupt a service; not applying it leaves a vulnerability whose consequences seem hypothetical. The real risk of not patching is underestimated, while the risk of patching is overestimated (see Normalcy bias).
• Version upgrades and debt : “don't touch what works”; the lack of updates causes no visible incident until the day it does.
• Preventive maintenance : planned restart, certificate rotation, data purge; omission has no visible cost before the incident.
• Escalating an alert : reporting an anomaly to leadership exposes you to criticism (false alarm), while not reporting it seems neutral.
• Retrospective : we analyze incidents caused by a deployment, rarely those caused by a deployment that never happened.

In management#

• Feedback : not telling an employee what's wrong seems safer than saying it and risking conflict; they discover the problem later, at their own expense.
• People decisions : not promoting or not removing someone is less risky for the decision-maker than the opposite, even if the team suffers.
• Delegation and responsibility : the manager who leaves a topic “as is” is rarely held responsible for what follows.
• Team culture : if a failed initiative is punished and a failed inaction is not, everyone refrains (see The bystander effect).

Famous cases#

Detection signals#

• “What if we put it in production and it breaks?”: the question has no equivalent for inaction.
• The cost of not shipping (defect remains, vulnerability stays open, users blocked) is written nowhere.
• Known defects remain open for months, with no decision and no owner.
• The person who shipped a problematic fix is named; the one who left open a problematic defect is not.
• People prefer “wait for the next version” or “see if it happens again” over a decision, with no review date.
• Retrospectives cover only what was done.

Avoidance reflexes#

1. Make inaction a written option. In every decision file: option 0 “do nothing,” with its risks, cost, and duration. It is compared like the others.
2. Quantify both branches. Probability and severity of what may happen if we act, and of what may happen if we refrain. Orders of magnitude are often enough to decide.
3. Do not leave a defect without an owner. Every accepted risk has a name, a review date, and signed acceptance; “we do nothing” becomes a dated decision.
4. Make action reversible. Progressive deployment, feature flag, tested rollback: fear of causing harm decreases when you know you can undo it.
5. Treat incidents symmetrically. The retrospective also examines incidents due to a decision not to act, with the same rigor as those due to action.
6. Protect those who choose to act reasonably. A team where a properly shipped fix does not trigger blame, even if it fails, will act more.
7. Decide together and in writing. Shared responsibility reduces the weight of anticipated regret on the individual actor.

With AI: detect, fix, mitigate#

Prompts to integrate into your practices#

1. Compare acting and doing nothing. Before a decision to ship a fix, upgrade a version, or postpone.

Decision in progress: [description: fix, version upgrade, release...].
Option A: act (ship, apply, change). Option B: do nothing (wait, postpone, leave as is).
For each option, give: (1) what can go wrong, with probability and severity in orders of magnitude (low, medium, high) and your confidence level; (2) what can go wrong <em>because of inaction</em> if I choose B, including in the medium term; (3) what would make rollback possible; (4) the missing information needed to decide.
Do not make up any statistics: indicate what needs to be measured. Conclude by saying which of the two options is easier to defend <em>without</em> being the most cautious.

2. Risk acceptance for inaction. When a known defect is left unresolved.

Here is a known defect or risk that we are leaving unresolved: [description], discovered on [date], concerning [scope].
Write a one-page risk acceptance sheet: what might happen, the consequences (users, data, reputation), the reasons not to act now, mitigation measures in place, the owner (to be completed), the review date (to be completed), and the trigger that would prompt action.
Do not assume anything about our systems: put in brackets what you do not know.

How to integrate them#

• In the decision template: the “do nothing” option is mandatory, and prompt 1 helps draft it.
• For every risk left unresolved: prompt 2 produces the sheet, signed by a manager.
• After an incident: also ask “what did we choose not to do, and why?”

Precautions#

• Probabilities provided by AI are orders of magnitude without measurement: treat them as hypotheses to verify.
• Biased framing (“the fix is dangerous”) produces biased analysis: describe both options symmetrically.
• Verify the cited vulnerability IDs, versions, and references: AI may invent or confuse them.
• Do not share sensitive security information (unpatched vulnerabilities, architecture) with an unauthorized tool.

Limits#

• The distinction between doing and letting happen is a widely shared moral principle, not just a bias: killing and letting die are not always considered equivalent, and the law often distinguishes them. The bias is established only when consequences are actually equivalent or better for action.
• In an organization, abstaining is sometimes the right decision: an uncontrolled change can cause more harm than the defect it fixes. The bias is not having compared.
• Vaccine experiments involve declarative scenarios; the size of the effect varies by people and wording, and field studies do not always measure the same thing.
• Famous cases (Equifax) illustrate an asymmetry of accountability, without allowing us to attribute the failure to this bias alone.
• Like many decision biases, this one is often intertwined in practice with the fear of blame and organizational culture: sometimes, abstaining is the rational response to a system that punishes the person who acts.

Sources and verification#

• Ritov & Baron (1990), “Reluctance to vaccinate: Omission bias and ambiguity”, Journal of Behavioral Decision Making — the vaccine experiment.
• Spranca, Minsk & Baron (1991), “Omission and commission in judgment and choice”, Journal of Experimental Social Psychology
• Ritov & Baron (1995), “Outcome Knowledge, Regret, and Omission Bias”, Organizational Behavior and Human Decision Processes
• Asch, Baron, Hershey, Kunreuther, Meszaros, Ritov & Spranca (1994), “Omission bias and pertussis vaccination”, Medical Decision Making, 14(2), 118-123.
• U.S. Government Accountability Office (2018), “Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach” (GAO-18-559)
• U.S. House Committee on Oversight and Government Reform (December 2018), The Equifax Data Breach — majority report
• Federal Trade Commission (July 22, 2019), “Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach” — settlement of $575 to $700 million.

See also#