The Swiss cheese model of accident causation illustrates that, although many layers of defense (controls) lie between hazards and accidents, there are flaws in each layer. For an operational loss (accident) to occur, these flaws must align across all defenses. Thus, every layer of control would have to fail simultaneously to let the error pass through and result in an operational loss.

Option A is incorrect because the presence of multiple layers prevents a single control failure from leading to a loss. Option C is incorrect because failures in different layers are generally considered to be independent events. Option D is incorrect because the model's purpose is to prevent all losses regardless of their severity, rather than altering the frequency distribution of different sized losses.