E.09 and E.10 - Weak Process Hazards Analysis—Risk Awareness

The team leader and the rest of the team seemed to resist including these scenarios. In a later discussion with the team leader, she learned this was way PHAs were performed at the facility for years, and none of the many auditors and government inspectors had challenged the “Double jeopardy” assumptions before.
The Coordinator explained at her previous facility, multiple failures were considered possible, and were considered in PHAs. The team leader seemed to regard this difference of opinion as a minor technical detail while the Coordinator regarded it as a fundamental flaw.
The new Coordinator was almost certainly right. Many deviation - consequence scenarios identified in a PHA require 2 or more Independent Protection Layer to reduce the risk to a tolerable level. Indeed, many incidents involve multiple failures. The Bhopal incident involved up to seven failures, although some of the failed layers of protection were not independent.
The new Process Safety Coordinator also discovered that the consequences for some scenarios were not the credible worst-case consequences. The consequences recorded in the study assumed some of the safeguards limited the severity of the consequences. The team leader explained later that the company considered these safeguards highly reliable. They had never failed and were regularly tested and inspected. The team leader believed it would not be reasonable to discount them. Indeed, he felt insulted that someone who knew nothing about the facility’s PHA approach would challenge his previous PHAs.
What cultural conditions make the concept of double jeopardy attractive? How should the Coordinator convince her colleagues to evaluate PHA scenarios more thoroughly?