Volume 2 - IRGC

The second volume of IRGC’s resource guide on resilience (2018):

Provides in-depth and pragmatic evaluation of concepts and methods for resilience-based approaches in contrast to risk-based approaches, as proposed and practiced in different domains of science and practice. Adequate articulation of risk and resilience is key to ensure security in systems.
Considers possible drawbacks of resilience, such as when resilience does not discourage inappropriate risk-seeking behavior
Discusses the relevance and role of resilience as a strategy to address challenges posed by systemic risks that develop in complex adaptive systems (CAS). Such systems are interconnected, with the result that risks can cascade within and between systems. Resilience can help steer dynamic changes in CAS, as those evolve in response to internal and external shocks and stresses.

All papers: A compilation of all papers including introduction and conclusion is available for download here (pdf).

Colours

Headers

Demos (6)

Papers	Authors	Metadata
An introduction to 2nd volume of the resource guide on resilience	Linkov, Florin & Trump	An Introduction to 2nd Volume of the Resource Guide on Resilience Igor Linkovi, Marie-Valentine Florinii, Benjamin D. Trumpi i United States Army Corps of Engineers, USA ii International Risk Governance Center (IRGC), École Polytechnique Fédérale de Lausanne (EPFL), Switzerland Suggested citation: Linkov, I., Florin, M.-V., & Trump, B. D. (2018). An Introduction to 2nd volume of the resource guide on resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Corresponding author: igor.linkov@yahoo.com Society is increasingly reliant upon complex and interconnected systems to foster virtually all elements of modern life. From basic infrastructure to public health and medicine to business and finance, these systems are often predicated upon interdependencies in order to deliver better, faster, and less expensive services. Such interconnection has opened the door to incredible innovations in organizational and infrastructural operation yet has also left many critical and foundational societal systems at risk of systemic disruption. A growing area of inquiry to best prepare the complex infrastructural, social, and environmental systems which sustain modern life is resilience. Across its many disciplinary and theoretical uses, resilience typically emphasizes the capacity of a system to ‘bounce back’ and adapt to changes within its environment. As both a philosophical topic and a methodological practice, resilience has exploded in usage over the past several years. Its effect upon policy is tangible, including efforts within the United States, European Union, OECD, United Nations, People’s Republic of China, and countless other nations and governing bodies (Larkin et al., 2015; Corfee-Morlot et al., 2012; Linkov, Trump & Keisler, 2018). The diversity of resilience applications is equally manifest, from infrastructural and engineering resilience to complex adaptive ecosystems, economic and financial markets, and psychosocial behavior at varying levels of abstraction (Linkov & Trump, 2019). This level of growth presents a key challenge – how might we arrive at shared core concepts of resilience without unduly restricting valuable research into a scientific discipline or policymaking practice? This is a subtle question which reflects upon the need for a common language by which resilience can be communicated and implemented across disciplines and borders, yet equally work within the political, institutional, scientific, and cultural contexts which comprise a given project, venture, or activity (Alexander, 2013). In late 2016, the 1st Volume of the Resource Guide on Resilience was assembled to address this concern. Across dozens of submissions, participants unpacked multiple definitions, analytical methods, tools, and governing strategies by which resilience is formulated and implemented (Linkov, Trump & Fox-Lent, 2016). With such a diversity of knowledge on the foundational principles of resilience, the 1st Volume of the Resource Guide serves as a core open-source document where interested parties can understand what resilience is, as well as identify the shared principles and opinions behind the analysis and implementation of resilience on a global scale. Papers presented in the 1st volume were tasked to accomplish the following: 1) Clarify how resilience differs and complements existing practices with risk assessment, and 2) Define resilience as a systems-focused approach which emphasizes the capacity of that system to recover from and adapt in the aftermath of disruption. The first point is a concern of governance and semantics. Risk assessment has evolved as the go-to exercise to explore how a specific hazard or threat might exploit a vulnerability within a given system and what the consequences of that hazard or threat might be. Individual disciplines, government agencies, and private sector stakeholders each possess their own approach to executing such risk assessment in a manner that is consistent with statutory requirements as well as social and institutional norms (Jasanoff, 2011). These processes work well within an environment of clearly defined hazards and threats to thoroughly understood risk receptors. However, such risk assessment becomes less capable of characterizing and prioritizing threats, clarifying system vulnerabilities, or reasonably assessing threat consequences within an environment of high complexity and interconnectivity within and between systems – there simply is not enough data to populate a risk assessment, nor is there sufficient expertise to confidently identify all of the threats which might exploit system vulnerabilities and generate cascading impacts to the system and its dependencies (Holling, 1986; Trump et al., 2017). Resilience thinking and assessment is a likely candidate to complement existing risk assessment practices within such environments of high uncertainty or system complexity (Gunderson, 2001). Rather than focusing upon any single threat (or requiring that all threats be identified and characterized to inform a system’s risks), resilience instead requires analysts to unpack the characteristics that define a system’s activities and baseline state of performance – including any external dependencies or internal sub-systems (Palma-Oliveira & Trump, 2016). This approach allows analysts to understand how a system performs when one or more of its critical functions are degraded, destroyed, or otherwise rendered inert. To best protect complex systems from lasting and widespread failure and loss of service, various strategies are needed to improve the system’s capacity to absorb and recover from risk – thereby limiting losses as much as possible. The second point is a concern of framing and analytics. We argue that risk assessment is primarily focused on preparing a system to withstand and absorb threats of a specific nature or intensity. Examples of such an approach are numerous, from coastal flood preparedness to bridge usage and maintenance scheduling to aircraft inspections and safety assessment. On the other hand, we argue that the novelty behind resilience is a need to emphasize the capacity of a normatively positive system to recover and adapt, following the occurrence of adverse events (Linkov, Trump & Keisler, 2018). This distinction might appear minor but represents a significant departure from how current assessment is conducted. One key distinction includes the general need for a resilience-based approach to consider low- probability, high-consequence events. A risk-based approach often struggles to inform decisions of this nature, where an analyst either places too much emphasis or too few resources onto the given risk receptor’s ability to withstand and absorb the shock of an adverse event. For resource- constrained agencies and organizations, such events are often prohibitively expensive to fully defend against. A recurring example includes preparedness for severe coastal storms – preparing every mile of coastline for a Category 5 Hurricane would be ruinously expensive and politically indefensible. Likewise, a resilience-based approach would instead offer an improved understanding of which essential components of a system would contribute to the greatest loss of function if taken offline. After identifying these critical functions, an analyst may then develop countermeasures or redundancies to improve the capacity of these functions to withstand and recover from their initial disruption. A key theme here is the notion of systemic threats. Such threats are characterized by their capacity to percolate across complex interconnected systems – either through an abrupt shock, or gradual stress (IRGC, 2018). Systemic threats are particularly difficult to model and calculate via a risk-based approach due to a mixture of the weak signals, which herald a potential upcoming systemic risk event, as well as the nested interaction effects by which a systemic threat incurs disruption to a system in an indirect manner. For example, the Financial Crisis of the previous decade began as a collection of relatively contained failures of financial firms, which ended in a substantial financial collapse across much of the world. In a separate yet related volume to the Resource Guide on Resilience, the International Risk Governance Center’s Guidelines for the Governance of Systemic Risks unpacks steps to identify, manage, and govern such systemic threats from the perspectives of policymakers and industry stakeholders alike. Resilience is an often-essential component for the governance of systemic risks, where such a governing approach emphasizes the need to limit the potential for cascading disruption as well as to build redundancies and countermeasures to quickly recover from and adapt to such systemic threats in an expeditious manner. When data is in abundance or relatively easy to acquire, or system complexity is limited and system threats are well characterized, risk-based approaches of assessment are the gold standard for most regulatory agencies or industry stakeholders to follow. However, when one or more of these characteristics become more uncertain or complex, resilience-based approaches may help complement any deficiencies that a risk-based approach presents. Such resilience-based concepts have been discussed and applied in many situations and disciplines globally and are growing in prevalence and scholarly attention. The opinions of the authors within this Resource Guide reflect the diversity of such approaches and perspectives, and collectively ask and answer important questions related to the further development and implementation of resilience in various industries and projects. Presenting the Second Resource Guide on Resilience This 2nd Volume of the Resource Guide on Resilience delves further into the more specific domain- based views on resilience, as well as critical questions in the field which remain underrepresented in scholarly literature and policy documents. For starters, the 2nd Volume reviews expertise from multiple domains, including environment and ecology, business, economics, and finance, and infrastructure and engineering. Each author presents an understanding of resilience as it is conceived and applied within their domain, as well as how resilience compares with more traditional statutory requirements of risk assessment, and how risk and resilience are complementary concepts. Many authors emphasize the dynamic property and process that comes with resilience, illustrated by Woods’ (2018) submission aptly titled “Resilience is a Verb.” After defining resilience within their field and articulating differences between risk-based and resilience-based approaches, authors were asked to comment upon two important questions regarding the framing and consequences of a resilience-based approach. One question centers upon potential downsides that a resilience-based strategy might evoke – either through implicitly changing the characteristics or properties of systems and making them more susceptible to losses or collapse, or altering the frames or perceptions of individuals relying upon these systems to behave in a different or more risk-seeking manner. A second question includes the author’s view of the role of resilience to enable or foster the capacity of systems to adapt or transform in the face of important changes that can trigger shocks and disruption. The potential downsides of resilience are often undiscussed in scholarly literature as well as within many important policy discussions. Indeed, resilience is often framed as being a universally positive trait, with little reflection upon how a recovery and adaptation-based approach can fundamentally change the way a system and its stakeholders function and behave (Nelson et al., 2007; Palma- Oliveira & Trump, 2016). Many authors within this Resource Guide reflect upon their concerns of a ‘downside’ of resilience as arising from (a) increasing brittleness in some components of a system in order to strive for robust recovery in others, or (b) a fear that a resilience-based approach might induce some concern of moral hazard, or excessive confidence in the capacity of a resilient system to quickly recover from any and all disruptions, and therefore contribute to increasing a risk appetite or exposure. Our authors described multiple potential drawbacks or concerns associated with developing resilience in various domain-specific approaches. Baum (2018) introduces the potential concern of moral hazard. Likewise, Aldrich et al. (2018) express concern at the tradeoffs inherent to developing resilience in societal contexts – in other words, they argue that decision-makers routinely prioritize spending on physical infrastructure over social system resilience, which can further entrench and enflame public tensions and social deficiencies. Stojadinovic (2018) further argues that resilience- based development in civil infrastructure may become unpopular due to its relative cost versus the uncertain likelihood that a disruption to such infrastructure will occur in the first place. Likewise, from an ecosystems perspective, Levin (2018) argues that furthering resilience-based approaches may extend the lifespan of suboptimal or undesirable system components, rather than enabling the system to transition to a more preferred state. Similar to the consideration of potential downsides of pursuing resilience-based strategies, transitions are equally a critical yet often under-discussed component of system resilience. Complex adaptive systems are constantly in flux and incorporate new information and capabilities to best respond to emerging trends and stresses within their surrounding environment (Hirota et al., 2011; Comfort et al., 2001). Acknowledging the broad diversity of systems which transitions apply to, we have asked experts in areas within each of the three domains listed above to discuss how adaptation and transitions apply to their area of research. In their pieces, several authors describe how resilience enables adaptation and transformation, either before important transitions or to cope with the consequences of important undergoing transitions. Finally, several authors discuss how resilience assessment can also evaluate the capacity of a system to adapt and transform to avoid dangerous disruptions. Authors of this Resource Guide, volume 2, individually explore the role of resilience to enable and foster system transitions. From an environmental and ecological perspective, Allen (2018) and Palma-Oliveira & Trump (2018) respectively discuss how ecological systems are defined by a constant influx of environmental change, where systems (e.g., a lake), sub-systems (e.g., the pH level of the lake), and supra-systems (e.g., the regional drainage of water into the lake) each shift to accommodate new and recurring environmental stressors. Allen discusses the constant and multi- scalar environmental change as panarchy, while Palma-Oliveira & Trump reflect upon the ecosystem transition concept known as basins of attraction. Within both pieces, the authors respectively argue that ecological transitions reflect moments where an existing environmental state can realign into a similar state or transition into one that is entirely different from the biodiversity and ecosystem health currently available. A critical takeaway point from these and other authors is that such transitions or the crossing or certain thresholds can drive a system towards a normatively positive or harmful ecosystem structure. Similar themes were raised by other authors in this regard. For social and organizational resilience, Pulakos & Lusk (2018) as well as Kudesia & Reb (2018) respectively describe the preconditions of social interaction and trust which are needed to transition an organization, business, or government away from a socially undesirable or unsustainable state, and towards one that is preferable. From the perspective of infrastructural resilience, Furuta & Kanno (2018) as well as Kott (2018) reflect upon the need to account for nested interdependencies of engineered systems, where transitions and adaptive capacity percolates from sub-systems into broader infrastructural systems such as with the experience of the Great East Japan Earthquake and the subsequent disaster at the Fukushima- Daiichi Nuclear Power Plant in 2011, or military systems and cybersecurity. Resilience is definitely a topic of growing interest not just as a philosophical or scholarly exercise, but increasingly as an aspirational goal for many complex systems facing systemic threats, and an appealing pragmatic approach to governing risks with a low probability of occurrence and potentially a high level of negative consequences, shocks, disruptions and cascading failures. This compendium of knowledge expands upon the 1st Volume of the Resource Guide on Resilience by providing a more in-depth view of disciplinary applications of resilience, as well as key questions regarding the implications of resilience-based strategies moving forward.
A Janus-faced resource: Social capital and resilience trade-offs	Aldrich, Page-Tan & Fraser	A Janus-Faced Resource: Social Capital and Resilience Trade-Offs Daniel P. Aldrichi, Courtney Page-Tani and Timothy Fraseri i Northeastern University Suggested citation: Aldrich, D. P., Page-Tan, C., & Fraser, T. (2018). A Janus-faced resource: Social capital and resilience trade-offs. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Community resilience, social capital, bridging, bonding, linking Corresponding author: daniel.aldrich@gmail.com Much research has underscored the critical role played by social capital in building resilience in communities and organizations. In a time of crisis, we know that individuals with more connections embedded in communities that are more cohesive and better connected horizontally and vertically have higher survival rates and better recoveries compared to similar individuals and locations that are less connected. Yet, a more nuanced analysis reveals resilience trade-offs between types of these social connections. This piece investigates how different types of social ties, including bonding, bridging, and linking ties, create different resilience trajectories for neighborhoods and institutions, and how they impart dynamic effects on pre-disaster neighborhood vulnerability. An introduction to community resilience In the wake of mega-disasters in New Orleans, Kobe, Bangkok, and more, experts have increasingly highlighted the importance of building resilience over risk management alone. We define community resilience as the capacity of a neighborhood or geographically defined community to anticipate, absorb and manage stressors and efficiently return to daily activities in the wake of a shock to social, physical, or ecological systems (Aldrich, 2012; NAS, 2018; Executive Order No. 13653, 2013). Scholars have connected community resilience with a variety of outcomes: increased local capacity and social support, effective communication systems, good community physical and mental health and public involvement in governance (Patel, Rogers, Amlôt, & Rubin, 2017; Food and Agricultural Organization [FAO] 2011). By investing in community resilience, cities can better prepare themselves to bounce back better after disaster strikes. Social capital - the ties that bind us - is a strong driver of resilience during and after disasters (Aldrich, 2012; Rackin & Weil, 2015). Following Hurricane Katrina, for example, the Vietnamese- American community quickly returned to New Orleans East despite having comparatively few financial resources and low levels of education. The strength of their connections, the leadership of the local Mary Queen of Vietnam (MQVN) Catholic Church, and connections with national co-ethnic institutions organized their evacuation, eased barriers to collective action and helped efficiently rebuild their community (Chamlee-Wright & Storr, 2009; Airriess et al., 2008). However, in some nearby communities throughout the Greater New Orleans area, recovery moved slowly, especially in terms of finding housing for residents in the first year after the storm. While many publicly agreed that temporary housing in the form of FEMA (Federal Emergency Management Agency) trailers contributed to recovery, residents viewed them negatively and sought to keep such facilities out of their neighborhoods. Utilizing and leveraging their ties, communities with higher levels of social capital were successful in keeping trailers - considered a ‘public bad’ - out of their backyards. Public bads are facilities that benefit the public but impart focused costs to the communities that host them, including FEMA trailers in disaster-struck towns, seawalls in coastal fishing communities, or controversial power plants. Opposition to these public bads slowed recovery throughout New Orleans as bureaucrats scrambled to find places for temporary housing (Aldrich & Crook, 2008; Aldrich, 2012). Without adequate housing, some residents may leave town, leaving local officials unclear of who reconstruction will serve. The longer residents stay away, the weaker their ties to home become, as stories of some New Orleans jazz musicians – who relocated to Chicago never to return – illustrate. These methods of disaster adaptation can weaken social ties, hindering recovery for communities overall. These examples illustrate how a community can leverage different kinds of social capital in different ways to mitigate risk and improve resilience. The Vietnamese-American community used its close- knit ties to serve the people within its community, while communities throughout the Greater New Orleans area used their linking social capital to keep out ‘public bads’ and slow recovery elsewhere. To gain a greater understanding of the dynamic resilience outcomes of bonding, bridging and linking social capital, we investigate how these three types of social capital can create different resilience outcomes across communities faced with uncertainty and unexpected disturbances. Social capital in community resilience Because cities face an uphill battle when predicting the risk, scale, intensity, and timing of shocks and stressors, some communities have instead chosen to invest in community resilience and mitigate vulnerabilities before disaster strikes. Whereas risk management strategies, such as levies, only pay off if a city successfully avoids a shock, social capital and community resilience convey benefits before, during, and after disaster. As a result, scholars of community resilience increasingly describe risk and resilience in terms of the social capital of a community. Social capital matters to community resilience because social ties in a community can offer a kind of communal insurance or capital where members can share information and resources, increasing the capacity of communities to respond to crisis (Tierney, 2014). Social capital comes in three types: bonding, bridging, and linking. Bonding social capital describes homophilous relationships between family, close friends, members of a social group or those who share ethnic or class ties (McPherson, Smith-Lovin, & Cook, 2001). In contrast, bridging social capital refers to relationships between people across different social and ethnic groups, and these ties are often built by civic and political institutions such as parent-teacher associations and advocacy groups (Small, 2010). Bonding and bridging social capital typically describe horizontal relationships among equals, whereas linking capital describes vertical relationships of respect and trust between persons and officials or ranking community members who exercise authority over them (Szreter & Woolcock, 2004). Access to these relationships with community officials means better representation of residents’ wants and needs in disaster-related planning. Trade-offs of social capital in community resilience Social capital in its three forms can impart unique and sometimes detrimental effects on community resilience, especially in communities that have developed more bonding social capital than bridging social capital. Social capital does not increase the appetite of communities for risk, but it can engineer uneven recovery across cities. In this way, building resilience can produce moral hazards of its own. This is particularly clear in the effect of social capital on post-disaster poverty rates in the United States. When residents try to rebuild homes, community recovery carried out through bonding social capital-based groups tends to absorb resources and impoverish the overall community. In contrast, bridging and linking groups assist at the county level over time. For example, after Hurricane Harvey in 2017, a wealthy church in the River Oaks neighborhood ceased its financial support for a local low- income church in order to help its own congregants, disrupting the flow of social and financial resources for low-income communities more than the disaster did itself. Broader analysis shows this to be true over time and space. Between 1985 and 2015, US counties heavily damaged by natural hazards developed higher poverty rates afterwards if they developed more religious or civic organizations that facilitate bonding ties, while developing more advocacy organizations that boost bridging ties reduced poverty rates (Smiley, Howell, & Elliott, 2018, p. 18). These trade-offs are evident in disasters abroad as well. During the Great Floods in Thailand in 2011, government agencies, community and faith-based organizations, and private enterprises that were more closely connected in urban and suburban areas delivered worse disaster aid than those groups in rural areas. These rural organizations benefited from stronger bridging ties, which afforded better coordination among organizations (Andrew et al., 2016). Yet an excess of bonding capital at the expense of bridging capital is not the only problematic resilience trade-off. If communities have significant bonding capital and linking capital, but lack bridging capital, the resulting unequal access to local officials can compound disparities in recovery rates. For example, following the Indian Ocean Tsunami, coastal hamlets throughout the southern state of Tamil Nadu with high levels of bonding and linking social capital had more access to aid and assistance from NGOs and government officials (Aldrich, 2012). These villages had a higher percentage of new and rebuilt homes. Villages that had to rely solely on bonding social capital experienced greater difficulty securing aid and assistance. Compared to villages with both bonding and linking social capital, families holding only bonding ties remained in shelters for an extended period of time and had fewer resources to rebuild or build anew. Likewise, in New Orleans, communities only with strong local, bonding social capital did not receive resources necessary for effective recovery (Elliott, Haney, & Sams-Abioudun, 2010). Residents of the Lower Ninth Ward, a disproportionately poor community, suffered significant setbacks because they were unable to access their translocal ties, compared to the residents in Lakeview, a neighborhood in New Orleans considered to be well off. This neighborhood had strong local ties along with a higher share of white residents, income levels, house prices, and education levels, compared to New Orlean’s many more diverse, often poorer neighborhoods. In a time of crisis, local ties can serve an important role when one needs help from someone nearby; however, in the event of an evacuation or forced egress, translocal ties spatially located outside of the affected area can provide uninterrupted support because they are unaffected by the crisis. For Lakeview, these translocal ties expedited their evacuation and eventual return to New Orleans. Additionally, as discussed above, their greater linking ties with local officials helped the neighborhood avoid hosting unwanted FEMA trailers to other communities, improving their own recovery while forcing other communities to host more of these public bads (Aldrich & Crook, 2008; Aldrich, 2012). However, communities need not be well-off to gather these social resources and navigate these resilience trade-offs. After the Kobe earthquake in 1995, disparities in bridging, bonding, and linking capital cost Kobe, Japan valuable time in the recovery process. In spite of Kobe planners’ bold efforts to redesign damaged wards and apply for national subsidies, the city’s top-down reconstruction planning exacerbated disparities between communities, focusing on waterfront and high-rise development rather than rebuilding existing communities (Edgington, 2010). This lack of linking social capital between citizens and government left communities to take recovery into their own hands. Neighborhoods that built more nonprofits after the quake undertook reconstruction planning on their own terms, using these organizations to rebuild and pressure City Hall to include their preferences. In this case, not only wealthy communities managed to build these linking ties. Anti- pollution advocacy campaigns in the working-class neighborhood of Mano had built stronger bridging and linking ties than in nearby Mikura, such that Mano regained much more of its original population after the disaster (Aldrich, 2012). Communities can build these strong civil society and community resilience even without financial resources. Navigating trade-offs in adaptation and risk mitigation These trade-offs among bonding, bridging, and linking capital are especially relevant to communities because they cannot only affect crisis response but can also exacerbate disparities in health and infrastructure, creating setbacks to recovery. Instead, effective resilience policy takes advantage of social capital trade-offs to mitigate pre-disaster vulnerabilities and enable new social and physical adaptations. Scholars have highlighted the dark side of bonding social capital in their effect on health. In Okayama City, Japan, residents with more bridging capital tended to have better health outcomes than those with strong bonding social capital (Iwase et al., 2012). In another city, bridging capital helped the elderly maintain cognitive abilities and avoid depression more than bonding capital (Murayama et al., 2013). After the Great East Japan Earthquake in 2011, some community development projects factored this into their decision-making, embedding elderly Japanese residents in disaster zones into larger social networks. These programs substantially improved elders’ social capital among each other and across age groups (Kiyota et al., 2015). Similarly, in New York City disease prevention efforts, Buddhist and Christian communities with more bridging capital among members were more engaged in HIV/AIDS prevention programming than those with just bonding capital (Leung et al., 2016). The trade-offs between bonding and bridging social capital are also important for preparing societies for disaster through decentralized technologies. In Yasu City, Japan, citizens built a bottom-up sustainable development economy focused on locally sourced biomass, all when local government created meaningful networking organizations that bridged environmentalist groups. However, similar sustainable development efforts in a neighboring city failed to achieve their goals, because they focused on community groups with high bonding social capital but fewer bridging ties (Kusakabe, 2013). Similarly, some city governments created quasi-private organizations to locate, correspond with, and invite external renewable power companies to their towns. Towns that fostered these bridging and linking ties built hundreds more renewable power plants than those that relied on their existing relationships with utilities to deploy renewable power, boosting the resilience of their energy systems (Fraser, 2018). As a result, cities that foster bridging and linking capital will see better community resilience. However, doing so will also mitigate the vulnerabilities and disparities in community networks created by high bonding capital. Mitigating these vulnerabilities will further improve cities’ capacity for adaptation and transformation. Decision-makers regularly prioritize spending on physical infrastructure over social infrastructure pre- and post-disaster. However, residents and policymakers can actively improve the social infrastructure and resilience of their communities through conventional interventions, such as hosting block parties, or with more novel approaches, such as supporting the growth of online hyperlocal online communities (Page-Tan, forthcoming). Yet for those few who do seek to increase social ties, as with San Francisco’s NeighborFest program or Colorado’s BoCo Strong programs, these communities may have to make trade-offs. Bonding, bridging, and linking social ties have different effects on residents. Going forward, certain metrics can help policymakers compare social ties in one community with those of others. Communities with strong bonding ties tend to have lower crime rates and more religious and civic organizations per capita, while those with strong bridging ties tend to have higher voter turnout, more political activity, and more advocacy organizations per capita. Finally, more support for the majority party, frequent neighborhood visits by local officials, or collaborations between local officials and community groups can indicate strong linking ties. Policymakers can monitor gaps or differences between these rates and incorporate these vulnerabilities into decision analysis and policy evaluation phases for disaster planning (Linkov & Moberg, 2011). We should look to invest heavily in bridging and linking ties which are harder to create and have an overall positive impact on societies and neighborhoods.
Ecological resilience	Allen & Twidwell	Ecological Resilience Craig R. Alleni* and Dirac Twidwellii i University of Nebraska, School of Natural Resources ii University of Nebraska, Department of Agronomy and Horticulture Suggested citation: Allen, C. R., & Twidwell, D. (2018). Ecological resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, ecological resilience, social-ecological system, panarchy *Corresponding author: callen3@unl.edu Introduction Ecological resilience was first proposed by C.S. Holling in 1973, who recognized that systems perturbed beyond their capacity to recover could shift into an alternative state (also called an alternative regime). Resilience is a measure of the amount of perturbation or disturbance a system can withstand without crossing a critical threshold (Holling, 1973). Resilience is an emergent phenomenon of complex systems, which means that it cannot be deduced from the component parts of the system in question. When a critical threshold is exceeded, the system may collapse and reorganize. Reorganization can lead to the original system simply renewing, or the system can reorganize around new drivers in which case a new, and potentially very different, system may emerge (Chaffin et al., 2016). When reorganization occurs around new drivers, the new system (an alternative system state) may be less desirable to humans in terms of the provision of the ecological goods and services produced, upon which humanity depends. Therefore, it is often in humankind’s interest to maintain systems in desirable states, avoid critical thresholds, and enhance resilience. Alternatively, when a system is in an undesirable state, it may be necessary to erode resilience and purposely transform the system to a more desirable state (Chaffin et al., 2016). In either case, it is important to be able to assess how resilient a system is so that humankind can either foster or erode resilience, depending upon the desirability of the current system state and the potential exposure and magnitude of current and future drivers of alternative state change. Resource managers often rely upon the system property of resilience, or the capacity of a social- ecological system to absorb and respond to a disturbance while maintaining its essential structure and functions (Holling, 1973; Linkov & Trump, 2019). Ecological resilience is a broader concept than engineering resilience, which focuses on bounce-back and assumes stationarity, equilibrium, and, often, the occurrence of a single, idealized state. These assumptions are most suitable for fully engineered systems at small scales over short periods of time. Ecological resilience emphasizes that a focus on bounce-back does not address the emergence of destabilizing feedbacks in the system that continue to force the system toward an alternative state. The ability for a state to absorb disturbance and persist, or to self-organize and re-emerge following disturbance-induced collapse, is now a central focus of social-ecological systems research and central to managers attempting to enhance or maintain resilience as a management goal or strategy. An improved understanding of the boundaries of resilience, the thresholds that separate one state of a system from alternative states, and how social and ecological system components interact to reinforce, or alternatively degrade, resilience may help resource managers avoid or facilitate regime shifts so that desired ecosystem services are maintained or restored. Coupling this information to knowledge of the likelihood of a regime change, and the potential for novel drivers to arise and trigger alternative state change following catastrophic change, is an important component of assessing the risk of systems to perturbation. Ecological resilience and risk Complex systems are generally understood to be open and self-organizing, have inherent unpredictability and uncertainty, non-linear dynamics, and emergent phenomena (EPFL International Risk Governance Center [IRGC], 2018). Complex systems are self-organizing because there is no central authority directing system components; complexity arises over time from many simple interactions. Complex system behavior cannot be inferred or predicted by summing system components, because complex systems have non-linear dynamics. Non-linear dynamics occur when small changes have a disproportionately large effect. For example, phosphorus levels in a lake may steadily rise over time, with no apparent consequence to the lake, until they exceed a critical threshold and the lake abruptly tips into a new regime, becoming eutrophic and prone to algae blooms – and less desirable to humans. Ecosystems and other complex systems change in response to changing conditions, which has consequences for how we understand ecosystems and how we manage them. Understanding the resilience of ecosystems is important, because humanity relies upon a consistent production of ecological goods and services, such as drinking water, crop pollination, soil renewal and regeneration, abundant marine life to eat, carbon dioxide storage, and more. Considering that risk is the uncertain negative (or undesirable) consequence of an event or an activity with regards to something that humans value, risk approaches should focus on identifying critical thresholds, because when an ecosystem’s resilience is exceeded and the system shifts into an alternative state, the system may become less desirable from a human perspective, and produce fewer goods and services, which can be a risk to those affected. It is often apparent when the resilience of an ecosystem has been exceeded as the system discernibly changes, as when a lake shifts from a clear to a turbid state, but it is difficult to predict when that shift might occur because of the non-linear dynamics of complex systems. Small changes to the system may have disproportionately large consequences, and vice versa. Ecological resilience should not be confused with engineering resilience, which emphasizes the ability of a system to perform a specific task consistently and predictably, and to re-establish performance quickly should a disturbance occur. The consequences of applying this type of thinking to the management of complex systems, especially social-ecological systems, is problematic because complex adaptive systems cannot be treated as an engineered system with predictable and consistent outputs. Ecosystems do not have an equilibrium where opposing forces are in balance. Rather, an ecosystem exists within a regime, and within a particular regime, the abundance and composition of the component parts that comprise that regime may change quite dynamically over time. In a risk context this means that compounded perturbations derived from hazards or global change can have unexpected and highly uncertain effects on natural resources, humans and societies. These effects can manifest in regime shifts, potentially spurring environmental degradation that might lock a social ecological system into an undesirable system state that can be difficult to reverse, and as a consequence of economic crises, conflict, human health problems, and the presence of hysteresis in the system. Consequences of exceeding resilience A premise of any complex social-ecological system is that surprise and uncertainty are inherent to the system. Achieving and managing trade-offs between benefits for humanity while reducing risks is difficult and does not adequately address surprise and uncertainty in system behaviour. Social ecological system management and governance have therefore, to a large extent, struggled to ensure the maintenance of ecological regimes that are desirable for humans in terms of consistent delivery of ecological goods and services while systems undergo change. Regime shifts, such as the collapse of commercial fisheries or agricultural systems, have often been the consequence of the sustained overuse of natural resources. Given that risk and undesirability are similar concepts (risk being the undesirable consequence of uncertainty), resilience-based management decreases risk in two ways. First, when systems are in a desirable state for humans, management can focus on fostering and enhancing the resilience needed to maintain this regime by assuring that functional attributes relevant for processes that deliver ecosystem services are diverse and imbricated. This reduces the chance that the system shifts to an undesirable state if subject to unsustainable stress, with the risk that the system may no longer be able to provide the services it is intended to provide. However, prioritizing resilience in management and planning has often proven difficult. Optimizing resource use and dampening variability or uncertainty in harvest use or efficiency has long-been prioritized in management, and while important, often erodes resilience by limiting the system’s use of state space, which may in turn narrow the basin of attraction for a desired state, making collapse more likely. Second, systems in undesirable states can also be highly resilient, yet present risks to assets or people depending on these systems (for example, people living in poverty traps). Where systems are in undesirable states resistant to change, that is, when an undesirable state is resilient, it may be necessary to reduce the resilience of the system and to induce a shift in the system to a regime that is more desirable, and then to manage the system to foster the regime of this desirable state. Understanding that complex systems can have critical thresholds affects risk equations. When there is hysteresis present in the system, risks must be assessed cautiously, and management should be correspondingly cautious. Crossing a critical threshold can have catastrophic consequences, and reversal can require much more input than was required to change the system in the first place. Adaptation and transformation In 2004, Walker, Holling, Carpenter, and Kinzig introduced “transformability” as an attribute of complex systems that defined the potential dynamics and future trajectory of a system. In this context, the authors defined transformability as the “capacity to create a fundamentally new system when ecological, economic, or social conditions make the existing system untenable” (Walker et al., 2004). At the scale of an SES, a transformation is a deliberate, societally-initiated process of pushing a system across a threshold by “a phased introduction of one or more new state variables” (Folke et al., 2010). This definition of transformation differs from others, which claim that there are two types of transformative change: intentional or deliberate; and unintentional or unexpected as a result of a process or event. In each of these cases, intentional and unintentional, a social ecological system undergoes a regime shift and a threshold is crossed. However, we define a transformation as occurring when the regime shift is a direct result of human planning and action, human agency. The phenomenon of transformation is scale-dependent, multilevel, and can be system-wide or can be nested as personal, organizational, or within other levels of subsystem transformation. Therefore, a transformation requires purposefully exceeding the resilience of a system in an undesirable state, and then, through human agency, fostering a reorganization into a more desired state. The concept of panarchy (Allen, Angeler, Garmestani, Gunderson, & Holling, 2014) is central to understanding transformation. The capacity to transform is likely the product of a nested system influenced by cross-scale interactions from above and below, and highly “dependent on the nature and extent of adaptive actions being taken at other interacting scales”. For example, larger-scale transformation may only occur as personal or individual transformations are scaled-up to forge the collective capacity to drive change. In this context, deliberate transformation has also been referred to as directional or purpose transformation. Regardless, transformation describes change in the dominant processes and structures that maintain a complex social ecological system in a particular state. These factors vary for any SES at a particular scale, but can include processes and associated feedbacks such as biophysical cycles, ecological hierarchies, human activity or social institutions. It follows that transformative governance builds capacity of society to alter these processes in order to foster a new regime in social ecological systems that achieve societal priorities. Transformative governance is an emerging approach to the management of complex systems with the capacity to catalyze and guide regime shifts in systems at multiple scales. The process of transformation requires disrupting internal or external drivers, or introducing new drivers, to displace the entrenched forms environmental governance and to provide space for innovation, and thereby foster a fundamental, positive, change in the nature of the affected social ecological system. A challenge to resilience theory is that it is very easy to recognize a system that has undergone a regime shift, but very difficult to recognize when the resilience of a system has been compromised. Quantification of the resilience of systems is in its infancy and remains poorly developed, though there have been recent advances in detecting early warning of impending regime shifts, usually focusing on rising variance in key parameters of the ecological system in question (Angeler & Allen, 2016). The development of leading indicators is critical to managing for resilience, and therefore sound environmental management.
From security to resilience: New vistas for international responses to protracted crises	Anholt & Boersma	From Security to Resilience: New Vistas for International Responses to Protracted Crises Rosanne Anholti* and Kees Boersmaii i Department of Political Science and Public Administration, Vrije Universiteit Amsterdam ii Department of Organization Sciences, Vrije Universiteit Amsterdam Suggested citation: Anholt, R., & Boersma, K. (2018). From security to resilience: New vistas for international responses to protracted crises. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, crisis, security, practice, international *Corresponding author: r.m.anholt@vu.nl Resilience: A response to protracted crises International institutions and organizations like the United Nations (UN) and the European Union (EU), governments, and non-governmental organizations (NGOs) have started to embrace the notion of ‘resilience’ as a way of thinking to guide international responses to international security – in particular with regards to governing protracted crises. Protracted crises are “fragile contexts characterized by long-term political instability, (episodes of) violent conflict, and vulnerability of the lives and livelihoods of the population” (Macrae & Harmer, 2004, p. 15) – like those across central and east Africa, and the Middle East. The concept of resilience is not new to crisis governance. International frameworks for responding to natural disasters, such as the Hyogo Framework for Action (United Nations Office for Disaster Risk [UNISDR], 2005) and the follow-up Sendai Framework for Disaster Risk Reduction (UNISDR, 2015), have long placed the idea of resilience central. With regards to insecurity due to political violence and armed conflict however, the concept is relatively new (Bourbeau, 2013; 2015; Brasset & Vaughan-Williams, 2015; see also Anderson & Wallace, 2013). Nevertheless, it features prominently across a range of policies, including for example the European Global Strategy for Foreign and Security Policy (Wagner & Anholt, 2016), the EU’s Action Plan for Resilience in Crisis Prone Countries (European Commission [EC], 2013), or programmes such as the Regional Refugee & Resilience Plan (3RP), a consortium co-led by the UN Refugee Agency (UNHCR) and the UN Development Programme (UNDP), with the participation of the governments of Jordan, Lebanon, Turkey, Iraq and Egypt, and some 270 partners, including UN agencies and international and local NGOs (Gonzalez, 2016; 3RP, 2018). As with many policy buzzwords, there is a lack of a clear, agreed-upon definition of resilience. The 2011 Humanitarian Emergency Response Review (HERR) of the UK Department for International Development (DFID), which was one of the first organizations to use the concept in the context of protracted crises, argues that “the impact of a disaster depends on how well prepared a country is to cope with it” (2011, p. 15), and that “being prepared, and being able to recover is what makes nations resilient [emphasis in original]” (2011, p. 15). The EU defines resilience as “the ability of an individual, a household, a community, a country or a region to withstand, to adapt, and to quickly recover from stresses and shocks” (European Commission [EC], 2012, p. 5). According to an influential position paper by the United Nations Development Group (UNDG), resilience means “the ability of households, communities and societies to cope with shocks and stresses, to recover from those stresses, and to work with households, communities and national and local government institutions to achieve sustained, positive and transformative change [emphasis added]” (UNDG, 2014, p.13). The different existing definitions emphasise various aspects of resilience, such as preparation and recovery, or coping, adaptation and transformation. From the academic literature, three characteristics of a resilient response become apparent: the ability or capacity to absorb the shock, adapt to the new reality, and transform in order to function either as before the crisis, or in a superior manner (see Keck & Sakdapolrak, 2013; Lorenz, 2013). Moreover, rather than an outcome, resilience is a process of “continual adaptive cycles of growth, accumulation, restructuring and renewal” (Welsh, 2014, p. 15). From security to resilience-based approaches to protracted crises The section above illustrates the ubiquity of resilience in the various policy domains dealing with protracted crises, including those of (international) security, and humanitarian and development assistance – despite its conceptual ambiguity. This section elaborates on the profound change in the understanding of, and approaches to, contemporary risks and crises underlying this new paradigm, as opposed to more traditional understandings of security. After the Cold War, ideas around security expanded from being primarily about conflicts between states, to being about many types of threats to the security of individuals, communities and societies (Buzan, Wæver & de Wilde, 1998) – including issues of poverty, social exclusion and natural hazards. In contrast to earlier, state-centric conceptions of security, ‘human security’ is about “how people live and breathe in a society, how freely they exercise their many choices, how much access they have to market and social opportunities – and whether they live in conflict or in peace” (UNDP, 1994, p. 23). With risks being defined in almost every domain of life (the so-called ‘risk society’, see Beck, 1992), governments set out to make ever-better “objective, standardised and exact predictions” to minimize harms and increase security (O’Malley, 2004, p. 1). In particular, western states portrayed democracy and trade “as almost magical formulas for peace” in contexts affected by political violence and armed conflict (Paris, 2010, p. 338; see also Duffield, 2014). Liberal approaches to peace-building, emergency relief and development assistance however, failed to fulfil their promises of a safer, better world (Paris, 1997). Moreover, they have been criticized not only for being ineffective, but also for having harmful unintended consequences (Paris, 2010) – Afghanistan, Iraq and Libya being cases in point. With systems and policies ill-equipped to face them, the frequency, duration and complexity of contemporary instances of political violence and armed conflict have engendered the idea that “the world is entering its most dangerous chapter in decades” (Guéhenno, 2017, para. 1). Syria serves as an exemplary case of a complex crisis with no end in sight and significant spill over effects. Violence among the many state and non-state actors involved caused 5.6 million people to seek refuge abroad, with many neighbouring countries ill- prepared to accommodate such large influxes of people, and others, like some European Union Member States, unwilling to do so. The attacks of 9/11 in particular, shattered the modernist belief that predicting, identifying, and responding to risks and crises was a matter of accumulating ever more scientific knowledge (Chandler, 2017). The resilience paradigm instead moves beyond a utopia of safety, by proposing “the impossibility and folly of thinking we might resist danger, and instead accept living a life of permanent exposure to endemic dangers” (Evans & Reid, 2013, p. 95). A policy memo of the European Council on Foreign Relations explicitly suggests this, to accept “that crisis and conflict ... is the new normal” (Witney & Dennison, 2015, p. 1). This makes resilience not so much about prevention and solutions to crises, as about accepting that emergencies happen – exactly because it is impossible to prevent them all (Bulley, 2013). Rather, resilience focuses on enhancing a system’s response to crisis rather than the crisis and its causes. Resilience: Drawbacks and challenges The above section illustrates that the emergence of the resilience paradigm is a response to two interrelated challenges. On the one hand, resilience signals a recognition of the fallibility of previous crisis governance approaches and systems, and on the other, a faltering belief in the possibility of controlling our world and preventing crises from happening. This section will elaborate on some of the drawbacks and challenges of using resilience-based approaches to insecurity. One challenge is that employing resilience-based responses shifts the responsibility for security away from states, and instead to societies themselves. Within traditional security approaches, the state is considered the primary provider of security. Yet to the extent that governments are unable to control or direct a complex world riddled with crises, they are incapable of fulfilling that role (Chandler, 2014). Instead, responsibility for security is transferred to the affected individuals and communities themselves (Chandler, 2014; Coaffee & Fussey, 2015; Coaffee & Wood, 2006), decentralizing power and inverting traditional top-down structures with bottom-up ones (Howell, 2015a). This makes resilience a conveniently cost-effective strategy in a time where many states are faced with a depletion of funds. The EU Approach to Resilience for example, explicitly states that resilience is not only better for the people involved, but also cheaper (EC, 2012). Unsurprisingly, resilience has been critiqued for its neoliberal character (Chandler 2013a; 2013b; Duffield, 2012; Joseph, 2013; Reid, 2012; Rogers, 2013), the potential hazard being that resilience strategies are advocated in order to justify the avoidance of responsibility, the limits to intervention, or budget cuts. Another challenge concerns the ways in which resilience-based approaches impact on subjects of governance. First, resilience is often understood as a set of coping strategies and skills that can be learned and taught, rather than it being a natural characteristic (Duffield, 2012). The US military, for example, employs resilience training to prevent soldiers from developing post-traumatic stress disorder and other mental health issues following deployment (Howell, 2015a; 2015b; O’Malley, 2010; Walklate, McGarry, & Mythen, 2014). This may imply that the development of PTSD symptoms is understood as having less to do with the trigger, i.e. deployment to a warzone, than with how well someone has learned to be resilient. Indeed, if resilience can be learned, it can also be failed to be learned. This de facto makes crisis-affected communities responsible for their own well-being, ergo, their vulnerabilities (Bulley, 2013; Chandler 2013b) – regardless of whether these are products of their own inherent weaknesses, or of structural socio-economic and political inequalities. To be resilient means to: “accept ... an understanding of life as a permanent process of continual adaptation to threats and dangers that are said to be outside its control. As such the resilient subject ... must permanently struggle to accommodate itself to the world: not a subject that can conceive of changing the world” (Chandler & Reid, 2016, p. 53). If our only choice is to adapt to the conditions of our suffering (Reid, 2012), resilience advocates for adaptation within existing structures rather than structural change. In the context of protracted crises, this means that rather than interrogating the existing structures that directly or indirectly generate crises, the resilient subject must prepare for, adapt to, and live with (protracted) instances of political violence and armed conflict. Resilience-building in practice The above section discusses the moral hazards and potential drawbacks of using resilience, particularly within the context of governing protracted crises. Whereas these critiques seem rather grim for policymakers and practitioners, resilience also has very positive connotations (Anholt, 2017). This section considers how resilience-based approaches to protracted crises are put into practice, and what aspects form the core of what resilience means in practical terms. For policymakers and practitioners, the shift from traditional top-down approaches to bottom-up responses has less to do with avoiding responsibility as with recognizing the need for local ownership of crisis responses. This is reminiscent of resilience applications in disaster risk reduction frameworks, where the concept rather refers to the capacity of local communities against the slow, reluctant or top-down approaches of the government that quash improvised community responses (Dynes, 1994). The 3RP programme for example, rather than being led by international organizations unfamiliar with the intricacies of the context, employs nationally-led country plans that address not only the protection and assistance needs of Syrian refugees, but also the resilience and stabilization needs of impacted and vulnerable communities in Jordan, Lebanon, Turkey, Egypt and Iraq (3RP, 2018). For the EU, in its implementation of the Global Strategy, it means “accepting different recipes to build resilient states and societies [and] supporting locally owned pathways to peace” (Tocci, 2017, p. 65). The EU in particular builds its understanding of resilience in practice upon the idea of ‘principled pragmatism’; although international law and its underlying norms remain the principal guide for EU external action (hence ‘principled’), it also demands “a rejection of universal truths, an emphasis on the practical consequences of acts, and a focus on local practices and dynamics” (hence ‘pragmatism’) (Tocci, 2017, p. 65; see also Joseph, 2016; Juncos, 2016). Resilience-building is as much about “a realistic assessment of the strategic environment”, as about the EU’s “idealistic aspiration to advance a better world” (Tocci, 2017, p. 64). Also, resilience in practice seems to be not so much about affected persons’ responsibility for their well-being, ergo, their vulnerabilities, but rather about understanding context-specific vulnerabilities and strengthening existing capacities (Bankoff, Frerks, & Hilhorst, 2004; Levine & Mosel, 2014). In its Action Plan for Resilience in Crisis Prone Countries, the EU for example explicitly commits to “more consistently [addressing] underlying causes of vulnerability” (EU, 2013, p 4). This implies that in practice, vulnerabilities are seen as determinants of the magnitude of the impact of a crisis and building resilience as a strategy to limiting that impact. Consistent with ideas around local ownership and context-specificity, this then requires the reinforcement – rather than replacement – of national and local systems, and investment in local capacities (UN, 2016). To achieve resilience-building in fragile contexts of protracted crises, international institutions and organizations, governments and NGOs recognize that doing different things requires doing things differently. The UN Office for the Coordination of Humanitarian Affairs’ (OCHA) New Way of Working articulates this need for different actors, including governments, NGOs, humanitarian and development actors, and the private sector to meaningfully work together towards collective outcomes (UNOCHA, 2017). In particular, it stresses the need for humanitarian and development actors to overcome their long-standing attitudinal, institutional and funding divides (UNOCHA, 2017). In a similar vein, the EU recognises that “achieving resilience objectives requires all EU actors (humanitarian, development, political) to work differently and more effectively together. Current practice and methods should be challenged, improved and new approaches adopted that are appropriate to different contexts” (EU, 2013, p. 4). Although these are commendable developments, whether resilience can really lead to sustained positive change on the ground remains to be seen.
The importance of resilience-based strategies in risk analysis, and vice versa	Aven & Thekdi	The Importance of Resilience-Based Strategies in Risk Analysis, and Vice Versa Terje Aveni* and Shital Thekdiii i University of Stavanger ii University of Richmond Suggested citation: Aven, T., & Thekdi, S. (2018). The importance of resilience-based strategies in risk analysis, and vice versa. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, strategy, risk analysis, resilience analysis *Corresponding author: terje.aven@uis.no As societies and economies continue to be subject to system disruptions and rapidly changing conditions, it is essential to implement resilience strategies that allow these systems to maintain functionality and effectively recover from disruptions. One critical component of an effective resilience strategy is the assessment of risk. Vice versa, there is a need for resilience-based strategies in risk analysis and management, as risk assessments have limitations in dealing with uncertainties, potential surprises and the unforeseen. In this paper we review and discuss these interactions and dependencies between resilience and risk. We outline how recent advancements in risk and resilience science have created a new platform for merging both quantitative and qualitative assessments. These advancements relate to the way risk and resilience are conceptualized and characterized, but also how we should in general confront uncertainties. Introduction In the following we use the term ‘risk analysis’ in agreement with the long tradition of Society for Risk Analysis (SRA) to include the areas of risk assessment, risk characterisation, risk communication, risk management, and policy relating to risk (SRA, 2015). To further simplify the nomenclature, a similar definition is used for resilience: ‘resilience analysis’ includes the areas of resilience assessment, resilience characterization, resilience communication, resilience management, and policy relating to resilience. The fields of risk analysis and resilience analysis are essential for enabling societies and economies to effectively manage system disruptions. Research in both fields have made significant advancements in recent years, allowing for organizations to concurrently manage both risk and resilience for applications like infrastructure, cyber-systems and commerce (Alderson, Brown, & Carlyle, 2015; Linkov et al., 2013; Park, Seager, Rao, Convertino, & Linkov, 2013). Given the importance of each distinct field, there is a need to develop an overall understanding of the role of risk assessment and management in resilience strategies, and the role of resilience strategies in the assessment and management of risk. The study of resilience seeks to address how to enable a system to sustain and restore (and even improve) its functionality following a change in the condition of the system (disruption, threat, opportunity - referred to as an event). As discussed in the literature (see Aven, 2017a) the resilience management (engineering) can, in principle, be conducted without considering potential events and risk. For example, adding redundancy in the system may be an effective resilience management strategy, and it does not need assessment of specific events and associated risk, to be implemented. A system manager would not need to know what type of events can occur and express their likelihoods as required in traditional risk assessments. In cases with large uncertainties related to what type of events that will occur, this is important because risk assessments then are not able to produce reliable probability estimates. Resilience strategies are of special relevance for complex systems, where it is acknowledged that unforeseen events or surprises will occur (Aven & Ylönen, 2018). Resilience analysis and management are especially suitable for confronting unknown and uncertain types of events, and both quantitative and semi-quantitative approaches for resilience assessment have been studied in the literature (see Linkov et al., 2013; Fox-Lent, Bates, & Linkov, 2015; Ganin et al., 2016; Gisladottir, Ganin, Keisler, Kepner, & Linkov, 2017; Gao, Barzel, & Barabási, 2016). Traditional risk assessment is not a part of the methodology used in these studies. There have been recent calls for a shift from risk to resilience, to a large extent motivated by the need for meeting the effects of climate change, by many organizations, scientists and leaders, including the former Secretary-General of the United Nations, Ban Ki-moon (UNISDR, 2015). These calls raise some questions. Are they arguing that the resilience strategy should be highlighted at the expense of the contemporary frameworks for handling risk? How do the calls acknowledge the fact that current risk science considers resilience analysis and management as an important strategy for managing risk? Also, arguments have been presented showing that risk considerations can provide useful input to the resilience analysis and management (Aven, 2017a). There seems to be a need for clarifying the interactions and dependencies between these two fields, and this is exactly what this paper seeks to obtain. It does this by first discussing how resilience-based strategies are essential for risk analysis. Then risk is shown to be an important factor in resilience analysis and management. The final section extends the discussion to a performance setting. The work summarizes and extends discussions in recent papers on the topic, including Aven (2017a) and Thekdi and Aven (2016). Resilience-based strategies in risk analysis Traditionally risk analysis has been linked to risk assessment and the use of this tool to inform decision makers (see e.g., Park et al., 2013). However, broader approaches have been developed, with many founded on risk governance frameworks (IRGC, 2005; Renn, 2008). What characterizes these approaches and frameworks is an acknowledgement of the need for seeing beyond risk assessments in order to adequately handle risk. Three main categories of strategies for handling risk are identified, i) risk-assessment informed, ii) cautionary and precautionary approaches, highlighting robustness and resilience, and iii) dialogue and participation (Renn, 2008; Aven, 2017a; SRA, 2017). The categories ii) and iii) are justified by the limitations of the risk assessment approach, in particular for being able to deal with uncertainties and potential surprises. Resilience is seen as a pillar of risk management and risk analysis as defined above. The cautionary/precautionary (robustness/resilience) strategy includes features such as constant monitoring, containment, and research to increase knowledge and the development of substitutes. Specifically, resilience captures measures such as strengthening of immune systems, diversification and flexible response options (Renn, 2008). In the discursive strategy, measures are implemented to build confidence and trustworthiness, through the clarification of facts, reduction of uncertainties, involvement of affected people, deliberation and accountability (Renn, 2008). The precautionary principle is interpreted as stating that in case of a potential for severe consequences and scientific uncertainties about the consequences of an activity, protective measures should be taken to reduce risks (Aven & Renn, 2018). The cautionary principle extends the precautionary principle, stating that if the consequences of an activity could be serious and subject to uncertainties, then cautionary measures should be taken or the activity should not be carried out (Aven & Renn, 2018). While the precautionary principle is used in cases of scientific uncertainties, the cautionary principle is used for all types of uncertainties and ambiguities. Risk analysis frameworks building on these three strategies are founded on broad perspectives on risk, acknowledging that risk is more than calculated probabilities and risk metrics. In line with recommendations of the Society for Risk Analysis (SRA, 2015), risk has two main features: the consequences (C) of the future activity considered – for example the operation of a manufacturing facility or the life in a country – and related uncertainties (U). The consequences are often seen in relation to some reference values (planned values, objectives, present state, etc.) and are with respect to something that humans value. There is always a potential for some negative outcomes. While historic study of risk has focused on negative or undesirable consequences, the SRA framework is general and allows for both negative and positive outcomes. Risk defined in this way makes a clear distinction between the concept (here risk) and how this concept is described, measured or characterised, in line with measurement theory. A probability distribution of the number of fatalities, as a result of the activity, is an example of such a risk characterisation. The ways risk can be characterised are many, but in its broadest sense, it captures (C’, Q, K), where C’ are some specified consequences (for example the number of fatalities), Q a measure or description of uncertainty (for example probability and associated judgments of the strength of knowledge supporting the probabilities) and K the knowledge supporting P (Aven, 2017b). Often the consequences explicitly refer to events A that can occur leading to some effects. Resilience is understood as the ability of the studied system to maintain functionality and effectively recover given that one or more events A occur, whether these events are known or not. Of special importance is the case of planning for resilience of the system for events A, that are not identified in C’. We will return to the resilience concept in the next section. Risk considerations supporting resilience analysis and management As mentioned in the introduction, resilience can to some degree be analyzed and managed without considering risk. We can improve the immune system by proper training, without really thinking about risk. However, further reflections would quickly make us realize that risk considerations are needed in relation to resilience analysis, for two notable reasons (Aven, 2017a): Firstly, risk analysis would supplement resilience analysis by addressing the potential occurrences of events. Through such analysis, new insights may be gained, for example, unknown and potentially surprising types of events could be identified, and new “cause-effect” relationships can be revealed. Concrete and more effective measures can then be developed to meet these events. By studying why certain infections occur, more effective measures can be developed than if the focus is limited to how to make the body withstand infections in general. Medicine, to a large extent, focuses on performing risk analysis related to known and unknown types of threats. It would be an extremely poor policy to lean on resilience-based strategies alone. Secondly, risk analysis would supplement resilience analysis in order to obtain more effective use of resources. In practice there are always resource limitations and that means that organizations must prioritize those limited resources to decide how and where to improve resilience. There could be many areas in which the resilience can be improved, but which should be selected and given weight? Many resilience metrics exist but what events will in fact occur? Say that a system can be subject to two types of events, A1 and A2. The system is resilient in relation to event A1 but not to A2. Now suppose A2 will occur with a probability of 0.000001% and A1 with a probability 0.999999%. Suppose a specific arrangement would significantly improve the resilience with respect to event A2, but its effect on risk (interpreted in a wide sense) is marginal. The arrangement could still be justified, but some types of consideration of risk seem useful, also in the case that we have difficulties in assessing likelihoods and being accurate on what type of events that will occur, as we always need to make prioritizations. The question is rather how we can make these considerations of risk informative. Different types of risk assessment methods can be used for the purpose of supplementing the resilience analysis. They are typically not traditional quantitative risk assessments searching for accurate probability estimates, but broad qualitative assessments of events, recovery (return to the normal condition or state) and uncertainties (see Aven, 2017a). The objectives of these assessments can be to obtain insights by: i. Making a judgement of the type of events that can occur, what we know and do not know (highlighting key assumptions and justified beliefs). ii. Making a distinction between known types of events, unknown types of events, and surprising events. iii. Assessing the probability for these types of events whenever found meaningful (using subjective probabilities or subjective interval probabilities). iv. Assessing the strength of knowledge supporting these judgements. How can the knowledge be strengthened? v. Conducting assessments to reveal unknown and surprising events. As a third and final way risk considerations can support resilience analysis, think of the objective of recovering or sustaining functionality and performance, or in other words, returning to the normal state following the event (disruption). Using the general risk set-up introduced in the previous section, the consequences C can be viewed as a deviation from this objective. The resilience is studied for fixed events A, but conceptually, the problem faced is similar to the one considered above with risk understood as (C,U\|A) and a description or characterisation of the form (C’,Q,K\|A), where the term “\| A” is to be read as ‘given the occurrence of A’. If a system is not resilient against a specific event A but this event is improbable, the system can still be considered resilient. Discussion The above discussion has shown that risk and resilience analysis are closely integrated. From the analysis in Section 2 we schematically can write Risk = (A,C,U) = (A,U) + (C,U\|A) = “occurrence of events, and associated uncertainties” + resilience, clearly showing that the resilience is a part of the risk concept, and hence resilience analysis can be seen as an element of risk analysis. More precisely, (C,U\|A) is to be understood as the ‘resilience- induced conditional risk’ or ‘lack of resilience-induced conditional risk’, given the occurrence of A. The symbol ‘+’ is here not to be interpreted as a sum, as in mathematics, but as a symbol for combining the two elements. The previous section argues that risk considerations are needed in relation to resilience analysis in different ways. Representing resilience by (C,U\|A), the uncertainties related to which events A that will occur need to be addressed in some way in order to meaningfully conduct the resilience analysis. Current perspectives on how to characterise risk, such as (C’,Q,K), are also applicable for the conditional case of resilience, leading to resilience characterizations of the form (C’,Q,K\|A). The integration is clearly observed when extending the discussion to performance-based type of frameworks, as in Thekdi and Aven (2016). The set-up can briefly be described as follows: The future performance of a system is affected by events (stressors, opportunities), which can lead to performance output O above or below a reference level (expressing for example a planned value, a goal or the current state). There are uncertainties associated with both the occurrence of these events and the actual performance output. Similar to the study of risk, the performance-related uncertainties are assessed using some measure Q, typically covering probability (or imprecise probability) and associated strength of knowledge judgments. The background knowledge K, on which Q is based, constitutes an element of the performance characterization. The resilience management is focused on the task of recovering or sustaining functionality and performance, given an event, and is thus an important element of the performance management. Traditionally, performance management has focused on the management of opportunity, whereas risk management has put emphasis on the study of missed or lost opportunity. The broader framework outlined above allows for a more holistic perspective which allows for resilience and risk analysis to be viewed as complementary activities aimed at managing system performance. There is need for further work linking resilience-based strategies in risk analysis and management. The resilience-based approach allows decision-makers to put larger emphasis on managing system performance to confront potential surprises and unforeseen events, but needs always to be seen in relation to risk as argued for above. At a more practical level, there is need to integrate resilience and risk analysis and management into organizational processes, such as enterprise risk management procedures.
Resilience as an integrative, measurable concept for humanitarian and development programming	Barrett & Upton	Resilience as an Integrative, Measurable Concept for Humanitarian and Development Programming Christopher B. Barrett* and Joanna B. Uptoni i Charles H. Dyson School of Applied Economics and Management, Cornell University, Ithaca, NY, USA Suggested citation: Barrett, C. B., & Upton, J. B. (2018). Resilience as an integrative, measurable concept for humanitarian and development programming. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, development, poverty analysis, resilience measurement *Corresponding author: chris.barrett@cornell.edu Resilience in the humanitarian and development context As recurring emergencies in low- and middle-income countries increasingly challenge international development and humanitarian agencies to reconsider how they simultaneously support both short- run recovery to adverse shocks and longer-run socioeconomic progress, many donor and operational agencies have gravitated to the concept of resilience. The concept of resilience potentially provides a framework for integrating programming and thinking around these two spheres, which had too often been treated quite separately. The emergent popularity of resilience as an integrative concept in the development and humanitarian communities is, however, quite recent. The watershed moment arguably came in 2011, when a global food price spike, widespread civil unrest in parts of sub-Saharan Africa and western Asia, severe drought in the Horn of Africa and the Sahel, and ongoing demands for recovery from the 2010 Haiti earthquake all challenged aid agency budgets and strategies. How best could aid agencies and their government and non-governmental organization (NGO) partners help current victims of natural disasters and violence to get on a sustainable pathway out of poverty, resilient to the myriad shocks and ongoing stressors that too often impede progress? Put differently, how could aid and operational agencies shock-proof continuous improvement in human well-being, especially in communities already experiencing intolerably high rates of poverty, malnutrition and other forms of severe deprivation? Resilience has thus recently become a central feature of development and humanitarian programming. Yet, the development and humanitarian communities struggle with defining and measuring the concept. The United States Agency for International Development (USAID) defines resilience as “the ability of people, households, communities, countries and systems to mitigate, adapt to and recover from shocks and stresses in a manner that reduces chronic vulnerability and facilities inclusive growth” (REAL, 2018). Barrett and Constas (2014, hereafter BC) conceptualize ‘development resilience’ as “the capacity over time of a person, household or other aggregate unit to avoid poverty in the face of various stressors and in the wake of myriad shocks. If and only if that capacity is and remains high over time, then the unit is resilient.” Two crucial features of the concept of resilience for development emerge from these two definitions (and there exist many others), in juxtaposition to more general academic definitions of resilience, for example the National Academy of Sciences’: “the ability to prepare and plan for, absorb, recover from, and more successfully adapt to adverse events” (NRC, 2012). First, in the development domain, the concept of resilience is explicitly normative. Because the central project of development is to improve human well-being among the under-resourced, merely stabilizing living standards around ex ante low levels, or accelerating recovery to an unacceptably low level does not advance these common goals. Within the international development community, resilience must reflect more than just recovery from (negative) disruption; it must expressly link recovery to acceptable living standards. Second, and relatedly, resilience as a concept must be applicable and decomposable from aggregate units to the micro level, or individual people and households. Resilience cannot be solely a community or system level property, because development and humanitarian objectives are rooted in individual human experience and human rights. In this view, the relation between micro-level measures and more aggregate ones is a matter of scale, although there may be separate processes operating at micro, meso or macro scales that reinforce one another across scales, much as is true for poverty (Barrett & Swallow, 2006). Resilience is related to, but transcends, the concept of vulnerability. Both concepts emphasize risk exposure and the context-dependent shocks to which one might be exposed. But one might be vulnerable to an adverse shock – i.e., suffer significant losses – and yet highly resilient – i.e., the conditional likelihood of loss is acceptably low and/or the speed of recovery to an adequate standard of living, conditional on loss, is quick. Conversely, one might not be vulnerable and yet also not be resilient. For example, those who opt out of the labor market after extended, failed efforts to find work after losing a job may no longer be vulnerable to unwanted unemployment shocks due to business cycle downturns. One could hardly claim, however, that such a person is better off, in any meaningful sense of the concept, than an otherwise identical employed person who may now be vulnerable to lay off. Similarly, a homeless person may be less vulnerable to loss of property or life in an earthquake than a richer counterpart, but could hardly be deemed more resilient, so long as the resilience concept is rooted in normative standards of attaining an adequate level of well-being. Put differently, the absence of vulnerability to a shock from which one might or might not recover ought not to be sufficient for one to be classified ‘resilient’. Both the ex ante normative state – one’s standard of living, however measured – and the time path of standard of living following an adverse shock together define one’s resilience. Resilience must also be contextualized within the complex social-ecological systems (SES) in which poor populations commonly reside (Folke, Hahn, Olsson, & Norberg, 2005). System-level shocks can affect individual-level behaviors, which aggravate system-level disturbances (Barrett & Constas, 2014). For example, drought shocks can lead herders to change the range over which they graze livestock, leading to initially-isolated resource conflict that quickly scales into ethnic violence, as has occurred repeatedly in east Africa (Little, McPeak, Barrett, & Kristjanson, 2008). The concept of resilience can inform a meaningful resilience strategy, as opposed to just poverty reduction or risk management strategy, helping organizations structure their programming in keeping with this broader picture. Development is ultimately about how policies and programs improve well-being sustainably over time in the face of shocks and stressors. Resilience measurement As the resilience concept has become central to development and humanitarian programming, the need to measure resilience has grown more urgent. At a minimum, one needs a resilience measure in order to evaluate whether or not ‘resilience building’ interventions indeed achieve their aim. As unsettled as the definition of resilience remains within the development and humanitarian communities, even less consensus exists around measurement methods. In order to remain true to the theoretical grounding of the concept in the stochastic dynamics of individual (and collective) well-being, measurement of development resilience must include indicators of well-being outcomes, as well as measures of shocks and/or stressors that motivate a concern for resilience. A good measurement method must also attend to the distinction between ex ante (pre-shock) resilience capacities, and the time path of the well-being outcome variable(s) of interest ex post (post-shock) (Hoddinott, 2014). This necessarily demands longitudinal data, ideally at reasonably high (e.g., seasonal) frequency, with which to measure pre-shock exposure and capacities as well as the time path of post-shock recovery (Headey & Barrett, 2016). The initial generation of methods, developed and advanced largely by the Food and Agriculture Organization of the United Nations (FAO), focused on developing a resilience index reflecting a diverse set of assets and livelihood activities thought to enhance one’s ex ante capacity to be resilient to particular shocks (Alinovi, Mane, & Romano, 2008; Alinovi, D’Errico, Mane, & Romano, 2010). The FAO method has been subsequently refined into a resilience capacity index that is popular among many European aid agencies and international agencies such as the United Nations Children’s Fund and the World Food Programme (d’Errico, Romano, & Pietrelli, 2018; d’Errico & Pietrelli, 2017). An alternative method, developed by the consulting firm TANGO and recently adopted by USAID and many US-based organizations, uses factor analysis as a data reduction method to define distinct absorptive, adaptive, and transformative capacity indices from a myriad of variables that they argue capture features of those capacities, including assets, human and social capital, livelihood activities, access to services, and psychosocial beliefs and characteristics (Smith & Frankenberger, 2018). These index methods have proved useful to agencies struggling to implement measurement methods for resilience programming. But they focus heavily on ex ante capacities, rather than on ex post recovery, and do not lend themselves well to impact evaluation since the indices are intended solely as explanatory variables. As such, they more help explain resilience than define or measure it. Yet as development agencies increasingly program explicitly to ‘build resilience’, the concept has de facto become a targeted outcome, even if it is conceptualized as purely a set of explanatory capacities. Toward that end, TANGO and USAID now also use a separate outcome measure to try to capture resilience, a simple indicator variable reflecting whether a household’s post-shock food security is greater than or equal to its pre-shock food security (Smith & Frankenberger, 2018, Sagara, 2018). That measure lacks a normative anchor, however, as one could fully recover to an unacceptably low standard and yet still be assessed as resilient. Cissé and Barrett (2018, hereafter CB) offer a method that directly implements the BC conceptualization of development resilience as reflecting the time path of conditional probabilities of being poor, however measured. In the CB approach, well-being (or absence of poverty) can be operationalized as an outcome using any of a wide range of indicators familiar to poverty analysis: assets, expenditures, health status, income, literacy, or some combination of those, potentially captured in an index measure (Alkire et al., 2015). The CB method relies on longitudinal, individual- level observations to capture both the underlying (and potentially nonlinear) dynamics of the system and the possible mediating effects of specific interventions on the effects of shocks on well-being. Early applications of the CB method have demonstrated its usefulness in rigorous evaluation of the impacts of resilience interventions, such as index insurance (Cissé & Ikegami, 2017) or livestock transfers (Phadera, Michelson, Winter-Nelson, & Goldsmith, 2018). McPeak and Little (2017) find that threshold-based resilience measures like CB significantly outperform alternative measures that define resilience as recovery to ex ante state. Most resilience measurement has been shock/stressor specific because most have been designed around ex ante capacities that are shock/stressor/setting specific. One of the virtues of the CB method is that it can accommodate shock/stressor-specific capacities as mediating variables while also allowing for a fully general representation of resilience to the full range of perils. Knippenberg, Jensen and Constas (2018) introduce an approach, developed in collaboration with Catholic Relief Services on a pilot project in Malawi, to measuring resilience as the non-persistence of shocks, which they label Measuring Indicators for Resilience Analysis (MIRA). MIRA uses high- frequency data to study the persistence of households’ subjective reports of a range of adverse shocks they suffer, such as drought, flood, or illness. The method also allows for regression estimation of the relationship between estimated shock persistence and household attributes. Like the TANGO/USAID outcome measure, the focus of MIRA is on shock recovery without reference to the level of well-being to which one recovers. Resilience to foster structural transformation With shocks seemingly increasing in intensity and frequency in low- and middle-income countries, the development and humanitarian communities are working energetically to embed the resilience concept into strategies to facilitate structural transformation. A central lesson of the related literature on the economics of poverty traps is that efforts to build resilience can conserve scarce resources, crowd in private investment, and help low-income populations accumulate productive assets and become secure in non-poor standards of living (Barrett, Carter & Chavas, 2018). So long as definitions of resilience remain normatively anchored in relation to living standards to which people routinely aspire, the risks of moral hazard, or the likelihood that resilience interventions inadvertently create adverse incentives for private investment, are relatively modest. Under very mild assumptions that people prefer better to worse living conditions and less to more downside risk exposure, they should routinely pursue strategies that reduce the conditional probability of adverse outcomes, i.e., that might reduce resilience. Indeed, in the face of poverty trap mechanisms associated with nonlinear well-being dynamics, resilience building activities may be more likely to crowd in than crowd out private responses that reinforce resilience (Barrett, Carter & Chavas, 2018). Such poverty trap mechanisms have been most clearly demonstrated in settings – like the Horn of Africa – where resilience strategy is increasingly central to development and humanitarian programming efforts. The resilience lens adds value to conventional poverty analysis in multiple ways. First, resilience conceptualized in the BC way and operationalized using the CB method way can effectively distinguish between what Carter and May (2001) term stochastic versus structural poverty. Relatedly, by incorporating the underlying path dynamics of both standards of living and the key state variables describing the system in which people live, the BC approach and CB method allow for the potentially transitory nature of both favorable and unfavorable realizations of standards of living. Development resilience analysis allowing accounting for (especially nonlinear) well-being dynamics and expanding analysis beyond the first moment of the conditional distributions of well- being outcomes, which matters for inference about program impacts (Phadera et al. 2018), for targeting of beneficiaries (Upton, Cissé, & Barrett, 2016; Watkins et al., 2017). By facilitating integrative thinking and measurement around the myriad stressors and shocks confronting vulnerable populations, the resilience concept challenges the development and humanitarian communities to collaborate more, both in advancing better understanding of the complex dynamic systems in which poor people commonly reside and in building improved monitoring systems (Bené, Headey, Haddad, & von Grebmer, 2016). As BC explain, the closely coupled feedback between natural systems – e.g., fisheries, forests, rangelands – that may exhibit nonlinear dynamics and multiple stable states, and inter-temporal human decision-making that is limited by imperfect information, local financial market failures, sociocultural barriers, and other constraints, leads to complex dynamics beyond what analysts or practitioners in the development and humanitarian communities currently measure. Resilience, especially anchored in notions of capacities, emphasizes individual agency in ways that transcend the more passive condition too often implied in prior concepts of poverty and vulnerability. Programming aimed at building individuals’, households’, communities’, and institutions’ resilience against shocks as diverse as extreme weather events, market price shocks, and civil unrest, can help promote proactive collaboration not only among development and humanitarian agencies but between those agencies and target populations.
Resilience to global catastrophe	Baum	Resilience to Global Catastrophe Seth D. Baumi* i Global Catastrophic Risk Institute Suggested citation: Baum, S. D. (2018). Resilience to global catastrophe. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, catastrophe, global, collapse *Corresponding author: seth@gcrinstitute.org Introduction The field of global catastrophic risk (GCR) studies the prospect of extreme harm to global human civilization, up to and including the possibility of human extinction. GCR has attracted substantial interest because the extreme severity of global catastrophe makes it an important class of risk, even if the probabilities are low. For example, in the 1990s, the US Congress and NASA established the Spaceguard Survey for detecting large asteroids and comets that could collide with Earth, even though the probability of such a collision was around one-in-500,000 per year (Morrison, 1992). Other notable GCRs include artificial intelligence, global warming, nuclear war, pandemic disease outbreaks, and supervolcano eruptions. While GCR has been defined in a variety of ways, Baum and Handoh (2014, p.17) define it as “the risk of crossing a large and damaging human system threshold”. This definition posits global catastrophe as an event that exceeds the resilience of global human civilization, potentially sending humanity into a fundamentally different state of existence, as in the notion of civilization collapse. Resilience in this context can be defined as a system’s capacity to withstand disturbances while remaining in the same general state. Over the course of human history, there have been several regional-scale civilization collapses, including the Akkadian Empire, the Old and New Kingdoms of Egypt, and the Mayan civilization (Butzer & Endfield, 2012). The historical collapses are believed to be generally due to a mix of social and environmental causes, though the empirical evidence is often limited due to the long time that has lapsed since these events. For example, the Akkadian Empire in Mesopotamia, approximately 4,300-4,200 years ago, is believed to have collapsed due to military destruction of economic networks and possibly also climatic drought or other environmental stressors, though the role of environmental stressors is controversial, and the Old Kingdom of Egypt, approximately 4,700 to 4,200 years ago, is believed to have collapsed due to a succession struggle following the long reign of Pepi II, Akkadian military destruction, and a catastrophic failure of the Nile (Butzer, 2012). While these historical collapses provide some insight, the collapse of modern global civilization would be unprecedented. Modern global civilization is of a scale and complexity that is fundamentally different from the civilizations that have previously collapsed. Civilization today has tightly interconnected global networks, advanced science and technology, and a population of over seven billion. None of the historical civilizations had anything close to this. These features of modern global civilization can increase its resilience in some ways and decrease it in others. For example, global trade enables populations in one part of the world to help out populations in another part of the world during a regional catastrophe, but global just-in-time supply chains can cause cascading global failures due to failure in one link of the chain. The lack of direct precedent makes GCR a difficult class of risk to analyze. Neither the probability nor the severity of global catastrophe can be directly quantified using historical data. Likewise, it is difficult to say just how resilient global human civilization is to global catastrophe—how severe an event global human civilization can endure without collapsing. It is nonetheless important to study the matter, in order to assess how serious the threat of collapse may be and to evaluate potential opportunities to increase humanity’s resilience. Risk vs. resilience for global catastrophe Risk and resilience are both conceptual paradigms for helping understand and address potential adverse events. The risk paradigm tends to emphasize quantitative evaluations of the probability and severity of potential adverse events and the effect of policy measures on the probability and severity. The resilience paradigm tends to emphasize the capacity of a system to cope with, recover from, or otherwise endure adverse events that may occur (Walker, Anderies, Kinzig, & Ryan, 2006; Park, Seager, Rao, & Convertino, 2013). It has been proposed that the resilience paradigm may be more appropriate for highly uncertain potential adverse events (see Park et al. 2013). The basic idea is that, in the absence of robust information about a threat, a sound approach is to focus on increasing resilience, on grounds that certain measures can increase a system’s resilience to a wide range of threats. For example, households can increase their resilience to many threats by stockpiling food, water, medical supplies, and other basic necessities. These measures can be helpful even if it is not known which threat will manifest. Similarly, certain measures may increase the resilience of global human civilization to a wide range of threats (Jebari, 2015). For example, civilization could establish dedicated refuges to protect select populations during a wide range of global catastrophe scenarios, including “surprise” scenarios that may have not yet been imagined. Thus, refuges have been considered as a response to GCR (Baum, Denkenberger, & Haqq-Misra, 2015; Jebari, 2015; Turchin & Green, 2017). Given the ambiguity inherent to global catastrophe, this perspective suggests an important role for resilience in policy for global catastrophe. An alternative perspective proposes that the risk and resilience paradigms are both appropriate for these sorts of ambiguous threats (Baum, 2015). Per this perspective, resilience measures can be quantified as policies to reduce the severity of an event if it occurs. It may be difficult to quantify the effect with precision, but the risk paradigm is capable of handling imprecise quantification. There can presumably be at least some basic quantification, such as the assessment that the resilience- increasing measure decreases the risk instead of increasing it. Furthermore, whereas the resilience paradigm focuses on reducing severity, the risk paradigm also includes reducing probability. For many GCRs (and other risks), there are important policy opportunities to reduce the probability that should not be neglected by focusing on resilience. It is nonetheless the case that the field of GCR often neglects resilience. One reason for this may be that scholars of GCR tend to come from intellectual backgrounds in which resilience is not prominent. Another likely reason is that attention goes primarily to how to prevent global catastrophes from occurring, with limited attention to how to respond to these events if they occur (Maher & Baum, 2013). Some focus on prevention is warranted—it would certainly be better if global catastrophes did not occur in the first place. However, prevention is not guaranteed to succeed, suggesting an important role for measures to limit the severity. The resilience paradigm can draw attention to this side of the issue and provide insights into what to do about it, which is a valuable contribution. This raises the question: how resilient is humanity to global catastrophe? Answering this question requires covering some details that are distinct from resilience at smaller scales. On the extreme end is the concept of minimum viable population (MVP), defined as the smallest isolated population that has a high (commonly 90%) probability of surviving for many generations. MVP is mostly used in conservation biology for non-human species, but in the context of GCR, it applies to the human species. The human MVP has been estimated variously at 150 to 40,000 (Lynch, Conery, & Burger, 1995; Impey, 2015). A resilient human population would need at least this number of members co-located and able to reproduce. This idea has been taken up in proposals for dedicated refuges to ensure a viable survivor population (see Jebari, 2015). On the opposite end is the possibility of collapse from much smaller catastrophes. At issue here is the fragility of global civilization. It is often observed that small initial events can cause cascading effects, toppling relatively large systems. However, regional catastrophes leave other regions intact and able to assist with the recovery. An important open question is what it would take for there to be a global failure, such that there would not be a recovery. This sort of question is studied in the field of global systemic risk (see Centeno, Nag, Patterson, Shaver, & Windawi, 2015). Drawbacks of resilience to global catastrophe An important question for all efforts to increase resilience is whether doing so reduces interest in preventing adverse events from occurring, an effect sometimes referred to as moral hazard. There is some precedence for this effect in the context of GCR. For example, civil defense for surviving nuclear war has generated concerns that nations would attempt to fight and win instead of focusing on deterrence and prevention (Weinberg, 1969). There is reason to believe that moral hazard is relatively limited for GCR. This is because global catastrophe is likely seen as so overwhelmingly horrible that the only sensible policy is to prevent it from occurring in the first place. Such an attitude is a plausible explanation for why there is so little attention to resilience to global catastrophe. Additional attention to resilience may be unlikely to make people inclined to accept the onset of global catastrophe. Alternatively, belief in the resilience of human civilization could prompt some to underestimate the severity of some global catastrophes. An extreme example of this is in the argument that human extinction risks are categorically more important than sub-extinction GCRs, an argument that is often found in the GCR literature (see Parfit, 1984; Matheny, 2007). However, this argument implicitly assumes a long-term resilience of human civilization, such that there would be a full recovery from sub-extinction global catastrophes. A recent study finds that this assumption lacks empirical support (Baum et al., 2018). More generally, belief that human civilization could endure major shocks could reduce interest in reducing GCR. However, this matter has not been studied rigorously, and definitive conclusions cannot be made at this time. How resilience can reduce the risk of global catastrophe While moral hazard may be a way for resilience to increase the risk of global catastrophe, there are also important ways that attention to resilience can decrease the risk. The value of resilience can be seen via the important example of resilience to global food supply catastrophes. There are several GCRs that are believed to threaten the global food supply. For example, nuclear war burns cities and other areas, sending large amounts of particulate matter into the stratosphere, which then blocks incoming sunlight worldwide, disrupting agriculture. An India-Pakistan nuclear war scenario has been found to cause reductions to major crop yields in the range of 10 to 50% (see Xia, Robock, Mills, Stenke, & Helfand, 2015). Large asteroid and comet collisions and volcano eruptions can have similar effects. Other global food supply threats could include crop pathogens and abrupt global warming. These various catastrophes could create relatively abrupt shocks to the global food supply, on time scales of years to decades. Slower events, such as gradual global warming and the depletion of agriculturally significant natural resources (such as phosphate rock), can also have large effects on the food supply, though they offer more opportunity for civilization to adapt. Several measures can be taken to increase resilience to global food supply catastrophes (Baum, Denkenberger, Pearce, Robock, & Winkler, 2015). The simplest is to make the most of the remaining food supply. In particular, crops can be shifted from livestock feed to direct human consumption. Under present (non-catastrophe) conditions, bypassing livestock could yield enough calories for four billion people (Cassidy, West, Gerber, & Foley, 2013). Post-catastrophe, this figure could be substantially reduced, but it may nonetheless help keep many people alive. Another measure is to stockpile food prior to the catastrophe. In principle, the amount of food that can be stockpiled is virtually unlimited. In practice, however, food stockpiling is expensive, labor- intensive, and cuts into the pre-catastrophe food supply. Food stockpiles are best suited to a more limited role for more moderate catastrophes, especially those of short duration. Existing food stockpiles could support the global human population for an estimated 4-7 months (Denkenberger & Pearce, 2014), which is insufficient for many global catastrophe scenarios. Another potential role for food stockpiles is to ensure the survival of a select population, such as in continuity of government facilities, survivalist communities, or dedicated refuges designed to ensure an MVP. A third measure is to develop capacity to produce food in unconventional ways. For example, if sunlight becomes unavailable, it may be possible to produce food via other means (Denkenberger & Pearce, 2014). Ultimately, food does not need sunlight—it needs energy. Non-sunlight energy sources could include fossil fuels, nuclear power, and energy stored in trees and other biomass. This option is attractive because it can succeed for catastrophes of all sizes with no expensive reductions in pre-catastrophe food supply. However, it may require technological development and institutional support that thus far has not been made. Thus, this is the sort of policy measure that could result from greater emphasis on resilience to global catastrophe. Conclusion While it should be hoped that global catastrophe will never occur, there is no guarantee that efforts to prevent global catastrophe will succeed. Therefore, efforts to increase humanity’s resilience to global catastrophe constitute an important class of policy—one that has thus far received rather limited attention. The continuity of global human civilization and the human species are essential policy goals. There are promising options for increasing resilience to global catastrophe. These options should be pursued.
Conceptualizing risk and unit resilience in a military context	Cato, Blue & Boyle	Conceptualizing Risk and Unit Resilience in a Military Contexti i The views expressed in this paper are those of the authors and do not necessarily reflect the official views of the U.S. Department of the Army, Department of Defense, or the U.S. Government. ii U.S. Army Research Institute for the Behavioral and Social Sciences (ARI) Suggested citation: Cato, C. R., Blue, S. N., & Boyle, B. (2018). Conceptualizing risk and unit resilience in a military context. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Colanda R. Catoii, Shala N. Blueii and Bridget Boyleii Keywords: Team/unit resilience, risk, military, U.S. Army, behavioral Corresponding author: colanda.r.cato.civ@mail.mil Unit/team resilience in the U.S. Army The United States Army Research Institute for the Behavioral and Social Sciences (ARI) is a leading agency of the Army that conducts innovative and applied research aimed at improving Army readiness and performance. The agency accomplishes its mission in part by developing innovative measures and methods to address these issues and improve the overall Soldier lifecycle and lethality. Fostering and ensuring resilience at the individual Soldier, unit, and organizational level may help leaders and Soldiers improve Soldier lethality. However, much of the scientific research on resilience has focused on defining and measuring resilience at the individual level, with less investigation of unit or team-level resilience. With the critical role of teams and small units in the Army, it is essential to have a theoretically supported definition of unit resilience as well as develop an empirically sound, evidenced-based measure to help determine its impact. To date, no agreed upon definition of unit resilience exists. In a recent effort (Cato, & Blue, 2017; Cato, Blue, & Boyle, 2018), we reviewed the collective (e.g., group, organization, community) resilience literature and identified recurrent themes across definitions of collective resilience. Themes such as absorption, withstanding, adapting, and bouncing back occurred numerous times across the collective resilience definitions examined in our literature review (Cato & Blue, 2017; Cato et al., 2018). Other concepts that appeared in the definitions and descriptions of multiple collective types of resilience included preparing/anticipating, learning, and growing/thriving. Based upon the above themes, we defined Unit Resilience as: “A multi-phasic process in which members of the unit deliberately and collectively apply skills, abilities, and resources to prepare the unit for adversity by planning and anticipating adverse events, successfully respond to challenging events by withstanding or adapting to stressors, and recover after the event, which involves the unit returning to homeostasis (e.g., bouncing back) or an improved state through post-event learning and growth.” (see Cato et al., 2018) This definition focuses on a unit’s ability to prepare, respond, and recover from adverse events and is consistent with other collective resilience definitions (see Alliger, Cerasoli, Tannenbaum, & Vessey, 2015; Bergstrom & Dekker, 2014; Linkov, Eisenberg, Bates et al., 2013; National Resource Council [National Academies of Science], 2012; Linkov et al., 2018). Our definition also embeds risk and threat as an inherent part of the overall collective resilience process that units must address in the preparation phase of unit resilience (Linkov & Trump, 2019). Moreover, our unit resilience definition acknowledges the role that Soldiers’ skills and abilities as well as individual and unit resources play to enable a unit’s successful progression through the three distinct unit resilience phases. The extent to which these skills, abilities, and resources are utilized or are damaged or depleted can positively or negatively impact a unit’s resilience. Such a perspective is consistent with the Systems theory (see Bergstrom & Decker, 2014) and Conservation of Resources (COR) theory (Hobfoll, 1989; McCubbin & McCubbin, 1988). From a systems theory perspective, we view the military unit or team as a system, with the collective resilience of the system being bolstered or hampered by the individuals who comprise the system. While one member in the system may not necessarily demonstrate resilience or behave in a resilient manner, the collective can still demonstrate resilience and overcome individual shortcomings. COR theory provides a resource-focused model that emphasizes how the impact of repeated stressors depletes resources availability. From these perspectives, we view the military unit as a complex system in which resources can be tapped individually or collectively. Over- or underutilization of resources within the system can negatively or positively impact the entire system, or Army unit. Likewise, COR theory holds that failure to allow resource regeneration within the system will overtax the system and result in adverse outcomes. These theories offer a promising perspective to advance our understanding of unit resilience. ARI, with contracted support, is using this literature-based, theory-informed definition of unit resilience to help inform the development and future validation of a unit resilience measure appropriate for use in the Army. Unit resilience strategies should be developed to help Army units better prepare for, respond to, and recover from adverse or challenging events. Such strategies should focus on individual and collective skill building within the unit along with determining appropriate and timely resource allocation. A unit resilience approach that includes risk assessment and management For military populations such as the Army, articulating what risk and resilience are, as well as how each manifest, is important. Risk is an inherent part of most Soldiers’ experiences in the Army. Risks that Soldiers face both individually and collectively include a multitude of stressors or challenges in garrison and during deployment, such as repeated deployments, family separation, or loss of life or limb during peacekeeping missions or other operations. Some argue that risk and resilience are indeed different constructs (Linkov et al., 2018). However, based upon a previous literature review (Cato et al., 2018) across multiple collective types of resilience, we propose that unit resilience must focus in some part on potential risks that units face as well as various skills, abilities, and resources which enable the unit to prepare, respond (via absorbing, adapting, or flexing), and recover in the face of adverse events or significant challenges. Risks can impact the overall resilience of units. The risks or stressors that Army units face can impede the units’ ability to respond rapidly or even recognize a need to respond, can limit the units’ ability to absorb and withstand the impact of stressors, and can result in an overall failure to adapt or respond, which can ultimately impede or limit post-event thriving and learning from adverse events or prevent recovery altogether. Even the most prepared unit may fail to respond and adapt when resources are depleted. Focusing on mitigating risks can potentially allow units to maintain an awareness about what resources need replenishing and when, which is likely to enable resilient responding. Understanding which risk assessment and management options are relevant is also an important characteristic of unit resilience. Within the Army, risk is defined “as probability and severity of loss linked to hazards…[and] the measure of the expected loss from a given hazard or group of hazards, usually estimated as the combination of the likelihood (probability) and consequences (severity) of the loss” (Headquarters, Department of the Army [Army], 2014, p. 4). The Army’s risk management approach is intended to assist individuals, leaders, and Army units in making informed decisions to reduce or offset risk, and ultimately influence mission success. The Army proposes a 5-step approach to engage in risk management, where steps one and two include identifying and assessing potential impacts of the hazards (assessment) and steps three through five include developing controls and making decisions, implementing controls, and supervising and evaluating the implementation and outcomes (management) (Army, 2014, p. 3-4). Leveraging and incorporating existing Army risk assessment and management principles and techniques as part of the unit resilience process can help clarify the relationship between these two constructs and ways in which the preparatory phase of unit resilience can be measured. Based upon our literature review (Cato et al., 2018) and other work by the Homeland Security Studies & Analysis Institute (Kahan et al., 2010), we adopt an approach which views risk assessment and management as a means to help understand unit resilience and its measurement (see Figure 1). Figure 1: Unit Resilience Phases across Time and Functioning Adapted from figures that depict resilience processes and profiles across various disciplines (Carver, 1998; Kahan, Allen & George, 2009; Linnenluecke & Griffiths, 2012; O’Leary & Ickovics, 1995) Assessing and managing risk involves understanding the probability (frequency) of risks occurring and the expected severity (consequences) of those risks. Per DA PAM 385-30 (Army, 2014), the Army assesses probability of risk occurrence across five categories: . Frequent (continuous/inevitable) . Likely (several occurrences) . Occasional (intermittent occurrences) . Seldom (infrequent occurrence) . Unlikely (improbable occurrence) Likewise, risk severity is assessed across four categories: . Catastrophic (death, unacceptable loss/damage, mission failure) . Critical (severe injury or damage, severe degradation of mission capability) . Moderate (minor injury or damage, minor degradation of mission capability) . Negligible (minimal injury or damage, little or no impact on mission capability Based on the challenges Army units face, it is meaningful to focus on the interactions between probability and severity of potential adverse events/hazards that produce “high” or “extremely high risks.” For example, high/extremely high risks events are those that are expected to be frequent coupled with severe consequences that threaten mission success. Risk assessment and management are essential to, and embedded within, the unit resilience process and both are integral in improving the likelihood of mission success. Within our unit resilience framework proposed herein, and indicated previously, risk assessment and management occur pre-event or during Phase 1 (Prepare). This phase involves identifying, anticipating, planning and routinely monitoring conditions to pre- emptively minimize hazards or threats (see DA Pam 385-30, Army 2014, p. 3). Unit resilience Phases 2 and 3 focus on responding to an adverse event (during the event) and recovering from the event (post-event). Within these additional phases of the unit resilience process, there are vital factors that influence the ability of a unit to confront acute and chronic stressors impacting mission success. For instance, the responding phase includes withstanding and absorbing the shock, adapting, adjusting, and flexing, whereas the recovery phase includes growing, thriving, and post-event learning. Army units might benefit more from using resilience-based approaches rather than risk-based approaches when specific risks are unknown or unexpected. Increasingly, threats and risks are pervasive issues Army units face. During deployments, it may be impossible to know all of the critical threats that a unit should prepare for, make attempts to avoid, or eliminate, given the nature of the unit’s mission. A resilience-based approach would allow Army units to focus on general resilience building skills that could then be applied when needed to various situations, particularly those with low probability but extreme impacts. Training Army units to be able to better withstand and absorb impacts, adjust, and flex under uncertainty will likely improve the unit’s ability to recover rapidly, improving the units’ overall performance and unit readiness. Utilization solely on risk-based approaches would be preferred only when events are known with critical to catastrophic impacts. Determining whether to utilize risk management or resilience strategies requires consideration of various metrics. Monetary cost is often one the most important metrics an organization must consider. Utilizing general resilience-building strategies might be more cost-effective than risk management-focused strategies. The latter requires resources focused on the identification, evaluation, prioritization, and planning to address a variety of specific known, anticipated threats. While it is generally possible to identify critical threats that organizations typically face, it might prove to be more challenging to do so in a military setting, given that a number of challenges Soldiers and Army units face in theatre are unpredictable and sometimes unknown. Resilience-based strategies can be used in garrison and during deployment, and can be aimed at addressing both the most critical known threats and general unknown threats or risks. These resilience strategies provide a more holistic approach and could enable resilient responding and quicker recovery regardless of the risk level. Research is needed to better understand and measure the comparative return on investment from investing in resilience-building strategies instead of or in addition to risk management strategies. Unit resilience is worth the risk Resilience-building might be associated with certain drawbacks or moral hazard (i.e., when individuals or an Army unit intentionally take on risks knowing that others will bear the negative consequences or impacts). In a military context such as the Army, risks inherently abound. In a variety of situations, Soldiers and Army units can do little to completely avoid such events, despite being faced with critical risks such as loss of limb or life. Resilience-building could result in several expected outcomes. Ideally, one potential outcome could be that Army units build resilience and learn to anticipate risks, respond appropriately, and recover more quickly using existing or newly garnered resources, as well as learn from their experiences. Using a resilience strategy, Soldiers would be able to better prepare for critical expected risks (and unknown risks), practice appropriate responses, develop and hone required skills and abilities, and garner resources to be ready to respond when exposed to inevitable, dangerous and adverse events. Such preparation does not necessitate incentivized risk taking, it merely means that units are potentially equipped with tools to appropriately respond should the need arise. Another potential outcome, and possible drawback, is that resilience-building could potentially bolster a units’ overall confidence in their ability to handle adverse events to the point that units become overconfident, taking on risks that exceed the units’ abilities and result in harm or depleted resources. Lastly, Army units may be required to engage in resilience-building skills directed by policy or processes, which could result in Army leaders believing that units that demonstrate resilience or are expected to be resilient should be tasked to take on more or longer deployments, have shorter demobilization periods, or be assigned to more dangerous locations.
Resilience in the context of systemic risks: Perspectives from IRGC’s guidelines for the governance of systemic risks	Florin & Trump	Resilience in the Context of Systemic Risks: Perspectives from IRGC's Guidelines for the Governance of Systemic Risks Marie-Valentine Florini* and Benjamin D. Trumpii i International Risk Governance Center (IRGC), École Polytechnique Fédérale de Lausanne (EPFL), Switzerland ii ORISE Fellow, United States Army Corps of Engineers, USA Suggested citation: Florin, M.-V. & Trump, B. D. (2018). Resilience in the context of systemic risks: Perspectives from IRGC's guidelines for the governance of systemic risks. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Systemic risk, transition, adaptation, transformation, insurance *Corresponding author: marie-valentine.florin@epfl.ch Introduction This piece discusses resilience in the context of systemic risks and complex adaptive systems. Systemic risks are an increasingly common threat to many interconnected systems worldwide, from cybersecurity, critical infrastructure to environmental sustainability. Building from IRGC’s recommendation regarding the governance of systemic risks, we describe how resilience strategies can support efforts towards helping systems navigate transitions, including cases of adaptation or transformation (IRGC, 2018). We also briefly use the case of insurance to illustrate the articulation of risk- and resilience-based perspectives and the drawback of resilience. Both theoretically and mathematically, resilience is a function of systems and their interaction. More explicitly, resilience is a property, a capacity, and a dynamic process by which a system is able to address disruptions to its core functionality, either at the micro or macro-scale. Dynamic systems are constantly incorporating new information and new practices into their core function and identity at various levels. These ideas define the backbone of complex adaptive systems, whereby systems influence and are influenced by other systems, sub-systems, and broader environmental conditions. Major shocks and disruptions materialise as the result of systemic risks cascading within and between complex adaptive systems and are often unexpected prior to their arrival. This cascading effect is perhaps one of the more complex and unpredictable components of systemic risk and is particularly dangerous in an environment of increasing system interdependency and connectivity (e.g., the global financial system, industrial agriculture and fishing, digital information systems, etc.). A resilience-based approach helps key stakeholders combat the negative consequences of systemic risk by preparing a system for an uncertain future of direct or cascading threats, and by enabling that system to recover from even those disturbances that threaten system collapse. A critical component which defines complex adaptive systems is the interconnectivity within and between systems. Such interconnectivity is often driven by convenience or for the sake of efficiency – i.e., it is easier to rely upon a public utility for water and power of a building rather than acquiring and managing that resource oneself. For most modern businesses, interconnectivity is often framed as normatively positive, whereby an interconnected organization can develop more advanced services or goods to larger customer bases in faster, cheaper, and more effective ways. Such interconnectivity is made possible through digitalisation and the reliance on the Internet for data transactions, as well as globalized economic and supply chain practices, among others. But what are the potential costs of such interconnectivity? While interconnectivity can increase the efficiency of a system to deliver critical services, it can also increase exposure to risks from external sources. If connections between important nodes are too tight, interconnectivity may expose the various layered systems to risks of sudden external shocks and unsustainable stresses. This may take the form of slow-moving and imperceptible changes that go largely unnoticed with the lay public but can ultimately drive the system beyond a tipping point, resulting in cascading changes in the system itself and other interconnected systems. Striving for organizational efficiency usually comes at the cost of reduced redundancy. Many business practices, such as lean manufacturing, often frame redundancy as a negative organizational trait that bloats costs. However, organizations with limited redundancy or buffer capacity to quickly recover and reorganize are at the greatest risk of collapse from systemic threat. Thinking in terms of resilience in contrast to efficiency implies fostering policies and management that reduce the duration and depth of shocks, enhance the capacity to recover quickly and reduce the severity of the impact on welfare (Connelly, et al., 2017). Complex adaptive systems can alternate between different stable states or regimes, provided that their base resource and operating requirements are relatively stable. From a socio-ecological perspective, rich grasslands can become increasingly arid and encounter desertification under certain environmental conditions, if a threshold (tipping point) was crossed. Systems are constantly in flux and incorporate new information in a deliberate or unintentional manner. Such transitions between regimes are natural processes and foster adaptation from one steady state into another. Resilient and sustainable systems are better placed than rigid, non-evolutive and non-sustainable systems, when they are confronted with cascading consequences of systemic risks. Articulating risk and resilience The IRGC is institutionally focused upon addressing risk, which may be understood as the negative consequences stemming from uncertainty within a given activity or objective and their associated values. In most contexts, risks may be best addressed through processes of risk assessment and risk management – both fundamental components of risk governance, and tested tools for regulators across the globe. However, traditional risk assessment methodologies, especially those based on linear or well-established cause-and-effect-relationships, cannot be successfully applied to risks that develop in complex adaptive systems and may even have counter-intuitive and unintended consequences. A better understanding of systemic risks and an appropriate approach for developing management options is thus essential for decision-makers to prepare their organisation for future challenges. For example, the OECD recommends that governments should seek to address critical risks, strengthen resilience to avoid being negatively affected by cascading failures, and create capacity for improved agility in case unexpected shocks and disruptions happen (OECD, 2011; 2014a; 2014b; Linkov, et al., 2014). Resilience serves as a more helpful alternative philosophy and methodology to analyse complex adaptive systems and systemic risks, which are difficult to analyse via conventional risk assessment methodologies. Many modern systems would benefit from a resilience-based approach, particularly for systems with inherent nested interdependencies with others, or those which are prone to low- probability, high-consequence events that are difficult to accurately predict or model. Resilience helps these systems prepare for disruptions, cope with and recover from them if they occur, and adapt to new context conditions (National Academy of Sciences (NAS), 2012; Linkov & Trump, 2019). Insurance provides a useful illustration of this. From an insurance point of view, the limitations of standard risk-based approaches are visible and increasingly problematic. The insurance sector is increasingly facing challenges such as accumulation, which go beyond traditional risk analysis and require resilience analysis. Risk management and risk transfer have always been the basic instrument of the insurance industry; but in the light of changes in the global risk landscape and the increased importance of systemic risks, conventional risk management approaches reach their limits. Resilience as an approach to deal with shocks and uncertainty appears a promising way forward and should become more important in the future of insurance, provided it can be measurable. However, investments in resilience are difficult to valorise, because it is difficult to align high present-day expenses and potential future advantages. On-going work to develop or refine indicators, tools, and quantitative/qualitative approaches to inform system resilience should help characterise and quantify the benefits of investments in resilience (Cutter, Burton, & Emrich, 2010; Hosseini, Barker, & Ramirez-Marquex, 2016). At a high-level, this is what insurance is meant to do with risk-based insurance premiums that can turn such potential future advantages into immediate premium discounts. Insurance can encourage investments in risk mitigation through financial incentives (e.g., premium discounts) and risk information (e.g., communicated risk assessments (Kousky & Shabman, 2016)). A relevant question for those who develop insurance products and resilience managers is the extent to which insurance can incentivize investments in resilience and make the cost of resilience competitive with the costs of risk-based measures. Answering this question will elaborate on the two properties of insurance: to mutualise costs and benefits across policyholders (space dimension), and to distribute over time the cost of risks (time dimension) (IRGC, 2019). Drawbacks of resilience - How a resilience-based focus might lead to unintended challenges Resilience-based approaches, while helpful in promoting expeditious recovery for normatively beneficial systems, can engender infrastructural or cognitive drawbacks that must be carefully guarded against. When system appetite or acceptance of risk is unacceptably high, or when individuals, communities or businesses believe that, if a catastrophe happens, someone else (often the government) will jump in to help recover and rebuild any lost assets or system functions, such resilience-based approaches foster an environment amenable to moral hazard. More simply, resilience may perversely lead to more risky behaviour in a belief that any and all disruptions can be quickly addressed and overcome with minimal losses. For example, when the government provides insurance to buildings destroyed by natural hazards such as flood or earthquake, even in areas that are known as exposed, homeowners and businesses may have less incentive to relocate to less hazard-prone areas. In that sense, the promotion of a resilience-based strategy can generate quick recovery from certain types of disruption but generate cognitive and social responses that are highly undesirable and likely to have recurring financial, infrastructural, and human losses. Such arrangements are particularly problematic when short-term gains are given significantly higher value than longer-term losses, fostering an environment that is less capable of preparing for future systemic challenges (Grossi, Kunreuther, & Windeler, 2005). In broad terms, moral hazard occurs when someone increases their exposure to risk, or willingness to take risk, because someone else bears the cost of that risk. Resilience may indirectly increase risk exposure and/or inhibit learning from a small manifestation of that risk, thus diverting attention from weak signals that may become stronger and thus stifle system solutions. Here also, insurance provides a useful illustration. Analysing how insurance and resilience work together can provide interesting insights into possible drawbacks of resilience, and into how insurance can contribute to reducing the risk of drawback. On the one hand, insurance can reduce incentives to risk management and resilience building by creating moral hazard and a false feeling of security. Insurance can reduce incentives to those who manage physical safety and security of insured assets. This has always been a problem in risk transfer solutions. The moral hazard needs to be addressed through the design of the insurance contract, in a way that there should be no incentive for policyholders to create a loss. For example, coverage limits or conditional coverage can provide such incentives. Conversely, resilience can reduce the perceived need for insurance. On the other hand, insurance can increase incentives for improving resilience, if insurance premiums are revised depending on the depth of disruption and speed of recovery after an insured risk event. Insurance can improve resilience by providing the financial resources to recover, rebuild and adapt (as insurance will require rebuilding in a way that intrinsic susceptibility to risk will be lower than before the risk event). Likewise, resilience can improve insurability or reduce the cost of insurance, for example by defining factors of insurance cost reduction based on tangible resilience indicators (IRGC, 2019). Can resilience be designed for transition, adaptation or transformation? In the context of systemic risks, considering resilience to cope with, navigate or steer possible transitions that come with change is worth some attention. Organisations must develop capabilities to adjust and adapt to uncertainty, rather than to inherently resist change. A traditional response to a specific threat is to harden a system to better withstand and absorb said threat – this works well when such threats are well characterized and understood. However, when threats are more uncertain, or the affected systems more complex and difficult to model, greater emphasis upon modularity and redundancy can afford greater system capacity to transition towards a more normatively positive resilient state. Resilience-based approaches for complex adaptive systems enhance the system’s capacity to absorb disturbances and re-organise system functions and characteristics in order to essentially retain the same system mission and purpose to deliver a specific set of services. For example, when a city with large and important assets is prone to flooding through sea level rise and storm surge, re-organising land-use and creating floodplains around that city can 'absorb' the risk of flooding and subsequent disturbances. This would be in contrast to building dykes to prevent the flood from entering the city. The city and its surroundings would be adapted or even transformed through resilience building. IRGC's Guidelines for the Governance of Systemic Risks place resilience as a tool to better understand and prepare complex adaptive systems to systemic risks. These systems adapt dynamically to internal and external changes, and resilience is well-placed to help a system adapt. Resilient social-ecological systems try to absorb shocks so that the crossing of a dangerous threshold is avoided. However, an organisation or system can deliberately engage in the process of change (transition) to adapt to change and, if needed, transform itself. In that case, the question is (a) whether resilience can be designed to steer, or drive a fully transformative process, which may be required in the face of transitions to fundamentally different regimes or systems, or (b) if a resilient system cannot do more than small adaptation. The capacity to fundamentally transform a system may be beyond what conventional strategies for resilience can achieve. But in either case, resilience can help deal with the specific disruptions that result from the transformation process, especially when transformation creates losers that must be compensated. Key terms and definitions related to systemic risks (IRGC, 2018) Persistence involves absorbing on-going change or risk. It may also correspond to a non-vital degradation of the system as it absorbs such risk. Persistence can be thought of as the capacity of a system to exhibit low vulnerability to risk or provide a good level of resistance to risk. For example, persistent ecosystems can provide a steady supply of valued ecosystem services, but over the long term, this may require adaptation and possibly transformation at other scales. Transition is the process or period of changing from one state or condition to another (Oxford Dictionary, n.d.). It is seen as a fluent change towards a new future, which is an improved version of what exists; it is a “gradual, continuous process of societal change, changing the character of society (or a complex part) structurally” (Rotmans, van Asselt, Geels, Verbong, & Molendijk, 2000). A dynamic phase between two stable phases enables the system to shift from a first context to a new, stronger one. Crises are often needed to make such changes happen. In a condensed form, the EEA defines transitions as “long-term, multi-dimensional and fundamental processes of change, based on profound changes in dominant practices, policies, and thinking” (EEA, 2016). Adaptation is the action or process of adapting or being adapted to something. It involves adjusting responses to changing external drivers and internal processes to remain in a necessary or a desired regime and on the current pathway. Adaptation is achieved through incremental change. It is seen as a slow process, which modifies the landscape only slightly. Transformation is a thorough or dramatic change in form or appearance. It involves fundamentally changing the system dynamics, so there are new feedbacks to maintain the system in a new regime or along a new pathway (Renn, 2017). It is a change towards a future that is fundamentally different from the existing paradigm (Roggema, 2012). In the case of the resilience of the global social- ecological system, transformability for sustainability is about shifting into new pathways of development (Folke, Biggs, Norström, Reyers, & Rockström, 2016). Resilience includes sustaining what we want to keep the same (i.e., persist). Adaptability can also be part of resilience because it represents the capacity to learn and adjust responses to changing drivers. “The very dynamics between periods of abrupt and gradual change and the capacity to adapt and transform for persistence are at the core of the resilience of social-ecological systems” (Folke, et al., 2010). IRGC's Guidelines for the Governance of Systemic Risks suggest that strategies should create supporting conditions to: . Reduce the exposure of the system and its vulnerability to various shocks and stresses . Collaborate with others at the periphery of the system. Multi-stakeholder partnerships and value-chain analysis can provide incentives to those actors who contribute to reducing systemic risks by adding diversity, modularity or other components of resilience, in such a way that the value chain can be more adaptive and able to re-organise if needed . Prepare proactive measures to adapt or transform the system, should a fundamental change occur . Consider planned adaptive governance . Prepare for when a window of opportunity opens, which will make possible the implementation of a strategy to adapt or transform the system or organisation. These supporting conditions can participate in the effective deployment of various types of approaches to the management of systemic risks. In the face of many unknowns, increasing the overall resilience of an organisation can be a way to prepare for and better deal with the shocks and stresses arising from those systemic risk. In line with mainstream recommendations for resilience- building (Hollnagel, Woods, & Leveson, 2006), IRGC therefore proposes three main strategic approaches: . Supporting and strengthening the ability of a system to self-organise and self-control, which is a property of resilient or sustainable systems. When biological systems engage in ‘self- healing’ in order to overcome disruptions to biological processes, they use a critical component of system resilience, whereby such systems can better recover from and adapt to threats and disruptions from various sources. . Engaging in proactive intervention strategies: prevention, adaptation, mitigation or transformation. The most radical intervention, transformation, is based on the logic that there is a window of opportunity to catalyse a positive regime shift and let the system evolve on new or improved trajectories. It typically involves initiating changes at lower scales while maintaining the resilience of the system at higher scales as the transformation proceeds, until the feedbacks in the new stability domain are sufficiently established. An example is the energy transition in Germany or the transformation to a circular economy (Centre for European Policy Studies (CEPS), 2017). . Preparing for disruptions, accidents and crises, which requires thinking in terms of resilience. There are three ways to frame resilience as a mechanism to facilitate system adaptation and transformation, and whether it can assist key stakeholders to steer a system transition towards a more favorable direction: . Say that adaptive systems will by definition adapt and resilience will help them recover from shocks while transitioning to a new state that is better adapted when context conditions change. Resilience is conceived over the long term and fits well as a concept with dealing with changes in system performance and their capacity to absorb shocks (Hollnagel, Woods, & Leveson, 2006). Resilience strategies have the potential to deeply change how an organisation prepares for the possible disruptions of key services on which it relies. When organisations prepare for recovery from external shocks of a significant magnitude, resilience strategies must be considered (Linkov, et al., 2014). Example: resilience of Walmart supermarkets after Hurricane Katrina (Zimmerman & Bauerlein, 2005), (Horwitz, 2009). . Say that resilience can or must promote adaptation of the system. This can be a discourse and an attitude of managers who are convinced that such a statement will force dynamic resilience to pursue a normative goal, such as adaptation to a new, preferable order. Example: change in agricultural practices to adapt to climate change. . Say that resilience must promote transformation towards sustainability or fundamentally changed conditions. This discourse must be accompanied with adequate leadership and authority to steer the transition to transformation. Examples: transformation of the energy system to avoid future shocks and disruptions; transformation to circular economies. Bresch, Berghuijs and Kupers (2014) summarise scholarly literature and describe nine lenses of resilience, among which "transformative resilience" requires systems to review changes over extended time horizons. This type of resilience enables an organisation to transform itself if the fundamental conditions of its survival have changed. Such change can take many shapes, such as the need to reduce exposure to systemic risk via reduced interconnectivity and feedback loops with other systems, or the creation of redundancies and reserve capacities to quickly address such shocks as they arise. Transformative resilience is based on various factors that can help address systemic risks in a responsible and thorough manner. These include (a) distributed governance, (b) foresight and anticipatory measures, and (c) innovation and experimentation. Collectively, these factors support strategies to anticipate and respond proactively to changes in the systems in which a company or an organisation is embedded with dynamic reorganisation, restructuration, and reinvention. Distributed governance is management undertaken from multiple centres of authority, with trust and effective communication between stakeholders and the capacity to develop and use measures of anticipating systemic risks. Foresight refers to the capacity of individuals and organisations to engage with uncertainty and anticipate the potential outcomes and the future state of the system in which they operate. Foresight is an effort undertaken by various stakeholders to both understand emerging trends regarding systemic behaviour and potential for disruption, as well as futuristic threats that may arise to disrupt a system in the years to come. Innovation and experimentation involve efforts to identify new strategies of system formation and operation, and to review the efficacy of such innovative proposals through modelling or small-scale implementation. Innovation often starts at the frontiers of a system, sometimes as alternative solutions to existing problems. While innovation frequently represents a threat to incumbents and existing practices, and is therefore often purposely ignored, it nevertheless represents opportunities to steer change, adaptation and transformation. Small-scale experimentation and modelling exercises provide the ability to simulate how a system behaves under stress, and how transitions to a system can allow it to perform more optimally in response to such systemic risks in the future. Conclusion Resilience is a key feature of complex adaptive systems when those are affected by transitions, which require adaptation and transformation. It can provide confidence to managers of such transitions that negative consequences from systemic risks, particularly those cascading within and between systems, will be addressed by the intrinsic and dynamic ability of that system to recover and adapt. What is less easy to figure out is how those managers can leverage transformative resilience to produce actual transformations of the system, when such transformation is deemed necessary. Systemic risks will become a regular threat to modern life. Increasing layers of interdependence between important yet fragile infrastructural, environmental, cyber, and social systems will generate situations where disruption may threaten severe limitations in how many basic services and modern conveniences are able to operate. Further, as interconnectivity becomes increasingly widespread across the globe, the number and scale of systemic threats will likewise only grow in number, complexity, and frequency. Though we cannot fully prevent systemic threats and risks from arising, resilience-based approaches might help policymakers and key stakeholders in system management better navigate the process of disruptions. By adopting a scientifically grounded systems approach, and accounting for potential unintended drawbacks of a resilience-based approach, an emphasis upon system recovery and adaptation may help many segments of our complex adaptive society better prepare for the threats to come.
Resilience analysis of urban critical infrastructure: A human-centred view of resilience	Furuta & Kanno	Resilience Analysis of Urban Critical Infrastructure: A human-Centred View of Resilience Kazuo Furutai* and Taro Kannoi i School of Engineering, The University of Tokyo Suggested citation: Furuta, K., & Kanno, T. (2018). Resilience analysis of urban critical infrastructure: A human- centred view of resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Critical infrastructure, interdependency, system of systems, human-centred view *Corresponding author: furuta@rerc.t.u-tokyo.ac.jp Introduction The Great East Japan Earthquake and the disaster at Fukushima-Daiichi Nuclear Power Plant in 2011 were events that caused many people to attend to resilience in Japan. After the disaster in 2011, the National Resilience Promotion Office was established in the Cabinet Office in 2013, and the Basic Act for National Resilience (Cabinet Secretariat, 2013) was enacted in the same year. Following the Basic Act for National Resilience, the Fundamental Plans for National Resilience both for the central government and for local governments were established and will be revised periodically. People have recognized that more comprehensive approaches than the conventional ones for disaster prevention are required in order to be prepared for unanticipated situations, like those experienced in 2011. In particular, resilience of urban critical infrastructure is a critical issue for saving lives in a crisis. After the Great East Japan Earthquake, industry and civic life were severely disrupted not only in the damaged area of Tohoku district but also in the metropolitan area of Tokyo. Many power generating plants were damaged, causing shut down, and a planned blackout was enforced in the metropolitan area of Tokyo, lasting for about a week. In the damaged area of Tohoku district, it took more than a month to recover the lifelines and recovery of local communities is still under way. Resilience has been defined and used as a technical term in various areas, but from a viewpoint of systems safety it stands for capabilities of a socio-technical system to absorb internal as well as external threats and to maintain its functionality (Hollnagel, Woods, & Leveson, 2006). It is a concept derived following great efforts around how to attain the safety of complex socio-technical systems that consist of hardware, human, organizational components, and interactions between them. Risk-based and resilience-based safety design In the conventional approach of safety design, the system is designed to achieve some design basis derived from a particular presumed threat scenario. The design basis is determined so that the risk that the actual system status may go beyond the design basis and then cause losses to the society will be kept below the allowable limit. It is assumed that the risk can be evaluated empirically as a combination of the scale and the probability of expected losses. The residual risk below the allowable limit is often neglected and retained in the system. Resilience sheds light to this residual risk neglected in the risk-based approach of safety design, and it can be seen as an extension of the risk-based approach. Resilience therefore complements rather than replaces the risk-based approach. Resilience includes not only the preventive measures of disaster but also the responses to unfavourable outcomes of disaster. The recovery speed of system functionality is therefore discussed very often in the resilience literature and the resilience triangle is a useful measure for quantitatively representing the degree of system resilience. The recovery speed, however, is not the only measure that is relevant to resilience. Recovery cost, for instance, is sometimes considered in the assessment of system resilience. In our study on the resilience of urban critical infrastructure, the amount of recovery efforts is used in addition to the recovery speed as a resilience measure. In the Infrastructure Resilience Analysis Methodology (Biringer, Vugrin, & Warren, 2013), the resilience measure is composed of Targeted System Performance (TSP), System Impact (SI), and Total Recovery Effort (TRE). We adopted this methodology for assessing the resilience of a telecommunication network after disaster. In this assessment, we defined TSP as the design capacity of the telecommunication lines without any damage, SI as the degradation from TSP represented as the call loss rate, and TRE as the social utility loss caused by traffic regulation. Other system characteristics are also useful for quantitatively representing the system resilience. We adopted the R4 framework of resilience, where resilience is represented in terms of four aspects of robustness, redundancy, resourcefulness, and rapidity (Bruneau, et al., 2003), in the sensitivity analysis for model validation. Which measures are useful depends on the purpose of analysis. Human-centred view of resilience When discussing the resilience of critical infrastructure, recovery of hardware facilities and components are focussed on from the standpoint of infrastructure operators. We should, however, focus more on the standpoint of end users. Resilience for whom is a key question to be asked, and recovery of civic life that depends on critical infrastructure should be the final goal. Since civic life is the basis that provides workers of the infrastructure industry, infrastructure operation and its recovery heavily depend on the civic life system. Civic life also depends on various industries and services other than infrastructure business. Medical, financial, and administrative services are, in particular, of critical importance after disaster. These industries and businesses are interconnected through a supply chain or a service chain and these chains depend on the operation of infrastructure. It is remarkable that some industries were halted due to disrupted supply chains after the Great East Japan Earthquake and the flooding in Thailand in 2011, though the industry locations were removed from the areas of damage. Industries depend in turn on civic life, because people cannot join the workforce if their living conditions have not been recovered. In order to analyze the resilience of urban critical infrastructure in reality, it is necessary to consider not only the lifeline hardware subsystem but also the service subsystem and the civic life subsystem for introducing a human-centred view. There are multiple interdependencies between these three subsystems, and they form a very complex system of systems as shown in Figure 1. Additionally, in our evaluation model of critical infrastructure resilience (Kanno & Furuta, 2012), the objective function for recovery planning includes not only the recovery level of lifeline capacity but also the recovery level of service activities and the satisfaction level of citizens. The satisfaction level of citizens is evaluated by scoring the everyday activities that are possible under the recovery condition of lifeline and services. The recovery cost, which is measured by the travel distance of recovery teams and the time required for recovery, is also minimized in recovery planning. The tasks for providing service and repairing damaged infrastructure are modelled by the PCANS model (Krackhardt & Carley, 1998). The supply chains among the agents in the service subsystem are also considered. This framework enables us to assess the resilience of critical infrastructure considering the above-mentioned human-centred view. Figure 1: Model of multiple lifeline systems In some cases, stakeholders of different characteristics have to be distinguished in greater detail. Since people of different characteristics will have different senses of value, the same system in the same situation may have different value for them. This issue was demonstrated by a trial evaluation of the resilience triangle of lifelines after the Great East Japan Earthquake using the Maslow hierarchical model of human needs and the persona method (Furuta, 2014). In this trial, the resilience triangle was evaluated for three personas of different characteristics living at the same location and it was shown that the satisfaction levels of physiological, safety, and social needs differ. This is because, for example, recovery of healthcare service is more critical for physiological needs of an elder person with a health problem than a young person of a working age. On the other hand, recovery of the public transportation is important for social (economic) needs of a young person who is commuting to his/her working place. This issue may cause conflicts of interest between different stakeholders and become a downside of resilience. Consensus should therefore be formed by compromising the conflicting interests, though this would not be a trivial process. Since it is not an issue just with resilience but also with the risk- based approach, we need some effective method for fair as well as rational social decision-making. Resilience analysis of critical infrastructure in Tokyo We have developed a simulation system for resilience analysis of urban critical infrastructure based on the comprehensive framework shown in Figure 1. The lifeline, service, and civic life subsystem are represented as interdependent coupled networks (Buldyrev, et al., 2010) and agent-based models. The recovery plan of damaged lifelines can be optimized by the genetic algorithm (GA) by minimizing the resilience triangle of the hybrid objective function already explained. We have also developed a model of critical infrastructure in the central 23-ward area of Tokyo with a 30x30 square grid (Kanno, Yoshida, Koike, & Furuta, 2018). Resilience of urban critical infrastructure is evaluated as recovery curves of lifeline, service, and civic life subsystem obtained by the simulation. An example of an analysis result for a scenario of a Tokyo metropolitan epicentral earthquake is shown in Figure 2, where the recovery level of the lifeline, service, and civic life subsystem are shown in colour maps along the timeline of days after the event. The damage level of lifeline just after the earthquake depends heavily on the location of the epicentre and the predicted seismic intensity. It is suggested from the result that recovery of the downtown area, where the headquarter functions of the government and principal industries are concentrated, is prioritized so that the recovery plan can be optimized. The proposed analysis method was useful for predicting the time- and space-dependent response of urban critical infrastructure after disaster and for evaluating its resilience. This analysis then can provide us with valuable insights for making proposals for improving the emergency response policy of both public and private organizations. The operation companies of the lifeline facilities can, for instance, identify bottlenecks in the lifeline subsystem and eliminate them by redesigning the lifeline facilities. The national and local governments can improve their disaster response plans such as the location of emergency supply bases. Since the proposed model considers not only the lifeline subsystem but also the service and civic life subsystem, the analysis will also be useful for urban planning, so that the critical urban infrastructure, which is a complex system of systems, can be made resilient against threats of various types and adaptive under environmental and social transitions in the long term. Figure 2: Resilience map of the 23-ward area after Tokyo metropolitan epicentral earthquake
Robustness and reconfigurability – Key concepts to build resilience	Heinimann	Robustness and Reconfigurability – Key Concepts to Build Resilience Hans Rudolf Heinimanni* i Future Resilient Systems, Singapore-ETH Centre, Singapore Suggested citation: Heinimann, H. R. (2018). Robustness and reconfigurability – Key concepts to build resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Robustness, reconfigurability, resilience, organisational mindfulness *Corresponding author: hans.heinimann@frs.ethz.ch Introduction Urbanization is an aggregation process that fosters the emergence of urban clusters where much of the world population resides, and where the magnitude of human activities prevails. Several phenomena characterise this process (Heinimann & Hartfield, 2017), in particular (1) the continuously increasing density of infrastructure assets per unit of area, (2) the flows of goods, services, information and people, borne by layered infrastructure networks that are enabling a different type of flows continue to expand dramatically, and (3) cities of today represent a nascent skeleton of cybernetic organism (cyborg) entities that constitute an interdependent mosaic of advanced infrastructure systems, enabling technologies, green spaces and social systems. Additionally, “smart technology” policies, such as “smart cities”, “smart nation” emerged, adding cyber-components to our physical infrastructure, which will amplify the cyborg trend significantly. A considerable amount of human design and development activities is still relying on certainty assumptions, while risk management – emerging in the 1950s to cope with large-scale impacts technologies in case of failure – introduced a systematic approach to cope with uncertainties. The above trends result in higher levels of complexity, which is going along with emergent behaviour and ambiguous or even unexpected behaviour that we are not able to explain with historical data. Resilience management is extending risk management to cope with ambiguous, unexpected events. This development trend is facing some fundamental challenges. First, expected damages due to disruptions will increase because the value at risk has grown. Second, climate change is changing the uncertainties of environmental states, which will undermine the very assumptions used to design existing interdependent engineering systems. Third, the coupling strength between and within the infrastructure, organisational and user systems continues to grow and may result in regime shifts that foster system disruptions that were never experienced before and that cannot be explained with observational data of the past. Risk management developed methods and tools to assess and manage portfolios of uncertain events (Keller & Modarres, 2005). The underlying assumption is that the process of generating those uncertain events is staying the same in time and that it is possible to characterise both frequency and consequence with the methods of extreme value statistics. Complex systems might demonstrate emerging behaviour and disruptions, which means that the process that this is generating those events is changing in time, which makes the methods of risk management questionable. This calls for a new approach, which is focusing on robustness and resilience. Robustness refers to design characteristics of the system, aiming to provide reliable performance for a set of requirements, despite changes in the environment or within the systems after the system has entered service; it is a strategy to bring uncertainty and ambiguity into the design process. Resilience refers to the: biophysical capacity of a system to resist within acceptable limits of degradation, to re-stabilising is crucial functions, to rebuild functionality up to a sufficient level of performance, and to reconfigure its flows of services and the underlying physical structures. This biophysical capacity is coupled with the cognitive ability to perceive the state of the system and its environment, to understand its significance and meaning, to retrieve purposeful courses of actions, to release the most meaningful action and to learn and to adapt (adapted from Heinimann & Hatfield, 2017). The purpose of this contribution is to provide a framework for how resilience-based management augments traditional risk-based management approaches, and to discuss strategies how to build resilience. It explores first the essence of ambiguous and unexpected system states, triggered by complexity properties, which is the primary rationale why there is a need for resilience-based management. It then explores three strategies that have the potential to build resilience effectively. Beyond risk management – Coping with complexity The quality of available knowledge of infrastructure system behaviour under different endogenous and exogenous conditions is the crucial issue (Figure 1, x-axis). Many engineering approaches, for example those identifying optimal solutions with mathematical methods, rely on certainty assumptions; that is, they assume complete knowledge of the system and the environment. The introduction of uncertainty enables the relaxation of those assumptions with expectation values, which are the product of probability times some metrics of consequences. Probabilistic risk analysis, which is the backbone of risk management since the 1950s is a stream of thinking, which still represents the state-of-the-art (Keller & Modarres, 2005). Further relaxation of what is known is engendered in the concept of ambiguity (Renn & Klinke, 2004), which assumes that there are observations on some phenomena, which proffer several legitimate interpretations of meaning. In air traffic control, ambiguity is termed as "weak signals", and most often, there is no finite interpretation of meaning. There is yet another level of system knowledge, which is characterised by "unexpected" or "unknown". The "dragon king" concept (Sornette, 2009) assumes – and successfully demonstrates – that there are options to anticipate or predict "unknown events" if we have real- time information about the system behaviour with an adequate time granularity (Sornette & Ouillon, 2012). Figure 1: The influence of knowledge domains and a new design and management paradigm on risk. Adapted from (MURRAY et al., 2013). The y-axis of figure 1 presents the expected adverse consequences for the different categories of knowledge and different management strategies for a system. Up to the 1950s, approaches to design and manage infrastructure systems were based on certainty assumptions. With the emergence of probabilistic risk analysis in the 1950s (Keller & Modarres, 2005), risk management approaches – aiming to eliminate or prevent unacceptable risks – improved the overall safety and security of our systems tremendously. Today’s constructed infrastructure systems are more complex and highly connected; these changes have pushed a significant fraction of urban infrastructure systems into the "ambiguous" and "unexpected" knowledge domains, and in turn increased the risk of adverse and ill-defined consequences (upper line, figure 1). Ambiguous and lacking knowledge about a system means that communities, engineers, and governments have to cope with invalid assumptions (Day et al, 2015), either due to unexpected changes in the environment or due to emerging and unforeseen behaviours in critical infrastructure systems (Haimes et al., 2008). Communities must acquire the capacity to ensure infrastructure systems continue to provide critical services and support essential function whenever and wherever invalid assumptions reside (Day et al, 2015). The capacity of a system to cope with invalid assumptions is the hallmark of a resilient system, which unfortunately does not appear in most resilience definitions. Ambiguous or unexpected phenomena that are emerging have their roots in complexity. Complexity comprises phenomena, which emerge from a collection of interaction objects, and the purpose of complexity science is to understand, predict and control such emergent phenomena (Johnson, 2011). It is remarkable that such emerging phenomena arise without the presence of any central controller or coordinator. There are key properties of the system that are required for emergent behaviour (Johnson, 2011): (1) many interacting objects or "agents", (2) memory or "feedback" is affecting the objects' behaviour, (3) objects can adapt their strategies, and (4) the system is "open", which means its interaction with the environment matters. This perspective raises the question in which systems there are properties of complexity. Human factors, in general, are the first source of complexity. Considering that large-scale infrastructure systems are a compound of engineered, organisational and user subsystems yields that all large-scale infrastructure systems are complex and prone to ambiguous and unexpected behaviour, which calls for resilience management. Cyber components are a second source of complexity. The "smart" trend augments many of our infrastructure systems with semi-automatic or automatic control systems, consisting of sensors, controllers and actuators, which together provide feedback, are adaptive and interacting with the environment. The ongoing digitisation is amplifying human adaptability and the spread of cyber- physical-systems (Lee, 2015), which together will increase ambiguous and unexpected system behaviour. Policymakers and practitioners are facing the issue of whether risk management is still a useful approach or whether resilience management should augment it. Risk management is always an appropriate methodology in domains in which adaptive system components are of minor significance, which is right for "mechanistic" processes, such as some natural hazards. Fields in which human factors have been dominating, such as geopolitical, social and financial hazards are calling for a resilience-based management approach. As mentioned above, digitalisation has been amplifying effect on the adaptive behaviour of humans, which will make this request even more critical. Domains in which cyber-physical systems or cyber-physical-human systems are dominating are requesting a resilience-based management approach, too. Strategies to build resilience In the introduction, we defined resilience in terms of generic system functions, consisting of four biophysical functions: (1) resist within acceptable limits of degradation, (2) restabilize the crucial functions, (3) rebuild functionality up to a sufficient level, and (4) reconfigure flows of services and the enabling physical structures. These biological and physical capabilities are coupled with five cognitive functions: (5) perceive the state of the system and its environment, (6) understand its significance and meaning, (7) retrieve purposeful courses of actions, (8) release the most meaningful action, and (9) learn and adapt. Each of those nine functions contributes to resilience, which represents a multi-objective optimisation problem with an efficiency frontier (Pareto frontier), at which no single function can be improved without decreasing the performance of at least one of the other eight functions. Unfortunately, we do not understand the trade-space yet. We hypothesise that three functions have a considerable leverage effect: resist within acceptable limits of degradation (robustness), reconfigurability, and understanding the significance of the system state and its environment (sense-making). Robustness is a pre-event strategy to identify system designs that perform well when facing variations in conditions of use, with time and use, and in production and manufacturing, whereas variations mean deviations from design assumptions (Saleh et al., 2003). Robust optimisation proved to be useful to identify optimal courses of action for the protection and the extension of large infrastructure systems (Caunhye & Cardin, 2017; Costa et al., 2018; Rahmat et al., 2017). However, it has not been widely used by policymakers and practitioners. Reconfigurability is a post-event strategy to repeatedly change and rearrange the components of a system cost-effectively, thus attaining different states with new or modified capabilities, over time (Setchi & Lagos, 2004). The concept has its origin in reconfigurable computing of the 1960s, appearing in reconfigurable robotics in the 1980s, and spreading to reconfigurable manufacturing systems in the 1990s. To our knowledge, there is no significant research on reconfigurability of infrastructure systems, which calls for a new research thrust to be developed. Of course, some of the fundamental concepts, such as modularity, integrability, or convertibility seem to have significant potential. Many resilience papers have been highlighting the role of adaptability, which – in its narrow sense – means to move limit state thresholds without fundamental structural change. Thus, this strategy is less effective than reconfigurability. Mindfulness sense-making is a during-event organisational process, aiming to stay attentive to what is going on in the present (mindfulness refers to staying in the present) and to create a meaningful group-mental model that is useful to identify and to release useful courses of action (Weick et al., 2008). For a long time, research in organisational behaviour has been focusing on decision-making, thus neglecting what has to happen before, problem framing (Simon et al., 1986). It is problematic and even misleading to map ambiguous and uncertain events to predefined mindsets and assumptions, which bears high risk to result in wrong assessments of the situation and ineffective actions. Weick (1993) started his research on mindfulness with so-called "Mann Gulch Forest Fire", in which 13 firefighters lost their lives due to a wrong sense-making. Research is still at an early stage, but it seems that organizational processes matter (Sutcliffe, 2018), in particular (1) staying engaged with changing physical realities of the internal and external environments, (2) communicating and coordinating, (3) meaning management, dealing with the meaning of people's experiences, and (4) connection management to collectively bear the burden of adversity. Previous considerations implicate that building resilience has a positive effect. The question is how resilience affects the risks of a system of interest. Building robustness significantly reduces the vulnerability of the system, and consequently, adverse events will result in lower consequences. Modifying a system for reconfigurability reduces the rehabilitation efforts, which equals a reduction in the cost of consequences. Overall, building resilience will result in a risk reduction (see resilience gain in figure 1), which emphasises that resilience-based is augmenting risk-based management strategies. Another question is if a transition of a system from a pre-event to a post-event state can be actively managed. Managing disasters stems from organisational capacity and processes, which means that there is some guiding idea how the rehabilitated system should look like that is driving the disaster management activities. Experience yields that organisational capacities, processes and culture have a significant effect how a society or societal group is managing a disruption cycle, starting with a shock, going on to restabilization of critical functions, and ideally resulting in the reconfiguration of the flow of essential services and their enabling physical structures.
Resilience of systems to individual risk and systemic risk	Hochrainer-Stigler, Boza, Colon, Poledna, Rovenskaya & Dieckmann	Resilience of Systems to Individual Risk and Systemic Risk Stefan Hochrainer-Stigleri, Gergely Bozai,ii, Célian Coloni,iii, Sebastian Polednai,iv, Elena Rovenskayai,v, and Ulf Dieckmanni* i International Institute for Applied Systems Analysis (IIASA), Laxenburg, Austria ii Evolutionary Systems Research Group, MTA Centre for Ecological Research, Hungarian Academy of Sciences, Tihany, Hungary iii Laboratoire de Meteorologie Dynamique, Ecole Polytechnique, Palaiseau, France iv Complexity Science Hub, Vienna, Austria v Lomonosov Moscow State University, Faculty of Computational Mathematics and Cybernetics, Moscow, Russia Suggested citation: Hochrainer-Stigler, S., Boza, G., Colon, C., Poledna, S., Rovenskaya, E., & Dieckmann, U. (2018). Resilience of systems to individual risk and systemic risk. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Individual risk, systemic risk, diversification, transformation, integration *Corresponding author: dieckmann@iiasa.ac.at Introduction The concept of resilience has a short but intense history and is now defined in as many ways as there are corresponding schools of thought (e.g., Ilmola et al., 2013; Keating et al., 2014; Linkov et al., 2016; Mochizuki et al., 2018). The popular understanding of resilience comes from engineering, which traditionally referred to the resistance of a system to disturbance and to the speed at which such a system returns to equilibrium (Davoudi, 2012). C.S. Holling, widely held to be the father of the concept, defined resilience differently, focusing on the “persistence of systems and their ability to absorb change and disturbance and still maintain the same relationships between populations or state variables” (Holling, 1973, p. 14). For Holling, understanding this ability requires a careful assessment of the dynamical interactions between a system’s components. Insufficiently resilient systems are exposed to knock-outs, with perturbations potentially triggering large and lasting system-wide collapses, a threat nowadays referred to as systemic risk. A distinguishing feature of such risks is that they emerge from the complex interactions among individual elements or agents and their associated individual risks; systemic risk is therefore also sometimes called network risk (Helbing, 2013). In contrast, individual risk originates from single events that directly affect an agent, in isolation from the rest of the system. It is often defined as the “effect of uncertainty on objectives” (ISO, 2009), and is typically quantified by assessing the probability of an event and its corresponding impacts (UNISDR, 2017). While the realization of individual risks may lead to a disaster in part of a system, the realization of systemic risks, by definition, leads to a breakdown—or at least a major dysfunction—of the system as a whole (Kovacevic et al., 2015). This has major implications for strategies aiming at increasing resilience. Modern societies typically manage individual risks through insurance (Geneva Association, 2010) or, more generally, through diversification (Kunreuther, 1996; IPCC, 2012). While moderate individual risks, such as car accidents, can be handled efficiently in this way, diversification gets increasingly difficult for extreme risks (Kessler, 2014; Linnerooth-Bayer & Hochrainer-Stigler, 2015). For systemic risks, in contrast, fundamentally different approaches need to be applied, e.g., restructuring a network’s connectivity (Gao et al. 2016; Poledna & Thurner, 2016). Measures of individual risk and of systemic risk are used not only to quantify risks, but also to identify strategies aiming at increasing resilience. For the latter, an assessment of current resilience levels to absorb, recover, and adapt to adverse events (National Research Council, 2012) is needed. This can focus on different features of resilience (Linkov et al., 2016) including the critical functions of a system, thresholds that if exceeded perpetuate a regime shift, the recovery time from degraded system performance, and the possibility for adaptive management through the anticipation of emerging risks or through learning from past events. Below, we discuss and compare some selected aspects of the most prominent measures and strategies used today. This illustrates differences as well as similarities, and thereby highlights options for developing a joint framework for increasing a system’s resilience to both types of risks. Measures of individual risk and systemic risk Looking at a system’s elements separately, one can assess how they carry individual risks. The most comprehensive quantification of such individual risks is the probability distribution of losses. However, probability distributions are complex objects, so there is a need to capture their most salient features using a minimal number of relevant characteristics. For frequent events, the expected loss or the median loss may provide the most appropriate summary information. For extreme events, on the other hand, tail measures such as the Value at Risk (VaR) or the Conditional Value at Risk (CVaR; also called the expected shortfall) are more appropriate (Pflug & Römisch, 2007). Usually, these risk measures are used to determine risk-management options, e.g., when setting up premium payments, determining the probability of ruin, or making cost-benefit analyses of mitigation measures. In this way, probability distributions and their characteristics have a wide area of application and play a prominent role in discourses about individual risks (Cardona et al., 2012). Systemic risk results from the interactions of individual risks, and, as any emerging phenomena, cannot be measured by separately quantifying the contributing parts. Studies of systemic risk typically construe systems as networks of interconnected elements and thereby focus attention on the interdependencies among individual risks. In particular, systemic risks result from cascading effects between the interconnected elements—which, in a network perspective, are often referred to as nodes or agents. Recently suggested measures of systemic risk emphasize the role of the structure of the entire network (e.g., Kharrazi et al., 2016) and the contributions of individual nodes to systemic risk, including the dependence of these contributions on their positions in the network (Poledna et al., 2015). In some systems, different types of perturbations can be studied through controlled experiments: so-called pulse perturbations are applied only temporarily, whereas press perturbations are imposed continuously (Dunne et al., 2002; Kondoh, 2003; Scheffer & Carpenter, 2003; Ives & Carpenter, 2007). Measures of systemic risk in such systems quantify a perturbation’s full impact, such as the number of secondary species extinctions or biomass reductions resulting from a primary species extinction or biomass reduction in an ecosystem. In other systems, only case studies are possible, which may nevertheless help identify the mechanisms that cause systemic risks. Using insights from such experiments and/or case studies, models can be built to quantify and forecast systemic risks. Financial systemic risk has become a focus of recent research, not only because of its immense importance for society, but also because of the availability of high-precision and high-resolution data and because financial systems are man-made, and thus—in principle—more amenable to engineering than many natural systems. One of the most prominent systemic-risk measures in financial network analyses today is the so-called DebtRank (Battiston et al., 2012). DebtRank estimates the impact of one node, or group of nodes, on the others and is inspired by the notion of centrality in a network. The centrality of a node takes into account the impact of the node’s distress on other nodes in the network, with a high value indicating a more central location of the node. Accordingly, DebtRank can be considered as a warning indicator for a node being too central to fail— an important feature aggravating a node’s contribution to systemic risk, in addition to being too big to fail (Poledna & Thurner, 2016). Other measures of systemic risk are also available, such as the Systemic Expected Shortfall, which uses pre-defined thresholds—akin to Value at Risk—to quantify a node’s anticipated contribution to a systemic crisis (Acharya et al., 2009). Enhancing resilience by restructuring networks As in the case of individual risks, measures of systemic risks have the potential to inform risk- management strategies aiming at decreasing risk. Due to the increasing connectedness within networks—e.g., financial networks—and across networks—e.g., financial systems interconnected with supply chains—it is nowadays becoming more difficult to ensure that a portfolio is adequately diversified, as hardly tractable pathways might connect events. Instead of looking for diversification possibilities, a system’s resilience against systemic risk can therefore often more readily be improved by modifying or transforming the topology of the underlying network toward safer configurations. How a network’s structural diversity can enhance its stability has long been analysed in ecology (e.g., May, 1973; Pimm & Lawton, 1978). While this so-called diversity-stability debate has led to fruitful distinctions among conclusions holding for different measures of diversity and for different measures of stability, no generally applicable simple results have been found regarding the impact of diversification on resilience (Tilman & Downing, 1996; McCann, 2000). This is because of several reasons. First, diversification may not only enable risk sharing and facilitate post-failure recovery, but can also multiply the number of pathways through which risks propagate (Gai & Kapadia, 2010; Haldane & May, 2011; Allen et al., 2012; Battiston et al., 2012; Amini et al., 2016). Second, increasing modularity—the degree to which the nodes of a system can be decoupled into relatively discrete components—may decrease risks for most parts of the system, potentially at the expense of impeding resilience for the system as a whole (May et al., 2008). Third, resilience and efficiency, e.g., of road systems, may not go hand in hand (Hochrainer-Stigler & Pflug, 2009; Ganin et al., 2017, 2018). Such trade-offs—e.g., between modular risk and systemic risk or between resilience and efficiency—are implying social dilemmas and creating leverage for moral hazard, as the constituencies bearing the costs or receiving the benefits of tipping trade-offs in either direction typically differ. For example, companies maintaining utility or transportation grids are tempted to make them more efficient to save costs and increase their profits, even when this decreases the networks’ resilience—potentially at great expense to the citizenry depending on them. Fourth, strategies to build resilience must take care to avoid so-called erosive strategies that lead to medium- and long-term negative impacts on development and well-being (Keating et al., 2014), e.g., by the short-term over-exploitation of natural resources (Heltberg et al., 2012). Fifth, so-called levee effects, through which increased safety is leading to much larger losses in case of risk realization need to be accounted for, as exemplified by the case of New Orleans after Hurricane Katrina (Kates, et al. 2006). Hence, instead of one-size-fits-all rules of thumb, the reshaping of a network’s topology is therefore best based on examining the specific contribution of each node to systemic risk (e.g., Gephart et al., 2016; Colon et al., submitted). With this approach, managers try to identify those nodes that are too big to fail, too interconnected to fail, and the so-called keystone nodes, which in times of failure cause large secondary effects or lead to a network’s complete breakdown (Paine, 1969; see also the critical comments on the latter concept by Mills et al., 1993). Restructuring a network can then be enabled by acting on those nodes. For example, Poledna & Thurner (2016) propose a risk measure based on DebtRank that quantifies the marginal contribution of individual liabilities in financial networks to the overall systemic risk. They then use this measure to introduce an incentive for reducing systemic risks through taxes, which they show can lead to the full elimination of systemic risks in the considered systems. The resultant proposal of a systemic-risk tax is a very concrete measure that can increase individual and systemic resilience (e.g., Adrian & Brunnermeier, 2008; Cooley et al., 2009; Roukny, et al., 2013). In other cases, more broadly-based governance approaches may be necessary (Linkov et al., 2016), which in turn might require changes in human behaviour or cultural norms (as highlighted, e.g., through the current ‘loss and damage’ debate in the climate-change community; Mechler et al., 2018). Integrative management of individual and systemic risk Before proceeding to the management of systemic risks (Cooley et al., 2009), one needs to be able to measure and model them appropriately. Here we have outlined how increasing a system’s resilience through the assessment and management of risks differs between individual risks and systemic risks. For individual risks, market-based instruments exist, including insurance and diversification strategies using the law of large numbers, whereas for systemic risk, transformational approaches need to be developed and applied, assessing the contributions of nodes to systemic risk and restructuring networks to reduce these contributions. Ideally, individual and systemic risks should not be treated in isolation, but in a holistic manner. This challenge has become even more pertinent through experiences showing how individual risks resulting from extreme events can trigger systemic risks (e.g., Massaro et al., 2018). A case in point is the 2011 Thailand flooding and its worldwide consequences (Chongvilaivan, 2012; Haraguchi & Lall, 2015), which has demonstrated the magnitude of potential knock-on effects and inspired the notion of global systemic risk (Centeno et al., 2015). Another example is the self-immolation of Mohammad Bouazazi in Tunisia in December 2010, which started the Arab Spring and caused large-scale consequences as well (Pollack et al., 2011). Indeed, individual risk and systemic risk can be seen as representing two ends of a continuum: with individual risk describing how an event changes a single network node and systemic risk describing the propensity for cascading failures triggered by such events across network nodes, the continuum is spanned by the affected proportion of nodes, with larger proportions characterizing risks at the more systemic end of the spectrum. On this basis, new mathematical methods are currently being developed for integrating measures and models of individual risk and systemic risk, such as the copula method (Hochrainer-Stigler et al., 2018). In addition, a major and yet unaddressed challenge is how to integrate the technical approaches rooted in natural science, which we have outlined here, with innovative governance approaches rooted in social science, which are crucial to build resilience in the face of systemic risks. Acknowledgments The authors would like to express their gratitude to Åke Brännström, Joanne Linnerooth-Bayer, Georg Pflug, and Stefan Thurner for the inspiring discussions to which these colleagues have contributed in the context of the crosscutting project ‘Systemic Risk and Network Dynamics’ at the International Institute for Applied Systems Analysis (IIASA).
Technological surprise and resilience in military systems	Kott	Technological Surprise and Resilience in Military Systems Alexander Kotti* i U.S. Army Research Laboratory, Adelphi, Maryland, USA Suggested citation: Kott, A. (2018). Technological surprise and resilience in military systems. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, organizational recovery, technological surprise, mission impact *Corresponding author: alexander.kott1.civ@mail.mil Introduction This paper focuses on ways to build resilience and benefit from it when an unexpected adverse event occur. The specific interest is in approaches – preferably supported by historical evidence of success – that can help an organization overcome a significant negative impact on its ability to continue its mission. To make the discussion more concrete, the paper focuses on a particular class of detrimental events – technological surprises in warfare. A technological surprise in warfare often unfolds as follows. One of the sides in an armed conflict (let’s call that side Red) introduces a weapon system that the other side (let’s call it Blue) did not expect to see on the battlefield. The new weapon may drastically reduce the ability of Blue to fight Red. As a result, Blue may experience significant losses in personnel, equipment, territory, etc. If Blue is sufficiently resilient, after a period of time it develops countermeasures – often a combination of new tactics and new technical means – that negate the effect of the new weapon, and restore the initial ratio of capabilities between Red and Blue. Two commonly used examples are (1) in the summer of 1941, the introduction of the Soviet T-34 tank which was nearly invulnerable to the German tanks of the time, and served as unwelcome surprise to the Germans; and (2) also in 1941, the use of the German powerful 88 mm Flak gun against the unprepared British tanks in North Africa. (Finkel & Tlamim, 2011) Following the above description, and for the purposes of this paper, let’s define resilience as the ability of a military organization to (a) avoid complete destruction in face of a technological surprise, and then to (b) recover and return to effective performance against the adversary. This definition is consistent with how resilience is defined by the National Academies of Science (2012) and Executive Orders by both the Obama (The White House, 2013) and Trump Administrations. For study of resilience, technological surprises are particularly convenient cases: the cause (e.g., a new weapon), the effects (the handicap and the losses), and the resiliency-restoring actions (countermeasures) are usually clearly understood, well documented, and often even quantifiable. For many countries, technological surprise is becoming a growing concern as technology and science are spreading ever broader across the globe. While generally, this is a highly welcome phenomenon, the proliferation of knowledge about building sophisticated weapons continues to increase the number of states and non-state actors that could spring a technological surprise at a given country. The limits of risk-based approaches By their very nature, technological surprises are hardly amenable to risk-management approaches. Risk-based approaches require identification of threat, vulnerability and consequences. The space of modern technologies is so broad and diverse that Red has almost unlimited opportunities to select a particular research and development direction, and to build a novel effective weapon system. If Blue’s intelligence services fail to detect the development (a common occurrence), Blue has no way to know the nature of the new Red weapon, and cannot pursue any meaningful risk-mitigation strategies that could help against the future encounter with the yet-unknown weapon. In theory, Blue might try to undertake a very broad portfolio of R&D programs in order to investigate the capabilities and the countermeasures against all likely future Red weapons. In practice, such an exhaustive exploration and mitigation is unaffordable even for the wealthiest countries. Therefore, resilience-based approaches are likely to be less costly than risk-based approaches. Instead of (or perhaps in addition to) investing in a very broad (and very expensive) range of mitigation mechanisms against an infinitely large spectrum of possible technological surprises, the country may prefer to invest in skills and assets that would enable resilient responses to an inevitable technological surprise. Although such investments are substantial, they are most likely to be significantly smaller that potentially unlimited spending on avoiding all possible risks. The limits of resilience-based approaches Although potentially cost-effective, a resilience-based approach comes with its own set of drawbacks. First, it does require significant investments. In order to be resilient to a technological surprise, a military organization must invest in developing skills and competencies of its personnel and leaders. It requires investments in expensive training and exercises. It requires investments in assets that are suitable for resilient responses, and in additional, redundant assets that would be used when the primary assets are destroyed or degraded by the adversary. And, all these investments have to be made in addition to investments into more conventional assets and personnel, which are intended for purposes other than resilience. Second, as mentioned in the introduction, when faced with a technological surprise imposed by Red, Blue may experience significant losses in personnel, equipment, territory, etc. The resilience of Blue might reduce and contain the extent of such losses, but would not eliminate them entirely. Finally, and perhaps most perniciously, improving the resilience of a military organization creates a temptation to neglect other preparations for facing the risk of a technological surprise. Similarly, a temptation may exist to remain complacent with an existing collection or technologies or the level of personnel skills. Faced with tight budgets, a decision-maker might be inclined to argue that certain upfront investments in material and personnel for reducing the risk of a surprise are unnecessary because “we will face a technological surprise anyways, and then we will have to improvise some resilient responses, so why do we need to invest in any new weapons at this time?” Effective resilience in historical examples Historical experiences with successful adaptations to technological surprises suggest several key elements common to such successes. The following steps (not necessarily sequential, but often taken in parallel) are commonly observed when a military organization (let’s call them Blue) successfully – or partly successfully – recovers from a technological surprise. First, Blue recognizes rapidly that its operation is degraded by a technological surprise, e.g., by a novel Red weapon system. Then, Blue takes agile actions in order to minimize the immediate impact of the surprising threat on Blue’s current operations. This usually requires Blue to accept a degree of further deterioration in performance of the Blue organization. One approach is for Blue to isolate itself from the Red threat, e.g., by creating a distance between Blue and the threat, or retreating to well protect positions. For instance, in the battle of Kasserine Pass (February 1943, Tunisia), having been surprised by the effectiveness of German forces, the US Army and its allies retreated to defensive positions in order to minimize the impact of the German forces, to regroup and await reinforcements (Finkel & Tlamim, 2011, p. 271) While holding off Red, Blue works rapidly to identify weaknesses and vulnerabilities of Red’s novel technology. This often involves the need to rapidly perform a forensic analysis of the known engagements with the threat, and to hypothesize, design and execute a series of experiments. These often happen organically, as various subunits of the Blue force try a variety of desperate expediencies to fight back against the Red threat. For instance, in 1943, surprised by the German acoustic torpedo against Allied ships, the British engineers rapidly improved a device that was towed behind the ships and caused the torpedo to explode harmlessly (Handel, 1987). Similarly, in October 1973, when the Israeli air force was surprised by the new Syrian SA-6 anti-aircraft missiles, a scientist at the Rafael Corporation rapidly developed a way for the Israeli planes to jam the radars of the missile batteries. (Finkel & Tlamim, 2011, p. 175) When the Blue force identifies a vulnerability or weakness of the Red technology, it proceeds to converge on a small set of tactics and techniques that seem to be effective against Red. If feasible, Blue may also develop and implement technical counter-measures against the Red surprise technology. Blue rapidly disseminates instructions for executing these tactics or applying technical countermeasures to all relevant sub-units; obtains additional equipment and performs training as needed. For instance, in the battle of Kasserine Pass, the US and Allied Forces recognized that the German forces would be vulnerable to artillery, and reinforced themselves with experienced artillery units. (Finkel & Tlamim 2011, p. 271) Finally, the Blue force aggressively and decisively applies the new tactical or technical counter- measures, in conjunctions with any other effects available, against the Red force. This may defeat the Red threat, may reduce or eliminate its efficacy, and may enable the Blue organization to return to near-normal level of performance in its operations. Desired organizational characteristics Not every organization is capable of successful execution of approaches described in the preceding section. Let’s consider – again, based largely on historical examples -- some of the key characteristics that help an organization to succeed in resilient adaptations to technological surprise. A particularly widely recognized characteristics of such nature is flexibility: the ability of the organization to change its organizational structure, techniques, procedures, and other forms of its operation, even if such changes are drastic and contradict established norms and past experiences. For instance, although in 1941 in North Africa the British possessed excellent anti-aircraft guns, the inflexible regimental culture prevented them from using the guns against the German tanks. (Handel, 1987) Another important characteristic is agility: the organization must be able to perform its actions rapidly and to eliminate any barriers that may cause a delay in decision or execution. This often requires the culture of delegating the authority to the lowest echelon of the organization and encouraging initiative of even the most junior members of the organization. For instance, when in 1986 the Afghan guerrillas started to use Stinger missiles (a technological surprise) against Soviet helicopters, the lack of independent initiative and creativity among the Soviet junior officers was a significant factor in slow (about 18 months) adaptation of the Soviets forces. (Miller, 2014) Both agility and flexibility must be supported by effective intelligence: the ability of the organization to obtain, analyse and disseminate intelligence about the technological surprise – e.g., the novel weapon system and its effect of the organization’s operations and assets, or a new tactical or strategic context – completely and efficiently, in spite of the stress and disruption caused by the threat. For instance, when in 1941 the Germans used their 88 mm gun against British tanks, the British failed to collect sufficient intelligence about the events, and remained unaware of the German weapon for several months after its initial use in a battle. (Handel, 1987) Last but not least breadth and diversity are vitally important: the organization should combine a diverse set of technical and cultural competencies, as well as assets that are capable of a variety of functions under different conditions. This is necessary in order to re-orient an organization effectively against the technological surprise and to combine the competencies and capabilities in novel ways. For instance, when facing Egyptian anti-tank Sagger missiles – a technological surprise – the Israeli homogenous tank units were unable to adapt until they were belatedly diversified with infantry and artillery. (Miller, 2014) Conclusions Analysis of technological surprises in warfare – particularly the study of historical cases of such surprises – is uniquely valuable for identifying the advantages and limitations of resilience-based approaches, the approaches to conducting resilient activities after an unwelcome surprise, and the characteristics that an organization must foster for the sake of improving its resilience. Historical experiences offer insights into several key elements – typical activities and ways of executing them – that are common to successful adaptations to technological surprises. However, to build capabilities for effective execution of such activities, an organization must develop several critical characteristics. These include flexibility, agility, effective use of intelligence, and breadth and diversity. While resilience-based approaches are likely to be less costly and more practical than risk-based approaches, leaders of an organization must recognize that improving the resilience of an organization must not lead to neglecting appropriate measures for reducing the risk of a hazardous event.
Mindfulness and the risk-resilience trade-off in organizations	Kudesia & Reb	Mindfulness and the Risk-Resilience Trade-off in Organizations Ravi S. Kudesiai,iii* and Jochen Rebii,iii i Fox School of Business, Temple University ii Lee Kong Chian School of Business, Singapore Management University iii Future Resilient Systems, Singapore-ETH Centre Suggested citation: Kudesia, R. S., & Reb, J. (2018). Mindfulness and the risk-resilience trade-off in organizations. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Risk, resilience, mindfulness, organization, theory *Corresponding author: rskudesia@temple.edu Through this chapter, we seek to contribute to ongoing discussion about risk, resilience, and how they can be jointly managed (see Linkov, Trump, & Keisler, 2018), particularly in the context of organizations. We start by reviewing the traditional image of organizations. In this traditional image, processes related to risk and resilience are seen as complementary, as these processes pertain to distinct aspects of the organizational environment. We then complicate this theoretical image by introducing five underappreciated ways that risk and resilience processes may not be complementary in practice—because the aspects of the environment to which these processes pertain cannot always be easily distinguished and because enacting either of these processes can produce tradeoffs that constrain the other. We conclude by suggesting three principles rooted in mindfulness to help organizations manage these risk-resilience tradeoffs. In so doing, we hope to offer an updated image of organizations. This updated image may enrich discussions about risk and resilience within communities of theorists and practitioners alike—as well as across them. Why risk and resilience appear complementary The traditional image of organizations is one in which risk and resilience imply complementary processes. Risk-related processes help organizations select among actions by predicting how the actions will affect their environment, whereas resilience processes help organizations adjust actions when the outcomes of action are uncertain and environments prove unpredictable. The implications of this image are straightforward: organizations should resolve uncertainty into risk by increasing information processing and then increase resilience for residual uncertainty through organization design and social interactions. Both implications are elaborated below. Resolving uncertainty into risk by increasing information processing Uncertainty describes situations in which actions lead to potential outcomes with unknown probabilities, whereas risk describes situations in which the probability distributions of actions are objective and are quantitatively known (Luce & Raiffa, 1957). Organizations can resolve uncertainty into risk by increasing their information processing (see Frame, 2003). For instance, an organization may need to decide on production rates, knowing that faster production rates increase the number of product defects. Increasing information processing can resolve the uncertainty of this decision by objectively quantifying the relevant costs and benefits. Historical sales data from firm and industry sources can help quantify the additional demand that could be met by increased production, legal precedent can be used to estimate the costs associated with the sale of defective products, and industry benchmarks can better delimit the acceptable range of defects-per-million. By increasing the information processing used to decide on its production rates, the organization resolved uncertainty into risk. As a result, the organization can use sophisticated quantitative tools like Monte Carlo simulations to make predictions and enact risk management strategies such as risk mitigation (e.g., preventive maintenance on machinery) or risk transfer (e.g., insuring against costs of defective products). Once risk management strategies are used, the information processing requirements for action diminish. Having predicted and planned for future outcomes, the selected action can theoretically be executed in the present with less need for active information processing. For instance, top managers must actively process a large amount of information to select the new production rate, but the unit charged with executing this new production rate on the front-lines need not process any of the information the managers used in selecting the new production rate. They only need to know the new production rate in order to execute. Thus, a temporal separation emerges between planning and execution in this traditional image—whereby planning is deliberative and demands intensive upfront information processing and the subsequent execution is more automatic and less intensive in its information processing. Yet, there will always be some residual uncertainty that organizations cannot resolve into risk, as not every aspect of the environment is predictable. For instance, the outcomes of setting production rates in a manufacturing unit are more readily quantifiable than are the outcomes of entering a new market in a strategy unit or developing a new product line in an R&D unit. Thus, different units in organizations will face different levels of residual uncertainty (see Tushman & Nadler, 1978). Organizations are typically designed such that most uncertainty resides atop the hierarchy, where top management teams develop plans to cope with wicked strategic problems, and less uncertainty resides near the bottom of the hierarchy, where plans are executed on the front-lines (March & Simon, 1958). Thus, there is also a spatial separation between planning and execution—as planning and execution processes are typically enacted by different units that are situated at different locations in the organizational hierarchy. In sum, this traditional image of organizations therefore presumes both temporal and spatial separation between planning and execution, where planning occurs atop the hierarchy prior to its execution on the front-lines and requires more active information processing than execution does. As a result, this image portrays top management units in the hierarchy as mostly enabling resilience in organizations because they handle the unexpected outcomes of planned actions and the unpredictable aspects of the environment. Namely, to the extent that the outcomes of actions can be rendered predictable by increased information processing, as in the case of risk, top management units plan the actions and distribute the execution of these plans down the hierarchy to units on the front-lines. To the extent that these plans produce unexpected outcomes, the front-lines are presumed to make upward demands for guidance from top management. And, in this image, top management also handles the residual uncertainty in the environment that cannot be adequately planned for and distributed down the hierarchy. Increasing resilience for residual uncertainty by organizational design and social interactions Because the traditional image of organizations presumes a spatial and temporal separation between planning and execution, it links resilience with an increased information processing capacity of top management units, as these units should face the most residual uncertainty. The information processing capacity of top management units can be increased by organizational design and by the quality of social interactions among unit members. Organization design can protect the information processing capacity of top management units by limiting upward demands posed by those executing plans in the hierarchy below (see Galbraith, 1973). For instance, units at the bottom of the hierarchy can be given greater slack resources (e.g., increased budgets, decreased time pressure for production). Units can also be designed in ways that decrease their dependence on other units (e.g., using cross-functional teams so all needed expertise resides in-unit, granting more autonomy to the unit, reducing resources it shares with other units). Organizational design can further reduce upward demands by improving lateral relations across units at the bottom of the hierarchy (e.g., liaison roles can solve problems between units and share best practices). And when upward demands are necessary, information technology can make demands more efficient, reducing the time and effort required of managers. Information processing, however, is not a purely individual activity, but a collective one. A unit’s capacity for information processing thus depends on the quality of its social interactions. In particular, increased information processing capacity is associated with social interactions that occur frequently because members work proximally, participate equally in decision-making, and trust each other—as well as through interactions that are guided, but not governed, by established rules and roles (Bigley & Roberts, 2001; Okhuysen & Bechky, 2009; Tushman & Nadler, 1978). Five social interaction patterns in particular characterize units with high information processing capacity: unit members often raise and openly discuss potential problems before the problems escalate into crises, communicate enough to ensure all members have a good mental “map” of ongoing operations, seek to question operational assumptions and received wisdom, rather than to confirm them—and, when crises do arise, they listen to the members with expertise rather than the members with formal power and they do their best to utilize and update their existing expertise by improvising solutions to the crisis (see Weick, Sutcliffe, & Obstfeld, 1999). When risk and resilience processes produce tradeoffs This traditional image of risk management and resilience as complementary processes in organizations, however, belies important tradeoffs, which we now introduce and explore. When risk erodes resilience Risk and resilience processes are appropriate for rather different aspects of the environment. But it is not clear that managers can reliably differentiate between these aspects. Organizations tend to romanticize the quantitative (Feldman & March, 1981), in part because investors, regulators, customers, and business partners expect them to act according to rationality norms. Although organizations can maintain the mere façade of rationality to satisfy their external stakeholders (Abrahamson & Baumard, 2008), in many cases, the rationality norm prevails internally within organizations as well. And when a rationality norm prevails internally, organizations may misapply sophisticated quantitative risk management tools on non-quantifiable or computationally intractable problems that are better suited for resilience processes (Artinger, Petersen, Gigerenzer, & Weibler, 2015). Risk management tools can enable more intricate plans held with greater confidence than the data support. Misapplying these tools can therefore set organizations up for nasty surprises for three reasons. First, misapplied risk management separates planning from execution both temporally and spatially. Adjustments to plans are thus subject to time delays (in how often those on the front-lines inform those atop the hierarchy of issues) and reporting biases (in that near-misses or non-events are unlikely to ever be reported). Such time delays and reporting biases limit the efficacy of managerial action. Second, misapplied risk management disempowers those on the front-lines because risk and resilience entail different logics of employee action. Namely, when front-line employees enact resilience processes, they readily apply their direct access to information (from customers, operations, suppliers, etc.) toward strategic priorities (Vogus & Rerup, 2018). Such a logic of action is difficult to cultivate with risk-related processes, where front-line employees are disempowered to adjust plans because of the separation between planning and execution. Thus, misapplying risk management in situations where resilience is more appropriate foregoes a logic of action where front-line employees adjust plans based on their privileged access to direct information. Third, having limited the efficacy of managerial action and disempowered front-line employees, the organization is left incapable of coping with eventual surprises. Coping with surprises can require an extraordinary willingness to examine flawed model assumptions, to avoid the blame game, and to transparently bring forward all relevant information (Argyris, 1990)—including across units that may have previously been operating in silos (see Dunbar & Garud, 2009). But without having actively developed these virtues during good times, the organization is unlikely to somehow do so during crisis. In this way, risk management can erode resilience processes. When resilience Increases risk Conversely, resilience processes can increase risk in two ways. First, resilience can be treated as an outcome (“100 days since an accident”), rather than a process that emerges from the everyday actions of organizational members. If resilience is treated as an outcome, managers may act with the assumption that resilience will remain a stable property of their organization, instead of realizing that resilience is dynamic and responsive to their actions. For instance, after resilience had been established for some time, managers at NASA assumed that resilience would remain a stable outcome, and shifted priorities and funding away from resilience processes and toward productivity—leading them to repeat critical mistakes (Haunschild, Polidoro, & Chandler, 2015). Second, adaptation at one level of an organization can substitute for adaptation at another level (Levinthal & March, 1993). This substitutability of adaptation can make resilience a risk, such that not all adaptation is normatively positive for the organization as a whole. Particularly in organizations where crises emerge from operations, highly resilient front-line employees can prevent adaptation atop the hierarchy. For instance, nurses often “work around” problems that arise during patient care. That is, they improvise on-the-spot actions that help them circumvent problems in a temporary way. As a result, problems are seldom reported to managers who can address them more systematically (Tucker, Edmondson, & Spear, 2002). A less resilient front-line would be unable to handle these problems, thus informing managers and allowing adaptation at the managerial level. Conversely, when selection pressures are most acute atop the hierarchy (from regulatory or competitive sources), managers may change rules, routines, and resources. But the front-line may lack a wider context to understand such changes, leading them to resist change and thereby increase risk. In this way, resilience can increase organizational risk. Mindfulness and managing the risk-resilience tradeoff The cutting edge of organizational research asks how the risk-resilience tradeoff can be managed through mindfulness. Early mindfulness work suggested that the deliberate mental processes people use during planning could, and should, be retained during execution (Langer, 1989). Instead of execution occurring on autopilot, people can use their experiences during execution to refine their plans and assumptions. In time, mindfulness expanded from the individual to the group, referring to the five social interaction patterns characterizing units with large information processing capacity (Weick et al., 1999). Most recently, mindfulness is seen as requiring the integration of these mental processes and social patterns with the organizational designs in which they occur (Kudesia, 2017b). With such an integration, organizations can enact continuous improvisational change in which planning and execution converge both temporally and spatially (Brown & Eisenhardt, 1997; Moorman & Miner, 1998), thus limiting this key cause of the risk-resilience tradeoff. Instead of predicting the environment, such organizations directly act on it, notice the impact of their actions, and make adjustments through rapid feedback cycles. We suggest this integration requires three principles. First, organizations must see expertise as not just deliberate and conceptual, but also automatic and perceptual (Dreyfus & Dreyfus, 2005). Mindfulness is less about constant deliberation. It instead requires that people switch mental processes between deliberation and automatic action based on their expertise in a situation (Kudesia, 2017b). This empowers useful improvisations to emerge from the automatic actions of experts (Chia & Holt, 2009). Second, for such improvisational actions to benefit the organization, they must be strategically aligned. Rather than relying on intricate plans to align actions, top managers can offer heuristics: simple rules that identify strategic priorities and values (Artinger et al., 2015; Brown & Eisenhardt, 1997). Heuristics give people a shared basis from which to improvise, ensuring alignment. Third, middle management plays a crucial role in troubleshooting areas of misalignment. Their position in the design best places them to reconcile differing priorities and values across the hierarchy—and to notice valuable improvisations on the front-lines, help articulate them, and encourage their adoption more broadly (Beck & Plowman, 2009; Eggers & Kaplan, 2013). As such, expertise on the front-lines, simple rules from top managers, and troubleshooting from middle management seem to be three necessary mindfulness principles for managing the risk- resilience tradeoff in organizations. Although much remains to be understood about these principles, they may underlie an updated image of risk and resilience in organizations. In this updated image, planning and execution converge in a manner that allows organizations to transcend the risk-resilience tradeoff through rapid, intelligent action. Acknowledgements The authors received support from the Future Resilient Systems project at the Singapore-ETH Centre, which is funded by the National Research Foundation of Singapore under its Campus for Research Excellence and Technological Enterprise program (FI 370074011).
Resilience and robustness in ecological systems	Levin	Resilience and Robustness in Ecological Systems Simon A. Levini* i Princeton University This research was supported by the Army Research Office Grant W911NF-18-1-0325. Resilience and Robustness in Ecological Distributed Decision-Making Dynamics. Suggested citation: Levin, S. A. (2018). Resilience and robustness in ecological systems. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, robustness, ecological systems *Corresponding author: slevin@princeton.edu Introduction The notions of resilience and robustness in ecological systems generally refer to the ability of the system to continue to maintain its essential character in the face of disturbances, endogenous or exogenous. In different traditions, the words “resilience” and “robustness” are alternatively used to describe this property. In some usages, however, the term resilience is reserved for the ability of a system to recover from displacement, and the more general term robustness used to combine resistance to displacement with the ability to recover (see Levin & Lubchenco, 2008); in other usages, as adopted for example by the Stockholm Resilience Centre, the term resilience refers to the combination of both (Holling, 1973). The notions of resilience and robustness in any system are tied to whatever macroscopic descriptors are defined to be of interest. For an organism like us, the concept is clear - it’s what keeps us healthy; and a physician has unambiguous descriptors that define the health of the organism. For an ecosystem, the concept is more difficult, because an ecosystem is not a well-defined evolutionary unit; rather, it is in general operationally defined in terms of the species that coexist in some area or region, together with the abiotic environment within which they coexist, including especially the nutrients whose dynamics sustain those species. The definition of resilience or robustness for such a system is not unique, but depends upon the level of description. Species may come and go without affecting the overall persistence of the features that make the system recognizable; and, in fact, the dynamic nature of species turnover, for example during ecological succession, may be essential to the maintenance of the more macroscopic features of the system. The question remains as to what macroscopic features should be the focus of resilience and robustness strategies for ecosystems. Are particular species essential to maintain in their own right, or should the focus be on broader functional groups that sustain critical ecosystem processes? (Kareiva & Levin, 2003). This is a key question, not easily answered, because which properties are valued depend on one’s perspective. For some, the intrinsic nature of individual species is paramount; while for others, the value of particular features of biodiversity are to be evaluated through the filter of the services humans derive from ecosystems. The more general notion of ecosystem services in theory combines services that can easily be given economic value with those, like the intrinsic nature of species, that cannot unequivocally be assigned such values (Daily et al., 2000). However, in practice, because of the difficulties in quantifying non-market values, the ethical and aesthetic dimensions receive short shrift. Any manager of an ecosystem, whether a natural one or an engineered one (such as in agriculture), must first determine the goals of management - namely, what is to be preserved. There is basically no unequivocal way to do this for natural systems, and hence the management objectives in general cannot be separated from the socio-economic context. Risk and resilience A fundamental issue in assessing the robustness of any system is that of systemic risk, namely the potential for localized disturbances to spread contagiously and become global problems (May, Levin, & Sugihara, 2008; Frank et al., 2014). Ecological systems differ from many other systems, like banking systems, in that they are essentially self-organized (Levin, 2005; Helbing, Yu, & Rauhut, 2011). When assessing the properties of resilience for engineered systems, one may rely on the fact that design principles have guided the construction of those systems. Similarly, for individual organisms, natural selection has shaped the regulatory processes and other characteristics to maintain the resilience of critical functions. For ecosystems, however, no such feedback mechanism has shaped their properties. There is, of course, another sort of process, a selection process that biases what we observe in favor of systems whose properties allow them to persist longer (Lewontin, 1977; Levin, 1999; Lenton & Lovelock, 2000), but this is different than a design principle. Over time, organisms have evolved to balance exploration and exploitation in ways that approximately optimize their fitnesses in a game-theoretic sense; successful organizations must do the same. To the extent that resilience or robustness means the maintenance of the status quo, it must be balanced against exploration, which carries risk. Whether systems are designed, evolved, or self-organized, the most resilient and robust systems will find this balance, or else they will not be able to persist in changing environments. Problems arise, of course, when the conditions that gave rise to that balance are disturbed, as for example through climate change. Carlson and Doyle (2002) describe a wide class of resilient systems that are “robust, yet fragile”; that is, they may be robust to a class of perturbations for which they have been selected, yet fragile in the face of novel ones. For example, comparing the resilience or robustness of tropical and temperate ecosystems only makes sense with regard to appropriate classes of disturbances; tropical ecosystems may be more robust with respect to normal stresses, but more fragile in the face of novel ones. Design principles can be applied to managed ecosystems, like forests, fisheries and agricultural systems, in order to balance success in current environments versus adaptive capacity to deal with novel ones (Clark, Jones, & Holling, 1979). Redundancy and diversity provide insurance and allow for innovation, while modular construction can limit systemic risk (Levin, 1999; Simon, 2002; Simon, 1962). More generally, managers have much to learn from how evolution has shaped robustness, for example through the evolution of the vertebrate immune system (Levin & Lo, 2015). Evolution has shaped the properties of the immune system to deal with the fact that, predictably, unpredictable pathogenic threats will attack us all. The immune system is hierarchical in the sense that the first line of defense involves barriers to invasion, things like skin. When those barriers are breached, the threat must be recognized as such, generalized responses (like macrophages) invoked, while adaptive responses (specific antibodies) evolve and provide memory. Such a hierarchy is very suggestive for the development of protection for a wide class of systems. Risk appetite and tolerance One of the most basic concepts in fisheries management is that of maximum sustained yield, and related concepts like maximum sustained rent (profit) similarity emphasize constancy of system properties. Constancy is obviously an attractive feature in many respects, since it implies sustainability and predictability. However, focusing entirely on robustness in this sense erodes the capacity for learning and exploration, and may lock systems into domains of performance that are suboptimal. In changing environments, the lack of innovation may in fact doom the system to collapse. More generally, robustness may not be a desirable feature, for example if a system is stuck in an unproductive configuration like a hypoxic or eutrophic lake. Economic recessions and depressions provide familiar examples (Levin et al., 1998). Indeed, principles of sound investment carry over little changed to ecological management. Risk tolerance and discounting dictate the degree to which bet- hedging and insurance arrangements need to be applied to maintain long-term performance, sacrificing short-term gains for long-term persistence. In any context, from investment strategies to the management of businesses and natural systems, and indeed to our own lives, one has to balance a tolerance for risk against the potential for the greater rewards that risk can bring. Any management situation that involves collective agreements necessarily involves trading off the ways different individuals discount the future. For example, politicians and CEOs typically would have steeper discount rates (because they need to show results) than stockholders and the general public; people who are worried about where their next meal is coming from have steeper discount rates than those who can afford to plan for retirement. In general, there is great heterogeneity within any population between risk-takers and more conservative planners, and indeed even individuals in making decisions balance these tendencies. This leads inexorably to non-constant discounting (for example, hyperbolic discounting), and all the complexities it introduces (Weitzman, 2001; Dasgupta & Maskin, 2005; Laibson, 1997). Societies aggregate individual preferences, just as individuals do for their internal conflicts, and solutions typically average tolerances through compromise decisions and insurance arrangements. The science and politics of how to do that effectively still needs a great deal of work, as evidenced by the lack of agreement within our own societies on such fundamental existential issues as climate change. Transition, adaptation, transformation Transitions and transformations can affect systems in unplanned ways or can be designed to transform systems from less desirable states to better ones. In the former case, it obviously would be desirable to have early warning indicators, as well as built-in feedback loops that minimize the damage. Certain classes of transformations show characteristic patterns of change, and efforts to identify them in biological and other systems have been a focus of research for at least a half- century (Guckenheimer, 1978). More recent efforts (Scheffer et al., 2009) have borrowed heavily from the literature on phase transitions in physics. Like the earlier efforts, these are promising directions, but care must be taken not to expect uniform patterns. Management of any system must anticipate transitions, and plan for transformations that are as painless as possible, while resisting the temptation to stick too long with losing strategies. Such issues are at the center of current research in business strategies (Reeves, Levin, & Ueda, 2016; Reeves, Levin, Harnoss & Ueda, 2018). Obviously, such issues are front and center for environmental systems and societies as well. In the face of global change in climate and other features, overall robustness must embrace change, and the challenge becomes how we engender change without severe disruptions. There are numerous examples in the environmental literature - for example, the recognition after years of alternative practice that small controlled fires remove tinder and increase the robustness of forests to major catastrophes, or the use of diversification in agriculture to minimize the potential for pathogen outbreaks or other system-wide disturbances. In financial systems, small corrections are generally regarded as healthy for the long-run viability of markets. Such principles must apply as well to our social and ecological systems, embracing adaptability, if our societies are to survive.
Considerations of resilience management in transportation	Nogal & O’Connor	Considerations of Resilience Management in Transportation Maria Nogali and Alan O’Connori* i Dept. of Civil, Structural & Environmental Engineering, Trinity College Dublin, Ireland Suggested citation: Nogal, M., & O’Connor, A. (2018). Considerations of resilience management in transportation. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, transportation, system, network, performance *Corresponding author: alan.oconnor@tcd.ie Introduction The aim of transportation systems is to enable movement of people and goods and to guarantee supply chain, in terms of safety and security at the core level, in terms of reliability and sustainability at an intermediate level, and in terms of efficiency at an outer level (Nogal & O’Connor, 2017). Traditionally, transportation systems have been designed and managed under a risk-based perspective, where serviceability level of the system should be guaranteed under any likely circumstance. In that way, the service offered by the transportation system was established as the input of the problem, and as a result of a number of engineering, social and economic considerations, the infrastructure was designed or the services programmed. The present transportation is characterized by its complexity and high interconnection with other systems, such as information and communications technology systems (ICTs) (Roege et al., 2017). Dependencies among systems imply that a perturbation in another system is likely to cause stress in the transportation system, and vice versa, triggering sometimes an uncontrolled feedback process. Thus, analyzing transportation systems without considering the relation with other systems would lead to underestimating both risks and consequences. In addition, ageing of the existing infrastructure that requires important investments to maintain acceptable service conditions, worsened by an increasing transport demand during a time period characterized by emerging threats, such as climate change and cyber-attacks, poses a special challenge to decision- makers when trying to allocate scarce resources competing with the needs of other critical infrastructures. Practitioners and managers have realized that the risk-based approach can be improved by a resilience perspective, whose aim is to guarantee the critical functions associated with a given level of disruption (Nogal & O’Connor, forthcoming), whereby the threshold relates to the tipping point where the required services cannot be provided anymore, and might vary over time with the improvement or worsening of the situation. For instance, it is a waste of resources to design a railway that provides the same level of reliability in normal situations as under an extreme (though statistically probable) snowstorm. Resilience management of transportation systems might be defined as the culture, processes and structures directed towards the effective management of passenger demand, goods supply, and services under different internal and external shocks and stresses, compatible with the resilience of other related systems. This chapter is focused on resilience management applied to transportation systems, where the user-oriented perspective is a key aspect to establish the role of the transportation system within a larger system consisting of many other systems, such as health, finance, and power. In other words, society is the guiding thread connecting them (Allen, Angeler, Garmestani, Gunderson & Holling, 2014). Resilience management in transportation networks following Hurricane Irma In September 2017, Florida suffered Hurricane Irma, which impacted with maintained 298 km/h winds for 37 hours in total, the longest period at this speed ever recorded, causing 84 fatalities. Under the threat of Hurricane Irma, 6.5 million people were evacuated from Florida to head north using land-based transport networks. To allow such a massive evacuation, tolls were suspended and the left shoulder of I-75 (northbound) and I-4 (eastbound) were opened to traffic. The shoulder-use plan for evacuations was put in place for the first time by the Florida Department of Transportation. Supported by theoretical studies, in comparison with the traditional contraflow plan, the new plan would provide similar evacuation capacity, reducing the personnel, resources (e.g., highway patrol cars, orange cones) and time required to implement, and avoiding the head-on collisions between confused drivers. Despite these measures, important traffic congestion in major roads (e.g., northbound I-95, I-75, and Turnpike) was registered, exacerbated by the long lines at fuel stations, which, in turn, suffered from fuel shortage as a consequence of Hurricane Harvey (September 2017). For the case presented, traffic jams, hours to obtain fuel and free toll-roads might be understood as a clear failure of the transport system under a risk-based perspective, where a fixed threshold related to a well-functioning system may be assumed. Indeed, the concept of system failure is a key aspect to understand the transition from the risk-centered vision to a resilience-centered vision. Under a resilience perspective, the main function of the transport system in this case was the safe evacuation of the population. Thus, the evacuation of 6.5 million people in less than five days cannot be considered as a failure. Nevertheless, there is room for improvement, e.g., four fatalities were registered due to car crashes. If a fixed threshold in terms of mobility conditions were established under any possible situation, the required effort and cost to guarantee that the system is always above this threshold would be absolutely disproportionate. Therefore, it is crucial to prioritize objectives and accept some non-optimal states compatible with the intensity of the hazardous event. A distinguishing characteristic of the Resilience Management is the inclusion of a feedback process, which allows the improvement of the system to future events, sometimes materialized by adaptation plans (Florin & Linkov, 2016). In the aftermath of the hurricane, a Committee on Hurricane Response and Preparedness was created to analyze the response and take advantage of the lessons learned from the experience. Among the several themes discussed, some recommendations were identified in terms of evacuation to improve the preparedness level to future events. They can be summarized in (a) to extend the evacuation road networks, (b) to include contraflow lanes were appropriate, (c) to use rail transport to evacuate people and meet fuel demands, (d) to provide Floridians with real-time information regarding the evacuation choices, and (e) community education (Florida House of Representatives, 2018). Among these recommendations to improve the resilience of the system, the last two points are highlighted. Risk management commonly focuses on the physical aspects of the system. The social aspects and how information is created, shared and understood, if considered, are assumed as secondary aspects. In the case of Hurricane Irma, the relevance of the social, the information and the cognitive domains to improve the response of the system was identified by the Committee. They are aspects that make a difference between a safe infrastructure system and a resilient one. Besides, the coordinated response is crucial between different decision-makers, infrastructure managers and operators, emergency responders, and other stakeholders. Given the short time to coordinate the operations, an established protocol with clear objectives and hierarchies is mandatory. Florida, an area commonly affected by hurricanes, has improved its resilience to hurricanes over time through a loop process of preparedness, response, recovery and learning with each event (Wood, Wells, Rice & Linkov, 2018) (Nogal, 2018). As indicated, a few days before Hurricane Irma occurred, Hurricane Harvey had impacted the area, causing fuel shortage, among other issues. The relevance of a recovery plan, strategically designed prioritizing on key aspects, e.g., fuel supply, is here observed. Resilience management extends the classical risk management by including this post-event layer. In terms of transportation, one of the reasons to implement the shoulder-use plan is that allows a natural, smoother transition to normal operation by drivers. Hurricane Irma case has evidenced how transport systems are at the service of the overall society, therefore, the needs of the society at each time should define the functions to be developed by transport systems with an integrative vision that includes all other systems (e.g., health, power, financial, etc.). Building a resilient future Let’s imagine that a practitioner designs a wall to avoid potential landslides affecting a road. Because climate change might increase the risk of landslides in the area, the engineer, following his/her risk-based perspective, thinks that a bigger wall should be built to guarantee the safety level. Nevertheless, the combination of a smaller wall designed to resist the probable landslides, with a number of soft measures, such as use of vegetation and surface drainage techniques (e.g., buried drains) (Gavin & Djidara, 2015), and monitoring and warning systems for very low- probability events, might be a more inexpensive solution, which is also safer, not only in relation to landslides, but to a wider range of threats. This simple example of a resilient solution is presented to show that resilience-building is not about accepting a certain degree of risk but modifies the point of how to deal with risk. Note that the core functions of the transportation system are safety and security, and they should be always guaranteed. Different performance of the transportation system is then expected under different disturbing scenarios, e.g., a hurricane or a strike. Therefore, when a hazardous event occurs, it might be expected that the system performance fulfils a series of functions (those identified as more relevant) but not others, causing that some actors, such as some users, might feel not entirely satisfied, if not negatively affected. The Florida case presented before shows that there is a number of actors involved, from transportation authorities to rescue services, politicians and social media. To avoid misunderstanding and even misuse of the decisions taken under a resilience umbrella, resilience-based decisions should be backed by programs and protocols defined in advance seeking consensus with stakeholders. To develop a well-defined resilient transportation system, it is important to build on the social responsibility and awareness of the different stakeholders. We claim that transitions to a resilient future require the definition of cross-sectorial visions and feasible action pathways to achieve such visions. With that aim, a map of the desirable resilient future considering a holistic perspective of the transport system as a part of a bigger system, should be envisaged. Then, the feasibility should be assessed through backcasting, where policies and programs connecting the future and present are identified. Here the main actors and their roles within the process have to be clearly identified. Special attention has to be paid to coordination among agencies, coordination among transport modes, cross-border governance arrangements, adequate communication tools and social education to engage users.
Resilience: Moving forward from a metaphor	Palma-Oliveira & Trump	Resilience: Moving Forward from a Metaphor José Palma-Oliveirai* and Benjamin D. Trumpi i University of Lisbon, Portugal Suggested citation: Palma-Oliveira, J., & Trump, B. D. (2018). Resilience: Moving forward from a metaphor. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience, complex systems, systemic risk, tipping point *Corresponding author: jpalma-oliveira@psicologia.ulisboa.pt Resilience and complex systems Resilience remains a field of tremendous potential to improve the management and sustainability of ecological and environmental systems – particularly in the manner by which humans engage within them. Many papers have argued that as a property of a system, resilience focuses upon ‘bouncing back’ to an initial steady state. Further, others operate under the assumption that resilience is a normatively positive characteristic to possess and tends to produce desirable outcomes. While in many cases this is somewhat true, in others it raises the threat of misdiagnosis of systemic threats as well as mismanagement of at-risk ecological systems. In volume 1 of IRGC’s Resource Guide on Resilience (Palma-Oliveira & Trump, 2016), we argued that the methodological promise of resilience is being overshadowed by its use as a metaphor for sustaining a system’s ideal state. In this volume, we argue that an improved application and scientifically-grounded understanding of ecological resilience can be formulated by an improved understanding of when such systems reach tipping or transition points. Scholarly literature such as Walker et al. (2004), Folke et al. (2010), Gallopin (2006), and Dai et al. (2012) offer scientifically- grounded approaches to model and assess ecosystem and environmental resilience as a measure of whether the current environmental system is stable, or whether it is nearing a tipping or transformation point. We apply the logic of such literature to emerging environmental and ecological concerns such as ocean pollution and climate change and describe how normatively positive or negative influences have the potential to shift an environmental system into a differing stable state. Risk, resilience, and complex adaptive systems Neither risk nor resilience are new disciplines. From an environmental perspective, the Ancient Egyptians regularly reviewed risk-based predictions for the annual inundation of the Nile River – excessive inundation could flood and destroy fields and rot crops, while too little flooding would limit grain production and threaten starvation for the land. Likewise, resilience has been used as a term to define systemic capacity to overcome disruption for at least two thousand years, such as with resiliency in Roman Republican rule despite political infighting, economic woes, or natural disasters (Alexander, 2013). More recently, the risk/resilience divide has become clearer and more bound to methodological practice (Linkov & Trump, 2019). On one hand, risk analysis in the environmental practice has centred upon reviewing the potential hazards to a component of a system, mapping the vulnerabilities of the system component to the hazard, and the ultimate consequences should that vulnerability be exploited. This has allowed eminent scientists, government agencies, NGOs, and scholars to better understand various environmental threats such as with the continual use of dichlorodiphenyltrichloroethane (DDT) chemical sprays as insecticide to human or environmental health, or the impact of chlorofluorocarbon (CFC) use upon the ozone layer. Decades of risk-based research have demonstrated that when we can clearly identify and unpack a specific threat (or ‘risk object’) to a specific target within the environment (or ‘object at risk’), we can often calculate the relative riskiness that such a threat has and make specific determinations regarding its safe use and good governance (Boholm & Corvellec, 2011). However, when the risk object is poorly understood, or the object at risk is incredibly complex and consists of many nested sub-systems, traditional risk analysis does not generate the same level of quantitative rigor that decision makers normally require. Further, there is often a lack of consensus amongst the different groups regarding whether something is a risk object or an object at risk (Palma-Oliveira et al., 2018). This is reflected in many emerging challenges today, ranging from global climate change to the sudden spread of harmful algal blooms generated by certain species of phytoplankton and dinoflagellates (known colloquially as ‘red tide’), where complex systems encounter a sudden yet poorly predicted shock to their equilibria. Without reliable risk forecasting and signal detection, as well as data to unpack the hazard, exposure, and effects assessment necessary to conduct risk analysis, systemic shocks to complex environmental systems are generally difficult to predict or solve with a risk-based approach. Resilience affords greater clarity over such threats (particularly systemic threats) by focusing upon the inherent structure of the system, its core characteristics, and the relationship that various sub- systems have with one another to generate an ecosystem’s baseline state of health (IRGC, 2018). Walker et al. (2004) define ecosystem equilibria as a characteristic of “basins of attraction”, where the components and characteristics of a system drive it towards a baseline state of health and performance. For example, the Pacific Ocean is a huge and complex ecosystem with a tremendous diversity of flora and fauna whose roles in complex food webs have been reinforced by millions of years of evolution and adaptivity; a localized oil spill may damage small points of ecosystem health but is unlikely to dramatically and permanently shift the species dynamics and food webs which currently prevail across most of the Ocean. However, through constant exposure to trillions of microplastics (i.e., the Pacific Trash Vortex) or continuous chemical and radiological contaminants (i.e. bleaching of the Great Barrier Reef, radiological runoff from the Fukushima Daiichi Nuclear Power Plant), system equilibria can be jolted in a manner that favours a differing basin of attraction. Unfortunately, we are moving in that direction already, where huge regions of oxygen-depletion in the Pacific Ocean are contributing to ‘dead zones’ where virtually no marine life can survive. Figure 1: Illustration of a complex interconnected environmental system (Linkov & Trump, in press) Both the initial Pacific Ocean baseline state of health (a larger, global system), as well as these dead zones (sub-system within the Pacific Ocean global system), are fundamentally resilient systems that are defined by basins of attraction which possess characteristics that reinforce the status quo in the absence of a shock or disruption. On one hand, a biologically rich and diverse Pacific biological system has recovered from a tremendous array of disruptions over the past century, or adapted system processes in a way that address incoming challenges such as with large-scale commercial fishing. However, continuous overfishing along with chemical and radiological runoff are disrupting the Pacific ecosystem enough to potentially transition it towards a new and less biologically complex basin of attraction. This will be further discussed in the last section. More than just a metaphor, ecosystem resilience describes the intensity of a given ecological basin of attraction to preserve the baseline state of health and activity within a given area, whether that state is optimum, desirable or not. It could be normatively positive (i.e., a complex and biodiverse Pacific Ocean) or negative (i.e., a Pacific Ocean comprised of huge dead zones and limited biodiversity). Methodologically, such basins of attraction are comprised of complex interconnected and adaptive systems that are constantly under stress, yet only shift to a new equilibrium if a tipping point has been breached and the system is trending towards a new basin. More than just system recovery and adaptation, ecosystem resilience is a property of natural selection and organism interaction within their broader environment in a manner that produces some sustainable end-state. Such resilience-based approaches can help us understand when and how certain ecosystems might shift from one steady-state to another (Linkov et al., 2018), as well as define the biological and ecological drivers which cause an ecosystem to arrive at a steady equilibrium altogether. In the modern age, there is no socioecological system that is not influenced by human behaviour or activity. Increasingly, many research organizations find that human activity is directly or indirectly pushing environmental and ecological systems from an initial condition of high biodiversity and systemic complexity, towards more simple, less diverse, and less hospitable climates and food webs. Some human-derived disruptions are relatively abrupt (e.g., industrial logging in tropical rainforests) or more gradual in effect (e.g., ocean pollution), yet both tend to drive such environmental and ecological systems towards a tipping point that limits the potential for diverse environmental life. Such a system is resilient yet normatively unfavourable, where significant energy and resources would have to be dedicated towards returning an at-risk environment to its original basin of attraction. Risk, resilience, and the nagging worry of brittleness It is critically important for practitioners to acknowledge, in spite of the benefits of such a governing strategy, the drawbacks of a resilience-based approach for ecosystem health. While facilitating the expeditious recovery of normatively positive systems from disruption is a helpful goal for ecosystem health, it is essential to acknowledge how developing ecological and biological properties resistant to transition or transformation can contribute to inherent brittleness in certain areas of the ecosystem. In essence, resilience-based drawbacks arrive in two areas: an ecosystem that is believed to be resilient and thus can withstand and recover from virtually any disruption (and thereby taking few steps to protect against such disruptions), or the simultaneous development of areas of systemic brittleness while fostering resilience in others. We have already seen countless examples of the former. Widespread overfishing, dumping of waste, or atmospheric pollution have been rampant within the 20th and 21st Centuries despite evidence that related ecosystems were more fragile, unsustainable and not resilient, and many international agreements to reduce such damage. Many reference a belief in the inherent resilience of the system as a root cause of the acceptability of such behaviour, contributing to classic tragedies of the commons and anticommons. A belief in ecosystem resilience reinforces commons-related problems worldwide by enabling feedback mechanisms and social traps which cause individuals to behave in socially and globally harmful manners. For the latter, developing resilient properties in some areas of complex ecosystems can generate brittleness in others. For example, some scholars have discussed the use of gene drives to improve the resistance of endangered species of coral to bleaching as well as to improve its ability to survive and reproduce in various other hazardous environmental conditions (notably, the Great Barrier Reef). Such genetic changes would foster increased capacity for at-risk coral to resist bleaching (vis- à-vis a ‘risk-based approach’) as well as potentially enable various species of coral to quickly recover from other possible disruptions in the future such as ocean acidification (a ‘resilience-based approach’ which emphasizes quick recovery and adaptation to future potential threats). However, the use of a gene drive for coral conservation and resiliency might have unintended side effects, such as threats to biodiversity via horizontal gene transfer, or potentially through excessive growth of such coral reefs in a manner that outstrips local food supplies. This is not to rule out such a technological solution to a complex ecosystem concern, but a necessary governance challenge of any effort to develop ecosystem resiliency must consider the unintended consequences of causing one species of flora or fauna to outperform or proliferate in a manner outside of the current ecosystem equilibrium. Further, one must acknowledge how an intervention to a specific sub-system (e.g., the Great Barrier Reef) might trigger secondary effects to nested sub-systems (other marine life) or the larger global system (the South Pacific Ocean). Resilience means adaptation: Basins of attraction and transition points Shocks and stresses are frequently discussed in scholarly literature as disruption events for complex systems, yet rarely acknowledge that such disruptions can contribute to (a) a reorganization of the same general system, or (b) contribute to a collapse of the original system, and foster the creation of a new system and basin of attraction altogether. For the former, some disruptions can generate substantial change in some areas yet preserve the overall system’s functions and characteristics. For example, many forest fires can destroy large forests, yet in the aftermath of such fires an environmental system can use the nutrients from the burned flora to foster new tree growth. Elements or subcomponents of the forest system may change over time in response to such fires, yet the baseline characteristics of that system are often able to return to prominence. Other disruptions generate collapses in the status quo system altogether. If a disruption is particularly consequential and removes the preconditions by which the system can recover and reorganize in a manner similar to the initial system structure, such a disruption can instead cause the destruction of the original system in favour of one that is entirely different in its characteristics and baseline state of health. For example, the widespread dumping and persistence of plastic in the Pacific Ocean is dramatically altering the capacity of ocean regions to sustain marine line, and limit localized ecosystems to tolerate only those organisms which can persist with minimal sunlight or oxygen. All systems are dynamically interconnected and are continually interacting and adapting within and across one another to best compete and operate within a given system paradigm. This idea, known academically as panarchy, is particularly salient when describing environmental and ecological systems as well as the foundational theories of evolution and natural selection. While there are many drivers which influence and shift behaviour within one or more components of a system, we identify three key influences of ecosystem adaptation and transition, including (a) solar and climatological influences, (b) bio-geological forces, and (c) socioeconomic human activity. More simply put, the interrelationships between humans, local ecosystems, and global climate and solar activity collectively influence the (in)stability of environmental systems, as well as how certain disruptions may or may not disrupt the current basin of attraction. Typically, bottom-up disruptions at localized levels rarely can trigger greater systemic transformations, yet they can shift or alter the characteristics of ecosystem health. Likewise, disruptions at the global level of a system (e.g., solar storms, ozone depletion, etc.) can trigger rapid and disastrous systemic risks that can fundamentally change the nature of life on Earth. The critical question of how such systems are governed depends upon where and how a potential disruption may occur – on a local level that may be resolved via limited or directed engagement such as with environmental remediation of a contaminated site, or on a global scale that requires the coordination of many actors to reduce the threat of global catastrophe, such as with the effect of CFCs upon the global ozone layer. The purpose of developing a normatively positive, resilient system is to instil within it the capabilities to incorporate new information within the environment, and adapt accordingly to such stimuli in order to adapt to all the types of changes and tipping points described above. Reviewing Walker et al. (2004), ecosystem resilience is defined by its tipping points, or transitionary periods, where a shock or stress will push a system away from one basin of attraction and into another. The critical question for policy- and decision-makers pertinent to environmental policy centers upon how can we utilize opportunities to transition our system to not just maintain the status quo, but even adapt to produce a more normatively positive outcome altogether? Any ecosystem resilience effort must incorporate the realities of adaptation, transitions, and transformations as a foundational component of evolutionary biology. Ecosystems are constantly in flux and adapting to new stimuli – some of which have the potential to remove it from one point of equilibrium to another. Sometimes this is relatively simple – an oil spill can be cleaned up, and its harms addressed through intense bioremediation over a few months. Other times this is quite difficult, such as the many steps needed to address harmful algal blooms in environmentally sensitive waters or to remove tons of plastic waste from ocean gyres. In ecological and environmental management, it is essential not only to identify the opportunities for such transitions, but to accurately characterize the drivers which could influence a local ecosystem away from a harmful or normatively negative basin of attraction, and towards one more beneficial to human and environmental health.
Resilience assessment in homeland security	Petit	Resilience Assessment in Homeland Security Frédéric Petiti* i Decision and Infrastructure Sciences Division, Argonne National Laboratory Suggested citation: Petit, F. (2018). Resilience assessment in homeland security. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Critical infrastructure, infrastructure interdependencies, resilience assessment, homeland security *Corresponding author: fpetit@anl.gov Definition of resilience The need to understand and enhance the protection of the United States critical infrastructure has been a national focus since the President’s Commission on Critical Infrastructure Protection was established in 1996 (President’s Commission on Critical Infrastructure Protection, 1997). Although resilience has been defined and studied in several fields (e.g., ecology, social science, economy, and computing) since the 1970s, it is only recently that this concept is used in homeland security for the management of critical infrastructure systems. In 2011 and 2013, the release of Presidential Policy Directive (PPD)-8 on National Preparedness and PPD-21 on Critical Infrastructure Security and Resilience expanded on the importance of understanding the resilience of citizens, communities, and critical infrastructure. PPD-8 aimed at strengthening the security and resilience of the United States by directing the development of a national preparedness goal that identifies the core capabilities necessary for preparedness and a national preparedness system to guide activities that will enable the resilience enhancement of the nation (DHS, 2011). PPD-21 is more specific to critical infrastructure because it establishes the roles and responsibilities of the Secretary of the Department of Homeland Security (DHS) to strengthen the security and resilience of all 16 critical infrastructure sectors. PPD-21 specifically calls for operational and strategic analysis to inform planning and operational decisions regarding critical infrastructure and to recommend resilience enhancement measures (The White House, 2013). Following the work conducted by the National Infrastructure Advisory Council (NIAC, 2009) (NIAC, 2010) and the National Academies of Sciences, Engineering, and Medicine (The National Academies, 2012), PPD-21 defined critical infrastructure resilience as “the ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruptions.” (The White House, 2013) Resilience is therefore about the change of state of the infrastructure system and integrates the system’s capability to adapt and transform its operations to deal with stresses and maintain an acceptable level of functioning. Assessing resilience requires to consider the evolution of the state of the infrastructure system over time, and to determine both the amount by which the activity/well- being declines and the amount of time required to return to the pre-event level of operations or to a new level of equilibrium. Therefore, elements characterizing the capabilities of the infrastructure systems both before (i.e., anticipation, resistance, and absorption) and after (i.e., response, adaptation, and recovery) an adverse event occurs are important to consider in resilience definition and strategies. The 2013 edition of the National Infrastructure Protection Plan followed PPD-21 and reinforced the need to “enhance critical infrastructure resilience by minimizing the adverse consequences of incidents through advance planning and mitigation efforts, and employing effective responses to save lives and ensure the rapid recovery of essential services” (DHS, 2013). These strategy documents are completed by government agencies’ strategic plans that operationalize the consideration of both security and resilience measures in risk management approaches. DHS has developed several of these plans. The DHS Office of Infrastructure Protection (IP) Strategic Plan 2012–2016 establishes the goals for the DHS IP to improve risk management activities and enhance resilience through better understanding of critical assets, systems, and networks’ operations (DHS, 2012). In 2015, the DHS developed the National Critical Infrastructure Security and Resilience Research and Development Plan (CSIR) to guide prioritization of research and development efforts within DHS. Among the tenets articulated for the CISR, is that “[m]etrics, standard methods of assessment, and baselines must continue to be developed and refined to effectively measure resilience” (DHS, 2015). DHS has also developed specific programs, such as the Regional Resiliency Assessment Program (RRAP), to address the objectives of its strategic plans. RRAP is an interagency and cooperative assessment of specific critical infrastructure within a designated geographic area (DHS, 2017). RRAP projects are initiated to respond to stakeholders’ requirements. Some RRAPs specifically analyze infrastructure systems and propose resilience enhancement options and operational alternatives to reinforce the robustness of critical infrastructure. Critical Infrastructure are complex networks mandated to provide resources and services that support the functioning of a socio-economic society and to satisfy its basic needs. Thus, it is necessary to keep these systems operational both on a daily basis and in time of emergencies. Resilience strategies represent a shift in traditional risk and emergency management perspectives from attempting to control changes in systems that are assumed to be stable, to sustaining and enhancing the capacity of socio-technical systems to adapt to uncertainty and emerging threats. Ultimately, the main goal of resilience strategies is to enable decision-makers to make informed choices that will result in cost-effective reductions in the level and duration of consequences associated with the range of potential natural and man-made threats. When risk management strategies focus more on enhancing the protection of critical infrastructure to probable hazards, resilience strategies seek more specifically to promote business continuity and continuity of operations to enhance infrastructure systems’ emergency management capabilities to cope with unanticipated threats (i.e., the famous black swan events). In the last 20 years, U.S. policies addressing critical infrastructure evolved from privileging risk management approaches focusing on protection against man-made threats to all-hazard approaches considering both security and resilience management strategies. Even if the concept of resilience is defined in national policies, discussions are still ongoing about the resilience components, the relationship between risk and resilience, and the characterization of resilience metrics. One of the main concerns is the absence of industry or government initiative to develop a consensus on or to implement standardized assessment approaches (DOE, 2017). To address this issue for the energy sector, the U.S. Department of Energy (DOE) developed the DOE Grid Modernization Laboratory Consortium (GMLC) with the objective to help shape the future of the electric grid and ensure its protection and resilience (DOE, 2018). Among all initiatives conducted by the GMLC, one project specifically addresses the development and application of analysis metrics (i.e., reliability, resilience, sustainability, flexibility, affordability, and security) for assessing the evolving state of the U.S. electricity system and monitoring progress in modernizing the electric grid (GMLC, 2017). Resilience: A component of risk management Over the ages, traditional approaches of critical infrastructure protection have focused mainly on the consideration of consequences and vulnerability to man-made hazards. However, methods used to define and analyze risk are constantly evolving. This evolution of homeland security from protection to the resilience of the Nation and its critical infrastructure raises a question about the relationship between risk and resilience. Risk is traditionally defined as a function of three elements: the threats to which an asset is susceptible, the vulnerabilities of the asset to the threat, and the consequences potentially generated by the degradation of the asset. If risk is a function of threats and hazards, vulnerabilities, and consequences, the challenge is to define where and how resilience fits into the determination of risk? The answer to this question is difficult yet important because it supports the development of risk and resilience assessment methodologies. As identified in national policies, such as the 2013 National Infrastructure Protection Plan, (DHS, 2013) risk management includes resilience, as well as promoting an all-hazards approach that integrates man-made threats and natural hazards. This evolution constitutes a major change of paradigm in terms of homeland security. Ways to assess risk to critical infrastructure have evolved, from methods that were based only on protective measures and vulnerability, to methods that integrate resilience. In order to manage critical infrastructure effectively from a “risk perspective,” it is necessary to form an approach that is not based exclusively on protection and prevention. Risk and emergency management must include a balance between preparedness, mitigation, response, and recovery. The progression of risk management for critical infrastructure must consist of an evolution and incorporation of resilience and service continuity, a more comprehensive involvement of all stakeholders (including the public) based on strong information sharing, and training and education processes that includes the effects from infrastructure interdependencies. Even if in recent homeland security policies and business standards, resilience concepts are included in risk management strategies, a distinction can be made between strategies seeking to eliminate or transfer the risk and strategies seeking to maintain critical infrastructure operations. The first type of strategies, usually named risk management strategies, tries to eliminate negative consequences by implementing protection measures that reduce threats and vulnerabilities. The second type of strategies tries to maintain consequences at an acceptable level by implementing preparedness, mitigation, response, and recovery measures. In general, protective measures are specific to a threat type and they obviously require knowing the threat. Resilience measures, on the other hand, can be specific to a given threat or can be general to apply to not yet identified threats. When, for protective measures, failure is not an option, resilience measures require to envision failure as being possible and to implement capabilities that will allow the system to react, adapt, and potentially transform. Resilience strategies require flexibility that can be supported by strong collaboration and information sharing mechanisms, but also by the development of business continuity and emergency management planning and exercises. Risk management and resilience management strategies are inseparable and complementary. Risk management strategies are implemented to mitigate known threats and resilience management strategies are implemented in case the protection measures are not sufficient to prevent negative consequences resulting from known or unknown threats. Comparing the costs of risk management or resilience management strategies is difficult. It depends on so many factors including the difficulty to define the return on investment and to prove that the absence or limitation of critical infrastructure dysfunctions result from the implementation of management strategies. Implementing resilience strategies requires changing traditional risk management approaches to consider both known and unknown hazards, and to base the assessments on critical infrastructure capabilities to cope with unidentified low probability high impact events. It is therefore difficult to justify investments and define resulting return on investments when the threats and their consequences are by definition unknown. However, developing resilience management strategies to enhance the flexibility and adaptability of critical infrastructure systems is always beneficial to maintain the systems’ operations at an acceptable level and this whatever the type and importance of threat or hazard. Resilience strategies to reduce undesired consequences Comprehensive risk and resilience management strategies require collaborative and multidisciplinary approaches to combine social, economic, and technical points of view to fully elucidate the full range of influences acting upon an organisation, from the individual asset to the system level. This requires combining social and system engineering methodologies to inform multi- organisational decision-making and prioritize activities to reduce consequences duration and importance, and therefore maintain acceptable levels of critical infrastructure operations. The next generation of resilience management methodologies needs to be developed at a regional level. The tendency for critical infrastructure to be managed and regulated in isolation from one another hampers the understanding of challenges arising from interdependencies. Resilience management approaches need to move beyond developing business continuity and emergency management plans that focus mainly on facilities and assets, to developing plans that consider regional resilience management capabilities and integrate elements that may be outside of one organization’s control. It is not sufficient to have generators, fuel storage, and refueling priority to prepare for a power outage. Enhancing the protection and resilience of critical infrastructure requires the promotion of regional coordination, the definition of restoration priority, and the reallocation of resources to limit consequences and channel potential cascading failures. Critical infrastructure should determine which of their missions, functions, and assets are critically dependent on the services or resources provided by other organizations. After prioritizing their operations, critical infrastructure should organize collaborative and secure exchanges with their suppliers and regional emergency managers to coordinate decision-making and achieve the greatest benefit for the most critical needs. The definition of an acceptable level of consequences is the first potential drawback for implementing resilience but also risk management strategies. Conceptually (and before an event), it is relatively easy to decide to prioritize response and recovery activities, and to decide to channel the consequences resulting from cascading and escalating failures. The reality may be different when the adverse event occurs. The main challenge is to define the risk ownership and to decide who will deal with the consequences, but also to prove that the actions taken will be beneficial for most (if not all) stakeholders. The second potential drawback is directly related to the need of regional coordination that requires developing collaborative approaches and information sharing mechanisms. Communication is an important, and too often forgotten, phase of risk management. A process for improving the protection and resilience of critical infrastructure cannot be effective without considering the several stakeholders involved in critical infrastructure management and regional emergency management, including the public. In risk management, it is always difficult to define what information must be communicated, to whom, and how. The development of processes that maintain a balance between protecting sensitive information (from a business and/or national security perspective) and providing emergency managers with necessary information continue to be a challenge. Understanding regional security and safety capabilities is beneficial for harmonizing resilience strategies. However, an intelligent adversary can also use this information to exploit existing weaknesses. Identifying and admitting that your system can fail can also generate a loss of public confidence and affect critical infrastructure business activities. The difficulty to define what consequences are acceptable and what and how information should be shared can be addressed by building a trusted environment to promote a sustainable development culture based on education and training. The development of trust must be supported by mechanisms to operationalize standards and policies promoting collaborative approaches and partnerships between critical infrastructure owners/operators and government representatives. Furthermore, the objective of resilience management strategies is to complement risk management strategies, which primarily address threats and vulnerabilities, by promoting flexible and adaptive approaches to further reduce undesired consequences. Resilience is a subset of risk specifically influencing the level of consequences resulting from detrimental events. Therefore, the implementation of resilience strategies is generally beneficial to decrease risk levels. However, all components of risk (i.e., threat, vulnerability, resilience, and consequence) are interdependent. For example, vulnerability and resilience are strongly related to the state of the system considered. Consequently, implementation of resilience strategies can affect the vulnerability levels. Resilience strategies are based on information sharing of vulnerabilities, protection and resilience measures, and regional capabilities, to lower the duration and importance of negative consequences. This can create additional vulnerabilities and therefore increase risk levels if this sensitive information is not protected and accessed by malicious people. Integrating critical infrastructure interdependencies in resilience management strategies Assuring critical infrastructure continuity of operations requires to consider the complexity of their organization but also to understand the diversity of threats they could face. Critical infrastructure assets are part of a “system of systems” and cannot be considered independently of their operating environment. As described by Rinaldi, Peerenboom, & Kelly (2001): “it is clearly impossible to adequately analyze or understand the behavior of a given infrastructure in isolation from the environment or other infrastructures”. These interconnections mean that disruption or failure of one element can lead to cascading failures in others. Interdependencies among infrastructure systems can result in important economic and physical damage on a citywide, regional, or even national or international scale. A critical infrastructure is thus in constant interaction with its environment, using and transforming inputs (i.e., critical services and resources) from the environment in order to provide outputs to the same environment. Several elements of its environment may directly affect the operations of a critical infrastructure, including economic and business opportunities and concerns, public policy, government investment decisions, legal and regulatory concerns, technical and security issues, social and political concerns, and public health and safety. (Rinaldi, Peerenboom, & Kelly, 2001) The modern society faces an ongoing challenge of maintaining critical infrastructure performance and avoiding significant damage caused by extreme weather events (e.g. floods, earthquakes, hurricanes), manmade events (e.g., malevolence, terrorism), and aging equipment. As these events continue to increase in both frequency and intensity, the efforts of owners and operators to enhance the resilience of their systems are more crucial than ever. New technologies increase the complexity of assessing the resilience and security of critical infrastructure and the whole society. As a consequence, interdependency relationships among critical infrastructure assets and emerging threats must be characterized to anticipate how a change in these connections could affect critical infrastructure operations. Based on the anticipation of what could constitute the future operating environment of critical infrastructure systems, the implementation of resilience strategies, by promoting coordination and collaboration at regional level, will help defining how critical infrastructure should modify (i.e., adapt or transform) their operations. Several approaches exist for defining security and resilience metrics but holistic risk and resilience assessments must go beyond traditional assessment approaches to integrate currently unknown threats in order to improve sustainability of today’s complex global systems (i.e., business, technology, society). While organizational resilience and business continuity standards already exist, there is still a need to find new ways to anticipate and be prepared for emerging and hybrid threats but also to institutionalize security and resilience more holistically both nationally and internationally. Building codes and standards need to be enhanced to better integrate the concepts of resilience, define common terminology and protocols, propose indicators to compare and benchmark practices. Standardization approaches cannot be sectorial; it is necessary to emphasize community-scale issues in standardizing an approach to critical infrastructure and community resilience. Resilience standards should propose procedures for early recognition/identification and monitoring of emerging risks, and assessment framework for managing these new risks. The challenge is to go beyond traditional risk management approaches based on historical data and to design critical infrastructure systems that will be adapted to their future socio-ecological environment and that will respond to current and future population needs.
Unlocking organizational resilience	Pulakos & Lusk	Unlocking Organizational Resilience Elaine D. Pulakosi and Derek Luskii* i PDRI ii Russell Reynolds Associates Suggested citation: Pulakos, E. D., & Lusk, D. (2018). Unlocking organizational resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Organizational resilience, psychology, values, behavioral *Corresponding author: Derek.Lusk@russellreynolds.com The meaning and measurement of resilience in industrial and organizational (IO) psychology Resilience is a word we hear frequently today, cited as an essential element for survival in today’s fast-paced, complex work environment that is characterized by disruptive change. In the field of IO psychology, resilience is studied at multiple levels – individual, team, and organizational, sometimes as a predictor of key performance outcomes and sometimes as the performance that is predicted by other factors. At the individual level, resilience is often defined and measured as an individual difference construct that is part of one’s personality – hence, it is a person’s innate disposition to bounce back quickly (or less quickly) from hardship. Individual resilience is also defined in terms of work behaviors that are critical for effective job performance; for example, “staying focused and continuing to perform tasks at hand in the face of tragic situations” is an important behavioral criterion in many jobs. As a criterion measure, resilient performance is typically measured through scaled performance ratings made by those with opportunities to observe employees on the job. The construct of resilience changes in nature at the team level as interest moves to how quickly an entire team can recover or bounce back from failure to return to a prior positive state of effectiveness. Assessing resilience at this level could entail measuring a variety of team processes, attitudes, and outcomes following a derailing event and comparing these to baseline measures to evaluate the recovery process. Hence the definition and measurement of resilience at the team level is quite different from the individual level with respect to both what is measured and how conclusions are drawn. At the organizational level, measuring resilience is yet different again, entailing assessment of a number of organizational characteristics and outcomes that collectively capture how effectively entire organizations bounce back from disruption or how long this takes. At the different levels at which IO psychologists operate, then, resilience is defined, predicted and measured in significantly different ways. A further complication with resilience in the field of IO psychology is that aside from resilience measured as an individual personality construct, there is no agreement about how resilience is defined or a standard way it is measured from study to study. Definitions of resilience in the literature range from narrower concepts, such as bouncing back, recovery, or re-invention after a jolt to broader definitions that incorporate related concepts like agility, flexibility, and adaptability. Resilience has been included in many models of individual, team, and organizational effectiveness (e.g., Pulakos, Arad, Donovan, & Plamondon, 2001), with many different proposed antecedents and outcomes. Summarizing and comparing all of these in a meaningful manner is beyond the scope of the present article. Recently, however, the concept of organizational resilience has become much more focal in IO psychology, as organizations struggle to achieve competitive advantage and survive in a disruptively changing world. Evidence-based models have begun defining resilience more clearly within this context and examining its antecedents and consequences, as well as its relationship with similar concepts, like agility and adaptability. The goal is to better understand how organizations can best create competitive advantage in the face of today’s threats - hyper-competition, knowledge commoditization, and relentless change. A recent, comprehensive model proposed by Pulakos, Schneider, and Kantrowitz (2018) offers new insights about what must be in place as well as the processes that rely on adaptability, resilience, and agility (ARA), with these concepts defined as follows: . Adaptability is reacting to externally imposed change to sustain or increase performance . Resilience is recovering and bouncing back to a prior positive state following jolts . Agility is proactively sensing and redirecting to chart a new path to success by reallocating energy to building new capabilities and ceasing what no longer creates value. Behavioral and values-based antecedents Several organizational processes and characteristics need to be in place to create ARA that enables competitive advantage. For the present purposes, however, we focus on the role of leaders because leadership needs to create the conditions for ARA to exist. What leaders in organizations do and their values define the context for performance and these have a tremendous impact on team and organizational ARA (Pulakos et al., 2018). To enable resilience, in particular, leaders must create certain types of foundational stability for organizations to flourish in disruption and change. They need to articulate a compelling mission and strategy that engages employees, provides sufficient resources to deliver the strategy, and embeds real time feedback to reduce ambiguity. They also need to lead the way in the development of recovery plans to accelerate resilience in handling failure and jolts. These things allow employees to focus on work, with less distraction and concern about how they are viewed and what they need to do to succeed. Certain leader values are also important for ARA. Values shine through in leader actions and attitudes, providing powerful influences on the mindsets, engagement, and actions of organizational members. Reason, acceptance, and achievement are particularly important values for resilience. These come from a time-tested model, grounded in evolutionary biology, in which an organism’s survival depends on its ability to adapt to change and transition from one situation or state to another (Hogan & Blickle, 2018). These values have been associated with high performing organizations across industries, sectors, and business cycles. These, like all values, are measured by using structured assessments in which respondents select responses that best reflect their views, principles, and beliefs. . Reason is the process of working to find an objective reality that exists outside intuition or faith (Pinker, 2018). The importance of reason as a value is supported by the scientific revolution of the 16th-18th centuries in which progressive intellectuals, including astronomers and mathematicians, challenged traditional dogma with a requirement for objective truth. This shift to evidence-based inquiry resulted in innovations that conquered catastrophic challenges such as epidemics, poverty, and famine. Reason thus helped humans to evolve into a more resilient species capable of overcoming threats. . Acceptance emphasizes cooperation, connectedness, and empathy, which have been fundamental in our ability to survive against other species over time (Turchin, 2016). People are hardwired to be part of communities and establish strong social bonds; hence, alienation from these is distressing and disengaging. The innate need for connectedness drives societal justice and behaving for the greater good, for example, ensuring that technological advances simultaneously recognize the importance of shareholder value, environmental sustainability, and employee engagement. Acceptance enables culture and strategy to be framed within a larger ecosystem that gives meaning, ethics, and purpose to reason, which can otherwise be robotic and inhumane. It is essential to creating an engaging work climate, which is a critical antecedent of ARA. . Achievement as a value stems from the innate human tendency to organize in status hierarchies. Irrespective of how much a cooperative and connected culture tries to downplay power dynamics, status hierarchies are needed to enable decision-making and determine whose subjective values will be considered objectively true (Hogan, 1983). At the group level, the individual search for power is the primary dynamic that is responsible for disruption, innovation, and risk-taking, which are essential for competitive advantage in the face of a rapidly changing business environment. Complex systems built on finding truth, acceptance, and achievement have consistently been able to compete and survive over time, outperforming others that operate on superstition, self-serving ideologies, and complacency – all of which undermine interconnectedness and ARA at the group level. The combination of these leadership values coupled with the critical behaviors that facilitate ARA create enduring systems that can successfully adapt, withstand jolts, and redirect to survive the threats and challenges organizations are experiencing today. One final factor – a leadership characteristic – is important to creating and embedding ARA. Leaders must demonstrate integrity. In a famous quote, Peter Drucker commented that “the only definition of a leader is someone who has followers.” Evidence from psychology and biology suggests followers need to feel that the benefits of cooperating with others outweigh the costs. They need to know that the person in charge will keep their word and distribute resources, recognition, and influence fairly. Integrity matters because the best predictor of employee engagement, which is an essential precursor to ARA, across interconnected systems within an organization is trust in one’s immediate leader. Engagement is the sine qua non of keeping individual units contributing to the system in a cooperative manner, even when doing so may result in under-optimized outcomes for individuals. The dark side We now turn to discussing challenges that can result when leaders drive adaptability, resilience, and agility to the extreme or themselves over-do related behaviors to the point of creating a level of dysfunction that threatens organizational effectiveness. Extreme resilience, for example, can be dysfunctional when individuals or teams bounce back so easily and so quickly that they blindly adjust to any jolt thrown their way, even if it is harmful to themselves or others and detrimental in the long-term. While quick recovery and moving on is important, doing this too quickly can by-pass important reflection and time that is necessary to fully heal from tragedy or crisis, creating unexpected reactions and consequences downstream. Leaders must likewise balance the behavioral and values-based (e.g., reason, acceptance) antecedents of ARA, avoiding over-utilization that creates their dysfunctional dark sides. The dark side of extreme reason, for example, is neglect of the human need for emotional connection, instead reducing people to numbers. While this may provide data to illuminate what’s going on and enable evidence-based decisions that optimize outcomes, it can also result in dysfunction that drives destruction. Devoid of humanism, systems lack the interconnectivity they need to modify themselves in optimal ways to adapt over time. The dark side of acceptance is extreme social sensitivity that results in stagnation and the lack of innovation – a deadly combination in the face of fast-paced disruptive change. This occurs when there is an excessive focus on harmonious relationships at the expense of productive conflict. Productive conflict and challenging the status quo is the essence of creativity, innovation, risk, and change. Thus, while cooperation, coordination, and smooth integration are necessary for effective delivery by teams, too much can suppress individualization and, at the extreme, create cult-like systems that reject destabilization and necessary risks that engender a better future state. In turn, organizations will be unable to reconfigure themselves and inject new life into complacency. Finally, the extreme search for achievement signals a decaying organization. When resources must be shared across units, widespread selfish behaviors that compound on one another can diminish or spoil the overarching system. Organizations that emphasize outputs (e.g., results and money), at the exclusion of cooperation, understanding, empathy, and resilience tend to collapse over time. Examples at the extreme are Enron, The Wolf of Wall Street, and many of the organizations involved in the Global Financial Crisis of 2008. The fatal flaw of excessive achievement, at the expense of cooperation, has been referred to by biologist Garrett Hardin as “the tragedy of the commons.” Managers need to understand the importance of achieving the right balance in implementing key behaviors, values, and ARA itself to avoid these dark side consequences. Final thoughts Today’s world is so complex that it is increasingly difficult to predict outcomes based on historical data and experience. This challenge is exacerbated by game-changing disruptions that are threatening the existence of many organizations. Survival requires developing organizational ecosystems that are characterized by ARA – ones that take risks, innovate successfully, withstand jolts, quickly recover, and know how and when to strategically redirect. There is not a simplistic or one-facet solution to get there. This instead requires a more complex set of reciprocating conditions – a compelling strategy, sufficient resources, specific evolution-based values, key leader behaviors, engaged employees, and the right structure and processes to enable delivery – all of which need to work together, without over-doing them – to achieve competitive advantage and organizational survival.
Advances in analyzing and measuring dynamic economic resilience	Rose & Dormady	Advances in Analyzing and Measuring Dynamic Economic Resilience Adam Rosei* and Noah Dormadyii i University of Southern California Sol Price School of Public Policy; USC Center for Risk and Economic Analysis of Terrorism Events (CREATE); Critical Infrastructure Resilience Institute (CIRI) at the University of Illinois ii The Ohio State University John Glenn College of Public Affairs; USC Center for Risk and Economic Analysis of Terrorism Events (CREATE); Critical Infrastructure Resilience Institute (CIRI) at the University of Illinois iii For example, the U.S. National Academies of Science defines resilience very broadly as: “Resilience is the ability to prepare and plan for, absorb, recover from, and more successfully adapt to adverse events.” iv The investment in dynamic economic resilience can also involve technological change and other forms of adaptation that lower the vulnerability of the system to future disasters. Suggested citation: Rose, A., & Dormady, N. (2018). Advances in analyzing and measuring dynamic economic resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Dynamic economic resilience, disaster recovery, resilience, definition *Corresponding author: Adam.Rose@usc.edu This paper places into the broader context of an analytical framework recent research findings and policy initiatives relating to dynamic economic resilience, which is usually defined as speeding up and/or shortening the duration of recovery from disasters. Our purpose is to offer insights into the operation and implications of both of these innovations. The first pertains to research that indicates that accelerating the pace of economic recovery has much greater potential for reducing disaster losses than does compressing its duration. The second pertains to supplementing the constructing and protecting of the built environment with the resilience strategy of embedding ways of repairing and reconstructing it more quickly in the aftermath of a disaster. Basic definitions The concept of economic resilience to disasters is often construed broadly to include actions taken both before the event, as well as after the disaster strikes, in order to reduce losses in an overall risk management strategy (Bruneau et al., 2003; Rose, 2016; Rose, 2017a).iii We find it useful to make the distinction between mitigation, which is generally undertaken before the disaster and to define resilience more narrowly to include actions implemented after the disaster strikes to promote recovery.iv However, we emphasize that resilience is a process. Overall resilience capacity can be enhanced prior to the disaster for implementation once it is needed (Tierney, 2007; Cutter, 2016; and Rose, 2017a). Examples of such resilience capacity-enhancing actions include the purchase of back-up electricity generators, stockpiling critical materials, and informational/learning actions such as disaster resource planning emergency drills. These examples apply to the microeconomic level (i.e., individual enterprises or organizations), but analogous pre-disaster resilience actions are also applicable at the mesoeconomic, or industry/market level (e.g., the workings of markets through price signals that reallocate scarce resources to their highest value use), and at the macroeconomic level (e.g., importing goods that are in short supply within the affected region, reserve margins and ancillary services markets in regional power grids). Another important distinction is the difference between static and dynamic economic resilience. The former refers to using remaining resources efficiently to maintain function (producing as much as possible), while the latter is often characterized as investing efficiently in repair and reconstruction in order to reestablish productive capacity as quickly as possible to regain function. It is dynamic because it involves an active decision with a real opportunity cost that requires foregoing the current use of resources in order to attain a higher level of future production capacity (Rose, 2017a).v Overall, static economic resilience works primarily within the existing system structure with limited potential to promote full recovery, while dynamic resilience is intended to promote full recovery through investment that can capitalize on revolutionary and evolutionary changes. v The more general versions of static and dynamic resilience are usually ascribed to ecologists Holling (1973) and Pimm (1984), respectively. vi See, e.g., Hosseini et al. (2016), who provide a current comprehensive survey of related resilience research for the interested reader. Yet another important distinction is between inherent and adaptive resilience. The former pertains to resilience that is naturally-occurring or otherwise already in place prior to the disaster (e.g., excess capacity, the operation of markets), and the latter pertains to deliberate enhancement (e.g., purchase of back-up generators and stockpiling). Adaptive resilience refers to improvisations made after the disaster strikes (e.g., relocation, finding new substitutes for critical materials in short supply). Practically all analyses to date have confined inherent resilience to the static version.vi However, there is increasing awareness that it can also apply to dynamic economic resilience. A major example is rethinking building materials and design considerations so that structures can be repaired more quickly and cheaply. Mitigation is the major strategy to reduce property damage from disasters. This refers to reducing the frequency and magnitude of disasters by reducing the root cause(s) and “hardening” the target. The outcome of the latter is often referred to as improving the robustness of the system. However, it is important to note that mitigation also reduces lost production associated with property damage. This is a major consideration for both individual businesses and the economy as a whole. The magnitude of disasters is increasingly measured by the economic losses they cause. Most of the attention to mitigation is on the destruction of buildings and infrastructure, but lost economic output, often referred to as “business interruption” (BI), can be even larger than property damage in major disasters. This is because supply-chain reactions radiate outward from the site of the disaster and accumulate over the course of a protracted recovery. This was the case, for example, for Hurricane Katrina, and the Wenchuan Earthquake. Mitigation reduces potential BI as a joint product along with its protection of the capital stock, but the potential of dynamic resilience to reduce some of the remaining BI losses has rarely been quantified. Inherent dynamic economic resilience has important implications for risk, because it requires investment prior to the occurrence of any disaster. This is in contrast to adaptive dynamic resilience, which has been the subject of most of the literature (such as hastening the pays of insurance payments from government assistance for repair and reconstruction of damaged), and which does not require investment until after the disaster strikes. Hence, the benefits of the insurance dynamic resilience require adjustment for the probability of occurrence of the disaster, while adaptive dynamic resilience is implemented with perfect knowledge of the disaster having actually taken place. Moreover, there are additional uncertainties pertaining to inherent dynamic resilience than in the case of inherent static resilience in terms of the effectiveness of the resilience tactic. This is more the case in the dynamic realm, as opposed to static inherent resilience (such as stockpiling or purchasing backup generators), because various dynamic inherent resilience tactics to be discussed below are relatively new and untested. Dynamic economic resilience and the time-path of disaster recovery Recovery from disasters is usually measured in terms of the time it takes the system to return to a pre-disaster level, to a projected baseline level, or to what is now referred to as a “new normal” - a sustainable post-disaster level of economic activity, such as the downsized economy of New Orleans in the aftermath of Hurricane Katrina. On the one hand, economic recovery from disasters is about the repair and reconstruction of buildings and infrastructure, along with social and political institutions and the rehabilitation of the workforce. It is helpful to conceptualize this in terms of stocks and flows. The major categories of economic inputs available for production (capital, labor, and institutions) are fixed quantities, or stocks. What is variable, however, is the lost flow of economic activity between the point at which the disaster strikes and the point at which it recovers. This is determined primarily by the duration and time-path of the recovery. Recovery from disasters and its time-path are linked through the concept of resilience. What has not been analyzed adequately to date is the connection between the variability of disaster recovery and disaster flow losses in terms of such indicators as economic output and employment, in contrast to property damage. Dynamic resilience pertains to the reduction in these flow losses during the recovery period by investment in repair and reconstruction so as to enhance future productive capacity, as opposed to static resilience actions of efficiently reallocating resources to increase current production. Referring again to Rose (2017a), dynamic economic resilience has two aspects: . the ability to recover . the ability to recover rapidly The first aspect is typically straightforward and can readily be observed and measured; it is simply a binary “yes” or “no.” The second aspect is more complex than might appear. Initially it is important to distinguish resilience and recovery—they are not the same thing (Chang & Rose, 2012). Dynamic resilience represents the possibility of both an acceleration in recovery and reduction in its duration (the “recovered rapidly” aspect of the definition above). The measurement of dynamic economic resilience thus requires a reference base, or baseline, recovery time-path to compare with the accelerated, or more rapid, recovery path.vii The difference between the two, in terms of GDP or employment, is the measure of BI losses averted by dynamic economic resilience during recovery. vii In this brief essay, we do not address how to define this reference case and instead refer the reader to Pant et al. (2012) and Xie et al. (2018). Recent research by Xie et al. (2018) on the macroeconomic impacts of the Wenchuan Earthquake indicates that jump-starting the disaster recovery will reap far greater BI loss reductions than shortening its duration. This conclusion holds for recovery time-paths for disasters in general that are linear, logistic (S-shaped), or exponential (i.e., most recovery paths), because relatively little of the recovery is left to perform in the final year(s). In effect, the earlier start and steepening of the recovery path has a compounding, or cumulative, positive effect on loss reduction that increases with the rate of acceleration. This is particularly the case for flows rather than stocks. Whereas stock losses are typically damaged plant and equipment with a known, fixed replacement cost, flow losses early in a firm’s recovery period can also have an additional adverse “snowball” effect over the duration of a recovery period with the potential for significant secondary and tertiary losses in the future. For example, middle-size firms (firms with annual revenues between $10 million and $1 billion, often referred to as the “middle market”), which make up the bulk of the U.S. economy (Young, Greenbaum & Dormady, 2017), are in many cases reliant upon contracts with larger firms (e.g., a machine shop contracted to make injection molds for a multi-national electronics manufacturer). It behooves a small- or medium-sized business to recover quickly so it does not lose its competitiveness for future contracts with current and prospective customers. The general time-path analysis and individual business example prompt us to reiterate the importance of modifying standard definitions of dynamic economic resilience. The reference to speed is too vague. It behooves analysts and decision-makers to distinguish between shortening the duration of recovery and accelerating its time-path. We offer one major caveat with respect to potential downsides of inherent dynamic economic resilience. For example, in the haste to accelerate recovery, there is the possibility of giving an adequate attention to tactics that can make the system (business, market, entire economy) less vulnerable to future disasters. This also relates to promoting long-term considerations of adaptation and sustainability. Therefore, assessment of the benefits of dynamic economic resilience of all forms requires a careful examination of trade-offs between reducing current and future losses. Inherent dynamic resilience tactics Tactics to improve dynamic economic resilience are typically represented by: hastening debris removal, reducing delays in the dispensation of insurance payments and government aid, increasing the level of these investment funds for recovery, and technological change during the reconstruction process. However, all of these examples are those of adaptive dynamic economic resilience, i.e., for the most part, improvised after the disaster has struck and the rebuilding process has begun. Of course, each of them can be enhanced prior to the disaster by having heavy equipment for debris removal in place, reducing paperwork needed to obtain insurance payments and government assistance, and having automatic triggers for government assistance to disaster areas. However, the more prevalent approach in research and practice on this strategy is on improvising to increase and accelerate each of these tactics, which pertains to the adaptive aspects. Yet another strategy to improve dynamic economic resilience is via inherent resilience, exemplified by modifying building materials and design, not only to make structures more robust, or disaster- resistant, but also to make their restoration more rapidly forthcoming, and, ideally less expensive. This goes beyond trying to make structures more durable toward the goal of making those that are damaged capable of becoming operational again much faster. Examples would include materials less likely to cause debris problems and more modular construction that facilitates repair (Benedetti, Landi & Merenda, 2014; Jones, 2018). Public policy can provide an additional stimulus to an inherent dynamic resilience strategy. There are an increasing number of examples of local government regulations to establish target dates for buildings and infrastructure to become habitable and operational more quickly following an earthquake. Buildings and infrastructure provide the capacity for producing goods and services, and providing jobs, upon which human well-being depends. This strategy is also being touted as a way to promote recovery by preventing a protracted or even permanent mass exodus from a disaster area (Rose, 2017b; Jones, 2018). Leadership in this initiative came from the San Francisco Planning and Urban Research Association (SPUR) (SPUR, 2016). This was followed by similar efforts in Oregon and Washington, and the attempt to standardize this in practice by the National Institute of Standards and Technology (NIST, 2016; see also the comparison of approaches by Miles, 2018). Essentially, this represents the setting of performance standards for recovery linked to time. The premier instrument was building codes. However, the emphasis is not on reducing property damage for its own sake but for reasons related to dynamic inherent economic resilience to promote recovery – stronger structures are easier to repair. Over time, this will merge with the rationale in the previous paragraph – more flexible structures are easier to repair. Measuring dynamic economic resilience We briefly summarize some aspects of our recent efforts to measure dynamic economic resilience (Rose et al., 2017; Dormady et al., 2018). We are utilizing a survey instrument of disaster-affected firms to pose questions such as: 1. How long did it take your business to recover? 2. How long did you originally expect it would take your business to recover? 3. What factors delayed recovery? 4. What factors expedited recovery? 5. Was the trend of your business’ time-path linear, logistic or exponential in shape? 6. What was your total business interruption (BI) loss during your recovery period? 7. What was your expected total business interruption loss during your recovery (assuming no delays or expedited effort)? Question 2 addresses the baseline or reference point. The difference between responses to Q1 and Q2 provide the speed of recovery, a first step in measuring dynamic resilience. The difference between Q6 and Q7 gives us a first approximation of the dollar value of dynamic economic resilience. However, it is important to control for static economic resilience efforts that would also affect avoided BI. There are four main motivations for investment that have major implications for measurement: 1. Restoration/Replacement/Repair/Reconstruction of previous productive capacity. All of the following have the goal of reestablishing original functionality: . Restoration refers to efforts made in reinstating the equipment or facility to its original character. This would be especially important if the original had historical, sentimental, or special marketing value, but is not always possible. . Replacement refers to obtaining or rebuilding a comparable piece of equipment or building. However, in most cases one would be replacing equipment or facilities put in place in previous years, and it is likely that the replacement goods would be more productive, even if that were not the original intent. . Repair refers to the range of patching up to overhauling damaged equipment or facilities to reestablish their functionality. . Reconstruction refers to extensive actions in rebuilding or re-fabrication. 2. Productivity Enhancement. This refers to explicit efforts to increase the level of output of goods or services per unit of equipment/facility input. As noted above, it may not be intended, but is likely in terms of replacing equipment. In other cases, it is an explicit decision. It may be attractive because it affords an opportunity to achieve a goal that would not otherwise be economically viable if the original equipment were still in place and did not actually need to be replaced. 3. Vulnerability Reduction in relation to future disasters. This is far from an automatic outcome. In fact, many experts suggest that, as economic activity becomes more advanced, it becomes more complex and less flexible, and hence more vulnerable within the firm and with respect to the supply chain (e.g., Zolli & Healy, 2012). In one way, the situation is similar to productivity enhancement in terms of the investment decision, whereby the disaster affords an opportunity, as well as the realization of the worthiness, of reducing losses from future disasters.viii viii We have omitted discussion of the expansion of productive capacity, which refers to the extension or enlargement of equipment or facilities of the same type or nearly the same as the original during recovery. We set this aside because it goes beyond recovery. One might say that this also applies to motivations 2 and 3 above, but they are part of the replacement process, even if they are intended for joint or other purposes. Expansion investment is not. In terms of obtaining data necessary to measure the cost-effectiveness of various types of investment on avoided BI losses, caution is advised. Subtleties in the distinction between motivations for investment often overlap or exist in complementarity on the effectiveness side. The estimation of property damage represents a start as a reference point for quantifying the cost of investment expenditures. However, investment need not equal standard damage estimates at original cost minus depreciation, because the best estimate of the value of an asset (intact or damaged) is replacement cost. The situation is also complicated by “demand surge,” which refers to an oft-observed condition of increased construction cost following disasters due to a spike in demand and damage to construction equipment and materials, as well as a shortage of construction labor due to death, injury, or outmigration. Conclusion This paper has made the case for enhancing the standard definition of economic resilience, and resilience in general. Dynamic resilience does in fact have an inherent aspect. In addition, the vague reference in many definitions of dynamic economic resilience, and dynamic resilience in general, to increasing the speed or reducing the duration of recovery is far too vague and actually emphasizes the wrong attributes, where the more important one is jump-starting the process. A greater emphasis needs to be placed on the time-path of the recovery and its shape. Both of these features lead us to a revised definition of dynamic economic resilience as: inherent and adaptive efficient tactics related to investment to reestablish functionality of the built environment so as to accelerate and shorten the time-path of disaster recovery. Acknowledgements The authors wish to thank Igor Linkov and Ben Trump for their helpful suggestions for improving the paper.
The case for systemic resilience: Urban communities in natural disasters	Stojadinović	The Case for Systemic Resilience: Urban Communities in Natural Disasters Božidar Stojadinovici* i Chair of Structural Dynamics and Earthquake Engineering, Swiss Federal Institute of Technology (ETH) Zurich, Switzerland Suggested citation: Stojadinovic, B. (2018). The case for systemic resilience: Urban communities in natural disasters. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Systemic resilience, communities, natural disasters *Corresponding author: stojadinovic@ibk.baug.ethz.ch A system of systems: An urban community A modern urban community bustles with life. We engage in work, business, entrepreneurship, education, culture and entertainment to pursue our wishes and fulfil our goals. We flock to cities that offer exciting opportunities and fulfilling experiences. As we take part and actively construct the so-called higher-level societal functions of an urban community, seldom do we observe the built environment that supports these functions (Figure 1). The roles of buildings that provide shelter, and infrastructure systems that furnish basic services of power, water, transport and communication are often taken for granted. The fundamental notion of resilience is far from the minds of average citizens… until a natural disaster strikes. Figure 1: Urban community functions (after (Southeast Region Research Initiative (SERRI) and Community and Regional Resilience Institute (CARRI), 2009)) The systemic nature of a modern urban community, and the need for its resilience, becomes painfully obvious in a natural disaster. Destruction of buildings crudely exposes their primary shelter functions. Failure of an infrastructure system to deliver the expected services directly affects the inhabitants and cascades to challenge other infrastructure systems as damage is absorbed. Importantly, recovery is also systemic. Re-establishing the service of one infrastructure system depends, often, on re-establishing the services of other infrastructure systems. Restoring the shelter functions for community inhabitants is slower, with building repairs and reconstruction taking more time and requiring more resources. Demand for infrastructure systems services is, in turn, directly related to the re-establishment of the shelter functions, closing another systemic dependency loop. And all this concerns only the resilience of the so-called front-line community systems, on which the re-establishment of higher-level community functions clearly depends. Systemic resilience of urban communities to natural hazards is a process of making the community whole again or in some adapted form. Among the many definitions of resilience, some reviewed in the first volume of IRGC’s Resource Guide on Resilience (https://www.irgc.org/irgc-resource-guide- on-resilience/), I find the functionality-based concept, developed within the MCEER Centre and presented by Bruneau and co-workers in (Bruneau, et al., 2003), appropriate for the built environment and the civil infrastructure systems of modern urban communities. The swoosh-shaped resilience curve they introduced is emblematic of the resilience process, while the four attributes (robustness, redundancy, resourcefulness and rapidity) framed the engineering actions available to increase the natural hazard resilience of communities, a goal aspired to by many and adopted in practice by the select pioneering cities, such as those participating in the 100 Resilient Cities network (https://www.100resilientcities.org). Community design for resilience Lost in the shuffle of recovery are the unrecoverable missing, dead or wounded: it is the risk of large- scale loss of life and limb that originally defined a natural disaster as a high-consequence low- probability event. Civil engineers today routinely design elements of the built environment and infrastructure systems of a community for life safety, under loads that span the gamut from permanent and known to very rare and difficult to estimate, using the principles of performance- based risk-informed design. In fact, it is because of robustness and redundancy built into the civil engineering design codes that only low-probability events have high consequences in modern communities. Thus, in the domains of risk and resilience for urban communities in natural disasters are tightly intertwined. Great earthquake disasters of the past decade (e.g. 2010 Maule earthquake in Chile, 2011-2012 Christchurch earthquake series in New Zealand, even the 2011 Tohoku earthquake in Japan) demonstrate that a century of seismic design focused on life safety risks and investment in modern built infrastructure paid off in terms of minimizing the casualties. On the other hand, damage to the buildings and infrastructure systems was extensive, and the recovery and rebuilding is slow and costly, straining not only the financial and material resources but also the social fabric of the affected communities. The impetus for performance-based risk- and resilience-informed design is strong: a probabilistic performance-based engineering paradigm developed within the PEER Centre by Cornell and Krawinkler (Cornell & Krawinkler, 2000) provides a framework for defining and attaining multiple design objectives. While life safety remains of ever-present concern, this framework enables simultaneous consideration of damage and design for efficient and speedy recovery. I find the resilience-based seismic design examples presented by Terzic and co-workers (Terzic, Mahin, & Comerio, 2014) particularly illustrative because they explicitly include the costs of business interruption during the recovery process in engineering decision making. Civil engineers, however, design and build one element at a time. They are aware of systemic aspects, but the design codes and the business practices in engineering design and construction focus their attention on setting performance objectives for elements of the urban community and achieving them element by element. This is significant drawback. Extending a performance-based risk- and resilience-informed design paradigm from system element to the system level, and further, to the community system-of-systems is clearly needed (Figure 2). Figure 2: System- and element-level performance-based design process. The first steps towards a systemic risk- and resilience-based urban community design have already been made. Setting system-level urban community seismic resilience objectives was explored in the San Francisco Planning and Urban Research Association Planning Resilient City project (San Francisco Planning and Urban Research Association [SPUR], 2009). There, probabilistic targets for the provision of shelter and infrastructure system functionality in a community struck by an earthquake are given in terms of several points along the recovery curves. This is crucial: it embraces the dynamic nature of the resilience process and sets out design acceptance criteria over a time horizon. De-convolving the community-level resilience objectives to the level of the community’s built environment and infrastructure system elements is the next step. One way to do this using a logic tree approach borrowed from nuclear facility safety analysis was done by Mieler and co-workers (Mieler, Stojadinovic, Budnitz, Comerio, & Mahin, 2015). Given element-level resilience objectives, engineers can now design these elements considering their systemic resilience roles. To complete the design loop, the system-(community)-level behaviour of the so-designed elements must be checked and their individual and systemic resilience quantified. Composing the community systems (bottom-up, building from their elements) and quantifying their system-level resilience during the recovery time can be done using the Re-CoDeS framework (Didier, Broccardo, Esposito, & Stojadinovic, 2018). Using Re-CoDeS, or another framework for system-level resilience quantification, a community engineer can verify if the system-level community resilience goals have been achieved or not. Our cities today Today, urban planners and engineers seldom have a blank sheet to design urban communities from scratch. Modern urban communities are systems of systems, built upon the constructions of previous generations (i.e. legacy systems), and are continually transforming as they are being used. The built environment and the infrastructure systems are not only interlaced spatially, but are also interconnected in time, throughout their life cycle. Individual infrastructure elements and buildings age and will, sooner or later, be transformed, re-engineered or replaced. Resilient urban communities also transform with the changing needs and interests of their inhabitants, the evolving population densities and resource flows, and the (r)evolution of technologies and industries. They must also adapt to the changes in intensity and frequency of the natural disasters they may face on an even longer time scale, a challenge of climate change that urban communities are just beginning to recognize and tackle. Systemic risk-based design against natural disasters tends to emphasize the robustness and redundancy characteristics of urban communities. This can be costly: in the era of limited resources and growing demands for them, dedicating a substantial portion to mitigate the effects of unlikely events that may happen once in a relatively distant future, means depriving the community of other more immediate needs and abandoning developments that may be more consequential in the future. Conversely, systemic resilience-based design tends to emphasize rapidity and resourcefulness of urban communities, investing future resources in effective damage absorption, speedy and efficient recovery, and agile adaptation to new conditions. While placing the burden of coping with natural disasters on future generations frees todays resources for other needs, the very real life-safety risks must still be covered today by actively maintaining the service of existing systems at the levels of function and safety needed to satisfy the community demands (for example, the recent collapse of the Morandi bridge in Genova, Italy). This risk versus resilience trade-off illustrates plastically the moral hazard facing the community decision makers. Faced with continuous growth of risk exposure (primarily due to increase in wealth, asset concentration and urban densification) and continuous degradation of the built environment and civil infrastructure systems (primarily due to use and aging), modern urban communities must make tough decision about their natural disaster resilience. These decisions are complicated by uncertainties, not only about the likelihood and intensity of possible natural disasters but also about future directions community development may take and the long-term implications of todays’ decisions that are difficult to foresee, and by constraints on the recourses a community can deploy to increase its natural disaster resilience. Resilient communities by systemic design There is, clearly, a need for a balanced approach to increasing the resilience of modern urban communities to natural disasters. Placing the problem solely in the context of civil engineering, even using modern risk- and resilience-based design frameworks, is not sufficiently broad. Community- level resilience objectives need to consider not only the consequences of a natural disaster, but also the means the community has to deal with them now and its willingness to postpone dealing with such consequences to the future (namely, the less risk versus more resilience conundrum). Formulating resilience design objectives, as well as resilience metrics and ways to quantify systemic community resilience, in terms useful to both civil and financial engineers is a start in the right direction. Importantly, this expands the scope of possible actions to increase the natural disaster resilience of communities from civil engineering measures to financial engineering measures and combinations thereof. For example, a community could decide to implement some robustness- or redundancy-increasing civil engineering measures now, while preparing for recovery by securing the necessary resources in the future using financial instruments available on the bond or insurance markets. Furthermore, such common resilience performance objectives and resilience metrics make it possible to rationally quantify resilience in terms of costs and benefit. This is key to making resilience-related community-level decisions, applicable over both short and long time horizons, that fully account for the life cycle lengths of the built environment and civil infrastructure system components as well as the long return periods of potent natural disasters. Modern urban communities are complex systems of systems. They must be resilient to natural disasters today, and their natural disaster resilience must only grow and become more systemic to match community growth and meet the challenges of the future. Understanding their natural disaster resilience requires a systemic approach, considering simultaneously the system-level and element-level hazard exposures, as well as system and element risks and recovery patterns as well as interdependencies. Increasing the resilience of modern communities is a systemic effort, requiring synergistic civil and financial engineering actions, as well as consistent public policy, over a long period of time. The civil and financial engineering community is developing frameworks and tools for systemic resilience-based design, with the goal to make steering of complex community systems through transformations towards a more resilient and, ultimately, a more sustainable state possible. However, the crucial decision to implement such resilience-based community-level actions is with the citizens. It is time to make the case for systemic resilience loudly and clearly: YES, it can be done!
Resilience of critical infrastructure systems: Policy, research projects and tools	Theocharidou, Galbusera & Giannopoulos	Resilience of Critical Infrastructure Systems: Policy, Research Projects and Tools Marianthi Theocharidoui, Luca Galbuserai and Georgios Giannopoulosi* i Affiliation European Commission, Joint Research Centre Suggested citation: Theocharidou, M., Galbusera, L., & Giannopoulos, G. (2018). Resilience of critical infrastructure systems: Policy, research projects and tools. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Infrastructure, system, resilience, complexity, dependency *Corresponding author: georgios.GIANNOPOULOS@ec.europa.eu Infrastructure resilience in EU policy and research In the European Union, Council Directive 2008/114/EC (‘ECI Directive’) required Member States (MS) to identify and designate European Critical Infrastructures (CI) towards improved protection. This also triggered several MS to identify national CIs and sectors, promoting additional security measures to be applied by operators (Setola, Luiijf, & Theocharidou, 2016). More recently, Directive (EU) 2016/1148 (‘NIS Directive’) fostered increased security levels in networks and information systems. Moreover, Horizon 2020 research funding is addressing topics such as CI protection, the safety of transport and energy systems, and cybersecurity. Complementing traditional risk management, security, and protection practices, resilience gains a prominent role as the ‘umbrella’ term to cover all stages of crisis management. This aspect is also prominent in emerging EU policy trends, wherein CI resilience acquires increasing importance and links to a number of strategic priorities, as illustrated in Figure 1. Figure 1: EU policy milestones towards resilience of CIs (see Annotated Bibliography for detailed policy references) While risk concepts have undergone standardization (see International Organization for Standardization [ISO], 2018), definitions and perspectives on resilience vary (Florin & Linkov, 2016). At the EU level, differences in CI resilience interpretation are also reflected in research funded under the Horizon 2020 programme (Herrera et al., 2018). Some projects focus on resilience aspects such as resistance, absorption, response to a threat or hazard, timely recovery, and restoration of systems/services. Some even include mechanisms for infrastructure hardening, for example, against climate change. Others address the resilience of organizations, communities and social processes that rely on these services and infrastructures. Another line of research tackles complexity and emergent phenomena that cannot be solely understood by analysing individual components or systems. Valuable insights into the ‘science of resilience’ also originate at the boundary between research and operational competencies. The EU-funded IMPROVER project has explored this thoroughly by organizing workshops with critical infrastructure stakeholders, such as the series of ERNCIP- IMPROVER joint workshops (Theocharidou, Lange, Carreira, & Rosenqvist, 2018) and three associate partner workshops (Rosenqvist, 2018). Starting from experience gained from these experts workshops, Petersen, Theocharidou, Lange, and Bossu (2018) argue that resilience implies a more ‘optimistic’ approach when compared to risk management, allowing operators to adopt a responsive approach to crises. This empowerment is especially evident when they are faced with crisis response exercises formulated in terms of resource unavailability, regardless of the cause. Also, Petersen, Theocharidou, et al. (2018, p.1) highlight the progress inherent in passing “from protecting assets from hazards to being able to continuously provide a minimum level of essential services to the public”. These aspects are well reflected in the NIS Directive, which strongly focuses on resilience and makes explicit reference to operators of essential services. From threat-based to systemic thinking Global scales and high degrees of interdependence are hallmarks of today’s networked infrastructures (Rinaldi, Peerenboom, & Kelly, 2001). Dependencies may also federate exposures associated with single assets and even originate new fragilities. Emerging systemic risks, which “result from connections between risks” (Helbing, 2013; Kotzanikolaou, Theoharidou, & Gritzalis, 2013; Stergiopoulos, Kotzanikolaou, Theocharidou, Lykou, & Gritzalis, 2016), can result from various triggers, bring multifaceted consequences, and display scarce predictability. The World Economic Forum’s Global Risks Report (2017, p.7) points out how “greater interdependence among different infrastructure networks is increasing the scope for systemic failures – whether from cyberattacks, software glitches, natural disasters or other causes – to cascade across networks and affect society in unanticipated ways”. Comprehensively addressing the aspects mentioned above is one of the challenges in CI protection today as we are moving from threat-based thinking towards a more systemic perspective (Zio, 2016). This is characterized by an all-hazard approach to resilience analysis and strategy-making, wherein exposures and failure likelihoods are integrated with concepts such as networked vulnerability and coping capacity. The idea is that deeply investigating the architecture of networks can unravel vulnerability paths inherent to systems and processes (Pescaroli & Alexander, 2016), laying the groundwork for targeted prevention, mitigation, and recovery actions. Moreover, resilience broadens the scope of what-if analysis with a proactive component, as it involves the ability of systems to reconfigure, synergize and improve throughout critical circumstances, for example, by means of adaptation. Various frameworks have been proposed in recent times to articulate the overarching concept of resilience. In O’Rourke's "Critical Infrastructure, Interdependencies, and Resilience" (2007) in particular, key resilience qualities (robustness, redundancy, resourcefulness, and rapidity) are combined with dimensions (technical, organizational, social, economic) into a “matrix of resilience qualities”. The following discussion illustrates ways in which such dimensions are taken into account in current projects and studies, in particular within the EU. Technical dimension. The ‘Prevention, Preparedness and Consequence Management of Terrorism and other Security-related Risks’ (CIPS) programme, 7th Framework Programme for Research and Technological Development and Horizon 2020 include numerous projects devoted to CI modelling and dependency analysis. These aspects are being addressed both in terms of structural complexity and from the operational/dynamic perspective (Zio, 2016). Considering systems heterogeneity, many emerging approaches are service-oriented, analyzing resilience in terms of supply-demand balance throughout adverse perturbations (Ouyang, 2014). Scientific progress is also accompanied by the development of tools such as JRC’s Geospatial Risk and Resilience Assessment Platformii and Rapid Natech Risk Assessment Tooliii, which incorporate risk and resilience assessment methods for various kinds of technological systems and promote the integration of layered analysis approaches. ii GRRASP, available at https://ec.europa.eu/jrc/en/grrasp iii RAPID-N, available at http://rapidn.jrc.ec.europa.eu/ Organizational dimension. While working towards technological resilience remains a priority for CIs, organizational processes (Hopkin, 2014, p. 108) need to be considered, too. A recent operators’ workshop (Theocharidou, Carreira, & Lange, 2018) highlighted how some CI operators don’t focus exclusively on disruption likelihoods or causes, but also on the organization’s ability to stay operational in spite of unexpected resource loss. Grote (2004) argues that, going beyond the traditional uncertainty minimization approach, the industry needs to find ways to help people coping with uncertainty. Employee resilience refers to an ability to thrive in a changing environment and it is strongly linked with the organizational context. Resilient employees are better at handling unexpected events, and training and learning mechanisms provided within the organization can be the means to achieve these needed capabilities. Other aspects of interest include the ability of an organization to re-assess itself and situations using a diverse set of skills and knowledge, to engage all parts of the organization in problem-solving, to adapt and renew when necessary, to collaborate in a dynamic network of actors, and more (Bram, Degerman, Melkunaite, & Urth, 2016b). Social dimension. When considering the social context of a CI, national and local governments, communities and households are important actors. In these contexts, CI resilience links with city/regional resilience and, as such, interacts with civil protection and crisis management mechanisms. Petersen, Fallou, Reilly, and Serafinelli (2018) point out that, during disasters, a gap may be observed between public expectations and the realistic supply capabilities of operators. Nevertheless, their study results indicate that the public may appear willing to tolerate reductions in service during crisis. Thus, CIs should not be assessed in isolation from the community that they serve. Indeed, the expectations and resilience capabilities of end users can play a significant role for operators to set more realistic resilience targets or performance goals during crises. Economic dimension. CIs today can be to a large extent privately owned. Thus, a key challenge for regulators and governments is to encourage private industry to invest in resilience, especially within current economic conditions and considering the changing environment infrastructures operate in (World Economic Forum, 2017). Resilience should be viewed not only as cost but also as an investment. From the resilience analysis perspective, interesting progress has been made on disaster impact assessment of CI failures from an economic perspective, for example, by means of input/output models and other techniques (Casagli, Guzzetti, Jaboyedoff, Nadim, & Petley, 2017). Tracing economic flows can also allow us to understand plausible failure propagation patterns involving CIs as part of a multi-sectoral system. Relevant topics involve the characterization of shock types, as well as direct/indirect and stock/flow losses with their relative importance, non-market and behavioural effects (Galbusera & Giannopoulos, 2018). Economic impact models are also being integrated in analysis tools such as the above-mentioned GRRASP, and they can be considered a key component of the overall resilience assessment cycle relevant to regulators and policy makers. In addition to the above-mentioned matrix of resilience qualities, a number of other approaches have been proposed for CIs. These include, for instance, the infrastructure report card from the American Society of Civil Engineers (2017), the resilience matrices proposed in Linkov et al. (2013) and the resilience cubes proposed in the SmartResilience projectiv, the IMPROVER framework for CI resilience assessment (Lange, Honfi, Sjöström, et al., 2017b) (see Figure 2 for an illustration), the Critical Infrastructure Resilience Index from the same project (Pursiainen & Rød, 2016), the Resilience Measurement Index (RMI) by Argonne labs (Petit et al., 2013), the Benchmark Resilience Tool (Lee, Vargo, & Seville, 2013) and the Guidelines for critical infrastructures resilience evaluation by the Italian Association of Critical Infrastructures Experts (2016). iv http://www.smartresilience.eu-vri.eu/ technicaleconomicorganisationalsocialCI risk assessmentCI risk identificationCI risk analysisCI risk evaluationCI risk treatment (reducing threat, vulnerability, impact, etc.) Communication and consultationMonitoring and reviewCI resilience assessmentCI resilience analysis(technological, organisational) CI resilience treatment (Improving the absorptive, adaptive and restorative capacity) User needs, expectations or tolerances CI resilience evaluationEstablishing the context Figure 2: IMPROVER CI REsilience Framework ICI-REF (Lange, Honfi, Sjöström, et al., 2017b; Lange, Honfi, Theocharidou, et al., 2017). Core areas of interest are, in this case, the technical, organizational and – to some extent – social dimensions. As for the development of structured analysis approaches, current trends include, for instance, the complexity-based tiered approach proposed in Linkov et al. (2018) and dimension/scale-based tiered approach from Galbusera and Giannopoulos (2016a). As illustrated in Figure 3, the latter approach is being implemented in the GRRASP platform, which includes models belonging to different tiers. Tier 1SECTORALANALYSIS-ontology-based data retrieval-graph metrics on service networks (e.g. power, ICT, gas, traffic) Tier 2CROSS-SECTORALANALYSIS-Interdependencies (e.g. ICT/electrical grid) -Dynamic Functional Modelling of for CIs (DMCI) Tier 3HIGH-LEVELSERVICE IMPACTANALYSIS-Leontief I/O modelstechnicaleconomicorganisationalsocial Figure 3: Implementation of the dimension/scale-based tiered approach in GRRASP, with an emphasis on technical and economic dimensions. Observe that many relevant techniques applied in the different tiers involve network-based approaches, which allow for the assessment of both infrastructure topologies and associated processes over time, for example, by means of flow-based models. Applications can involve, for instance: specific infrastructures, such as transportation networks (Ganin et al., 2017); multi-layer systems, such as in the case of the power grid and ICT infrastructure (Galbusera, Theodoridis, & Giannopoulos, 2015; Theodoridis, Galbusera, & Giannopoulos, 2016); service and emergency recovery networks (Galbusera, Azzini, Jonkeren, & Giannopoulos, 2016; Galbusera, Giannopoulos, Argyroudis, & Kakderi, 2018; Trucco, Cagno, & De Ambroggi, 2012); cross-tier applications (Jonkeren, Azzini, Galbusera, Ntalampiras, & Giannopoulos, 2015). Coping with potential resilience drawbacks: Prudential regulation and chains of trust When considering CIs, many different resilience-building priorities coexist, given the number of actors involved in service management, delivery, and consumption. Historical trends such as liberalization and the development of global supply networks are radically affecting the investments in efficiency, competitiveness, and complementarity among providers. At the same time, service and liability fragmentation may introduce new threats, for example, in situations wherein service chains operate with dangerously low safety margins (de Bruijne & van Eeten, 2007). In such situations, detrimental failures may emerge also in the absence of external shocks (Helbing, 2013). Recent studies observe how, today, systemic risk can emerge not only from technical factors but from moral hazard as well (Dow, 2000). Moreover, moral hazard may, in turn, have both an individual and a collective component. Some propose the concept and practice of Corporate Social Responsibility (CSR) as a means for organizations to self-regulate and meet social needs (Ridley, 2011). Complementary action channels can be prudential mechanisms by regulatory bodies or the development of chains of trust (Boin & McConnell, 2007). In current practice, prudential regulation can translate into collective actions such as the running of stress tests (Borio, Drehmann, & Tsatsaronis, 2014). These and other similar initiatives can allow for a better and more timely detection of misbehaviours, the design of incentive/disincentive mechanisms to mitigate risk appetite and unawareness, as well as the promotion of resilience strategies that meet public expectations and needs. An effective risk and resilience strategy should not only mediate among diverse objectives (e.g. asset preservation, profit, public safety and security). Instead, it should favour and benefit from synergies between private and public resilience-building priorities. In this perspective, the development of chains of trust is another emerging trend and aims at improving communication and understanding of complexity both among operators and in a dialog between them and public authorities. The European Reference Network for Critical Infrastructure Protection (ERNCIPv) is such a trusted network of security-related experts volunteering to address pre-standardization issues at the EU level (Gattinesi, 2018; Ward, Kourti, Lazari, & Cofta, 2014). Articulated into thematic groups (TGs), ERNCIP addresses security-related technological solutions for CIs (see Figure 4). Despite its clear security focus, most of the TGs have incorporated a resilience and systems thinking. This allows for breaking down silos, reusing knowledge developed in one area to address security problems in other areas where threats call for affine approaches, despite technological differences (e.g. CBRNE threats to the water distribution network and to indoor environments), always taking into account the need for business continuity and uninterrupted delivery of services. v More information on the ERNCIP project available at: https://erncip-project.jrc.ec.europa.eu/ Figure 4: ERNCIP Thematic Groups 2018 (Gattinesi, 2018). Conclusions As discussed above, CI resilience integrates traditional risk concepts while focusing on the entire disruption-recovery cycle and underlying complexities. Transition, adaptation and transformation processes seem fundamental both to observe, in order to enhance systemic understanding, and to steer, in order to mitigate immediate and long-term impacts and to prepare for future events. These concepts have not been fully explored or operationalized in the CI field, but there is on-going interest, as reflected by recent EU-funded research (Herrera et al., 2018). Examples include the H2020 RESIN project on adaptation measures for citizens infrastructuresvi, the H2020 EU-CIRCLE projects on infrastructure resilience to today’s natural hazards to climate changevii or the H2020 HERACLES project on resilience of cultural heritages against climate change effectsviii. Beyond climate change, other aspects are driving focus on transition, adaptation and transformation of infrastructures, such as social changes, for example population rate increase, urbanization and emergence of megacities. vi http://www.resin-cities.eu/ vii http://www.eu-circle.eu/ viii http://www.heracles-project.eu/ This multidimensional treatment of resilience is also in agreement with current policy trends in disaster risk reduction. This is the case of the Sendai Framework for Disaster Risk Reduction 2015- 2030 (United Nations Office for Disaster Risk [UNISDR], 2015), which “aims to guide the multi-hazard management of disaster risk in development at all levels as well as within and across all sectors”. The framework includes an articulated set of global targets, with CIs playing an ubiquitous role through developing their resilience by 2030, including the ‘build back better’ principle. It considers the dual aspect of damages both to facilities and services and links to the economic dimension. The body of knowledge on CI resilience currently built is a valuable source for authorities and operators to explore. Enabling the operationalization of resources, models and tools still requires substantial efforts. A potential approach could include inventories of models, methods and tools provided by specialists. Work on the interoperability of models is also needed, especially in relation to current risk practises. Indeed, this volume aims to contribute to knowledge sharing in this domain. Understanding technical, financial, political, reputational, and further priorities and constraints that operators face can be a valuable tool for policy makers when they develop strategies for resilience. At the policy level, challenges to be addressed include stakeholder engagement and incentives for resilience in spite of conflicting interests and objectives. Acknowledgements This work has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 653390. Disclaimer The views expressed are purely those of the authors and may not in any circumstances be regarded as stating an official position of the European Commission.
Resilience analytics by separation of enterprise schedules: Applications to infrastructure	Thorisson & Lambert	Resilience Analytics by Separation of Enterprise Schedules: Applications to Infrastructure Heimir Thorissoni and James H. Lamberti* i Department of Engineering Systems & Environment, University of Virginia Suggested citation: Thorisson, S., & Lambert, J. H. (2018). Resilience analytics by separation of enterprise schedules: Applications to infrastructure. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Resilience analytics, scheduling, systems engineering, strategic planning, scenario analysis *Corresponding author: lambert@virginia.edu Introduction This article identifies literature and other resources for resilience analytics applied to infrastructure, in particular when the emphasis is the disruption of preferences by alternative scenarios. It recognizes that multiple, possibly conflicting, perspectives of politics, economics, demographics, technology, environment, etc., are an inherent part of decision-making and plans and processes need to be resilient to emergent and future conditions that might bring one or more perspectives closer to the front. In a previous volume, the authors provided a review of definitions and quantifications of resilience analytics (Thorisson & Lambert, 2016). Here, the focus is on applications to infrastructure, with a motivating demonstration to building capacity for wireless broadband for public safety agencies (Hassler & Lambert, forthcoming). Infrastructure risk and disaster management Agencies are put under considerable strain during disasters. The disruptive effects of disaster can cascade across geographic, political, institutional, and other boundaries. For example, in September 2018, hurricane Florence made landfall on the United States East Coast. Populations in three states, South Carolina, North Carolina, and Virginia, were evacuated from their homes and sought shelter across the Southeast region of the country. Agencies responsible for transportation, public health, education, and others needed to cooperate with local and federal first response and emergency management agencies. In such a scenario, sharing of information and resources across different agencies is critical. To support such data exchanges and facilitate communications, the United States Congress approved in 2012 the creation of a nationwide interoperable public safety broadband network (FirstNet). The enterprise systems planning for the FirstNet accounts for the interests of local, state/territory, tribal and federal public safety agencies across the United States. In particular, FirstNet planners are collaborating with public safety stakeholders and leadership from each state and territory. The coming nationwide broadband network is thus aimed to meet needs of the agency users as they protect communities and lives across the nation. Design and implementation of such a system is subject to a variety of stressors and sources of risk. The objectives of several groups of stakeholders must be balanced. Resilience analytics can be useful to explore the tradeoffs between meeting objectives, accepting risk, and cost. Risk and resilience Resilience analytics as described in this article focuses on methods for identifying the perspectives of a system (or particular risk scenarios related to the perspectives), that are most in need of investigation, including risk analysis, simulation, experimentation, data collection and analysis, etc. (Karvetski et al., 2009, Teng et al., 2012). It is complementary to traditional risk management by focusing on how differences in priorities between stakeholders can pose risks to the system. Resilience analytics identifies the perspectives that have the greatest potential to disrupt a prioritization of system milestones/initiatives (Linkov & Trump, forthcoming). The perspectives that are found to have a high disruptive potential are candidates for an in-depth investigation, including an assessment of the consequences and likelihood of risks associated with the particular perspective. Risk analysis often relies on being able to assess likelihood and consequences, while resilience analytics can proceed without that assessment (Thorisson et al., 2017b). In application, milestones of a system are prioritized such as to most effectively meet system goals and objectives. This prioritization can vary between different system perspectives. In the development of a public safety broadband network, at least three perspectives must be considered, each representing a distinct group of key stakeholders: . The government/regulatory perspective represents the owners of the system (and the constituents they represent) . The vendor perspective represents the technical developers and operators of the system . The public safety perspectives represent the system users, public safety agencies If there are large discrepancies between the perspectives about the prioritization of system milestones, the system is less resilient as stakeholders do not agree on how to mitigate losses or recover from disruptions. Multiple success criteria, measuring the goals and objectives of the system, need to be considered. Table 1 describes ten identified criteria along with their relevance in each perspective. Using multicriteria analysis (e.g., Karvetski et al., 2009), the coverage of criteria by the system milestones (Hassler & Lambert, forthcoming), can be used to prioritize the milestones. An aspect of resilience analytics is to identify milestones with large differences in priority between perspectives to help guide further risk management. The different relevance of criteria to the various stakeholder groups results in a different prioritization in each perspective. Table 1: Success criteria to prioritize schedule milestones in public safety broadband networks, and their relative relevance for three stakeholder perspectives. Index Criteria Government/regulatory relevance Vendor relevance Public safety relevance Availability high high high Privacy low low medium Interoperability high medium high Usability medium high high Quality of Service low high low Affordability high medium medium Standards Based low low low Flexibility medium low medium Coverage/Ubiquity high high high Risk Aversion medium low medium Others Figure 1 illustrates the prioritization of milestones in the development of a public safety broadband network. The figure shows 22 milestones, ranging from promoting cyber security, to investing in customer service, to developing data standards. The milestones are prioritized from the three perspectives, allowing for comparison of prioritization across the perspectives. Some milestones, such as x20: Invest in satellite services, have a wide range in priority among the three perspectives (described above), suggesting these are vulnerable in case the schedule is disrupted. Others, such as x04: Improve data source access, are consistently prioritized similarly. The variation of a milestone in priority between perspectives can help guide risk management as a milestone with a large difference could be a point of contention when negotiating recovery strategies following a disruption. Figure 1: Prioritization of schedule milestones towards a public safety broadband network from three perspectives: owner (regulatory), operator (vendor), user (public safety community). System transitions and negotiations The resilience (as a separation of priorities between system perspectives) has been quantified as the absolute value of change in prioritization (Connelly et al., 2015, Parlak et al., 2012), the sum of squares of ordering change (Hamilton et al., 2012), Spearman rank correlation coefficient (Thorisson et al., 2017b, Kendall tau rank correlation (Hamilton et al., 2016, You et al., 2014a; You et al., 2014b). Table 2 demonstrates the quantification of resilience from one perspective to another, measured by the Kendall Tau correlation coefficient. The coefficient takes value 1 when all combinations of pairs of milestones have the same order in two perspectives and value 0 when all pairs have the opposite order. Thus, the agreement between the prioritizations in the vendor and public safety perspectives is the lowest among the three perspectives, followed by the agreement between the vendor and the regulatory perspective. Conversely, the regulatory and public safety perspectives have higher agreement. This means that stakeholders in the vendor community have the most distinct priorities among the three stakeholder groups, including priorities during adaptation or recovery from a disruption. Table 2: Quantification of resilience from one perspective to another (Kendall Tau correlation coefficient) Regulatory perspective Vendor perspective Public safety perspective Regulatory perspective 1 0.71 0.90 Vendor perspective 0.71 1 0.68 Public safety perspective 0.90 0.68 1 Assessing how separate priorities of different perspectives are can be helpful when negotiating a schedule, or a recovery plan following a disruption. Acknowledging the differences allows for studying and addressing their root causes or building flexibility. The methods described have been applied in various other sectors of infrastructure and transportation, including power grid development (Hamilton et al., 2016; Thorisson et al., 2017), disaster recovery (Collier & Lambert, 2018; Connelly et al., 2015; Lambert et al., 2013; Parlak et al., 2012), development of electric vehicle bidirectional charging (Almutairi et al., 2018; Thorisson et al., 2017a), aviation biofuels industry development (Connelly et al., 2015), and others. Conclusion Resilience analytics should be considered in the context of negotiations (Thekdi & Lambert, 2015) or development of terms for design and operations of systems (Lambert et al., 2012). Resilience analytics as described in this article does not replace traditional approaches of consequence and likelihood-based procedures that analyze the effects of particular events or risk scenarios. However, it adds a layer of preliminary analysis that considers the connections and interactions of stakeholders on an enterprise level. Resilience analytics studies systems based on their schedules and milestones, and disruption, recovery, and adaptation are considered in this light. Quantifying how schedule priorities differ across stakeholder perspectives, and what milestones have the largest discrepancies, provides a starting point for negotiating terms and furthermore identifies urgencies for risk management. Thus, resilience is achieved by anticipating and accounting for the perspectives and other factors that are identified to have the greatest potential to have cascading effects on the overall schedule of implementation.
Resilience is a verb	Woods	Resilience is a Verb David D. Woodsi* i Department of Integrated Systems Engineering, The Ohio State University Suggested citation: Woods, D. D. (2018). Resilience is a verb. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords Resilience engineering, adaptive capacities, graceful extensibility, adaptation *Corresponding author: woods.2@osu.edu Introduction: Poised to adapt The title of this paper appears to violate grammar rules. But the violation runs in the opposite direction — much too often we see resilience as a state to be achieved — something a system has, when it refers to a set of capabilities for action, actually future action when conditions, challenges, opportunities change. As Erik Hollnagel has said repeatedly since Resilience Engineering began (Hollnagel & Woods, 2006), resilience is about what a system can do — including its capacity: . to anticipate — seeing developing signs of trouble ahead to begin to adapt early and reduce the risk of decompensation . to synchronize — adjusting how different roles at different levels coordinate their activities to keep pace with tempo of events and reduce the risk of working at cross purposes . to be ready to respond — developing deployable and mobilizable response capabilities in advance of surprises and reduce the risk of brittleness . for proactive learning — learning about brittleness and sources of resilient performance before major collapses or accidents occur by studying how surprises are caught and resolved Resilience concerns the capabilities a system needs to respond to inevitable surprises. Adaptive capacity is the potential for adjusting patterns of activities to handle future changes in the kinds of events, opportunities and disruptions experienced. Therefore, adaptive capacities exist before changes and disruptions call upon those capacities. Systems possess varieties of adaptive capacity, and Resilience Engineering seeks to understand how these are built, sustained, degraded, and lost. Adaptive capacity means a system is poised to adapt, it has some readiness or potential to change how it currently works— its models, plans, processes, behaviors (Woods, 2015; 2018). Adaptation is not about always changing the plan, model, or previous approaches, but about the potential to modify plans to continue to fit changing situations. Space mission control is a positive case study for this capability, especially how space shuttle mission control developed its skill of handling anomalies, even as they expected that the next anomaly to be handled would not match any of the ones they had planned and practiced for (Watts-Perotti & Woods, 2009). Studies of how successful military organizations adapted to handle surprises provide another rich set of contrasting cases (Finkel, 2011). Adaptive capacity does not mean a system is constantly changing what it has planned or does so all the time, but rather that the system has some ability to recognize when it's adequate to continue the plan, to continue to work in the usual way, and when it is not adequate to continue on, given the demands, changes and context ongoing or upcoming. Adaptation can mean continuing to work to plan, but, and this is a very important but, with the continuing ability to re-assess whether the plan fits the situation confronted—even as evidence about the nature of the situation changes and evidence from the effects of interventions changes. The ability to recognize and to stretch, extend, or change what you're doing/what you have planned has to be there in advance of adapting. This capability can be extended or constricted as challenges arise, expanded or degraded over cycles of change, and redirected or become stuck as conditions evolve into new configurations. Extensibility is fundamental to adaptive capacities that support resilient performance when future challenges arise (Woods, 2015; 2018). Systems are messy All systems are developed and operate given finite resources and live in a changing environment. As a result, plans, procedures, automation, agents and roles are inherently limited and unable to completely cover the complexity of activities, events, demands. All systems operate under pressures and in degraded modes (Cook, 1998). People and operations adapt to meet the inevitable challenges, pressures, trade-offs, resources scarcity, and surprises. To summarize the point vividly, Cook and Woods (2016) use a coinage from the American soldier in WWII: SNAFU is the normal state of systems—where SNAFU stands for Situation Normal All ‘Fouled’ Up. With SNAFU normal, SNAFU Catching is essential— resilient performance depends on the ability to adapt outside of the standard plans as these inevitably break down. SNAFU Catching, however technologically facilitated, is a fundamentally human capability essential for viability in a world of change and surprise (Woods, 2017). Some people in some roles provide the essential adaptive capacity for SNAFU Catching, though this may be local, underground, and invisible to distant perspectives (Perry & Wears, 2012). All organizations are adaptive systems, consist of a network of adaptive systems, and exist in a web of adaptive systems. The pace of change is accelerated by past successes, as growth stimulates more adaptation by more players in a more interconnected system. Growing technological and productivity capabilities also grow interdependencies and scales of operation that invoke complexity penalties and require trade-offs to cope with finite resources. The complexity penalties occur in the form of changing patterns of conflict, congestion, cascade and surprise. Regardless of the advance, SNAFU will re-emerge. Improvements drive a pattern in adaptive cycles: effective leaders take advantage of improvements to drive systems to do more, do it faster, and in more complicated ways. Growth creates opportunities for others to hijack new capabilities as they pursue their goals. Success drives increasing scale complexity which leads to the emergence of new forms of SNAFU and SNAFU Catching, as systems become messy again. This can be observed in the rise of high frequency trading in financial markets, in ransomware, and the influence of internet bots in elections, among others. SNAFU Catching is essential for the viability of adaptive systems in complex worlds. But organizations rationalize this core finding away on grounds of rarity, prevention, compliance. The first claim is: SNAFUs occur rarely given the organization’s design thus investing in SNAFU Catching is a narrow issue of low priority. The second claim is: there is a record of improvement that reduces the likelihood/severity/difficulty of SNAFUs. Third, when SNAFUs occur, poor response is due to people who fail to work to the rules for their role within the organization’s design. These rationalizations are wrong empirically, technically, and theoretically. As organizations focus on making systems work faster, better, and cheaper, they develop new plans embodied in procedures, automation, policies, and forcing functions. These plans are seen as effective since they represent improvements relative to how the system worked previously. When surprising results occur, the organization interprets the surprises as deviations—erratic people were unable to work to plan, to work to their role within the plan, and to work to the rules prescribed for their role. The countermeasures become more stringent pressures to work-to-plan, work-to-role and work-to-rule (Dekker, 2018). The compliance pressure undermines the adaptive capacities needed for SNAFU Catching (such as initiative), creates double binds that drive adaptations to make the system work ‘underground,’ and generates role retreat that undermines coordinated activities. In every risky world, improvements continue, yet we also continue to experience major failures that puzzle organizations, industries, and stakeholders. SNAFU recurs visibly—in June 2018 IT failures stopped online financial trading (TSB in the UK and Canadian Stock exchanges). Befuddlement arises from a background of continued improvement on some indicators, coupled with surprising sudden performance collapses. This combination IS the signature of adaptive systems in complex environments. The scale complexity that arises from changes to increase optimality comes at the cost of increased brittleness leading to systems “which are robust to perturbations they were designed to handle, yet fragile to unexpected perturbations and design flaws” (Carlson & Doyle, 2000, p. 2529). As scale and interdependencies increase, a system’s performance on average increases, but there is also an increase in the proportion of large collapses/failures. Given that pursuit of optimality increases brittleness, why don’t failures occur more often?—SNAFU Catching. Adapting to handle the regular occurrence of SNAFUs makes the work of SNAFU Catching almost invisible (Woods, 2017). The fluency law states: well adapted activity occurs with a facility that belies the difficulty of the demands resolved and the dilemmas balanced (Woods, 2018). Systems that continue to adapt to changing environments, stakeholders, demands, contexts, and constraints are poised to adapt through enabling SNAFU Catching (Cook & Woods, 2016). Continuous adaptability How can organizations flourish despite complexity penalties? Answers to this question have emerged from research on resilient performance of human adaptive systems. For organizations to flourish they need to build and sustain the ability to continuously adapt. Today this paradigm exists in web engineering and operations because it was necessary to keep pace with the accelerating consequences of change as new kinds of services arose from internet fueled capabilities (Allspaw, 2015). Web-based companies live or die by the ability to scale their infrastructure to accommodate increasing demand as their services provide value. Planning for such growth requires organizations to be fluent at change and poised to adapt. Because these organizations recognize that they operate at some velocity, they know they will experience anomalies that threaten those services. Web engineering and operations has served as one natural laboratory for studying resilience-in- action (emergency medicine and space mission management are other examples). Outages and near outages are common even at the best-in-class providers. Past success fuels the pace of change. Systems work at increasing scale in a constantly changing environment of opportunity and risk. Web engineering and operations is important also because all organizations are or are becoming digital service organizations. For example, recently multiple airlines have suffered major economic losses when IT service outages led to the collapse of the airlines ability to manage flights. Results from this natural laboratory help reveal fundamental constraints on how human adaptive systems function. Organizational systems succeed despite the basic limits of automata and plans in a complex, interdependent and changing environment because responsible people adapt to make the system work despite its design—SNAFU Catching. Four capabilities provide the basis for continuous adaptation. Initiative is essential for adaptation to conflicting pressures, constant risk of overload, and inevitable surprises (Woods, 2018). Organizations need to guide the expression of initiative to ensure synchronization across roles tailored to changing situations. This requires pushing initiative down to units of action (Finkel, 2011). Initiative can run too wide when undirected leading to fragmentation, working at cross- purposes, and mis-synchronization across roles. However, initiative is reduced or eliminated by pressure to work-to-rule/work-to-plan, especially by threats of sanctions should adaptations prove ineffective or erroneous in hindsight. Emphasis on work-to-rule/work-to-plan compliance cultures limits adaptive capacity when events occur that do not meet assumptions in the plan, impasses block progress, or when opportunities arise. Resilience engineering is then left with the task of specifying which system architecture balances the expression of initiative as the potential for surprise waxes and wanes. The pressures generated by other interdependent units either energizes or reduces initiative and therefore the capacity to adapt. These pressures also change how initiative is synchronized across roles and levels. The pressures constrain and direct how the expression of initiative prioritizes some goals and sacrifices other goals when conflicts across goals intensify. Effective organizations build reciprocity across roles and levels (Ostrom, 2003). Reciprocity in collaborative work is commitment to mutual assistance. With reciprocity, one unit donates from their limited resources now to help another in their role, so both achieve benefits for overarching goals, and trusts that when the roles are reversed, the other unit will come to its aid. Each unit operates under limited resources in terms of energy, workload, time, attention for carrying out each role. Diverting some of these resources to assist creates opportunity costs and workload management costs for the donating unit. Units can ignore other interdependent roles and focus their resources on meeting just the performance standards set for their role alone. Pressures for compliance undermine the willingness to reach across roles and coordinate when anomalies and surprises occur. This increases brittleness and undermines coordinated activity. Reciprocity overcomes this tendency to act selfishly and narrowly. Interdependent units in a network should show a willingness to invest energy to accommodate other units, specifically when the other units’ performance is at risk. Third, a key lesson from studies of resilience is that tangible experiences of surprise are powerful drivers for learning how to guide adaptability. Tangible experience with surprises helps organizations see SNAFU concretely and to see how people adapt as difficulties and challenges grow over time. Episodes of surprise provide the opportunity to see when and how people re-prioritize across multiple goals when operating in the midst of uncertainties, changing tempos and pressures. Fourth, proactive learning from well-handled surprises contributes to re-calibration and model updating (Woods, 2017). This starts with careful study of sets of incidents that reveal SNAFU Catching (Allspaw, 2015). What constitutes an ‘interesting’ incident changes. Organizations usually reserve limited resources to study events that threatened or resulted in significant economic loss or harm to people. But this is inherently reactive and many factors narrow the learning possible. To be proactive in learning about resilience shifts the focus: study how systems work well usually despite difficulties, limited resources, trade-offs, and surprises—SNAFU Catching. In addition, effective learning requires organizations to develop lightweight mechanisms to foster the spread of learning about SNAFU Catching across roles and levels. Resilience is a verb that refers to capabilities that build and sustain the potential for continuous adaptability. Only few organizations can ‘do’ resilience, but these systems provide the ‘proofs’ of concept that can guide all organizations to develop the adaptive capacities needed to flourish in an increasingly interdependent world as the velocity of change accelerates.
Managing energy transition through dynamic resilience	Young & Wilkinson	Managing Energy Transition Through Dynamic Resilience Martin Youngi* and Angela Wilkinsoni i World Energy Council Suggested citation: Young, M., & Wilkinson, A. (2018). Managing energy transition through dynamic resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on irgc.epfl.ch and irgc.org. Keywords: Dynamic resilience, energy transition, learning, practice *Corresponding author: young@worldenergy.org Energy transition in a new era of emerging and systems risks Energy transitions are not new with modern societies flourishing through previous technology-led energy transitions, including steam-power and electrification. However, managing a global scale energy transition is an unprecedented recent phenomenon which presents new risks and opportunities for societies across the world. Some of the risks could manifest with disruptions of current arrangements, and some incumbents may be abruptly and very negatively affected. Developing resilience ahead of potential regime shifts could help them recover, rebound and adapt. “With accelerating energy systems integration, resilience is no longer just about returning single assets to full operation after a disruptive event. When interdependent parts of a system are blacked out, the system as a whole is at risk of being deadlocked” (WEC 2016a). The Grand Transition described by the World Energy Council (WEC 2016b) is not restricted to energy with faster and fundamental changes becoming apparent. Energy challenges emerge from an interplay of global megatrends – digitalisation, decarbonisation, and decentralisation – and combine with regional and local developments to transform energy demand, services and systems. A new era of digital economic productivity and emerging artificial intelligence is raising big questions about the role of energy and the outlook for human-centric well-being / flourishing. Recent progress in aligning international action on reducing energy-related carbon emissions are not sufficient to guarantee a successful and timely low carbon global energy transition. And other energy-related challenges are evident in enabling a next era of global productivity, inclusive prosperity, human-centric wellbeing and peace. Successfully navigating energy transitions presents a wicked situation, rather than a simple problem (Rittel & Webber, 1973). Defining and driving successful and well-managed energy transitions requires attention to the socially messy, multi-scale, and multiple dimensions of the connected challenges of better lives for all and a healthy planet. The diversity of regional energy systems and national energy security contexts has led to increasing recognition that ‘one size fits all’ solutions are ineffective to the common problem of global energy transition. Each country will have its own unique energy transition dependent upon its culture, natural resource endowment and policy capabilities. Energy systems themselves are becoming more diffuse, due to market fragmentation and technological change with a more diverse cast of energy actors that are also dividing responsibility for energy security and grid reliability. The global energy transition is not just about managing new types of emerging and systemic risks but also realising new opportunities for energy systems to evolve faster than ever before. This introduces two new imperatives for action beyond conventional competitive strategies and better risk management – improvisation, cooperation – and, in turn, shifts the emphasis from better risk management tools to building dynamic resilience capabilities to sudden or unpredictable changes. The resilience of energy firms to specific events or systemic shifts is not in their direct control but can be enhanced by situational awareness of different types of risk and preparedness for new future developments. Integrated risk management and the search for dynamic resilience capabilities The risk space that the energy market players manage is evolving into a broader landscape of systemic and emerging risks - such as increasing price volatility, cyber security, and extreme weather events - due to a combination of urbanisation and climatic variability, and in some cases increasing evidence of impacts of global climate change. The unfolding and evolving risk landscape is fast moving and unpredictable, which is likely to leave some energy system players blind to emerging threats and less prepared if they continue to rely on passive system buffers to provide energy security, such as strategic reserves or grid integrity. New risks such as cyber security challenges to operation systems can overwhelm the unprepared where existing response strategies are not necessarily useful. In parallel with the evolving risk landscape, a new opportunities agenda for global energy systems transition is being emphasised, which aims to deliver deep decarbonisation and other goals. Achieving the UN Sustainable Development Goals and Paris Climate Agreement will require flexible cooperation across energy- and policy domains and adjacent sectors (e.g., transport, finance, and industry). The new risk landscape requires a more agile and adaptive response framework with a greater emphasis on resilience and rapid recovery. In this environment, energy stakeholders are starting to experiment with responsive, networked and innovation-rich strategies as energy leaders shift their focus from better risk management to building new dynamic resilience capabilities. This shift reflects a gradual recognition that the traditional risk management approaches to control risk are no longer sufficient and that greater systematic resilience is required to enable more agility, adaptation and regeneration by energy firms, sectors and communities. An energy-focused framework The World Energy Council has been developing a Dynamic Energy Resilience (DER) framework for the purpose of helping energy firms and communities improve their approach to resilience to endogenous or exogenous shocks and disruptive innovations. It integrates three previously separate systemic and emerging risk themes i) extreme weather or natural hazard, ii) digital or cyber risks and iii) food-energy-water nexus with a practical focus on risk identification and assessment, situational awareness and prevention-mitigation plans (WEC 2018). Extreme Weather / Natural Hazards Extreme weather event impacts on energy systems can be associated with i) repeating patterns or ii) shifting weather regimes due to climate change. Energy systems are already impacted by extreme weather events such as flooding, drought, hurricanes etc. as well as weather patterns (e.g., El Niño, Monsoon) but climate change is anticipated to increase the frequency and severity of extreme weather events. Digital / Cyber Risks Digital risks are a novel and evolving challenge that is difficult to assess using conventional risk analysis methods. Cyberattacks are expected to increase with the shift from mechanical and centralised energy assets to the new operational-plus-digital systems implied in the digitalisation- decentralisation transition. The key interface between operational and digital elements can mismatch and increase the risks for human error or malicious attack (Ciborra, 2001). Energy firms and others are highly sensitive about discussing cyber risks and their impacts so a different approach is required where a dialogue between leaders in digital and energy sectors could be useful. System Risks – Food-Energy-Water Nexus Systemic risks of increasing connectivity, like the food-energy-water nexus when managing global value chains, requires attention to interdependencies between the different sectors and levels. Systemic risk emerges from within the complex adaptive systems characterised by the many-to- many interests and needs. Energy players need to anticipate how they can prepare for systemic risks emerging from the dynamic interactions of multiple systems and global supply chains, particularly in the drive to “circularity”. The DER framework identifies a combination of four capabilities: i) situational awareness of all risks (current / potential); ii) agility (speed); iii) adaptive capacity to prevent or mitigate impact on performance (flexibility/optionality); and iv) regenerative development i.e. the evolution / self- transformation of energy organisations and systems to promote synergies in human-centric wellbeing, planetary health and socio-economic flourishing. The framework is being developed thorough engagement with the emerging global community of practice to draw on the new and different experiences and new solutions firms within the energy sector and beyond are using to improve their organisational and energy system resilience – agility, adaptability, regenerative capabilities – including: • Governance and culture • Financial mitigation • Operating through crisis • Short vs. long term energy security • Diversification/pricing in redundancy Comparing approaches to risk governance and dynamic resilience The Council’s Dynamic Energy Resilience framework and the IRGC’s Risk Governance Framework (IRGC 2017) overlap with each other although they focus on differing aspects and derive from different approaches. The academic-led IRGC framework provides greater delineation of the differing tasks for risk identification, categorization and evaluation while the practise-led DER framework reflects more on the organisational capabilities for agile risk management, adaptive capacity, and ability to self- transform, i.e., on strategic renewal. The IRGC Risk Governance Framework challenges the linear, predictive and control-based approach of identify, assess, manage, communicate risks and highlights the need for a more integrated, learning-based approaches to risk management. Similarly, the DER framework highlights systemic risks that emerge between conventional risk categories or policy silos, and impact before significant trends are fully visible. This suggests new capabilities for horizontal learning, improvisation in crisis and integrated innovation are needed which are enabled through a “team of teams” culture and connects risk appetite with context and capability. An iterative, four capabilities framework, in turn, can help develop double -and even triple-learning loops which involve systems thinking and futures framing about the co-evolution of context and capabilities, and avoid the trap of looking only for expected performance. Dynamic resilience is not a theory-led risk-based tool, it is a practice-led, organisational capability which is supported by a culture that does not rely on either the numbers to speak the truth or winning through competitive strategies. Dynamic resilience adopts a stance of learning with multiple futures, rather than the conventional risk-based approach of reducing uncertainty to enable control of the future. The emphasis is on anticipating, appreciating and addressing disruptive changes, which are characterised by novelty and uncertainty, by triggering improvisation and accelerating experimental, interactive and collaborative responses. Barriers and facilitators of dynamic resilience Knowledge sharing across diverse energy firms and communities has already highlighted the following insights about progressing dynamic resilience: 1. Energy players need to move beyond passive security measures and develop capabilities in dynamic resilience, working across different realities of weather, water, cyber, price volatility, and other systemic and emerging risks. Dynamic resilience also involves creativity – improvisation through crisis. 2. Regional integration can enhance energy systems resilience but is not straightforward. Political economy risks such as politicians exposed in event of national shocks, and lack of mutual trust between diverse energy actors and systems can constrain regional interconnectivity. 3. Digital technologies provide many new opportunities but may also expose the energy system to new risks such as cyber-attacks. Substantial technological coordination is required to avoid regionally integrated and physical-digital interfaces suffering catastrophic cyber failures, whether from malicious or unintentional causes. 4. Regulation can empower resilience by encouraging energy systems to plan for resilience and counteract the tendency to focus on economic efficiency alone that can remove shock absorbers from the system and accelerate path dependency towards a crisis from ‘lock in’. But energy system resilience cannot be achieved without economic efficiency, and regulation can be slow. Some level of productive or regenerative redundancy is beneficial although how to create buffers that are economically productive is poorly understood. Moreover, the opportunity to enable system circuit breakers has yet to be considered where policymakers and regulators could do more to promote policies to encourage dynamic resilience. More secure systems are costly and while those costs will fall with time, it is unclear if countries are evaluating the cost of security in terms of resilience by assessing energy system risks against affordability. 5. Mutual aid schemes can help and there are mutual resilience fund clusters in the nuclear sub- sector which also has peer reviewed security policies and a common insurance fund. This approach could benefit other sub-sectors.