After the hospital burns

On the distinction between trust and legitimacy, and why it matters for recovery

When Lady Sybil Free Hospital burns in a fire that the understaffed fire service cannot contain, and eleven patients die, the Patrician faces a crisis that is structurally different from any scandal he has managed before. Scandals he has managed many times. The Guild of Assassins’ fee dispute. The clacks monopoly controversy. The matter of the Seamstresses’ Guild accounts. Each of these damaged trust in specific officials, in specific decisions, in his own judgment on particular occasions. Each was managed: accountability was exercised, the narrative was shifted, the personnel were changed, time passed. Trust recovered.

The hospital fire does not work like this.

The damage is not to trust in the Patrician, though his trust metrics fall. It is not to trust in the fire service command, though heads roll. It is not to trust in the Hospital Board, though it is reconstituted. These are personal trusts, relational trusts, trusts in specific people and decisions. They are damaged, and they will recover, because trust in individuals and institutions is recovered through demonstrated changed behaviour, and the Patrician is very good at demonstrating changed behaviour.

What is damaged by the fire is something else: the quiet background assumption shared by nearly everyone in the city, including people who dislike the Patrician intensely, that Lady Sybil Free Hospital will keep patients alive if they are brought to it. That assumption is not about the Patrician. It is not about the hospital board. It is about whether the structural model, the model in which a city of this size has a functioning hospital that does not let patients die in fires that an adequate fire service would have contained, is reliable. That assumption has been broken. It is not rebuilt by a press statement. It is not rebuilt by dismissing the hospital board. It is rebuilt, if it is rebuilt at all, by years of visible, competent, unremarkable hospital operation that accumulates into a new background assumption. That takes years. The political position that was already difficult becomes structurally weaker for those years.

Two kinds of damage

The distinction between trust and legitimacy is rarely made explicit in crisis management. Both look like damaged confidence. Both produce political pressure. Both are measured, loosely, in approval ratings and public opinion data. But they are different in their origin, their character, and what is required to repair them.

Trust is relational and personal. It is confidence in a specific entity, a person, a team, an institution, based on accumulated experience of how that entity has behaved. Trust is damaged by behaviour that violates expectations: dishonesty, failure to deliver, abuse of position, demonstrated incompetence. It is restored by demonstrated changed behaviour: accountability for the violation, evidence that the cause of the violation has been addressed, time spent behaving differently. Trust damage is recoverable because it is specific: the entity that violated trust can demonstrate, through subsequent behaviour, that the violation was not permanent or structural.

Legitimacy is structural and background. It is not confidence in a specific entity. It is confidence in a model: the structural framework within which entities operate. The legitimacy of a hospital system is not trust in the hospital board; it is the background assumption that the system as a whole produces outcomes consistent with its purpose. The legitimacy of a regulatory framework is not trust in the current regulator; it is confidence that the framework itself is designed to catch the things it is supposed to catch. Legitimacy is damaged when a structural failure reveals that the model does not work as assumed: not that an individual failed within a working model, but that the model itself has a flaw serious enough to produce the failure.

This distinction matters practically because the tools for repairing trust do not repair legitimacy. Accountability actions address the personal dimension of the failure. Communication addresses the narrative. Personnel changes remove the visible symbol of the failure. These are all necessary when trust has been damaged. None of them touch the structural question that legitimacy damage raises: does the model work? Applying trust-repair tools to legitimacy damage produces the worst possible combination. The organisation is seen to be managing the optics of a structural problem without addressing the structure. This accelerates legitimacy loss rather than arresting it.

Why legitimacy damage is hard to see

Legitimacy damage is harder to identify than trust damage partly because it does not manifest as identifiable anger at specific people. It manifests as a background shift: decisions that would previously have been uncontested now require justification that they previously did not. Investment proposals that would have passed now face scepticism about whether the structural model behind them is reliable. Policy announcements are received with a reserve that they did not previously attract.

These changes are diffuse and hard to attribute to the specific failure that caused them. The organisation experiencing the legitimacy damage typically experiences this as an increase in general public scepticism, a harder environment for approvals and proposals, a weakening of the authority with which it can make future decisions. It often diagnoses this as a communications problem: the messaging is not landing, the public is not engaging, the case is not being heard. The response is more communications effort, which addresses a diagnosis that is wrong.

The second difficulty is that legitimacy damage is transferable in ways that trust damage is not. Trust in a specific institution is held and broken by that institution. Legitimacy in a structural model can be damaged by any institution operating under that model. The failure of one privatised concession holder can damage confidence in all privatised concessions. The failure of one auditor to detect fraud can damage confidence in the audit profession across the relevant sector. The failure of one nuclear plant can damage the legitimacy of nuclear power as a technology. The scope of legitimacy damage is determined by the structural model implicated, not by the specific institution that failed.

Morandi

On 14 August 2018, a section of the Morandi Bridge in Genoa collapsed, killing 43 people. The bridge formed part of the A10 motorway and was operated under a long-term concession by Autostrade per l’Italia. Structural vulnerabilities in the bridge design and condition had been identified in engineering assessments years earlier, but monitoring and maintenance interventions proved insufficient. The inspection and incentive structure embedded in the concession regime did not produce the level of preventive intervention the model assumed it would.

The immediate trust damage was severe and direct. Autostrade per l’Italia and its executives became subject to criminal investigation, while the concession framework came under intense political and regulatory scrutiny. The Benetton family, which controlled the concession holder through Atlantia, suffered reputational damage that extended beyond the infrastructure sector. The Italian government forced a restructuring of ownership and governance that transferred control of much of the motorway network to a state-led consortium.

The legitimacy damage extended beyond the operator involved. The Morandi collapse became a reference point for broader doubts about privatised infrastructure concessions in Italy: the adequacy of regulatory oversight, the effectiveness of inspection regimes, and the assumption that private operators reliably maintain critical public assets. In the years following the collapse, Morandi continued to be cited in parliamentary and public debate whenever new concessions, privatisations, or private-operation proposals were considered.

While political attention to specific individuals and contractual arrangements gradually diminished, the broader legitimacy cost remained. Proposals involving private operation of public infrastructure faced a higher political threshold than before 2018. The background assumption that concession models could be trusted to deliver long-term infrastructure stewardship had been weakened, and no single accountability action or communication effort was sufficient to restore it. Any recovery of legitimacy depended on accumulated evidence of different outcomes over time, a process measured in years rather than statements.

Wirecard

In June 2020, Wirecard AG, a German financial technology company that had been included in the DAX index and described as a national champion of financial innovation, disclosed that approximately 1.9 billion euros listed on its balance sheet did not exist. The company had been falsely reporting assets for years. Its auditor, EY Germany, had certified the accounts. The German financial regulator, BaFin, had failed to act on warnings and had, at one point, taken action against the journalists and short-sellers who were raising concerns about the company’s reporting.

The trust damage to specific entities was direct and appropriate. EY Germany faced regulatory and legal consequences. BaFin’s leadership was replaced and the organisation underwent substantial reform. Several Wirecard executives faced criminal prosecution. These trust damages addressed the personal and institutional dimension of the failure.

The legitimacy damage was to the structural model. Wirecard raised three structural questions, each applying to the model rather than to the individuals within it. First: the audit model. If a major auditor could certify accounts that did not reflect reality for years, what confidence was appropriate in audit certification as a signal of financial health? This question applied to EY Germany specifically but also to the audit profession across German and European financial services. Second: the regulatory model. If BaFin could receive warnings about a company that was committing large-scale fraud and respond by acting against the people raising the warnings, what confidence was appropriate in German financial regulation as a protective mechanism? Third: the innovation narrative. Germany had used Wirecard as evidence that it could produce globally competitive financial technology companies. The narrative itself was implicated in the regulatory indulgence that had allowed the fraud to continue: scrutiny that might have been applied to a less symbolically useful company had been withheld.

German financial regulation is still being rebuilt in the shadow of Wirecard. The reforms to BaFin are genuine and structural. They are rebuilding legitimacy through demonstrated different institutional functioning. The process takes the years it takes, and the background assumption about German financial regulation that existed before 2020 has not been restored by any statement or personnel change. It will be restored, if it is restored, by a period of regulation that demonstrably works differently.

Chernobyl and the slow delegitimisation

The 1986 Chernobyl disaster damaged the legitimacy of nuclear power in Western Europe in a way that has not fully recovered in the four decades since. The mechanism was structural rather than personal: the failure demonstrated that the model for nuclear power containment could produce outcomes that the model had claimed were impossible or vanishingly unlikely. The specific cause, a design flaw in RBMK reactors combined with operational errors during a safety test, was particular to Soviet conditions. The legitimacy damage was not.

In Italy, a national referendum in 1987 closed the country’s four nuclear plants, following a campaign that drew directly on the images from Chernobyl. The trust damage to specific Soviet institutions was irrelevant to Italian voters. The legitimacy question was about the model. In Germany, the Green Party’s anti-nuclear position gained mainstream political support in the late 1980s in ways it had not managed before Chernobyl, and the Energiewende policy that eventually produced Germany’s nuclear phase-out had its political roots in the legitimacy damage of 1986. The Fukushima disaster of 2011 reopened and deepened the same legitimacy question: not because it was caused by the same factors as Chernobyl, but because it renewed evidence that the structural model could produce failures of this magnitude, and that the assurances made about containment had been insufficient.

The trust damage from both events, to specific operators, specific regulators, specific governments, has largely recovered in the sense that the specific entities are no longer the subject of ongoing political controversy. The legitimacy damage, to nuclear power as a structural model for electricity generation in Europe, has not recovered to its pre-Chernobyl level, and will not recover through any accountability action or communication effort. It will recover, if it does, through a sustained period in which the model demonstrably produces different outcomes, which is a standard that requires decades to meet.

The loop

The legitimacy scar is a feedback loop as well as a one-time event, because the damaged legitimacy makes the structural conditions that caused the failure harder to address.

When Lady Sybil Free Hospital burns and eleven patients die, the legitimacy of the city’s healthcare model is damaged. The subsequent budget discussions for healthcare are held in an environment where the structural model has been publicly demonstrated to fail. This makes it harder, not easier, to secure the investment that would prevent a similar failure. Every proposal for healthcare infrastructure improvement must now be made against the background of a demonstrated failure, which makes each proposal a reminder of that failure and an implicit acknowledgement that the model is broken in ways that the proposal may not fully address. Scepticism about whether the investment will actually produce the promised outcomes is higher than it would have been before the fire. Political capital available for healthcare investment is lower, because the association of healthcare with the fire makes it a more politically costly subject to engage with.

The damaged legitimacy does not reduce the case for investment. It makes the investment case harder to make and harder to approve. The conditions that produced the fire are therefore more likely to persist than they would have been if the fire had not occurred. The legitimacy damage has made the structural failure more likely to recur. When it recurs, the legitimacy damage deepens further. The loop is reinforcing in the wrong direction.

What repair requires

Trust is repaired through demonstrated changed behaviour by the specific entities involved: accountability for the failure, evidence that its causes have been addressed, a period of operating differently and visibly. The timescale is months to years.

Legitimacy is repaired through demonstrated changed structural outcomes, accumulated over long enough a period that the background assumption about the model is rebuilt. Not through communication about different outcomes. Not through promises of different outcomes. Through the outcomes themselves, occurring repeatedly and reliably enough that the background assumption can form again. The timescale is years to decades.

In Ankh-Morpork, the Patrician’s press statement after the fire is correctly drafted. The accountability actions are swift. The hospital board is reconstituted with credible people. The fire service budget is increased. The communications team produces accurate and well-timed updates. None of this is wrong. All of it addresses the trust dimension of the damage.

The patients who need surgery in the years after the fire ask their families whether Lady Sybil is safe to go to. This is the legitimacy question, and it does not have a press statement for an answer. It has only the answer that the next years of hospital operation will produce. If the hospital functions well, and functions well consistently, and no further patients die in preventable circumstances, the question will eventually stop being asked. That process cannot be accelerated by communication, and it cannot be shortcut by accountability. It takes the time it takes.

The Patrician, who is patient in most things, finds this the hardest patience to maintain: the patience of waiting for demonstrated competence to restore what demonstrated failure destroyed, with no shortcut available and no announcement to make.