A certificate is not a capability, and organisations buy the certificate
First aid is procured as a training product and needed as an operational response. The distance between those two is where preventable harm happens.
Ask an organisation about its first aid arrangements and the answer is almost always a number: how many trained people it has, and when their certificates expire. That is the measure the system produces, it is what appears in a compliance register, and it is close to unrelated to what happens when somebody collapses in a corridor at half past four.
What determines that is different and mostly unmeasured. Whether a trained person is actually on site at that hour, on that floor. Whether anybody knows who the trained people are without looking it up. Whether the equipment is where the plan says and whether it works. Whether the person who arrives has done anything since the course. Whether somebody calls for an ambulance in the first thirty seconds or spends four minutes deciding whether it is serious enough.
The failure is nearly always in the first few minutes and nearly always organisational rather than clinical. The trained responder was on a different site. Nobody could find the kit. The defibrillator was in a locked room. Three people knew what to do and each assumed one of the others was doing it. Reception did not know the street address to give the operator. None of that is a training deficiency and no amount of additional certificates addresses any of it.
There is a second problem, which is decay. First aid skills degrade quickly and measurably, and the interval between refreshers is set by certification rather than by retention. Somebody trained two years ago who has never practised since holds a valid certificate and considerably less capability than the certificate implies. Everybody in the field knows this and the compliance regime cannot express it.
The most consequential single component is also the one most often treated as optional. Early recognition of a cardiac arrest and immediate compressions, with defibrillation as soon as possible, is where the difference between outcomes is largest, and the variable is minutes. An organisation whose realistic time to first compression is four minutes has a different capability from one where it is one minute, and neither figure appears in any register.
None of this argues against training, which is the foundation and is required in most jurisdictions. It argues that training is the input and the organisation has to build the rest: coverage that reflects when people are actually present, equipment that is findable by somebody who has never looked for it, a way to summon help that does not depend on a particular individual, and enough practice that the trained response is available under stress.
The practical test is unglamorous and can be run this week. Pick a random hour, walk to the least convenient part of the site, and ask how long it would take for somebody trained to arrive with the kit. Then check the kit. Most organisations find something in the first attempt, and what they find is usually not about training.
A final point about how this is procured, since it explains the pattern. First aid training is bought on price and convenience by whoever holds the training budget, against a required number of certificates. Nobody in that transaction is accountable for what happens during an actual incident, and no part of it asks whether the organisation could respond. Until somebody owns the response rather than the compliance, the certificates will keep being renewed and the defibrillator will keep being in a locked room.