The second volume of IRGC’s resource guide on resilience (2018):

  • Provides in-depth and pragmatic evaluation of concepts and methods for resilience-based approaches in contrast to risk-based approaches, as proposed and practiced in different domains of science and practice. Adequate articulation of risk and resilience is key to ensure security in systems.
  • Considers possible drawbacks of resilience, such as when resilience does not discourage inappropriate risk-seeking behavior
  • Discusses the relevance and role of resilience as a strategy to address challenges posed by systemic risks that develop in complex adaptive systems (CAS). Such systems are interconnected, with the result that risks can cascade within and between systems. Resilience can help steer dynamic changes in CAS, as those evolve in response to internal and external shocks and stresses.

All papers: A compilation of all papers including introduction and conclusion is available for download here (pdf).

An introduction to 2nd volume of the resource guide on resilienceLinkov, Florin & TrumpAn Introduction to 2nd Volume of the Resource Guide on Resilience

Igor Linkovi*, Marie-Valentine Florinii, Benjamin D. Trumpi

i United States Army Corps of Engineers, USA

ii International Risk Governance Center (IRGC), École Polytechnique Fédérale de Lausanne (EPFL), Switzerland

Suggested citation: Linkov, I., Florin, M.-V., & Trump, B. D. (2018). An Introduction to 2nd volume of the
resource guide on resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience
(vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk
Governance Center. Available on and

*Corresponding author:

Society is increasingly reliant upon complex and interconnected systems to foster virtually all
elements of modern life. From basic infrastructure to public health and medicine to business and
finance, these systems are often predicated upon interdependencies in order to deliver better,
faster, and less expensive services. Such interconnection has opened the door to incredible
innovations in organizational and infrastructural operation yet has also left many critical and
foundational societal systems at risk of systemic disruption.

A growing area of inquiry to best prepare the complex infrastructural, social, and environmental
systems which sustain modern life is resilience. Across its many disciplinary and theoretical uses,
resilience typically emphasizes the capacity of a system to ‘bounce back’ and adapt to changes
within its environment. As both a philosophical topic and a methodological practice, resilience has
exploded in usage over the past several years. Its effect upon policy is tangible, including efforts
within the United States, European Union, OECD, United Nations, People’s Republic of China, and
countless other nations and governing bodies (Larkin et al., 2015; Corfee-Morlot et al., 2012; Linkov,
Trump & Keisler, 2018). The diversity of resilience applications is equally manifest, from
infrastructural and engineering resilience to complex adaptive ecosystems, economic and financial
markets, and psychosocial behavior at varying levels of abstraction (Linkov & Trump, 2019).

This level of growth presents a key challenge – how might we arrive at shared core concepts of
resilience without unduly restricting valuable research into a scientific discipline or policymaking
practice? This is a subtle question which reflects upon the need for a common language by which
resilience can be communicated and implemented across disciplines and borders, yet equally work
within the political, institutional, scientific, and cultural contexts which comprise a given project,
venture, or activity (Alexander, 2013).

In late 2016, the 1st Volume of the Resource Guide on Resilience was assembled to address this
concern. Across dozens of submissions, participants unpacked multiple definitions, analytical
methods, tools, and governing strategies by which resilience is formulated and implemented (Linkov,
Trump & Fox-Lent, 2016). With such a diversity of knowledge on the foundational principles of
resilience, the 1st Volume of the Resource Guide serves as a core open-source document where
interested parties can understand what resilience is, as well as identify the shared principles and
opinions behind the analysis and implementation of resilience on a global scale.

Papers presented in the 1st volume were tasked to accomplish the following:

1) Clarify how resilience differs and complements existing practices with risk assessment, and
2) Define resilience as a systems-focused approach which emphasizes the capacity of that
system to recover from and adapt in the aftermath of disruption.

The first point is a concern of governance and semantics. Risk assessment has evolved as the go-to
exercise to explore how a specific hazard or threat might exploit a vulnerability within a given
system and what the consequences of that hazard or threat might be. Individual disciplines,
government agencies, and private sector stakeholders each possess their own approach to executing
such risk assessment in a manner that is consistent with statutory requirements as well as social and
institutional norms (Jasanoff, 2011). These processes work well within an environment of clearly
defined hazards and threats to thoroughly understood risk receptors. However, such risk assessment
becomes less capable of characterizing and prioritizing threats, clarifying system vulnerabilities, or
reasonably assessing threat consequences within an environment of high complexity and
interconnectivity within and between systems – there simply is not enough data to populate a risk
assessment, nor is there sufficient expertise to confidently identify all of the threats which might
exploit system vulnerabilities and generate cascading impacts to the system and its dependencies
(Holling, 1986; Trump et al., 2017).

Resilience thinking and assessment is a likely candidate to complement existing risk assessment
practices within such environments of high uncertainty or system complexity (Gunderson, 2001).
Rather than focusing upon any single threat (or requiring that all threats be identified and
characterized to inform a system’s risks), resilience instead requires analysts to unpack the
characteristics that define a system’s activities and baseline state of performance – including any
external dependencies or internal sub-systems (Palma-Oliveira & Trump, 2016). This approach allows
analysts to understand how a system performs when one or more of its critical functions are
degraded, destroyed, or otherwise rendered inert. To best protect complex systems from lasting and
widespread failure and loss of service, various strategies are needed to improve the system’s
capacity to absorb and recover from risk – thereby limiting losses as much as possible.

The second point is a concern of framing and analytics. We argue that risk assessment is primarily
focused on preparing a system to withstand and absorb threats of a specific nature or intensity.
Examples of such an approach are numerous, from coastal flood preparedness to bridge usage and
maintenance scheduling to aircraft inspections and safety assessment. On the other hand, we argue
that the novelty behind resilience is a need to emphasize the capacity of a normatively positive
system to recover and adapt, following the occurrence of adverse events (Linkov, Trump & Keisler,
2018). This distinction might appear minor but represents a significant departure from how current
assessment is conducted.

One key distinction includes the general need for a resilience-based approach to consider low-
probability, high-consequence events. A risk-based approach often struggles to inform decisions of
this nature, where an analyst either places too much emphasis or too few resources onto the given
risk receptor’s ability to withstand and absorb the shock of an adverse event. For resource-
constrained agencies and organizations, such events are often prohibitively expensive to fully defend
against. A recurring example includes preparedness for severe coastal storms – preparing every mile
of coastline for a Category 5 Hurricane would be ruinously expensive and politically indefensible.
Likewise, a resilience-based approach would instead offer an improved understanding of which

essential components of a system would contribute to the greatest loss of function if taken offline.
After identifying these critical functions, an analyst may then develop countermeasures or
redundancies to improve the capacity of these functions to withstand and recover from their initial

A key theme here is the notion of systemic threats. Such threats are characterized by their capacity
to percolate across complex interconnected systems – either through an abrupt shock, or gradual
stress (IRGC, 2018). Systemic threats are particularly difficult to model and calculate via a risk-based
approach due to a mixture of the weak signals, which herald a potential upcoming systemic risk
event, as well as the nested interaction effects by which a systemic threat incurs disruption to a
system in an indirect manner. For example, the Financial Crisis of the previous decade began as a
collection of relatively contained failures of financial firms, which ended in a substantial financial
collapse across much of the world. In a separate yet related volume to the Resource Guide on
Resilience, the International Risk Governance Center’s Guidelines for the Governance of Systemic
Risks unpacks steps to identify, manage, and govern such systemic threats from the perspectives of
policymakers and industry stakeholders alike. Resilience is an often-essential component for the
governance of systemic risks, where such a governing approach emphasizes the need to limit the
potential for cascading disruption as well as to build redundancies and countermeasures to quickly
recover from and adapt to such systemic threats in an expeditious manner.

When data is in abundance or relatively easy to acquire, or system complexity is limited and system
threats are well characterized, risk-based approaches of assessment are the gold standard for most
regulatory agencies or industry stakeholders to follow. However, when one or more of these
characteristics become more uncertain or complex, resilience-based approaches may help
complement any deficiencies that a risk-based approach presents. Such resilience-based concepts
have been discussed and applied in many situations and disciplines globally and are growing in
prevalence and scholarly attention. The opinions of the authors within this Resource Guide reflect
the diversity of such approaches and perspectives, and collectively ask and answer important
questions related to the further development and implementation of resilience in various industries
and projects.

Presenting the Second Resource Guide on Resilience

This 2nd Volume of the Resource Guide on Resilience delves further into the more specific domain-
based views on resilience, as well as critical questions in the field which remain underrepresented in
scholarly literature and policy documents. For starters, the 2nd Volume reviews expertise from
multiple domains, including environment and ecology, business, economics, and finance, and
infrastructure and engineering. Each author presents an understanding of resilience as it is
conceived and applied within their domain, as well as how resilience compares with more traditional
statutory requirements of risk assessment, and how risk and resilience are complementary concepts.
Many authors emphasize the dynamic property and process that comes with resilience, illustrated
by Woods’ (2018) submission aptly titled “Resilience is a Verb.”

After defining resilience within their field and articulating differences between risk-based and
resilience-based approaches, authors were asked to comment upon two important questions
regarding the framing and consequences of a resilience-based approach. One question centers upon
potential downsides that a resilience-based strategy might evoke – either through implicitly
changing the characteristics or properties of systems and making them more susceptible to losses or

collapse, or altering the frames or perceptions of individuals relying upon these systems to behave in
a different or more risk-seeking manner. A second question includes the author’s view of the role of
resilience to enable or foster the capacity of systems to adapt or transform in the face of important
changes that can trigger shocks and disruption.

The potential downsides of resilience are often undiscussed in scholarly literature as well as within
many important policy discussions. Indeed, resilience is often framed as being a universally positive
trait, with little reflection upon how a recovery and adaptation-based approach can fundamentally
change the way a system and its stakeholders function and behave (Nelson et al., 2007; Palma-
Oliveira & Trump, 2016). Many authors within this Resource Guide reflect upon their concerns of a
‘downside’ of resilience as arising from (a) increasing brittleness in some components of a system in
order to strive for robust recovery in others, or (b) a fear that a resilience-based approach might
induce some concern of moral hazard, or excessive confidence in the capacity of a resilient system to
quickly recover from any and all disruptions, and therefore contribute to increasing a risk appetite or

Our authors described multiple potential drawbacks or concerns associated with developing
resilience in various domain-specific approaches. Baum (2018) introduces the potential concern of
moral hazard. Likewise, Aldrich et al. (2018) express concern at the tradeoffs inherent to developing
resilience in societal contexts – in other words, they argue that decision-makers routinely prioritize
spending on physical infrastructure over social system resilience, which can further entrench and
enflame public tensions and social deficiencies. Stojadinovic (2018) further argues that resilience-
based development in civil infrastructure may become unpopular due to its relative cost versus the
uncertain likelihood that a disruption to such infrastructure will occur in the first place. Likewise,
from an ecosystems perspective, Levin (2018) argues that furthering resilience-based approaches
may extend the lifespan of suboptimal or undesirable system components, rather than enabling the
system to transition to a more preferred state.

Similar to the consideration of potential downsides of pursuing resilience-based strategies,
transitions are equally a critical yet often under-discussed component of system resilience. Complex
adaptive systems are constantly in flux and incorporate new information and capabilities to best
respond to emerging trends and stresses within their surrounding environment (Hirota et al., 2011;
Comfort et al., 2001). Acknowledging the broad diversity of systems which transitions apply to, we
have asked experts in areas within each of the three domains listed above to discuss how adaptation
and transitions apply to their area of research. In their pieces, several authors describe how
resilience enables adaptation and transformation, either before important transitions or to cope
with the consequences of important undergoing transitions. Finally, several authors discuss how
resilience assessment can also evaluate the capacity of a system to adapt and transform to avoid
dangerous disruptions.

Authors of this Resource Guide, volume 2, individually explore the role of resilience to enable and
foster system transitions. From an environmental and ecological perspective, Allen (2018) and
Palma-Oliveira & Trump (2018) respectively discuss how ecological systems are defined by a
constant influx of environmental change, where systems (e.g., a lake), sub-systems (e.g., the pH level
of the lake), and supra-systems (e.g., the regional drainage of water into the lake) each shift to
accommodate new and recurring environmental stressors. Allen discusses the constant and multi-
scalar environmental change as panarchy, while Palma-Oliveira & Trump reflect upon the ecosystem

transition concept known as basins of attraction. Within both pieces, the authors respectively argue
that ecological transitions reflect moments where an existing environmental state can realign into a
similar state or transition into one that is entirely different from the biodiversity and ecosystem
health currently available. A critical takeaway point from these and other authors is that such
transitions or the crossing or certain thresholds can drive a system towards a normatively positive or
harmful ecosystem structure.

Similar themes were raised by other authors in this regard. For social and organizational resilience,
Pulakos & Lusk (2018) as well as Kudesia & Reb (2018) respectively describe the preconditions of
social interaction and trust which are needed to transition an organization, business, or government
away from a socially undesirable or unsustainable state, and towards one that is preferable. From
the perspective of infrastructural resilience, Furuta & Kanno (2018) as well as Kott (2018) reflect
upon the need to account for nested interdependencies of engineered systems, where transitions
and adaptive capacity percolates from sub-systems into broader infrastructural systems such as with
the experience of the Great East Japan Earthquake and the subsequent disaster at the Fukushima-
Daiichi Nuclear Power Plant in 2011, or military systems and cybersecurity.

Resilience is definitely a topic of growing interest not just as a philosophical or scholarly exercise, but
increasingly as an aspirational goal for many complex systems facing systemic threats, and an
appealing pragmatic approach to governing risks with a low probability of occurrence and potentially
a high level of negative consequences, shocks, disruptions and cascading failures. This compendium
of knowledge expands upon the 1st Volume of the Resource Guide on Resilience by providing a more
in-depth view of disciplinary applications of resilience, as well as key questions regarding the
implications of resilience-based strategies moving forward.
A Janus-faced resource: Social capital and resilience trade-offsAldrich, Page-Tan & FraserA Janus-Faced Resource:
Social Capital and Resilience Trade-Offs

Daniel P. Aldrichi*, Courtney Page-Tani and Timothy Fraseri

i Northeastern University

Suggested citation: Aldrich, D. P., Page-Tan, C., & Fraser, T. (2018). A Janus-faced resource: Social capital and
resilience trade-offs. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2):
Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance
Center. Available on and

Keywords: Community resilience, social capital, bridging, bonding, linking

*Corresponding author:

Much research has underscored the critical role played by social capital in building resilience in
communities and organizations. In a time of crisis, we know that individuals with more connections
embedded in communities that are more cohesive and better connected horizontally and vertically
have higher survival rates and better recoveries compared to similar individuals and locations that
are less connected. Yet, a more nuanced analysis reveals resilience trade-offs between types of
these social connections. This piece investigates how different types of social ties, including bonding,
bridging, and linking ties, create different resilience trajectories for neighborhoods and institutions,
and how they impart dynamic effects on pre-disaster neighborhood vulnerability.

An introduction to community resilience

In the wake of mega-disasters in New Orleans, Kobe, Bangkok, and more, experts have increasingly
highlighted the importance of building resilience over risk management alone. We define community
resilience as the capacity of a neighborhood or geographically defined community to anticipate,
absorb and manage stressors and efficiently return to daily activities in the wake of a shock to social,
physical, or ecological systems (Aldrich, 2012; NAS, 2018; Executive Order No. 13653, 2013). Scholars
have connected community resilience with a variety of outcomes: increased local capacity and social
support, effective communication systems, good community physical and mental health and public
involvement in governance (Patel, Rogers, Amlôt, & Rubin, 2017; Food and Agricultural Organization
[FAO] 2011). By investing in community resilience, cities can better prepare themselves to bounce
back better after disaster strikes.

Social capital - the ties that bind us - is a strong driver of resilience during and after disasters
(Aldrich, 2012; Rackin & Weil, 2015). Following Hurricane Katrina, for example, the Vietnamese-
American community quickly returned to New Orleans East despite having comparatively few
financial resources and low levels of education. The strength of their connections, the leadership of
the local Mary Queen of Vietnam (MQVN) Catholic Church, and connections with national co-ethnic
institutions organized their evacuation, eased barriers to collective action and helped efficiently
rebuild their community (Chamlee-Wright & Storr, 2009; Airriess et al., 2008). However, in some
nearby communities throughout the Greater New Orleans area, recovery moved slowly, especially in
terms of finding housing for residents in the first year after the storm. While many publicly agreed

that temporary housing in the form of FEMA (Federal Emergency Management Agency) trailers
contributed to recovery, residents viewed them negatively and sought to keep such facilities out of
their neighborhoods. Utilizing and leveraging their ties, communities with higher levels of social
capital were successful in keeping trailers - considered a ‘public bad’ - out of their backyards. Public
bads are facilities that benefit the public but impart focused costs to the communities that host
them, including FEMA trailers in disaster-struck towns, seawalls in coastal fishing communities, or
controversial power plants. Opposition to these public bads slowed recovery throughout New
Orleans as bureaucrats scrambled to find places for temporary housing (Aldrich & Crook, 2008;
Aldrich, 2012). Without adequate housing, some residents may leave town, leaving local officials
unclear of who reconstruction will serve. The longer residents stay away, the weaker their ties to
home become, as stories of some New Orleans jazz musicians – who relocated to Chicago never to
return – illustrate. These methods of disaster adaptation can weaken social ties, hindering recovery
for communities overall.

These examples illustrate how a community can leverage different kinds of social capital in different
ways to mitigate risk and improve resilience. The Vietnamese-American community used its close-
knit ties to serve the people within its community, while communities throughout the Greater New
Orleans area used their linking social capital to keep out ‘public bads’ and slow recovery elsewhere.
To gain a greater understanding of the dynamic resilience outcomes of bonding, bridging and linking
social capital, we investigate how these three types of social capital can create different resilience
outcomes across communities faced with uncertainty and unexpected disturbances.

Social capital in community resilience

Because cities face an uphill battle when predicting the risk, scale, intensity, and timing of shocks
and stressors, some communities have instead chosen to invest in community resilience and
mitigate vulnerabilities before disaster strikes. Whereas risk management strategies, such as levies,
only pay off if a city successfully avoids a shock, social capital and community resilience convey
benefits before, during, and after disaster. As a result, scholars of community resilience increasingly
describe risk and resilience in terms of the social capital of a community.

Social capital matters to community resilience because social ties in a community can offer a kind of
communal insurance or capital where members can share information and resources, increasing the
capacity of communities to respond to crisis (Tierney, 2014). Social capital comes in three types:
bonding, bridging, and linking. Bonding social capital describes homophilous relationships between
family, close friends, members of a social group or those who share ethnic or class ties (McPherson,
Smith-Lovin, & Cook, 2001). In contrast, bridging social capital refers to relationships between
people across different social and ethnic groups, and these ties are often built by civic and political
institutions such as parent-teacher associations and advocacy groups (Small, 2010). Bonding and
bridging social capital typically describe horizontal relationships among equals, whereas linking
capital describes vertical relationships of respect and trust between persons and officials or ranking
community members who exercise authority over them (Szreter & Woolcock, 2004). Access to these
relationships with community officials means better representation of residents’ wants and needs in
disaster-related planning.

Trade-offs of social capital in community resilience

Social capital in its three forms can impart unique and sometimes detrimental effects on community
resilience, especially in communities that have developed more bonding social capital than bridging
social capital. Social capital does not increase the appetite of communities for risk, but it can
engineer uneven recovery across cities. In this way, building resilience can produce moral hazards of
its own.

This is particularly clear in the effect of social capital on post-disaster poverty rates in the United
States. When residents try to rebuild homes, community recovery carried out through bonding social
capital-based groups tends to absorb resources and impoverish the overall community. In contrast,
bridging and linking groups assist at the county level over time. For example, after Hurricane Harvey
in 2017, a wealthy church in the River Oaks neighborhood ceased its financial support for a local low-
income church in order to help its own congregants, disrupting the flow of social and financial
resources for low-income communities more than the disaster did itself. Broader analysis shows this
to be true over time and space. Between 1985 and 2015, US counties heavily damaged by natural
hazards developed higher poverty rates afterwards if they developed more religious or civic
organizations that facilitate bonding ties, while developing more advocacy organizations that boost
bridging ties reduced poverty rates (Smiley, Howell, & Elliott, 2018, p. 18).

These trade-offs are evident in disasters abroad as well. During the Great Floods in Thailand in 2011,
government agencies, community and faith-based organizations, and private enterprises that were
more closely connected in urban and suburban areas delivered worse disaster aid than those groups
in rural areas. These rural organizations benefited from stronger bridging ties, which afforded better
coordination among organizations (Andrew et al., 2016).

Yet an excess of bonding capital at the expense of bridging capital is not the only problematic
resilience trade-off. If communities have significant bonding capital and linking capital, but lack
bridging capital, the resulting unequal access to local officials can compound disparities in recovery

For example, following the Indian Ocean Tsunami, coastal hamlets throughout the southern state of
Tamil Nadu with high levels of bonding and linking social capital had more access to aid and
assistance from NGOs and government officials (Aldrich, 2012). These villages had a higher
percentage of new and rebuilt homes. Villages that had to rely solely on bonding social capital
experienced greater difficulty securing aid and assistance. Compared to villages with both bonding
and linking social capital, families holding only bonding ties remained in shelters for an extended
period of time and had fewer resources to rebuild or build anew.

Likewise, in New Orleans, communities only with strong local, bonding social capital did not receive
resources necessary for effective recovery (Elliott, Haney, & Sams-Abioudun, 2010). Residents of the
Lower Ninth Ward, a disproportionately poor community, suffered significant setbacks because they
were unable to access their translocal ties, compared to the residents in Lakeview, a neighborhood
in New Orleans considered to be well off. This neighborhood had strong local ties along with a higher
share of white residents, income levels, house prices, and education levels, compared to New
Orlean’s many more diverse, often poorer neighborhoods. In a time of crisis, local ties can serve an
important role when one needs help from someone nearby; however, in the event of an evacuation
or forced egress, translocal ties spatially located outside of the affected area can provide

uninterrupted support because they are unaffected by the crisis. For Lakeview, these translocal ties
expedited their evacuation and eventual return to New Orleans. Additionally, as discussed above,
their greater linking ties with local officials helped the neighborhood avoid hosting unwanted FEMA
trailers to other communities, improving their own recovery while forcing other communities to host
more of these public bads (Aldrich & Crook, 2008; Aldrich, 2012).

However, communities need not be well-off to gather these social resources and navigate these
resilience trade-offs. After the Kobe earthquake in 1995, disparities in bridging, bonding, and linking
capital cost Kobe, Japan valuable time in the recovery process. In spite of Kobe planners’ bold efforts
to redesign damaged wards and apply for national subsidies, the city’s top-down reconstruction
planning exacerbated disparities between communities, focusing on waterfront and high-rise
development rather than rebuilding existing communities (Edgington, 2010). This lack of linking
social capital between citizens and government left communities to take recovery into their own
hands. Neighborhoods that built more nonprofits after the quake undertook reconstruction planning
on their own terms, using these organizations to rebuild and pressure City Hall to include their
preferences. In this case, not only wealthy communities managed to build these linking ties. Anti-
pollution advocacy campaigns in the working-class neighborhood of Mano had built stronger
bridging and linking ties than in nearby Mikura, such that Mano regained much more of its original
population after the disaster (Aldrich, 2012). Communities can build these strong civil society and
community resilience even without financial resources.

Navigating trade-offs in adaptation and risk mitigation

These trade-offs among bonding, bridging, and linking capital are especially relevant to communities
because they cannot only affect crisis response but can also exacerbate disparities in health and
infrastructure, creating setbacks to recovery. Instead, effective resilience policy takes advantage of
social capital trade-offs to mitigate pre-disaster vulnerabilities and enable new social and physical

Scholars have highlighted the dark side of bonding social capital in their effect on health. In
Okayama City, Japan, residents with more bridging capital tended to have better health outcomes
than those with strong bonding social capital (Iwase et al., 2012). In another city, bridging capital
helped the elderly maintain cognitive abilities and avoid depression more than bonding capital
(Murayama et al., 2013). After the Great East Japan Earthquake in 2011, some community
development projects factored this into their decision-making, embedding elderly Japanese
residents in disaster zones into larger social networks. These programs substantially improved
elders’ social capital among each other and across age groups (Kiyota et al., 2015). Similarly, in New
York City disease prevention efforts, Buddhist and Christian communities with more bridging capital
among members were more engaged in HIV/AIDS prevention programming than those with just
bonding capital (Leung et al., 2016).

The trade-offs between bonding and bridging social capital are also important for preparing societies
for disaster through decentralized technologies. In Yasu City, Japan, citizens built a bottom-up
sustainable development economy focused on locally sourced biomass, all when local government
created meaningful networking organizations that bridged environmentalist groups. However,
similar sustainable development efforts in a neighboring city failed to achieve their goals, because
they focused on community groups with high bonding social capital but fewer bridging ties
(Kusakabe, 2013). Similarly, some city governments created quasi-private organizations to locate,

correspond with, and invite external renewable power companies to their towns. Towns that
fostered these bridging and linking ties built hundreds more renewable power plants than those that
relied on their existing relationships with utilities to deploy renewable power, boosting the resilience
of their energy systems (Fraser, 2018).

As a result, cities that foster bridging and linking capital will see better community resilience.
However, doing so will also mitigate the vulnerabilities and disparities in community networks
created by high bonding capital. Mitigating these vulnerabilities will further improve cities’ capacity
for adaptation and transformation.

Decision-makers regularly prioritize spending on physical infrastructure over social infrastructure
pre- and post-disaster. However, residents and policymakers can actively improve the social
infrastructure and resilience of their communities through conventional interventions, such as
hosting block parties, or with more novel approaches, such as supporting the growth of online
hyperlocal online communities (Page-Tan, forthcoming). Yet for those few who do seek to increase
social ties, as with San Francisco’s NeighborFest program or Colorado’s BoCo Strong programs, these
communities may have to make trade-offs. Bonding, bridging, and linking social ties have different
effects on residents.

Going forward, certain metrics can help policymakers compare social ties in one community with
those of others. Communities with strong bonding ties tend to have lower crime rates and more
religious and civic organizations per capita, while those with strong bridging ties tend to have higher
voter turnout, more political activity, and more advocacy organizations per capita. Finally, more
support for the majority party, frequent neighborhood visits by local officials, or collaborations
between local officials and community groups can indicate strong linking ties. Policymakers can
monitor gaps or differences between these rates and incorporate these vulnerabilities into decision
analysis and policy evaluation phases for disaster planning (Linkov & Moberg, 2011). We should look
to invest heavily in bridging and linking ties which are harder to create and have an overall positive
impact on societies and neighborhoods.
Ecological resilienceAllen & TwidwellEcological Resilience

Craig R. Alleni* and Dirac Twidwellii

i University of Nebraska, School of Natural Resources

ii University of Nebraska, Department of Agronomy and Horticulture

Suggested citation: Allen, C. R., & Twidwell, D. (2018). Ecological resilience. In Trump, B. D., Florin, M.-V., &
Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected
systems. Lausanne, CH: EPFL International Risk Governance Center. Available on and

Keywords: Resilience, ecological resilience, social-ecological system, panarchy

*Corresponding author:


Ecological resilience was first proposed by C.S. Holling in 1973, who recognized that systems
perturbed beyond their capacity to recover could shift into an alternative state (also called an
alternative regime). Resilience is a measure of the amount of perturbation or disturbance a system
can withstand without crossing a critical threshold (Holling, 1973). Resilience is an emergent
phenomenon of complex systems, which means that it cannot be deduced from the component
parts of the system in question. When a critical threshold is exceeded, the system may collapse and
reorganize. Reorganization can lead to the original system simply renewing, or the system can
reorganize around new drivers in which case a new, and potentially very different, system may
emerge (Chaffin et al., 2016). When reorganization occurs around new drivers, the new system (an
alternative system state) may be less desirable to humans in terms of the provision of the ecological
goods and services produced, upon which humanity depends. Therefore, it is often in humankind’s
interest to maintain systems in desirable states, avoid critical thresholds, and enhance resilience.
Alternatively, when a system is in an undesirable state, it may be necessary to erode resilience and
purposely transform the system to a more desirable state (Chaffin et al., 2016). In either case, it is
important to be able to assess how resilient a system is so that humankind can either foster or erode
resilience, depending upon the desirability of the current system state and the potential exposure
and magnitude of current and future drivers of alternative state change.

Resource managers often rely upon the system property of resilience, or the capacity of a social-
ecological system to absorb and respond to a disturbance while maintaining its essential structure
and functions (Holling, 1973; Linkov & Trump, 2019). Ecological resilience is a broader concept than
engineering resilience, which focuses on bounce-back and assumes stationarity, equilibrium, and,
often, the occurrence of a single, idealized state. These assumptions are most suitable for fully
engineered systems at small scales over short periods of time. Ecological resilience emphasizes that
a focus on bounce-back does not address the emergence of destabilizing feedbacks in the system
that continue to force the system toward an alternative state. The ability for a state to absorb
disturbance and persist, or to self-organize and re-emerge following disturbance-induced collapse, is
now a central focus of social-ecological systems research and central to managers attempting to
enhance or maintain resilience as a management goal or strategy. An improved understanding of the

boundaries of resilience, the thresholds that separate one state of a system from alternative states,
and how social and ecological system components interact to reinforce, or alternatively degrade,
resilience may help resource managers avoid or facilitate regime shifts so that desired ecosystem
services are maintained or restored. Coupling this information to knowledge of the likelihood of a
regime change, and the potential for novel drivers to arise and trigger alternative state change
following catastrophic change, is an important component of assessing the risk of systems to

Ecological resilience and risk

Complex systems are generally understood to be open and self-organizing, have inherent
unpredictability and uncertainty, non-linear dynamics, and emergent phenomena (EPFL
International Risk Governance Center [IRGC], 2018). Complex systems are self-organizing because
there is no central authority directing system components; complexity arises over time from many
simple interactions. Complex system behavior cannot be inferred or predicted by summing system
components, because complex systems have non-linear dynamics. Non-linear dynamics occur when
small changes have a disproportionately large effect. For example, phosphorus levels in a lake may
steadily rise over time, with no apparent consequence to the lake, until they exceed a critical
threshold and the lake abruptly tips into a new regime, becoming eutrophic and prone to algae
blooms – and less desirable to humans. Ecosystems and other complex systems change in response
to changing conditions, which has consequences for how we understand ecosystems and how we
manage them. Understanding the resilience of ecosystems is important, because humanity relies
upon a consistent production of ecological goods and services, such as drinking water, crop
pollination, soil renewal and regeneration, abundant marine life to eat, carbon dioxide storage, and
more. Considering that risk is the uncertain negative (or undesirable) consequence of an event or an
activity with regards to something that humans value, risk approaches should focus on identifying
critical thresholds, because when an ecosystem’s resilience is exceeded and the system shifts into an
alternative state, the system may become less desirable from a human perspective, and produce
fewer goods and services, which can be a risk to those affected.

It is often apparent when the resilience of an ecosystem has been exceeded as the system
discernibly changes, as when a lake shifts from a clear to a turbid state, but it is difficult to predict
when that shift might occur because of the non-linear dynamics of complex systems. Small changes
to the system may have disproportionately large consequences, and vice versa. Ecological resilience
should not be confused with engineering resilience, which emphasizes the ability of a system to
perform a specific task consistently and predictably, and to re-establish performance quickly should
a disturbance occur. The consequences of applying this type of thinking to the management of
complex systems, especially social-ecological systems, is problematic because complex adaptive
systems cannot be treated as an engineered system with predictable and consistent outputs.
Ecosystems do not have an equilibrium where opposing forces are in balance. Rather, an ecosystem
exists within a regime, and within a particular regime, the abundance and composition of the
component parts that comprise that regime may change quite dynamically over time. In a risk
context this means that compounded perturbations derived from hazards or global change can have
unexpected and highly uncertain effects on natural resources, humans and societies. These effects
can manifest in regime shifts, potentially spurring environmental degradation that might lock a social
ecological system into an undesirable system state that can be difficult to reverse, and as a

consequence of economic crises, conflict, human health problems, and the presence of hysteresis in
the system.

Consequences of exceeding resilience

A premise of any complex social-ecological system is that surprise and uncertainty are inherent to
the system. Achieving and managing trade-offs between benefits for humanity while reducing risks is
difficult and does not adequately address surprise and uncertainty in system behaviour. Social
ecological system management and governance have therefore, to a large extent, struggled to
ensure the maintenance of ecological regimes that are desirable for humans in terms of consistent
delivery of ecological goods and services while systems undergo change. Regime shifts, such as the
collapse of commercial fisheries or agricultural systems, have often been the consequence of the
sustained overuse of natural resources.

Given that risk and undesirability are similar concepts (risk being the undesirable consequence of
uncertainty), resilience-based management decreases risk in two ways. First, when systems are in a
desirable state for humans, management can focus on fostering and enhancing the resilience
needed to maintain this regime by assuring that functional attributes relevant for processes that
deliver ecosystem services are diverse and imbricated. This reduces the chance that the system
shifts to an undesirable state if subject to unsustainable stress, with the risk that the system may no
longer be able to provide the services it is intended to provide. However, prioritizing resilience in
management and planning has often proven difficult. Optimizing resource use and dampening
variability or uncertainty in harvest use or efficiency has long-been prioritized in management, and
while important, often erodes resilience by limiting the system’s use of state space, which may in
turn narrow the basin of attraction for a desired state, making collapse more likely. Second, systems
in undesirable states can also be highly resilient, yet present risks to assets or people depending on
these systems (for example, people living in poverty traps). Where systems are in undesirable states
resistant to change, that is, when an undesirable state is resilient, it may be necessary to reduce the
resilience of the system and to induce a shift in the system to a regime that is more desirable, and
then to manage the system to foster the regime of this desirable state.

Understanding that complex systems can have critical thresholds affects risk equations. When there
is hysteresis present in the system, risks must be assessed cautiously, and management should be
correspondingly cautious. Crossing a critical threshold can have catastrophic consequences, and
reversal can require much more input than was required to change the system in the first place.

Adaptation and transformation

In 2004, Walker, Holling, Carpenter, and Kinzig introduced “transformability” as an attribute of
complex systems that defined the potential dynamics and future trajectory of a system. In this
context, the authors defined transformability as the “capacity to create a fundamentally new system
when ecological, economic, or social conditions make the existing system untenable” (Walker et al.,
2004). At the scale of an SES, a transformation is a deliberate, societally-initiated process of pushing
a system across a threshold by “a phased introduction of one or more new state variables” (Folke et
al., 2010). This definition of transformation differs from others, which claim that there are two types
of transformative change: intentional or deliberate; and unintentional or unexpected as a result of a
process or event. In each of these cases, intentional and unintentional, a social ecological system

undergoes a regime shift and a threshold is crossed. However, we define a transformation as
occurring when the regime shift is a direct result of human planning and action, human agency. The
phenomenon of transformation is scale-dependent, multilevel, and can be system-wide or can be
nested as personal, organizational, or within other levels of subsystem transformation. Therefore, a
transformation requires purposefully exceeding the resilience of a system in an undesirable state,
and then, through human agency, fostering a reorganization into a more desired state.

The concept of panarchy (Allen, Angeler, Garmestani, Gunderson, & Holling, 2014) is central to
understanding transformation. The capacity to transform is likely the product of a nested system
influenced by cross-scale interactions from above and below, and highly “dependent on the nature
and extent of adaptive actions being taken at other interacting scales”. For example, larger-scale
transformation may only occur as personal or individual transformations are scaled-up to forge the
collective capacity to drive change. In this context, deliberate transformation has also been referred
to as directional or purpose transformation. Regardless, transformation describes change in the
dominant processes and structures that maintain a complex social ecological system in a particular
state. These factors vary for any SES at a particular scale, but can include processes and associated
feedbacks such as biophysical cycles, ecological hierarchies, human activity or social institutions. It
follows that transformative governance builds capacity of society to alter these processes in order to
foster a new regime in social ecological systems that achieve societal priorities. Transformative
governance is an emerging approach to the management of complex systems with the capacity to
catalyze and guide regime shifts in systems at multiple scales. The process of transformation
requires disrupting internal or external drivers, or introducing new drivers, to displace the
entrenched forms environmental governance and to provide space for innovation, and thereby
foster a fundamental, positive, change in the nature of the affected social ecological system.

A challenge to resilience theory is that it is very easy to recognize a system that has undergone a
regime shift, but very difficult to recognize when the resilience of a system has been compromised.
Quantification of the resilience of systems is in its infancy and remains poorly developed, though
there have been recent advances in detecting early warning of impending regime shifts, usually
focusing on rising variance in key parameters of the ecological system in question (Angeler & Allen,
2016). The development of leading indicators is critical to managing for resilience, and therefore
sound environmental management.
From security to resilience: New vistas for international responses to protracted crises Anholt & BoersmaFrom Security to Resilience:
New Vistas for International Responses to Protracted Crises

Rosanne Anholti* and Kees Boersmaii

i Department of Political Science and Public Administration, Vrije Universiteit Amsterdam

ii Department of Organization Sciences, Vrije Universiteit Amsterdam

Suggested citation: Anholt, R., & Boersma, K. (2018). From security to resilience: New vistas for international
responses to protracted crises. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on
resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International
Risk Governance Center. Available on and

Keywords: Resilience, crisis, security, practice, international

*Corresponding author:

Resilience: A response to protracted crises

International institutions and organizations like the United Nations (UN) and the European Union
(EU), governments, and non-governmental organizations (NGOs) have started to embrace the notion
of ‘resilience’ as a way of thinking to guide international responses to international security – in
particular with regards to governing protracted crises. Protracted crises are “fragile contexts
characterized by long-term political instability, (episodes of) violent conflict, and vulnerability of the
lives and livelihoods of the population” (Macrae & Harmer, 2004, p. 15) – like those across central
and east Africa, and the Middle East. The concept of resilience is not new to crisis governance.
International frameworks for responding to natural disasters, such as the Hyogo Framework for
Action (United Nations Office for Disaster Risk [UNISDR], 2005) and the follow-up Sendai Framework
for Disaster Risk Reduction (UNISDR, 2015), have long placed the idea of resilience central. With
regards to insecurity due to political violence and armed conflict however, the concept is relatively
new (Bourbeau, 2013; 2015; Brasset & Vaughan-Williams, 2015; see also Anderson & Wallace,
2013). Nevertheless, it features prominently across a range of policies, including for example the
European Global Strategy for Foreign and Security Policy (Wagner & Anholt, 2016), the EU’s Action
Plan for Resilience in Crisis Prone Countries (European Commission [EC], 2013), or programmes such
as the Regional Refugee & Resilience Plan (3RP), a consortium co-led by the UN Refugee Agency
(UNHCR) and the UN Development Programme (UNDP), with the participation of the governments of
Jordan, Lebanon, Turkey, Iraq and Egypt, and some 270 partners, including UN agencies and
international and local NGOs (Gonzalez, 2016; 3RP, 2018).

As with many policy buzzwords, there is a lack of a clear, agreed-upon definition of resilience. The
2011 Humanitarian Emergency Response Review (HERR) of the UK Department for International
Development (DFID), which was one of the first organizations to use the concept in the context of
protracted crises, argues that “the impact of a disaster depends on how well prepared a country is to
cope with it” (2011, p. 15), and that “being prepared, and being able to recover is what makes
nations resilient [emphasis in original]” (2011, p. 15). The EU defines resilience as “the ability of an

individual, a household, a community, a country or a region to withstand, to adapt, and to quickly
recover from stresses and shocks” (European Commission [EC], 2012, p. 5). According to an
influential position paper by the United Nations Development Group (UNDG), resilience means “the
ability of households, communities and societies to cope with shocks and stresses, to recover from
those stresses, and to work with households, communities and national and local government
institutions to achieve sustained, positive and transformative change [emphasis added]” (UNDG,
2014, p.13). The different existing definitions emphasise various aspects of resilience, such as
preparation and recovery, or coping, adaptation and transformation. From the academic literature,
three characteristics of a resilient response become apparent: the ability or capacity to absorb the
shock, adapt to the new reality, and transform in order to function either as before the crisis, or in a
superior manner (see Keck & Sakdapolrak, 2013; Lorenz, 2013). Moreover, rather than an outcome,
resilience is a process of “continual adaptive cycles of growth, accumulation, restructuring and
renewal” (Welsh, 2014, p. 15).

From security to resilience-based approaches to protracted crises

The section above illustrates the ubiquity of resilience in the various policy domains dealing with
protracted crises, including those of (international) security, and humanitarian and development
assistance – despite its conceptual ambiguity. This section elaborates on the profound change in the
understanding of, and approaches to, contemporary risks and crises underlying this new paradigm,
as opposed to more traditional understandings of security.

After the Cold War, ideas around security expanded from being primarily about conflicts between
states, to being about many types of threats to the security of individuals, communities and societies
(Buzan, Wæver & de Wilde, 1998) – including issues of poverty, social exclusion and natural hazards.
In contrast to earlier, state-centric conceptions of security, ‘human security’ is about “how people
live and breathe in a society, how freely they exercise their many choices, how much access they
have to market and social opportunities – and whether they live in conflict or in peace” (UNDP,
1994, p. 23). With risks being defined in almost every domain of life (the so-called ‘risk society’, see
Beck, 1992), governments set out to make ever-better “objective, standardised and exact
predictions” to minimize harms and increase security (O’Malley, 2004, p. 1). In particular, western
states portrayed democracy and trade “as almost magical formulas for peace” in contexts affected
by political violence and armed conflict (Paris, 2010, p. 338; see also Duffield, 2014).

Liberal approaches to peace-building, emergency relief and development assistance however, failed
to fulfil their promises of a safer, better world (Paris, 1997). Moreover, they have been criticized not
only for being ineffective, but also for having harmful unintended consequences (Paris, 2010) –
Afghanistan, Iraq and Libya being cases in point. With systems and policies ill-equipped to face them,
the frequency, duration and complexity of contemporary instances of political violence and armed
conflict have engendered the idea that “the world is entering its most dangerous chapter in
decades” (Guéhenno, 2017, para. 1). Syria serves as an exemplary case of a complex crisis with no
end in sight and significant spill over effects. Violence among the many state and non-state actors
involved caused 5.6 million people to seek refuge abroad, with many neighbouring countries ill-
prepared to accommodate such large influxes of people, and others, like some European Union
Member States, unwilling to do so.

The attacks of 9/11 in particular, shattered the modernist belief that predicting, identifying, and
responding to risks and crises was a matter of accumulating ever more scientific knowledge

(Chandler, 2017). The resilience paradigm instead moves beyond a utopia of safety, by proposing
“the impossibility and folly of thinking we might resist danger, and instead accept living a life of
permanent exposure to endemic dangers” (Evans & Reid, 2013, p. 95). A policy memo of the
European Council on Foreign Relations explicitly suggests this, to accept “that crisis and conflict ... is
the new normal” (Witney & Dennison, 2015, p. 1). This makes resilience not so much about
prevention and solutions to crises, as about accepting that emergencies happen – exactly because it
is impossible to prevent them all (Bulley, 2013). Rather, resilience focuses on enhancing a system’s
response to crisis rather than the crisis and its causes.

Resilience: Drawbacks and challenges

The above section illustrates that the emergence of the resilience paradigm is a response to two
interrelated challenges. On the one hand, resilience signals a recognition of the fallibility of previous
crisis governance approaches and systems, and on the other, a faltering belief in the possibility of
controlling our world and preventing crises from happening. This section will elaborate on some of
the drawbacks and challenges of using resilience-based approaches to insecurity.

One challenge is that employing resilience-based responses shifts the responsibility for security away
from states, and instead to societies themselves. Within traditional security approaches, the state is
considered the primary provider of security. Yet to the extent that governments are unable to
control or direct a complex world riddled with crises, they are incapable of fulfilling that role
(Chandler, 2014). Instead, responsibility for security is transferred to the affected individuals and
communities themselves (Chandler, 2014; Coaffee & Fussey, 2015; Coaffee & Wood, 2006),
decentralizing power and inverting traditional top-down structures with bottom-up ones (Howell,
2015a). This makes resilience a conveniently cost-effective strategy in a time where many states are
faced with a depletion of funds. The EU Approach to Resilience for example, explicitly states that
resilience is not only better for the people involved, but also cheaper (EC, 2012). Unsurprisingly,
resilience has been critiqued for its neoliberal character (Chandler 2013a; 2013b; Duffield, 2012;
Joseph, 2013; Reid, 2012; Rogers, 2013), the potential hazard being that resilience strategies are
advocated in order to justify the avoidance of responsibility, the limits to intervention, or budget

Another challenge concerns the ways in which resilience-based approaches impact on subjects of
governance. First, resilience is often understood as a set of coping strategies and skills that can be
learned and taught, rather than it being a natural characteristic (Duffield, 2012). The US military, for
example, employs resilience training to prevent soldiers from developing post-traumatic stress
disorder and other mental health issues following deployment (Howell, 2015a; 2015b; O’Malley,
2010; Walklate, McGarry, & Mythen, 2014). This may imply that the development of PTSD symptoms
is understood as having less to do with the trigger, i.e. deployment to a warzone, than with how well
someone has learned to be resilient. Indeed, if resilience can be learned, it can also be failed to be
learned. This de facto makes crisis-affected communities responsible for their own well-being, ergo,
their vulnerabilities (Bulley, 2013; Chandler 2013b) – regardless of whether these are products of
their own inherent weaknesses, or of structural socio-economic and political inequalities.

To be resilient means to:

“accept ... an understanding of life as a permanent process of continual adaptation to
threats and dangers that are said to be outside its control. As such the resilient subject ...

must permanently struggle to accommodate itself to the world: not a subject that can
conceive of changing the world” (Chandler & Reid, 2016, p. 53).

If our only choice is to adapt to the conditions of our suffering (Reid, 2012), resilience advocates for
adaptation within existing structures rather than structural change. In the context of protracted
crises, this means that rather than interrogating the existing structures that directly or indirectly
generate crises, the resilient subject must prepare for, adapt to, and live with (protracted) instances
of political violence and armed conflict.

Resilience-building in practice

The above section discusses the moral hazards and potential drawbacks of using resilience,
particularly within the context of governing protracted crises. Whereas these critiques seem rather
grim for policymakers and practitioners, resilience also has very positive connotations (Anholt,
2017). This section considers how resilience-based approaches to protracted crises are put into
practice, and what aspects form the core of what resilience means in practical terms.

For policymakers and practitioners, the shift from traditional top-down approaches to bottom-up
responses has less to do with avoiding responsibility as with recognizing the need for local
ownership of crisis responses. This is reminiscent of resilience applications in disaster risk reduction
frameworks, where the concept rather refers to the capacity of local communities against the slow,
reluctant or top-down approaches of the government that quash improvised community responses
(Dynes, 1994). The 3RP programme for example, rather than being led by international organizations
unfamiliar with the intricacies of the context, employs nationally-led country plans that address not
only the protection and assistance needs of Syrian refugees, but also the resilience and stabilization
needs of impacted and vulnerable communities in Jordan, Lebanon, Turkey, Egypt and Iraq (3RP,
2018). For the EU, in its implementation of the Global Strategy, it means “accepting different recipes
to build resilient states and societies [and] supporting locally owned pathways to peace” (Tocci,
2017, p. 65). The EU in particular builds its understanding of resilience in practice upon the idea of
‘principled pragmatism’; although international law and its underlying norms remain the principal
guide for EU external action (hence ‘principled’), it also demands “a rejection of universal truths, an
emphasis on the practical consequences of acts, and a focus on local practices and dynamics” (hence
‘pragmatism’) (Tocci, 2017, p. 65; see also Joseph, 2016; Juncos, 2016). Resilience-building is as
much about “a realistic assessment of the strategic environment”, as about the EU’s “idealistic
aspiration to advance a better world” (Tocci, 2017, p. 64).

Also, resilience in practice seems to be not so much about affected persons’ responsibility for their
well-being, ergo, their vulnerabilities, but rather about understanding context-specific vulnerabilities
and strengthening existing capacities (Bankoff, Frerks, & Hilhorst, 2004; Levine & Mosel, 2014). In its
Action Plan for Resilience in Crisis Prone Countries, the EU for example explicitly commits to “more
consistently [addressing] underlying causes of vulnerability” (EU, 2013, p 4). This implies that in
practice, vulnerabilities are seen as determinants of the magnitude of the impact of a crisis and
building resilience as a strategy to limiting that impact. Consistent with ideas around local ownership
and context-specificity, this then requires the reinforcement – rather than replacement – of national
and local systems, and investment in local capacities (UN, 2016).

To achieve resilience-building in fragile contexts of protracted crises, international institutions and
organizations, governments and NGOs recognize that doing different things requires doing things

differently. The UN Office for the Coordination of Humanitarian Affairs’ (OCHA) New Way of Working
articulates this need for different actors, including governments, NGOs, humanitarian and
development actors, and the private sector to meaningfully work together towards collective
outcomes (UNOCHA, 2017). In particular, it stresses the need for humanitarian and development
actors to overcome their long-standing attitudinal, institutional and funding divides (UNOCHA,
2017). In a similar vein, the EU recognises that “achieving resilience objectives requires all EU actors
(humanitarian, development, political) to work differently and more effectively together. Current
practice and methods should be challenged, improved and new approaches adopted that are
appropriate to different contexts” (EU, 2013, p. 4). Although these are commendable developments,
whether resilience can really lead to sustained positive change on the ground remains to be seen.
The importance of resilience-based strategies in risk analysis, and vice versaAven & ThekdiThe Importance of Resilience-Based Strategies in Risk Analysis, and
Vice Versa

Terje Aveni* and Shital Thekdiii

i University of Stavanger

ii University of Richmond

Suggested citation: Aven, T., & Thekdi, S. (2018). The importance of resilience-based strategies in risk analysis,
and vice versa. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2):
Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance
Center. Available on and

Keywords: Resilience, strategy, risk analysis, resilience analysis

*Corresponding author:

As societies and economies continue to be subject to system disruptions and rapidly changing
conditions, it is essential to implement resilience strategies that allow these systems to maintain
functionality and effectively recover from disruptions. One critical component of an effective
resilience strategy is the assessment of risk. Vice versa, there is a need for resilience-based strategies
in risk analysis and management, as risk assessments have limitations in dealing with uncertainties,
potential surprises and the unforeseen. In this paper we review and discuss these interactions and
dependencies between resilience and risk. We outline how recent advancements in risk and
resilience science have created a new platform for merging both quantitative and qualitative
assessments. These advancements relate to the way risk and resilience are conceptualized and
characterized, but also how we should in general confront uncertainties.


In the following we use the term ‘risk analysis’ in agreement with the long tradition of Society for
Risk Analysis (SRA) to include the areas of risk assessment, risk characterisation, risk communication,
risk management, and policy relating to risk (SRA, 2015). To further simplify the nomenclature, a
similar definition is used for resilience: ‘resilience analysis’ includes the areas of resilience
assessment, resilience characterization, resilience communication, resilience management, and
policy relating to resilience.

The fields of risk analysis and resilience analysis are essential for enabling societies and economies to
effectively manage system disruptions. Research in both fields have made significant advancements
in recent years, allowing for organizations to concurrently manage both risk and resilience for
applications like infrastructure, cyber-systems and commerce (Alderson, Brown, & Carlyle, 2015;
Linkov et al., 2013; Park, Seager, Rao, Convertino, & Linkov, 2013). Given the importance of each
distinct field, there is a need to develop an overall understanding of the role of risk assessment and
management in resilience strategies, and the role of resilience strategies in the assessment and
management of risk.

The study of resilience seeks to address how to enable a system to sustain and restore (and even
improve) its functionality following a change in the condition of the system (disruption, threat,

opportunity - referred to as an event). As discussed in the literature (see Aven, 2017a) the resilience
management (engineering) can, in principle, be conducted without considering potential events and
risk. For example, adding redundancy in the system may be an effective resilience management
strategy, and it does not need assessment of specific events and associated risk, to be
implemented. A system manager would not need to know what type of events can occur and
express their likelihoods as required in traditional risk assessments. In cases with large uncertainties
related to what type of events that will occur, this is important because risk assessments then are
not able to produce reliable probability estimates. Resilience strategies are of special relevance for
complex systems, where it is acknowledged that unforeseen events or surprises will occur (Aven &
Ylönen, 2018). Resilience analysis and management are especially suitable for confronting unknown
and uncertain types of events, and both quantitative and semi-quantitative approaches for resilience
assessment have been studied in the literature (see Linkov et al., 2013; Fox-Lent, Bates, & Linkov,
2015; Ganin et al., 2016; Gisladottir, Ganin, Keisler, Kepner, & Linkov, 2017; Gao, Barzel, & Barabási,
2016). Traditional risk assessment is not a part of the methodology used in these studies.

There have been recent calls for a shift from risk to resilience, to a large extent motivated by the
need for meeting the effects of climate change, by many organizations, scientists and leaders,
including the former Secretary-General of the United Nations, Ban Ki-moon (UNISDR, 2015). These
calls raise some questions. Are they arguing that the resilience strategy should be highlighted at the
expense of the contemporary frameworks for handling risk? How do the calls acknowledge the fact
that current risk science considers resilience analysis and management as an important strategy for
managing risk? Also, arguments have been presented showing that risk considerations can provide
useful input to the resilience analysis and management (Aven, 2017a). There seems to be a need for
clarifying the interactions and dependencies between these two fields, and this is exactly what this
paper seeks to obtain. It does this by first discussing how resilience-based strategies are essential for
risk analysis. Then risk is shown to be an important factor in resilience analysis and management.
The final section extends the discussion to a performance setting. The work summarizes and extends
discussions in recent papers on the topic, including Aven (2017a) and Thekdi and Aven (2016).

Resilience-based strategies in risk analysis

Traditionally risk analysis has been linked to risk assessment and the use of this tool to inform
decision makers (see e.g., Park et al., 2013). However, broader approaches have been developed,
with many founded on risk governance frameworks (IRGC, 2005; Renn, 2008). What characterizes
these approaches and frameworks is an acknowledgement of the need for seeing beyond risk
assessments in order to adequately handle risk. Three main categories of strategies for handling risk
are identified, i) risk-assessment informed, ii) cautionary and precautionary approaches, highlighting
robustness and resilience, and iii) dialogue and participation (Renn, 2008; Aven, 2017a; SRA, 2017).
The categories ii) and iii) are justified by the limitations of the risk assessment approach, in particular
for being able to deal with uncertainties and potential surprises. Resilience is seen as a pillar of risk
management and risk analysis as defined above.

The cautionary/precautionary (robustness/resilience) strategy includes features such as constant
monitoring, containment, and research to increase knowledge and the development of substitutes.
Specifically, resilience captures measures such as strengthening of immune systems, diversification
and flexible response options (Renn, 2008). In the discursive strategy, measures are implemented to

build confidence and trustworthiness, through the clarification of facts, reduction of uncertainties,
involvement of affected people, deliberation and accountability (Renn, 2008).

The precautionary principle is interpreted as stating that in case of a potential for severe
consequences and scientific uncertainties about the consequences of an activity, protective
measures should be taken to reduce risks (Aven & Renn, 2018). The cautionary principle extends the
precautionary principle, stating that if the consequences of an activity could be serious and subject
to uncertainties, then cautionary measures should be taken or the activity should not be carried out
(Aven & Renn, 2018). While the precautionary principle is used in cases of scientific uncertainties,
the cautionary principle is used for all types of uncertainties and ambiguities.

Risk analysis frameworks building on these three strategies are founded on broad perspectives on
risk, acknowledging that risk is more than calculated probabilities and risk metrics. In line with
recommendations of the Society for Risk Analysis (SRA, 2015), risk has two main features: the
consequences (C) of the future activity considered – for example the operation of a manufacturing
facility or the life in a country – and related uncertainties (U). The consequences are often seen in
relation to some reference values (planned values, objectives, present state, etc.) and are with
respect to something that humans value. There is always a potential for some negative outcomes.
While historic study of risk has focused on negative or undesirable consequences, the SRA
framework is general and allows for both negative and positive outcomes. Risk defined in this way
makes a clear distinction between the concept (here risk) and how this concept is described,
measured or characterised, in line with measurement theory. A probability distribution of the
number of fatalities, as a result of the activity, is an example of such a risk characterisation. The ways
risk can be characterised are many, but in its broadest sense, it captures (C’, Q, K), where C’ are
some specified consequences (for example the number of fatalities), Q a measure or description of
uncertainty (for example probability and associated judgments of the strength of knowledge
supporting the probabilities) and K the knowledge supporting P (Aven, 2017b).

Often the consequences explicitly refer to events A that can occur leading to some effects. Resilience
is understood as the ability of the studied system to maintain functionality and effectively recover
given that one or more events A occur, whether these events are known or not. Of special
importance is the case of planning for resilience of the system for events A, that are not identified in
C’. We will return to the resilience concept in the next section.

Risk considerations supporting resilience analysis and management

As mentioned in the introduction, resilience can to some degree be analyzed and managed without
considering risk. We can improve the immune system by proper training, without really thinking
about risk. However, further reflections would quickly make us realize that risk considerations are
needed in relation to resilience analysis, for two notable reasons (Aven, 2017a):

Firstly, risk analysis would supplement resilience analysis by addressing the potential occurrences of
events. Through such analysis, new insights may be gained, for example, unknown and potentially
surprising types of events could be identified, and new “cause-effect” relationships can be revealed.
Concrete and more effective measures can then be developed to meet these events. By studying
why certain infections occur, more effective measures can be developed than if the focus is limited
to how to make the body withstand infections in general. Medicine, to a large extent, focuses on

performing risk analysis related to known and unknown types of threats. It would be an extremely
poor policy to lean on resilience-based strategies alone.

Secondly, risk analysis would supplement resilience analysis in order to obtain more effective use of
resources. In practice there are always resource limitations and that means that organizations must
prioritize those limited resources to decide how and where to improve resilience. There could be
many areas in which the resilience can be improved, but which should be selected and given weight?
Many resilience metrics exist but what events will in fact occur? Say that a system can be subject to
two types of events, A1 and A2. The system is resilient in relation to event A1 but not to A2. Now
suppose A2 will occur with a probability of 0.000001% and A1 with a probability 0.999999%. Suppose
a specific arrangement would significantly improve the resilience with respect to event A2, but its
effect on risk (interpreted in a wide sense) is marginal. The arrangement could still be justified, but
some types of consideration of risk seem useful, also in the case that we have difficulties in assessing
likelihoods and being accurate on what type of events that will occur, as we always need to make
prioritizations. The question is rather how we can make these considerations of risk informative.

Different types of risk assessment methods can be used for the purpose of supplementing the
resilience analysis. They are typically not traditional quantitative risk assessments searching for
accurate probability estimates, but broad qualitative assessments of events, recovery (return to the
normal condition or state) and uncertainties (see Aven, 2017a). The objectives of these assessments
can be to obtain insights by:

i. Making a judgement of the type of events that can occur, what we know and do not know
(highlighting key assumptions and justified beliefs).
ii. Making a distinction between known types of events, unknown types of events, and
surprising events.
iii. Assessing the probability for these types of events whenever found meaningful (using
subjective probabilities or subjective interval probabilities).
iv. Assessing the strength of knowledge supporting these judgements. How can the knowledge
be strengthened?
v. Conducting assessments to reveal unknown and surprising events.

As a third and final way risk considerations can support resilience analysis, think of the objective of
recovering or sustaining functionality and performance, or in other words, returning to the normal
state following the event (disruption). Using the general risk set-up introduced in the previous
section, the consequences C can be viewed as a deviation from this objective. The resilience is
studied for fixed events A, but conceptually, the problem faced is similar to the one considered
above with risk understood as (C,U|A) and a description or characterisation of the form (C’,Q,K|A),
where the term “| A” is to be read as ‘given the occurrence of A’. If a system is not resilient against a
specific event A but this event is improbable, the system can still be considered resilient.


The above discussion has shown that risk and resilience analysis are closely integrated. From the
analysis in Section 2 we schematically can write

Risk = (A,C,U) = (A,U) + (C,U|A)

= “occurrence of events, and associated uncertainties” + resilience,

clearly showing that the resilience is a part of the risk concept, and hence resilience analysis can be
seen as an element of risk analysis. More precisely, (C,U|A) is to be understood as the ‘resilience-
induced conditional risk’ or ‘lack of resilience-induced conditional risk’, given the occurrence of A.
The symbol ‘+’ is here not to be interpreted as a sum, as in mathematics, but as a symbol for
combining the two elements. The previous section argues that risk considerations are needed in
relation to resilience analysis in different ways. Representing resilience by (C,U|A), the uncertainties
related to which events A that will occur need to be addressed in some way in order to meaningfully
conduct the resilience analysis. Current perspectives on how to characterise risk, such as (C’,Q,K),
are also applicable for the conditional case of resilience, leading to resilience characterizations of the
form (C’,Q,K|A).

The integration is clearly observed when extending the discussion to performance-based type of
frameworks, as in Thekdi and Aven (2016). The set-up can briefly be described as follows:

The future performance of a system is affected by events (stressors, opportunities), which can lead
to performance output O above or below a reference level (expressing for example a planned value,
a goal or the current state). There are uncertainties associated with both the occurrence of these
events and the actual performance output. Similar to the study of risk, the performance-related
uncertainties are assessed using some measure Q, typically covering probability (or imprecise
probability) and associated strength of knowledge judgments. The background knowledge K, on
which Q is based, constitutes an element of the performance characterization. The resilience
management is focused on the task of recovering or sustaining functionality and performance, given
an event, and is thus an important element of the performance management.

Traditionally, performance management has focused on the management of opportunity, whereas
risk management has put emphasis on the study of missed or lost opportunity. The broader
framework outlined above allows for a more holistic perspective which allows for resilience and risk
analysis to be viewed as complementary activities aimed at managing system performance.

There is need for further work linking resilience-based strategies in risk analysis and management.
The resilience-based approach allows decision-makers to put larger emphasis on managing system
performance to confront potential surprises and unforeseen events, but needs always to be seen in
relation to risk as argued for above. At a more practical level, there is need to integrate resilience
and risk analysis and management into organizational processes, such as enterprise risk
management procedures.

Resilience as an integrative, measurable concept for humanitarian and development programming Barrett & UptonResilience as an Integrative, Measurable Concept for Humanitarian
and Development Programming

Christopher B. Barrett* and Joanna B. Uptoni

i Charles H. Dyson School of Applied Economics and Management, Cornell University, Ithaca, NY, USA

Suggested citation: Barrett, C. B., & Upton, J. B. (2018). Resilience as an integrative, measurable concept for
humanitarian and development programming. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource
guide on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL
International Risk Governance Center. Available on and

Keywords: Resilience, development, poverty analysis, resilience measurement

*Corresponding author:

Resilience in the humanitarian and development context

As recurring emergencies in low- and middle-income countries increasingly challenge international
development and humanitarian agencies to reconsider how they simultaneously support both short-
run recovery to adverse shocks and longer-run socioeconomic progress, many donor and operational
agencies have gravitated to the concept of resilience. The concept of resilience potentially provides a
framework for integrating programming and thinking around these two spheres, which had too
often been treated quite separately. The emergent popularity of resilience as an integrative concept
in the development and humanitarian communities is, however, quite recent. The watershed
moment arguably came in 2011, when a global food price spike, widespread civil unrest in parts of
sub-Saharan Africa and western Asia, severe drought in the Horn of Africa and the Sahel, and
ongoing demands for recovery from the 2010 Haiti earthquake all challenged aid agency budgets
and strategies. How best could aid agencies and their government and non-governmental
organization (NGO) partners help current victims of natural disasters and violence to get on a
sustainable pathway out of poverty, resilient to the myriad shocks and ongoing stressors that too
often impede progress? Put differently, how could aid and operational agencies shock-proof
continuous improvement in human well-being, especially in communities already experiencing
intolerably high rates of poverty, malnutrition and other forms of severe deprivation?

Resilience has thus recently become a central feature of development and humanitarian
programming. Yet, the development and humanitarian communities struggle with defining and
measuring the concept. The United States Agency for International Development (USAID) defines
resilience as “the ability of people, households, communities, countries and systems to mitigate,
adapt to and recover from shocks and stresses in a manner that reduces chronic vulnerability and
facilities inclusive growth” (REAL, 2018). Barrett and Constas (2014, hereafter BC) conceptualize
‘development resilience’ as “the capacity over time of a person, household or other aggregate unit
to avoid poverty in the face of various stressors and in the wake of myriad shocks. If and only if that
capacity is and remains high over time, then the unit is resilient.” Two crucial features of the concept
of resilience for development emerge from these two definitions (and there exist many others), in
juxtaposition to more general academic definitions of resilience, for example the National Academy

of Sciences’: “the ability to prepare and plan for, absorb, recover from, and more successfully adapt
to adverse events” (NRC, 2012). First, in the development domain, the concept of resilience is
explicitly normative. Because the central project of development is to improve human well-being
among the under-resourced, merely stabilizing living standards around ex ante low levels, or
accelerating recovery to an unacceptably low level does not advance these common goals. Within
the international development community, resilience must reflect more than just recovery from
(negative) disruption; it must expressly link recovery to acceptable living standards. Second, and
relatedly, resilience as a concept must be applicable and decomposable from aggregate units to the
micro level, or individual people and households. Resilience cannot be solely a community or system
level property, because development and humanitarian objectives are rooted in individual human
experience and human rights. In this view, the relation between micro-level measures and more
aggregate ones is a matter of scale, although there may be separate processes operating at micro,
meso or macro scales that reinforce one another across scales, much as is true for poverty (Barrett &
Swallow, 2006).

Resilience is related to, but transcends, the concept of vulnerability. Both concepts emphasize risk
exposure and the context-dependent shocks to which one might be exposed. But one might be
vulnerable to an adverse shock – i.e., suffer significant losses – and yet highly resilient – i.e., the
conditional likelihood of loss is acceptably low and/or the speed of recovery to an adequate
standard of living, conditional on loss, is quick. Conversely, one might not be vulnerable and yet also
not be resilient. For example, those who opt out of the labor market after extended, failed efforts to
find work after losing a job may no longer be vulnerable to unwanted unemployment shocks due to
business cycle downturns. One could hardly claim, however, that such a person is better off, in any
meaningful sense of the concept, than an otherwise identical employed person who may now be
vulnerable to lay off. Similarly, a homeless person may be less vulnerable to loss of property or life in
an earthquake than a richer counterpart, but could hardly be deemed more resilient, so long as the
resilience concept is rooted in normative standards of attaining an adequate level of well-being. Put
differently, the absence of vulnerability to a shock from which one might or might not recover ought
not to be sufficient for one to be classified ‘resilient’. Both the ex ante normative state – one’s
standard of living, however measured – and the time path of standard of living following an adverse
shock together define one’s resilience.

Resilience must also be contextualized within the complex social-ecological systems (SES) in which
poor populations commonly reside (Folke, Hahn, Olsson, & Norberg, 2005). System-level shocks can
affect individual-level behaviors, which aggravate system-level disturbances (Barrett & Constas,
2014). For example, drought shocks can lead herders to change the range over which they graze
livestock, leading to initially-isolated resource conflict that quickly scales into ethnic violence, as has
occurred repeatedly in east Africa (Little, McPeak, Barrett, & Kristjanson, 2008).

The concept of resilience can inform a meaningful resilience strategy, as opposed to just poverty
reduction or risk management strategy, helping organizations structure their programming in
keeping with this broader picture. Development is ultimately about how policies and programs
improve well-being sustainably over time in the face of shocks and stressors.

Resilience measurement

As the resilience concept has become central to development and humanitarian programming, the
need to measure resilience has grown more urgent. At a minimum, one needs a resilience measure
in order to evaluate whether or not ‘resilience building’ interventions indeed achieve their aim. As
unsettled as the definition of resilience remains within the development and humanitarian
communities, even less consensus exists around measurement methods.

In order to remain true to the theoretical grounding of the concept in the stochastic dynamics of
individual (and collective) well-being, measurement of development resilience must include
indicators of well-being outcomes, as well as measures of shocks and/or stressors that motivate a
concern for resilience. A good measurement method must also attend to the distinction between ex
ante (pre-shock) resilience capacities, and the time path of the well-being outcome variable(s) of
interest ex post (post-shock) (Hoddinott, 2014). This necessarily demands longitudinal data, ideally
at reasonably high (e.g., seasonal) frequency, with which to measure pre-shock exposure and
capacities as well as the time path of post-shock recovery (Headey & Barrett, 2016).

The initial generation of methods, developed and advanced largely by the Food and Agriculture
Organization of the United Nations (FAO), focused on developing a resilience index reflecting a
diverse set of assets and livelihood activities thought to enhance one’s ex ante capacity to be
resilient to particular shocks (Alinovi, Mane, & Romano, 2008; Alinovi, D’Errico, Mane, & Romano,
2010). The FAO method has been subsequently refined into a resilience capacity index that is
popular among many European aid agencies and international agencies such as the United Nations
Children’s Fund and the World Food Programme (d’Errico, Romano, & Pietrelli, 2018; d’Errico &
Pietrelli, 2017). An alternative method, developed by the consulting firm TANGO and recently
adopted by USAID and many US-based organizations, uses factor analysis as a data reduction
method to define distinct absorptive, adaptive, and transformative capacity indices from a myriad of
variables that they argue capture features of those capacities, including assets, human and social
capital, livelihood activities, access to services, and psychosocial beliefs and characteristics (Smith &
Frankenberger, 2018). These index methods have proved useful to agencies struggling to implement
measurement methods for resilience programming. But they focus heavily on ex ante capacities,
rather than on ex post recovery, and do not lend themselves well to impact evaluation since the
indices are intended solely as explanatory variables. As such, they more help explain resilience than
define or measure it. Yet as development agencies increasingly program explicitly to ‘build
resilience’, the concept has de facto become a targeted outcome, even if it is conceptualized as
purely a set of explanatory capacities. Toward that end, TANGO and USAID now also use a separate
outcome measure to try to capture resilience, a simple indicator variable reflecting whether a
household’s post-shock food security is greater than or equal to its pre-shock food security (Smith &
Frankenberger, 2018, Sagara, 2018). That measure lacks a normative anchor, however, as one could
fully recover to an unacceptably low standard and yet still be assessed as resilient.

Cissé and Barrett (2018, hereafter CB) offer a method that directly implements the BC
conceptualization of development resilience as reflecting the time path of conditional probabilities
of being poor, however measured. In the CB approach, well-being (or absence of poverty) can be
operationalized as an outcome using any of a wide range of indicators familiar to poverty analysis:
assets, expenditures, health status, income, literacy, or some combination of those, potentially
captured in an index measure (Alkire et al., 2015). The CB method relies on longitudinal, individual-

level observations to capture both the underlying (and potentially nonlinear) dynamics of the system
and the possible mediating effects of specific interventions on the effects of shocks on well-being.
Early applications of the CB method have demonstrated its usefulness in rigorous evaluation of the
impacts of resilience interventions, such as index insurance (Cissé & Ikegami, 2017) or livestock
transfers (Phadera, Michelson, Winter-Nelson, & Goldsmith, 2018). McPeak and Little (2017) find
that threshold-based resilience measures like CB significantly outperform alternative measures that
define resilience as recovery to ex ante state. Most resilience measurement has been shock/stressor
specific because most have been designed around ex ante capacities that are shock/stressor/setting
specific. One of the virtues of the CB method is that it can accommodate shock/stressor-specific
capacities as mediating variables while also allowing for a fully general representation of resilience
to the full range of perils.

Knippenberg, Jensen and Constas (2018) introduce an approach, developed in collaboration with
Catholic Relief Services on a pilot project in Malawi, to measuring resilience as the non-persistence
of shocks, which they label Measuring Indicators for Resilience Analysis (MIRA). MIRA uses high-
frequency data to study the persistence of households’ subjective reports of a range of adverse
shocks they suffer, such as drought, flood, or illness. The method also allows for regression
estimation of the relationship between estimated shock persistence and household attributes. Like
the TANGO/USAID outcome measure, the focus of MIRA is on shock recovery without reference to
the level of well-being to which one recovers.

Resilience to foster structural transformation

With shocks seemingly increasing in intensity and frequency in low- and middle-income countries,
the development and humanitarian communities are working energetically to embed the resilience
concept into strategies to facilitate structural transformation. A central lesson of the related
literature on the economics of poverty traps is that efforts to build resilience can conserve scarce
resources, crowd in private investment, and help low-income populations accumulate productive
assets and become secure in non-poor standards of living (Barrett, Carter & Chavas, 2018). So long
as definitions of resilience remain normatively anchored in relation to living standards to which
people routinely aspire, the risks of moral hazard, or the likelihood that resilience interventions
inadvertently create adverse incentives for private investment, are relatively modest. Under very
mild assumptions that people prefer better to worse living conditions and less to more downside risk
exposure, they should routinely pursue strategies that reduce the conditional probability of adverse
outcomes, i.e., that might reduce resilience. Indeed, in the face of poverty trap mechanisms
associated with nonlinear well-being dynamics, resilience building activities may be more likely to
crowd in than crowd out private responses that reinforce resilience (Barrett, Carter & Chavas, 2018).
Such poverty trap mechanisms have been most clearly demonstrated in settings – like the Horn of
Africa – where resilience strategy is increasingly central to development and humanitarian
programming efforts.

The resilience lens adds value to conventional poverty analysis in multiple ways. First, resilience
conceptualized in the BC way and operationalized using the CB method way can effectively
distinguish between what Carter and May (2001) term stochastic versus structural poverty.
Relatedly, by incorporating the underlying path dynamics of both standards of living and the key
state variables describing the system in which people live, the BC approach and CB method allow for
the potentially transitory nature of both favorable and unfavorable realizations of standards of

living. Development resilience analysis allowing accounting for (especially nonlinear) well-being
dynamics and expanding analysis beyond the first moment of the conditional distributions of well-
being outcomes, which matters for inference about program impacts (Phadera et al. 2018), for
targeting of beneficiaries (Upton, Cissé, & Barrett, 2016; Watkins et al., 2017).

By facilitating integrative thinking and measurement around the myriad stressors and shocks
confronting vulnerable populations, the resilience concept challenges the development and
humanitarian communities to collaborate more, both in advancing better understanding of the
complex dynamic systems in which poor people commonly reside and in building improved
monitoring systems (Bené, Headey, Haddad, & von Grebmer, 2016). As BC explain, the closely
coupled feedback between natural systems – e.g., fisheries, forests, rangelands – that may exhibit
nonlinear dynamics and multiple stable states, and inter-temporal human decision-making that is
limited by imperfect information, local financial market failures, sociocultural barriers, and other
constraints, leads to complex dynamics beyond what analysts or practitioners in the development
and humanitarian communities currently measure. Resilience, especially anchored in notions of
capacities, emphasizes individual agency in ways that transcend the more passive condition too
often implied in prior concepts of poverty and vulnerability. Programming aimed at building
individuals’, households’, communities’, and institutions’ resilience against shocks as diverse as
extreme weather events, market price shocks, and civil unrest, can help promote proactive
collaboration not only among development and humanitarian agencies but between those agencies
and target populations.

Resilience to global catastropheBaumResilience to Global Catastrophe

Seth D. Baumi*

i Global Catastrophic Risk Institute

Suggested citation: Baum, S. D. (2018). Resilience to global catastrophe. In Trump, B. D., Florin, M.-V., & Linkov,
I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected
systems. Lausanne, CH: EPFL International Risk Governance Center. Available on and

Keywords: Resilience, catastrophe, global, collapse

*Corresponding author:


The field of global catastrophic risk (GCR) studies the prospect of extreme harm to global human
civilization, up to and including the possibility of human extinction. GCR has attracted substantial
interest because the extreme severity of global catastrophe makes it an important class of risk, even
if the probabilities are low. For example, in the 1990s, the US Congress and NASA established the
Spaceguard Survey for detecting large asteroids and comets that could collide with Earth, even
though the probability of such a collision was around one-in-500,000 per year (Morrison, 1992).
Other notable GCRs include artificial intelligence, global warming, nuclear war, pandemic disease
outbreaks, and supervolcano eruptions.

While GCR has been defined in a variety of ways, Baum and Handoh (2014, p.17) define it as “the
risk of crossing a large and damaging human system threshold”. This definition posits global
catastrophe as an event that exceeds the resilience of global human civilization, potentially sending
humanity into a fundamentally different state of existence, as in the notion of civilization collapse.
Resilience in this context can be defined as a system’s capacity to withstand disturbances while
remaining in the same general state.

Over the course of human history, there have been several regional-scale civilization collapses,
including the Akkadian Empire, the Old and New Kingdoms of Egypt, and the Mayan civilization
(Butzer & Endfield, 2012). The historical collapses are believed to be generally due to a mix of social
and environmental causes, though the empirical evidence is often limited due to the long time that
has lapsed since these events. For example, the Akkadian Empire in Mesopotamia, approximately
4,300-4,200 years ago, is believed to have collapsed due to military destruction of economic
networks and possibly also climatic drought or other environmental stressors, though the role of
environmental stressors is controversial, and the Old Kingdom of Egypt, approximately 4,700 to
4,200 years ago, is believed to have collapsed due to a succession struggle following the long reign of
Pepi II, Akkadian military destruction, and a catastrophic failure of the Nile (Butzer, 2012).

While these historical collapses provide some insight, the collapse of modern global civilization
would be unprecedented. Modern global civilization is of a scale and complexity that is
fundamentally different from the civilizations that have previously collapsed. Civilization today has
tightly interconnected global networks, advanced science and technology, and a population of over
seven billion. None of the historical civilizations had anything close to this. These features of modern

global civilization can increase its resilience in some ways and decrease it in others. For example,
global trade enables populations in one part of the world to help out populations in another part of
the world during a regional catastrophe, but global just-in-time supply chains can cause cascading
global failures due to failure in one link of the chain.

The lack of direct precedent makes GCR a difficult class of risk to analyze. Neither the probability nor
the severity of global catastrophe can be directly quantified using historical data. Likewise, it is
difficult to say just how resilient global human civilization is to global catastrophe—how severe an
event global human civilization can endure without collapsing. It is nonetheless important to study
the matter, in order to assess how serious the threat of collapse may be and to evaluate potential
opportunities to increase humanity’s resilience.

Risk vs. resilience for global catastrophe

Risk and resilience are both conceptual paradigms for helping understand and address potential
adverse events. The risk paradigm tends to emphasize quantitative evaluations of the probability
and severity of potential adverse events and the effect of policy measures on the probability and
severity. The resilience paradigm tends to emphasize the capacity of a system to cope with, recover
from, or otherwise endure adverse events that may occur (Walker, Anderies, Kinzig, & Ryan, 2006;
Park, Seager, Rao, & Convertino, 2013).

It has been proposed that the resilience paradigm may be more appropriate for highly uncertain
potential adverse events (see Park et al. 2013). The basic idea is that, in the absence of robust
information about a threat, a sound approach is to focus on increasing resilience, on grounds that
certain measures can increase a system’s resilience to a wide range of threats. For example,
households can increase their resilience to many threats by stockpiling food, water, medical supplies,
and other basic necessities. These measures can be helpful even if it is not known which threat will

Similarly, certain measures may increase the resilience of global human civilization to a wide range
of threats (Jebari, 2015). For example, civilization could establish dedicated refuges to protect select
populations during a wide range of global catastrophe scenarios, including “surprise” scenarios that
may have not yet been imagined. Thus, refuges have been considered as a response to GCR (Baum,
Denkenberger, & Haqq-Misra, 2015; Jebari, 2015; Turchin & Green, 2017). Given the ambiguity
inherent to global catastrophe, this perspective suggests an important role for resilience in policy for
global catastrophe.

An alternative perspective proposes that the risk and resilience paradigms are both appropriate for
these sorts of ambiguous threats (Baum, 2015). Per this perspective, resilience measures can be
quantified as policies to reduce the severity of an event if it occurs. It may be difficult to quantify the
effect with precision, but the risk paradigm is capable of handling imprecise quantification. There
can presumably be at least some basic quantification, such as the assessment that the resilience-
increasing measure decreases the risk instead of increasing it. Furthermore, whereas the resilience
paradigm focuses on reducing severity, the risk paradigm also includes reducing probability. For
many GCRs (and other risks), there are important policy opportunities to reduce the probability that
should not be neglected by focusing on resilience.

It is nonetheless the case that the field of GCR often neglects resilience. One reason for this may be
that scholars of GCR tend to come from intellectual backgrounds in which resilience is not prominent.

Another likely reason is that attention goes primarily to how to prevent global catastrophes from
occurring, with limited attention to how to respond to these events if they occur (Maher & Baum,
2013). Some focus on prevention is warranted—it would certainly be better if global catastrophes
did not occur in the first place. However, prevention is not guaranteed to succeed, suggesting an
important role for measures to limit the severity. The resilience paradigm can draw attention to this
side of the issue and provide insights into what to do about it, which is a valuable contribution.

This raises the question: how resilient is humanity to global catastrophe? Answering this question
requires covering some details that are distinct from resilience at smaller scales.

On the extreme end is the concept of minimum viable population (MVP), defined as the smallest
isolated population that has a high (commonly 90%) probability of surviving for many generations.
MVP is mostly used in conservation biology for non-human species, but in the context of GCR, it
applies to the human species. The human MVP has been estimated variously at 150 to 40,000 (Lynch,
Conery, & Burger, 1995; Impey, 2015). A resilient human population would need at least this number
of members co-located and able to reproduce. This idea has been taken up in proposals for
dedicated refuges to ensure a viable survivor population (see Jebari, 2015).

On the opposite end is the possibility of collapse from much smaller catastrophes. At issue here is
the fragility of global civilization. It is often observed that small initial events can cause cascading
effects, toppling relatively large systems. However, regional catastrophes leave other regions intact
and able to assist with the recovery. An important open question is what it would take for there to
be a global failure, such that there would not be a recovery. This sort of question is studied in the
field of global systemic risk (see Centeno, Nag, Patterson, Shaver, & Windawi, 2015).

Drawbacks of resilience to global catastrophe

An important question for all efforts to increase resilience is whether doing so reduces interest in
preventing adverse events from occurring, an effect sometimes referred to as moral hazard. There is
some precedence for this effect in the context of GCR. For example, civil defense for surviving
nuclear war has generated concerns that nations would attempt to fight and win instead of focusing
on deterrence and prevention (Weinberg, 1969).

There is reason to believe that moral hazard is relatively limited for GCR. This is because global
catastrophe is likely seen as so overwhelmingly horrible that the only sensible policy is to prevent it
from occurring in the first place. Such an attitude is a plausible explanation for why there is so little
attention to resilience to global catastrophe. Additional attention to resilience may be unlikely to
make people inclined to accept the onset of global catastrophe. Alternatively, belief in the resilience
of human civilization could prompt some to underestimate the severity of some global catastrophes.
An extreme example of this is in the argument that human extinction risks are categorically more
important than sub-extinction GCRs, an argument that is often found in the GCR literature (see Parfit,
1984; Matheny, 2007). However, this argument implicitly assumes a long-term resilience of human
civilization, such that there would be a full recovery from sub-extinction global catastrophes. A
recent study finds that this assumption lacks empirical support (Baum et al., 2018). More generally,
belief that human civilization could endure major shocks could reduce interest in reducing GCR.
However, this matter has not been studied rigorously, and definitive conclusions cannot be made at
this time.

How resilience can reduce the risk of global catastrophe

While moral hazard may be a way for resilience to increase the risk of global catastrophe, there are
also important ways that attention to resilience can decrease the risk. The value of resilience can be
seen via the important example of resilience to global food supply catastrophes.

There are several GCRs that are believed to threaten the global food supply. For example, nuclear
war burns cities and other areas, sending large amounts of particulate matter into the stratosphere,
which then blocks incoming sunlight worldwide, disrupting agriculture. An India-Pakistan nuclear
war scenario has been found to cause reductions to major crop yields in the range of 10 to 50% (see
Xia, Robock, Mills, Stenke, & Helfand, 2015). Large asteroid and comet collisions and volcano
eruptions can have similar effects. Other global food supply threats could include crop pathogens
and abrupt global warming. These various catastrophes could create relatively abrupt shocks to the
global food supply, on time scales of years to decades. Slower events, such as gradual global
warming and the depletion of agriculturally significant natural resources (such as phosphate rock),
can also have large effects on the food supply, though they offer more opportunity for civilization to

Several measures can be taken to increase resilience to global food supply catastrophes (Baum,
Denkenberger, Pearce, Robock, & Winkler, 2015). The simplest is to make the most of the remaining
food supply. In particular, crops can be shifted from livestock feed to direct human consumption.
Under present (non-catastrophe) conditions, bypassing livestock could yield enough calories for four
billion people (Cassidy, West, Gerber, & Foley, 2013). Post-catastrophe, this figure could be
substantially reduced, but it may nonetheless help keep many people alive.

Another measure is to stockpile food prior to the catastrophe. In principle, the amount of food that
can be stockpiled is virtually unlimited. In practice, however, food stockpiling is expensive, labor-
intensive, and cuts into the pre-catastrophe food supply. Food stockpiles are best suited to a more
limited role for more moderate catastrophes, especially those of short duration. Existing food
stockpiles could support the global human population for an estimated 4-7 months (Denkenberger &
Pearce, 2014), which is insufficient for many global catastrophe scenarios. Another potential role for
food stockpiles is to ensure the survival of a select population, such as in continuity of government
facilities, survivalist communities, or dedicated refuges designed to ensure an MVP.

A third measure is to develop capacity to produce food in unconventional ways. For example, if
sunlight becomes unavailable, it may be possible to produce food via other means (Denkenberger &
Pearce, 2014). Ultimately, food does not need sunlight—it needs energy. Non-sunlight energy
sources could include fossil fuels, nuclear power, and energy stored in trees and other biomass. This
option is attractive because it can succeed for catastrophes of all sizes with no expensive reductions
in pre-catastrophe food supply. However, it may require technological development and institutional
support that thus far has not been made. Thus, this is the sort of policy measure that could result
from greater emphasis on resilience to global catastrophe.


While it should be hoped that global catastrophe will never occur, there is no guarantee that efforts
to prevent global catastrophe will succeed. Therefore, efforts to increase humanity’s resilience to
global catastrophe constitute an important class of policy—one that has thus far received rather
limited attention. The continuity of global human civilization and the human species are essential
policy goals. There are promising options for increasing resilience to global catastrophe. These
options should be pursued.
Conceptualizing risk and unit resilience in a military contextCato, Blue & BoyleConceptualizing Risk and Unit Resilience in a Military Contexti

i The views expressed in this paper are those of the authors and do not necessarily reflect the official views of
the U.S. Department of the Army, Department of Defense, or the U.S. Government.

ii U.S. Army Research Institute for the Behavioral and Social Sciences (ARI)

Suggested citation: Cato, C. R., Blue, S. N., & Boyle, B. (2018). Conceptualizing risk and unit resilience in a
military context. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2):
Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance
Center. Available on and

Colanda R. Catoii*, Shala N. Blueii and Bridget Boyleii

Keywords: Team/unit resilience, risk, military, U.S. Army, behavioral

*Corresponding author:

Unit/team resilience in the U.S. Army

The United States Army Research Institute for the Behavioral and Social Sciences (ARI) is a leading
agency of the Army that conducts innovative and applied research aimed at improving Army
readiness and performance. The agency accomplishes its mission in part by developing innovative
measures and methods to address these issues and improve the overall Soldier lifecycle and

Fostering and ensuring resilience at the individual Soldier, unit, and organizational level may help
leaders and Soldiers improve Soldier lethality. However, much of the scientific research on resilience
has focused on defining and measuring resilience at the individual level, with less investigation of
unit or team-level resilience. With the critical role of teams and small units in the Army, it is essential
to have a theoretically supported definition of unit resilience as well as develop an empirically
sound, evidenced-based measure to help determine its impact. To date, no agreed upon definition
of unit resilience exists. In a recent effort (Cato, & Blue, 2017; Cato, Blue, & Boyle, 2018), we
reviewed the collective (e.g., group, organization, community) resilience literature and identified
recurrent themes across definitions of collective resilience. Themes such as absorption,
withstanding, adapting, and bouncing back occurred numerous times across the collective resilience
definitions examined in our literature review (Cato & Blue, 2017; Cato et al., 2018). Other concepts
that appeared in the definitions and descriptions of multiple collective types of resilience included
preparing/anticipating, learning, and growing/thriving. Based upon the above themes, we defined
Unit Resilience as:

“A multi-phasic process in which members of the unit deliberately and collectively apply skills,
abilities, and resources to prepare the unit for adversity by planning and anticipating adverse
events, successfully respond to challenging events by withstanding or adapting to stressors, and
recover after the event, which involves the unit returning to homeostasis (e.g., bouncing back) or
an improved state through post-event learning and growth.” (see Cato et al., 2018)

This definition focuses on a unit’s ability to prepare, respond, and recover from adverse events and
is consistent with other collective resilience definitions (see Alliger, Cerasoli, Tannenbaum, & Vessey,
2015; Bergstrom & Dekker, 2014; Linkov, Eisenberg, Bates et al., 2013; National Resource Council
[National Academies of Science], 2012; Linkov et al., 2018). Our definition also embeds risk and
threat as an inherent part of the overall collective resilience process that units must address in the
preparation phase of unit resilience (Linkov & Trump, 2019). Moreover, our unit resilience definition
acknowledges the role that Soldiers’ skills and abilities as well as individual and unit resources play
to enable a unit’s successful progression through the three distinct unit resilience phases. The extent
to which these skills, abilities, and resources are utilized or are damaged or depleted can positively
or negatively impact a unit’s resilience. Such a perspective is consistent with the Systems theory (see
Bergstrom & Decker, 2014) and Conservation of Resources (COR) theory (Hobfoll, 1989; McCubbin &
McCubbin, 1988).

From a systems theory perspective, we view the military unit or team as a system, with the collective
resilience of the system being bolstered or hampered by the individuals who comprise the system.
While one member in the system may not necessarily demonstrate resilience or behave in a resilient
manner, the collective can still demonstrate resilience and overcome individual shortcomings. COR
theory provides a resource-focused model that emphasizes how the impact of repeated stressors
depletes resources availability. From these perspectives, we view the military unit as a complex
system in which resources can be tapped individually or collectively. Over- or underutilization of
resources within the system can negatively or positively impact the entire system, or Army unit.
Likewise, COR theory holds that failure to allow resource regeneration within the system will overtax
the system and result in adverse outcomes. These theories offer a promising perspective to advance
our understanding of unit resilience. ARI, with contracted support, is using this literature-based,
theory-informed definition of unit resilience to help inform the development and future validation of
a unit resilience measure appropriate for use in the Army.

Unit resilience strategies should be developed to help Army units better prepare for, respond to, and
recover from adverse or challenging events. Such strategies should focus on individual and collective
skill building within the unit along with determining appropriate and timely resource allocation.

A unit resilience approach that includes risk assessment and management

For military populations such as the Army, articulating what risk and resilience are, as well as how
each manifest, is important. Risk is an inherent part of most Soldiers’ experiences in the Army. Risks
that Soldiers face both individually and collectively include a multitude of stressors or challenges in
garrison and during deployment, such as repeated deployments, family separation, or loss of life or
limb during peacekeeping missions or other operations. Some argue that risk and resilience are
indeed different constructs (Linkov et al., 2018). However, based upon a previous literature review
(Cato et al., 2018) across multiple collective types of resilience, we propose that unit resilience must
focus in some part on potential risks that units face as well as various skills, abilities, and resources
which enable the unit to prepare, respond (via absorbing, adapting, or flexing), and recover in the
face of adverse events or significant challenges. Risks can impact the overall resilience of units. The
risks or stressors that Army units face can impede the units’ ability to respond rapidly or even
recognize a need to respond, can limit the units’ ability to absorb and withstand the impact of
stressors, and can result in an overall failure to adapt or respond, which can ultimately impede or
limit post-event thriving and learning from adverse events or prevent recovery altogether. Even the

most prepared unit may fail to respond and adapt when resources are depleted. Focusing on
mitigating risks can potentially allow units to maintain an awareness about what resources need
replenishing and when, which is likely to enable resilient responding.

Understanding which risk assessment and management options are relevant is also an important
characteristic of unit resilience. Within the Army, risk is defined “as probability and severity of loss
linked to hazards…[and] the measure of the expected loss from a given hazard or group of hazards,
usually estimated as the combination of the likelihood (probability) and consequences (severity) of
the loss” (Headquarters, Department of the Army [Army], 2014, p. 4). The Army’s risk management
approach is intended to assist individuals, leaders, and Army units in making informed decisions to
reduce or offset risk, and ultimately influence mission success. The Army proposes a 5-step approach
to engage in risk management, where steps one and two include identifying and assessing potential
impacts of the hazards (assessment) and steps three through five include developing controls and
making decisions, implementing controls, and supervising and evaluating the implementation and
outcomes (management) (Army, 2014, p. 3-4). Leveraging and incorporating existing Army risk
assessment and management principles and techniques as part of the unit resilience process can
help clarify the relationship between these two constructs and ways in which the preparatory phase
of unit resilience can be measured. Based upon our literature review (Cato et al., 2018) and other
work by the Homeland Security Studies & Analysis Institute (Kahan et al., 2010), we adopt an
approach which views risk assessment and management as a means to help understand unit
resilience and its measurement (see Figure 1).

Figure 1: Unit Resilience Phases across Time and Functioning

Adapted from figures that depict resilience processes and profiles across various disciplines (Carver, 1998;
Kahan, Allen & George, 2009; Linnenluecke & Griffiths, 2012; O’Leary & Ickovics, 1995)

Assessing and managing risk involves understanding the probability (frequency) of risks occurring
and the expected severity (consequences) of those risks. Per DA PAM 385-30 (Army, 2014), the Army
assesses probability of risk occurrence across five categories:

. Frequent (continuous/inevitable)
. Likely (several occurrences)

. Occasional (intermittent occurrences)
. Seldom (infrequent occurrence)
. Unlikely (improbable occurrence)

Likewise, risk severity is assessed across four categories:

. Catastrophic (death, unacceptable loss/damage, mission failure)
. Critical (severe injury or damage, severe degradation of mission capability)
. Moderate (minor injury or damage, minor degradation of mission capability)
. Negligible (minimal injury or damage, little or no impact on mission capability

Based on the challenges Army units face, it is meaningful to focus on the interactions between
probability and severity of potential adverse events/hazards that produce “high” or “extremely high
risks.” For example, high/extremely high risks events are those that are expected to be frequent
coupled with severe consequences that threaten mission success. Risk assessment and management
are essential to, and embedded within, the unit resilience process and both are integral in improving
the likelihood of mission success. Within our unit resilience framework proposed herein, and
indicated previously, risk assessment and management occur pre-event or during Phase 1 (Prepare).
This phase involves identifying, anticipating, planning and routinely monitoring conditions to pre-
emptively minimize hazards or threats (see DA Pam 385-30, Army 2014, p. 3). Unit resilience Phases
2 and 3 focus on responding to an adverse event (during the event) and recovering from the event
(post-event). Within these additional phases of the unit resilience process, there are vital factors
that influence the ability of a unit to confront acute and chronic stressors impacting mission success.
For instance, the responding phase includes withstanding and absorbing the shock, adapting,
adjusting, and flexing, whereas the recovery phase includes growing, thriving, and post-event

Army units might benefit more from using resilience-based approaches rather than risk-based
approaches when specific risks are unknown or unexpected. Increasingly, threats and risks are
pervasive issues Army units face. During deployments, it may be impossible to know all of the critical
threats that a unit should prepare for, make attempts to avoid, or eliminate, given the nature of the
unit’s mission. A resilience-based approach would allow Army units to focus on general resilience
building skills that could then be applied when needed to various situations, particularly those with
low probability but extreme impacts. Training Army units to be able to better withstand and absorb
impacts, adjust, and flex under uncertainty will likely improve the unit’s ability to recover rapidly,
improving the units’ overall performance and unit readiness. Utilization solely on risk-based
approaches would be preferred only when events are known with critical to catastrophic impacts.

Determining whether to utilize risk management or resilience strategies requires consideration of
various metrics. Monetary cost is often one the most important metrics an organization must
consider. Utilizing general resilience-building strategies might be more cost-effective than risk
management-focused strategies. The latter requires resources focused on the identification,
evaluation, prioritization, and planning to address a variety of specific known, anticipated threats.
While it is generally possible to identify critical threats that organizations typically face, it might
prove to be more challenging to do so in a military setting, given that a number of challenges
Soldiers and Army units face in theatre are unpredictable and sometimes unknown. Resilience-based
strategies can be used in garrison and during deployment, and can be aimed at addressing both the

most critical known threats and general unknown threats or risks. These resilience strategies provide
a more holistic approach and could enable resilient responding and quicker recovery regardless of
the risk level. Research is needed to better understand and measure the comparative return on
investment from investing in resilience-building strategies instead of or in addition to risk
management strategies.

Unit resilience is worth the risk

Resilience-building might be associated with certain drawbacks or moral hazard (i.e., when
individuals or an Army unit intentionally take on risks knowing that others will bear the negative
consequences or impacts). In a military context such as the Army, risks inherently abound. In a
variety of situations, Soldiers and Army units can do little to completely avoid such events, despite
being faced with critical risks such as loss of limb or life. Resilience-building could result in several
expected outcomes. Ideally, one potential outcome could be that Army units build resilience and
learn to anticipate risks, respond appropriately, and recover more quickly using existing or newly
garnered resources, as well as learn from their experiences. Using a resilience strategy, Soldiers
would be able to better prepare for critical expected risks (and unknown risks), practice appropriate
responses, develop and hone required skills and abilities, and garner resources to be ready to
respond when exposed to inevitable, dangerous and adverse events. Such preparation does not
necessitate incentivized risk taking, it merely means that units are potentially equipped with tools to
appropriately respond should the need arise. Another potential outcome, and possible drawback, is
that resilience-building could potentially bolster a units’ overall confidence in their ability to handle
adverse events to the point that units become overconfident, taking on risks that exceed the units’
abilities and result in harm or depleted resources. Lastly, Army units may be required to engage in
resilience-building skills directed by policy or processes, which could result in Army leaders believing
that units that demonstrate resilience or are expected to be resilient should be tasked to take on
more or longer deployments, have shorter demobilization periods, or be assigned to more
dangerous locations.
Resilience in the context of systemic risks: Perspectives from IRGC’s guidelines for the governance of systemic risksFlorin & TrumpResilience in the Context of Systemic Risks:
Perspectives from IRGC's Guidelines for the Governance of Systemic

Marie-Valentine Florini* and Benjamin D. Trumpii

i International Risk Governance Center (IRGC), École Polytechnique Fédérale de Lausanne (EPFL), Switzerland

ii ORISE Fellow, United States Army Corps of Engineers, USA

Suggested citation: Florin, M.-V. & Trump, B. D. (2018). Resilience in the context of systemic risks:

Perspectives from IRGC's guidelines for the governance of systemic risks. In Trump, B. D., Florin, M.-V., &
Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected
systems. Lausanne, CH: EPFL International Risk Governance Center. Available on and

Keywords: Systemic risk, transition, adaptation, transformation, insurance

*Corresponding author:


This piece discusses resilience in the context of systemic risks and complex adaptive systems.
Systemic risks are an increasingly common threat to many interconnected systems worldwide, from
cybersecurity, critical infrastructure to environmental sustainability. Building from IRGC’s
recommendation regarding the governance of systemic risks, we describe how resilience strategies
can support efforts towards helping systems navigate transitions, including cases of adaptation or
transformation (IRGC, 2018). We also briefly use the case of insurance to illustrate the articulation
of risk- and resilience-based perspectives and the drawback of resilience.

Both theoretically and mathematically, resilience is a function of systems and their interaction. More
explicitly, resilience is a property, a capacity, and a dynamic process by which a system is able to
address disruptions to its core functionality, either at the micro or macro-scale. Dynamic systems are
constantly incorporating new information and new practices into their core function and identity at
various levels. These ideas define the backbone of complex adaptive systems, whereby systems
influence and are influenced by other systems, sub-systems, and broader environmental conditions.

Major shocks and disruptions materialise as the result of systemic risks cascading within and
between complex adaptive systems and are often unexpected prior to their arrival. This cascading
effect is perhaps one of the more complex and unpredictable components of systemic risk and is
particularly dangerous in an environment of increasing system interdependency and connectivity
(e.g., the global financial system, industrial agriculture and fishing, digital information systems, etc.).
A resilience-based approach helps key stakeholders combat the negative consequences of systemic
risk by preparing a system for an uncertain future of direct or cascading threats, and by enabling that
system to recover from even those disturbances that threaten system collapse.

A critical component which defines complex adaptive systems is the interconnectivity within and
between systems. Such interconnectivity is often driven by convenience or for the sake of efficiency
– i.e., it is easier to rely upon a public utility for water and power of a building rather than acquiring
and managing that resource oneself. For most modern businesses, interconnectivity is often framed

as normatively positive, whereby an interconnected organization can develop more advanced
services or goods to larger customer bases in faster, cheaper, and more effective ways. Such
interconnectivity is made possible through digitalisation and the reliance on the Internet for data
transactions, as well as globalized economic and supply chain practices, among others.

But what are the potential costs of such interconnectivity? While interconnectivity can increase the
efficiency of a system to deliver critical services, it can also increase exposure to risks from external
sources. If connections between important nodes are too tight, interconnectivity may expose the
various layered systems to risks of sudden external shocks and unsustainable stresses. This may take
the form of slow-moving and imperceptible changes that go largely unnoticed with the lay public but
can ultimately drive the system beyond a tipping point, resulting in cascading changes in the system
itself and other interconnected systems.

Striving for organizational efficiency usually comes at the cost of reduced redundancy. Many
business practices, such as lean manufacturing, often frame redundancy as a negative organizational
trait that bloats costs. However, organizations with limited redundancy or buffer capacity to quickly
recover and reorganize are at the greatest risk of collapse from systemic threat. Thinking in terms of
resilience in contrast to efficiency implies fostering policies and management that reduce the
duration and depth of shocks, enhance the capacity to recover quickly and reduce the severity of the
impact on welfare (Connelly, et al., 2017).

Complex adaptive systems can alternate between different stable states or regimes, provided that
their base resource and operating requirements are relatively stable. From a socio-ecological
perspective, rich grasslands can become increasingly arid and encounter desertification under
certain environmental conditions, if a threshold (tipping point) was crossed. Systems are constantly
in flux and incorporate new information in a deliberate or unintentional manner. Such transitions
between regimes are natural processes and foster adaptation from one steady state into another.
Resilient and sustainable systems are better placed than rigid, non-evolutive and non-sustainable
systems, when they are confronted with cascading consequences of systemic risks.

Articulating risk and resilience

The IRGC is institutionally focused upon addressing risk, which may be understood as the negative
consequences stemming from uncertainty within a given activity or objective and their associated
values. In most contexts, risks may be best addressed through processes of risk assessment and risk
management – both fundamental components of risk governance, and tested tools for regulators
across the globe. However, traditional risk assessment methodologies, especially those based on
linear or well-established cause-and-effect-relationships, cannot be successfully applied to risks that
develop in complex adaptive systems and may even have counter-intuitive and unintended
consequences. A better understanding of systemic risks and an appropriate approach for developing
management options is thus essential for decision-makers to prepare their organisation for future
challenges. For example, the OECD recommends that governments should seek to address critical
risks, strengthen resilience to avoid being negatively affected by cascading failures, and create
capacity for improved agility in case unexpected shocks and disruptions happen (OECD, 2011; 2014a;
2014b; Linkov, et al., 2014).

Resilience serves as a more helpful alternative philosophy and methodology to analyse complex
adaptive systems and systemic risks, which are difficult to analyse via conventional risk assessment
methodologies. Many modern systems would benefit from a resilience-based approach, particularly
for systems with inherent nested interdependencies with others, or those which are prone to low-

probability, high-consequence events that are difficult to accurately predict or model. Resilience
helps these systems prepare for disruptions, cope with and recover from them if they occur, and
adapt to new context conditions (National Academy of Sciences (NAS), 2012; Linkov & Trump, 2019).

Insurance provides a useful illustration of this. From an insurance point of view, the limitations of
standard risk-based approaches are visible and increasingly problematic. The insurance sector is
increasingly facing challenges such as accumulation, which go beyond traditional risk analysis and
require resilience analysis. Risk management and risk transfer have always been the basic
instrument of the insurance industry; but in the light of changes in the global risk landscape and the
increased importance of systemic risks, conventional risk management approaches reach their limits.
Resilience as an approach to deal with shocks and uncertainty appears a promising way forward and
should become more important in the future of insurance, provided it can be measurable.

However, investments in resilience are difficult to valorise, because it is difficult to align high
present-day expenses and potential future advantages. On-going work to develop or refine
indicators, tools, and quantitative/qualitative approaches to inform system resilience should help
characterise and quantify the benefits of investments in resilience (Cutter, Burton, & Emrich, 2010;
Hosseini, Barker, & Ramirez-Marquex, 2016). At a high-level, this is what insurance is meant to do
with risk-based insurance premiums that can turn such potential future advantages into immediate
premium discounts.

Insurance can encourage investments in risk mitigation through financial incentives (e.g., premium
discounts) and risk information (e.g., communicated risk assessments (Kousky & Shabman, 2016)). A
relevant question for those who develop insurance products and resilience managers is the extent to
which insurance can incentivize investments in resilience and make the cost of resilience competitive
with the costs of risk-based measures. Answering this question will elaborate on the two properties
of insurance: to mutualise costs and benefits across policyholders (space dimension), and to
distribute over time the cost of risks (time dimension) (IRGC, 2019).

Drawbacks of resilience - How a resilience-based focus might lead to unintended challenges

Resilience-based approaches, while helpful in promoting expeditious recovery for normatively
beneficial systems, can engender infrastructural or cognitive drawbacks that must be carefully
guarded against. When system appetite or acceptance of risk is unacceptably high, or when
individuals, communities or businesses believe that, if a catastrophe happens, someone else (often
the government) will jump in to help recover and rebuild any lost assets or system functions, such
resilience-based approaches foster an environment amenable to moral hazard. More simply,
resilience may perversely lead to more risky behaviour in a belief that any and all disruptions can be
quickly addressed and overcome with minimal losses. For example, when the government provides
insurance to buildings destroyed by natural hazards such as flood or earthquake, even in areas that
are known as exposed, homeowners and businesses may have less incentive to relocate to less
hazard-prone areas. In that sense, the promotion of a resilience-based strategy can generate quick
recovery from certain types of disruption but generate cognitive and social responses that are highly
undesirable and likely to have recurring financial, infrastructural, and human losses. Such
arrangements are particularly problematic when short-term gains are given significantly higher value
than longer-term losses, fostering an environment that is less capable of preparing for future
systemic challenges (Grossi, Kunreuther, & Windeler, 2005).

In broad terms, moral hazard occurs when someone increases their exposure to risk, or willingness
to take risk, because someone else bears the cost of that risk. Resilience may indirectly increase risk

exposure and/or inhibit learning from a small manifestation of that risk, thus diverting attention
from weak signals that may become stronger and thus stifle system solutions.

Here also, insurance provides a useful illustration. Analysing how insurance and resilience work
together can provide interesting insights into possible drawbacks of resilience, and into how
insurance can contribute to reducing the risk of drawback.

On the one hand, insurance can reduce incentives to risk management and resilience building by
creating moral hazard and a false feeling of security. Insurance can reduce incentives to those who
manage physical safety and security of insured assets. This has always been a problem in risk
transfer solutions. The moral hazard needs to be addressed through the design of the insurance
contract, in a way that there should be no incentive for policyholders to create a loss. For example,
coverage limits or conditional coverage can provide such incentives. Conversely, resilience can
reduce the perceived need for insurance.

On the other hand, insurance can increase incentives for improving resilience, if insurance premiums
are revised depending on the depth of disruption and speed of recovery after an insured risk event.
Insurance can improve resilience by providing the financial resources to recover, rebuild and adapt
(as insurance will require rebuilding in a way that intrinsic susceptibility to risk will be lower than
before the risk event). Likewise, resilience can improve insurability or reduce the cost of insurance,
for example by defining factors of insurance cost reduction based on tangible resilience indicators
(IRGC, 2019).

Can resilience be designed for transition, adaptation or transformation?

In the context of systemic risks, considering resilience to cope with, navigate or steer possible
transitions that come with change is worth some attention. Organisations must develop capabilities
to adjust and adapt to uncertainty, rather than to inherently resist change. A traditional response to
a specific threat is to harden a system to better withstand and absorb said threat – this works well
when such threats are well characterized and understood. However, when threats are more
uncertain, or the affected systems more complex and difficult to model, greater emphasis upon
modularity and redundancy can afford greater system capacity to transition towards a more
normatively positive resilient state.

Resilience-based approaches for complex adaptive systems enhance the system’s capacity to absorb
disturbances and re-organise system functions and characteristics in order to essentially retain the
same system mission and purpose to deliver a specific set of services. For example, when a city with
large and important assets is prone to flooding through sea level rise and storm surge, re-organising
land-use and creating floodplains around that city can 'absorb' the risk of flooding and subsequent
disturbances. This would be in contrast to building dykes to prevent the flood from entering the city.
The city and its surroundings would be adapted or even transformed through resilience building.

IRGC's Guidelines for the Governance of Systemic Risks place resilience as a tool to better
understand and prepare complex adaptive systems to systemic risks. These systems adapt
dynamically to internal and external changes, and resilience is well-placed to help a system adapt.
Resilient social-ecological systems try to absorb shocks so that the crossing of a dangerous threshold
is avoided. However, an organisation or system can deliberately engage in the process of change
(transition) to adapt to change and, if needed, transform itself. In that case, the question is (a)
whether resilience can be designed to steer, or drive a fully transformative process, which may be
required in the face of transitions to fundamentally different regimes or systems, or (b) if a resilient
system cannot do more than small adaptation. The capacity to fundamentally transform a system

may be beyond what conventional strategies for resilience can achieve. But in either case, resilience
can help deal with the specific disruptions that result from the transformation process, especially
when transformation creates losers that must be compensated.

Key terms and definitions related to systemic risks (IRGC, 2018)

Persistence involves absorbing on-going change or risk. It may also correspond to a non-vital
degradation of the system as it absorbs such risk. Persistence can be thought of as the capacity of a
system to exhibit low vulnerability to risk or provide a good level of resistance to risk. For example,
persistent ecosystems can provide a steady supply of valued ecosystem services, but over the long
term, this may require adaptation and possibly transformation at other scales.

Transition is the process or period of changing from one state or condition to another (Oxford
Dictionary, n.d.). It is seen as a fluent change towards a new future, which is an improved version of
what exists; it is a “gradual, continuous process of societal change, changing the character of society
(or a complex part) structurally” (Rotmans, van Asselt, Geels, Verbong, & Molendijk, 2000). A
dynamic phase between two stable phases enables the system to shift from a first context to a new,
stronger one. Crises are often needed to make such changes happen. In a condensed form, the EEA
defines transitions as “long-term, multi-dimensional and fundamental processes of change, based on
profound changes in dominant practices, policies, and thinking” (EEA, 2016).

Adaptation is the action or process of adapting or being adapted to something. It involves adjusting
responses to changing external drivers and internal processes to remain in a necessary or a desired
regime and on the current pathway. Adaptation is achieved through incremental change. It is seen
as a slow process, which modifies the landscape only slightly.

Transformation is a thorough or dramatic change in form or appearance. It involves fundamentally
changing the system dynamics, so there are new feedbacks to maintain the system in a new regime
or along a new pathway (Renn, 2017). It is a change towards a future that is fundamentally different
from the existing paradigm (Roggema, 2012). In the case of the resilience of the global social-
ecological system, transformability for sustainability is about shifting into new pathways of
development (Folke, Biggs, Norström, Reyers, & Rockström, 2016).

Resilience includes sustaining what we want to keep the same (i.e., persist). Adaptability can also be
part of resilience because it represents the capacity to learn and adjust responses to changing
drivers. “The very dynamics between periods of abrupt and gradual change and the capacity to
adapt and transform for persistence are at the core of the resilience of social-ecological systems”
(Folke, et al., 2010).

IRGC's Guidelines for the Governance of Systemic Risks suggest that strategies should create
supporting conditions to:

. Reduce the exposure of the system and its vulnerability to various shocks and stresses
. Collaborate with others at the periphery of the system. Multi-stakeholder partnerships and
value-chain analysis can provide incentives to those actors who contribute to reducing
systemic risks by adding diversity, modularity or other components of resilience, in such a
way that the value chain can be more adaptive and able to re-organise if needed
. Prepare proactive measures to adapt or transform the system, should a fundamental change
. Consider planned adaptive governance

. Prepare for when a window of opportunity opens, which will make possible the
implementation of a strategy to adapt or transform the system or organisation.

These supporting conditions can participate in the effective deployment of various types of
approaches to the management of systemic risks. In the face of many unknowns, increasing the
overall resilience of an organisation can be a way to prepare for and better deal with the shocks and
stresses arising from those systemic risk. In line with mainstream recommendations for resilience-
building (Hollnagel, Woods, & Leveson, 2006), IRGC therefore proposes three main strategic

. Supporting and strengthening the ability of a system to self-organise and self-control, which
is a property of resilient or sustainable systems. When biological systems engage in ‘self-
healing’ in order to overcome disruptions to biological processes, they use a critical
component of system resilience, whereby such systems can better recover from and adapt
to threats and disruptions from various sources.
. Engaging in proactive intervention strategies: prevention, adaptation, mitigation or
transformation. The most radical intervention, transformation, is based on the logic that
there is a window of opportunity to catalyse a positive regime shift and let the system
evolve on new or improved trajectories. It typically involves initiating changes at lower
scales while maintaining the resilience of the system at higher scales as the transformation
proceeds, until the feedbacks in the new stability domain are sufficiently established. An
example is the energy transition in Germany or the transformation to a circular economy
(Centre for European Policy Studies (CEPS), 2017).
. Preparing for disruptions, accidents and crises, which requires thinking in terms of resilience.

There are three ways to frame resilience as a mechanism to facilitate system adaptation and
transformation, and whether it can assist key stakeholders to steer a system transition towards a
more favorable direction:

. Say that adaptive systems will by definition adapt and resilience will help them recover from
shocks while transitioning to a new state that is better adapted when context conditions
change. Resilience is conceived over the long term and fits well as a concept with dealing
with changes in system performance and their capacity to absorb shocks (Hollnagel, Woods,
& Leveson, 2006). Resilience strategies have the potential to deeply change how an
organisation prepares for the possible disruptions of key services on which it relies. When
organisations prepare for recovery from external shocks of a significant magnitude,
resilience strategies must be considered (Linkov, et al., 2014). Example: resilience of
Walmart supermarkets after Hurricane Katrina (Zimmerman & Bauerlein, 2005), (Horwitz,
. Say that resilience can or must promote adaptation of the system. This can be a discourse
and an attitude of managers who are convinced that such a statement will force dynamic
resilience to pursue a normative goal, such as adaptation to a new, preferable order.
Example: change in agricultural practices to adapt to climate change.
. Say that resilience must promote transformation towards sustainability or fundamentally
changed conditions. This discourse must be accompanied with adequate leadership and
authority to steer the transition to transformation. Examples: transformation of the energy
system to avoid future shocks and disruptions; transformation to circular economies.

Bresch, Berghuijs and Kupers (2014) summarise scholarly literature and describe nine lenses of
resilience, among which "transformative resilience" requires systems to review changes over

extended time horizons. This type of resilience enables an organisation to transform itself if the
fundamental conditions of its survival have changed. Such change can take many shapes, such as the
need to reduce exposure to systemic risk via reduced interconnectivity and feedback loops with
other systems, or the creation of redundancies and reserve capacities to quickly address such shocks
as they arise.

Transformative resilience is based on various factors that can help address systemic risks in a
responsible and thorough manner. These include (a) distributed governance, (b) foresight and
anticipatory measures, and (c) innovation and experimentation. Collectively, these factors support
strategies to anticipate and respond proactively to changes in the systems in which a company or an
organisation is embedded with dynamic reorganisation, restructuration, and reinvention.

Distributed governance is management undertaken from multiple centres of authority, with trust
and effective communication between stakeholders and the capacity to develop and use measures
of anticipating systemic risks.

Foresight refers to the capacity of individuals and organisations to engage with uncertainty and
anticipate the potential outcomes and the future state of the system in which they operate.
Foresight is an effort undertaken by various stakeholders to both understand emerging trends
regarding systemic behaviour and potential for disruption, as well as futuristic threats that may arise
to disrupt a system in the years to come.

Innovation and experimentation involve efforts to identify new strategies of system formation and
operation, and to review the efficacy of such innovative proposals through modelling or small-scale
implementation. Innovation often starts at the frontiers of a system, sometimes as alternative
solutions to existing problems. While innovation frequently represents a threat to incumbents and
existing practices, and is therefore often purposely ignored, it nevertheless represents opportunities
to steer change, adaptation and transformation. Small-scale experimentation and modelling
exercises provide the ability to simulate how a system behaves under stress, and how transitions to
a system can allow it to perform more optimally in response to such systemic risks in the future.


Resilience is a key feature of complex adaptive systems when those are affected by transitions,
which require adaptation and transformation. It can provide confidence to managers of such
transitions that negative consequences from systemic risks, particularly those cascading within and
between systems, will be addressed by the intrinsic and dynamic ability of that system to recover
and adapt. What is less easy to figure out is how those managers can leverage transformative
resilience to produce actual transformations of the system, when such transformation is deemed

Systemic risks will become a regular threat to modern life. Increasing layers of interdependence
between important yet fragile infrastructural, environmental, cyber, and social systems will generate
situations where disruption may threaten severe limitations in how many basic services and modern
conveniences are able to operate. Further, as interconnectivity becomes increasingly widespread
across the globe, the number and scale of systemic threats will likewise only grow in number,
complexity, and frequency.

Though we cannot fully prevent systemic threats and risks from arising, resilience-based approaches
might help policymakers and key stakeholders in system management better navigate the process of
disruptions. By adopting a scientifically grounded systems approach, and accounting for potential

unintended drawbacks of a resilience-based approach, an emphasis upon system recovery and
adaptation may help many segments of our complex adaptive society better prepare for the threats
to come.
Resilience analysis of urban critical infrastructure: A human-centred view of resilienceFuruta & KannoResilience Analysis of Urban Critical Infrastructure:
A human-Centred View of Resilience

Kazuo Furutai* and Taro Kannoi

i School of Engineering, The University of Tokyo

Suggested citation: Furuta, K., & Kanno, T. (2018). Resilience analysis of urban critical infrastructure: A human-
centred view of resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience
(vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk
Governance Center. Available on and

Keywords: Critical infrastructure, interdependency, system of systems, human-centred view

*Corresponding author:


The Great East Japan Earthquake and the disaster at Fukushima-Daiichi Nuclear Power Plant in 2011
were events that caused many people to attend to resilience in Japan. After the disaster in 2011, the
National Resilience Promotion Office was established in the Cabinet Office in 2013, and the Basic Act
for National Resilience (Cabinet Secretariat, 2013) was enacted in the same year. Following the Basic
Act for National Resilience, the Fundamental Plans for National Resilience both for the central
government and for local governments were established and will be revised periodically. People
have recognized that more comprehensive approaches than the conventional ones for disaster
prevention are required in order to be prepared for unanticipated situations, like those experienced
in 2011. In particular, resilience of urban critical infrastructure is a critical issue for saving lives in a

After the Great East Japan Earthquake, industry and civic life were severely disrupted not only in the
damaged area of Tohoku district but also in the metropolitan area of Tokyo. Many power generating
plants were damaged, causing shut down, and a planned blackout was enforced in the metropolitan
area of Tokyo, lasting for about a week. In the damaged area of Tohoku district, it took more than a
month to recover the lifelines and recovery of local communities is still under way.

Resilience has been defined and used as a technical term in various areas, but from a viewpoint of
systems safety it stands for capabilities of a socio-technical system to absorb internal as well as
external threats and to maintain its functionality (Hollnagel, Woods, & Leveson, 2006). It is a concept
derived following great efforts around how to attain the safety of complex socio-technical systems
that consist of hardware, human, organizational components, and interactions between them.

Risk-based and resilience-based safety design

In the conventional approach of safety design, the system is designed to achieve some design basis
derived from a particular presumed threat scenario. The design basis is determined so that the risk
that the actual system status may go beyond the design basis and then cause losses to the society
will be kept below the allowable limit. It is assumed that the risk can be evaluated empirically as a

combination of the scale and the probability of expected losses. The residual risk below the
allowable limit is often neglected and retained in the system.

Resilience sheds light to this residual risk neglected in the risk-based approach of safety design, and
it can be seen as an extension of the risk-based approach. Resilience therefore complements rather
than replaces the risk-based approach. Resilience includes not only the preventive measures of
disaster but also the responses to unfavourable outcomes of disaster. The recovery speed of system
functionality is therefore discussed very often in the resilience literature and the resilience triangle is
a useful measure for quantitatively representing the degree of system resilience.

The recovery speed, however, is not the only measure that is relevant to resilience. Recovery cost,
for instance, is sometimes considered in the assessment of system resilience. In our study on the
resilience of urban critical infrastructure, the amount of recovery efforts is used in addition to the
recovery speed as a resilience measure. In the Infrastructure Resilience Analysis Methodology
(Biringer, Vugrin, & Warren, 2013), the resilience measure is composed of Targeted System
Performance (TSP), System Impact (SI), and Total Recovery Effort (TRE). We adopted this
methodology for assessing the resilience of a telecommunication network after disaster. In this
assessment, we defined TSP as the design capacity of the telecommunication lines without any
damage, SI as the degradation from TSP represented as the call loss rate, and TRE as the social utility
loss caused by traffic regulation.

Other system characteristics are also useful for quantitatively representing the system resilience. We
adopted the R4 framework of resilience, where resilience is represented in terms of four aspects of
robustness, redundancy, resourcefulness, and rapidity (Bruneau, et al., 2003), in the sensitivity
analysis for model validation. Which measures are useful depends on the purpose of analysis.

Human-centred view of resilience

When discussing the resilience of critical infrastructure, recovery of hardware facilities and
components are focussed on from the standpoint of infrastructure operators. We should, however,
focus more on the standpoint of end users. Resilience for whom is a key question to be asked, and
recovery of civic life that depends on critical infrastructure should be the final goal. Since civic life is
the basis that provides workers of the infrastructure industry, infrastructure operation and its
recovery heavily depend on the civic life system.

Civic life also depends on various industries and services other than infrastructure business. Medical,
financial, and administrative services are, in particular, of critical importance after disaster. These
industries and businesses are interconnected through a supply chain or a service chain and these
chains depend on the operation of infrastructure. It is remarkable that some industries were halted
due to disrupted supply chains after the Great East Japan Earthquake and the flooding in Thailand in
2011, though the industry locations were removed from the areas of damage. Industries depend in
turn on civic life, because people cannot join the workforce if their living conditions have not been

In order to analyze the resilience of urban critical infrastructure in reality, it is necessary to consider
not only the lifeline hardware subsystem but also the service subsystem and the civic life subsystem
for introducing a human-centred view. There are multiple interdependencies between these three
subsystems, and they form a very complex system of systems as shown in Figure 1. Additionally, in
our evaluation model of critical infrastructure resilience (Kanno & Furuta, 2012), the objective

function for recovery planning includes not only the recovery level of lifeline capacity but also the
recovery level of service activities and the satisfaction level of citizens. The satisfaction level of
citizens is evaluated by scoring the everyday activities that are possible under the recovery condition
of lifeline and services. The recovery cost, which is measured by the travel distance of recovery
teams and the time required for recovery, is also minimized in recovery planning. The tasks for
providing service and repairing damaged infrastructure are modelled by the PCANS model
(Krackhardt & Carley, 1998). The supply chains among the agents in the service subsystem are also
considered. This framework enables us to assess the resilience of critical infrastructure considering
the above-mentioned human-centred view.

Figure 1: Model of multiple lifeline systems

In some cases, stakeholders of different characteristics have to be distinguished in greater detail.
Since people of different characteristics will have different senses of value, the same system in the
same situation may have different value for them. This issue was demonstrated by a trial evaluation
of the resilience triangle of lifelines after the Great East Japan Earthquake using the Maslow
hierarchical model of human needs and the persona method (Furuta, 2014). In this trial, the
resilience triangle was evaluated for three personas of different characteristics living at the same
location and it was shown that the satisfaction levels of physiological, safety, and social needs differ.
This is because, for example, recovery of healthcare service is more critical for physiological needs of
an elder person with a health problem than a young person of a working age. On the other hand,
recovery of the public transportation is important for social (economic) needs of a young person
who is commuting to his/her working place.

This issue may cause conflicts of interest between different stakeholders and become a downside of
resilience. Consensus should therefore be formed by compromising the conflicting interests, though
this would not be a trivial process. Since it is not an issue just with resilience but also with the risk-
based approach, we need some effective method for fair as well as rational social decision-making.

Resilience analysis of critical infrastructure in Tokyo

We have developed a simulation system for resilience analysis of urban critical infrastructure based
on the comprehensive framework shown in Figure 1. The lifeline, service, and civic life subsystem are
represented as interdependent coupled networks (Buldyrev, et al., 2010) and agent-based models.

The recovery plan of damaged lifelines can be optimized by the genetic algorithm (GA) by minimizing
the resilience triangle of the hybrid objective function already explained. We have also developed a
model of critical infrastructure in the central 23-ward area of Tokyo with a 30x30 square grid (Kanno,
Yoshida, Koike, & Furuta, 2018).

Resilience of urban critical infrastructure is evaluated as recovery curves of lifeline, service, and civic
life subsystem obtained by the simulation. An example of an analysis result for a scenario of a Tokyo
metropolitan epicentral earthquake is shown in Figure 2, where the recovery level of the lifeline,
service, and civic life subsystem are shown in colour maps along the timeline of days after the event.
The damage level of lifeline just after the earthquake depends heavily on the location of the
epicentre and the predicted seismic intensity. It is suggested from the result that recovery of the
downtown area, where the headquarter functions of the government and principal industries are
concentrated, is prioritized so that the recovery plan can be optimized.

The proposed analysis method was useful for predicting the time- and space-dependent response of
urban critical infrastructure after disaster and for evaluating its resilience. This analysis then can
provide us with valuable insights for making proposals for improving the emergency response policy
of both public and private organizations. The operation companies of the lifeline facilities can, for
instance, identify bottlenecks in the lifeline subsystem and eliminate them by redesigning the lifeline
facilities. The national and local governments can improve their disaster response plans such as the
location of emergency supply bases.

Since the proposed model considers not only the lifeline subsystem but also the service and civic life
subsystem, the analysis will also be useful for urban planning, so that the critical urban
infrastructure, which is a complex system of systems, can be made resilient against threats of
various types and adaptive under environmental and social transitions in the long term.

Figure 2: Resilience map of the 23-ward area after Tokyo metropolitan epicentral earthquake
Robustness and reconfigurability – Key concepts to build resilienceHeinimannRobustness and Reconfigurability – Key Concepts to Build Resilience

Hans Rudolf Heinimanni*

i Future Resilient Systems, Singapore-ETH Centre, Singapore

Suggested citation: Heinimann, H. R. (2018). Robustness and reconfigurability – Key concepts to build
resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains
of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center.
Available on and

Keywords: Robustness, reconfigurability, resilience, organisational mindfulness

*Corresponding author:


Urbanization is an aggregation process that fosters the emergence of urban clusters where much of
the world population resides, and where the magnitude of human activities prevails. Several
phenomena characterise this process (Heinimann & Hartfield, 2017), in particular (1) the
continuously increasing density of infrastructure assets per unit of area, (2) the flows of goods,
services, information and people, borne by layered infrastructure networks that are enabling a
different type of flows continue to expand dramatically, and (3) cities of today represent a nascent
skeleton of cybernetic organism (cyborg) entities that constitute an interdependent mosaic of
advanced infrastructure systems, enabling technologies, green spaces and social systems.
Additionally, “smart technology” policies, such as “smart cities”, “smart nation” emerged, adding
cyber-components to our physical infrastructure, which will amplify the cyborg trend significantly. A
considerable amount of human design and development activities is still relying on certainty
assumptions, while risk management – emerging in the 1950s to cope with large-scale impacts
technologies in case of failure – introduced a systematic approach to cope with uncertainties. The
above trends result in higher levels of complexity, which is going along with emergent behaviour and
ambiguous or even unexpected behaviour that we are not able to explain with historical data.
Resilience management is extending risk management to cope with ambiguous, unexpected events.

This development trend is facing some fundamental challenges. First, expected damages due to
disruptions will increase because the value at risk has grown. Second, climate change is changing the
uncertainties of environmental states, which will undermine the very assumptions used to design
existing interdependent engineering systems. Third, the coupling strength between and within the
infrastructure, organisational and user systems continues to grow and may result in regime shifts
that foster system disruptions that were never experienced before and that cannot be explained
with observational data of the past.

Risk management developed methods and tools to assess and manage portfolios of uncertain events
(Keller & Modarres, 2005). The underlying assumption is that the process of generating those
uncertain events is staying the same in time and that it is possible to characterise both frequency
and consequence with the methods of extreme value statistics. Complex systems might demonstrate
emerging behaviour and disruptions, which means that the process that this is generating those

events is changing in time, which makes the methods of risk management questionable. This calls for
a new approach, which is focusing on robustness and resilience. Robustness refers to design
characteristics of the system, aiming to provide reliable performance for a set of requirements,
despite changes in the environment or within the systems after the system has entered service; it is
a strategy to bring uncertainty and ambiguity into the design process. Resilience refers to the:

biophysical capacity of a system to resist within acceptable limits of degradation, to
re-stabilising is crucial functions, to rebuild functionality up to a sufficient level of
performance, and to reconfigure its flows of services and the underlying physical
structures. This biophysical capacity is coupled with the cognitive ability to perceive
the state of the system and its environment, to understand its significance and
meaning, to retrieve purposeful courses of actions, to release the most meaningful
action and to learn and to adapt (adapted from Heinimann & Hatfield, 2017).

The purpose of this contribution is to provide a framework for how resilience-based management
augments traditional risk-based management approaches, and to discuss strategies how to build
resilience. It explores first the essence of ambiguous and unexpected system states, triggered by
complexity properties, which is the primary rationale why there is a need for resilience-based
management. It then explores three strategies that have the potential to build resilience effectively.

Beyond risk management – Coping with complexity

The quality of available knowledge of infrastructure system behaviour under different endogenous
and exogenous conditions is the crucial issue (Figure 1, x-axis). Many engineering approaches, for
example those identifying optimal solutions with mathematical methods, rely on certainty
assumptions; that is, they assume complete knowledge of the system and the environment. The
introduction of uncertainty enables the relaxation of those assumptions with expectation values,
which are the product of probability times some metrics of consequences. Probabilistic risk analysis,
which is the backbone of risk management since the 1950s is a stream of thinking, which still
represents the state-of-the-art (Keller & Modarres, 2005). Further relaxation of what is known is
engendered in the concept of ambiguity (Renn & Klinke, 2004), which assumes that there are
observations on some phenomena, which proffer several legitimate interpretations of meaning. In
air traffic control, ambiguity is termed as "weak signals", and most often, there is no finite
interpretation of meaning. There is yet another level of system knowledge, which is characterised by
"unexpected" or "unknown". The "dragon king" concept (Sornette, 2009) assumes – and successfully
demonstrates – that there are options to anticipate or predict "unknown events" if we have real-
time information about the system behaviour with an adequate time granularity (Sornette & Ouillon,

Figure 1: The influence of knowledge domains and a new design and management paradigm on risk.
Adapted from (MURRAY et al., 2013).

The y-axis of figure 1 presents the expected adverse consequences for the different categories of
knowledge and different management strategies for a system. Up to the 1950s, approaches to
design and manage infrastructure systems were based on certainty assumptions. With the
emergence of probabilistic risk analysis in the 1950s (Keller & Modarres, 2005), risk management
approaches – aiming to eliminate or prevent unacceptable risks – improved the overall safety and
security of our systems tremendously. Today’s constructed infrastructure systems are more complex
and highly connected; these changes have pushed a significant fraction of urban infrastructure
systems into the "ambiguous" and "unexpected" knowledge domains, and in turn increased the risk
of adverse and ill-defined consequences (upper line, figure 1). Ambiguous and lacking knowledge
about a system means that communities, engineers, and governments have to cope with invalid
assumptions (Day et al, 2015), either due to unexpected changes in the environment or due to
emerging and unforeseen behaviours in critical infrastructure systems (Haimes et al., 2008).
Communities must acquire the capacity to ensure infrastructure systems continue to provide critical
services and support essential function whenever and wherever invalid assumptions reside (Day et
al, 2015). The capacity of a system to cope with invalid assumptions is the hallmark of a resilient
system, which unfortunately does not appear in most resilience definitions.

Ambiguous or unexpected phenomena that are emerging have their roots in complexity. Complexity
comprises phenomena, which emerge from a collection of interaction objects, and the purpose of
complexity science is to understand, predict and control such emergent phenomena (Johnson,
2011). It is remarkable that such emerging phenomena arise without the presence of any central
controller or coordinator. There are key properties of the system that are required for emergent
behaviour (Johnson, 2011): (1) many interacting objects or "agents", (2) memory or "feedback" is
affecting the objects' behaviour, (3) objects can adapt their strategies, and (4) the system is "open",
which means its interaction with the environment matters. This perspective raises the question in
which systems there are properties of complexity. Human factors, in general, are the first source of
complexity. Considering that large-scale infrastructure systems are a compound of engineered,
organisational and user subsystems yields that all large-scale infrastructure systems are complex and
prone to ambiguous and unexpected behaviour, which calls for resilience management. Cyber
components are a second source of complexity. The "smart" trend augments many of our
infrastructure systems with semi-automatic or automatic control systems, consisting of sensors,

controllers and actuators, which together provide feedback, are adaptive and interacting with the
environment. The ongoing digitisation is amplifying human adaptability and the spread of cyber-
physical-systems (Lee, 2015), which together will increase ambiguous and unexpected system

Policymakers and practitioners are facing the issue of whether risk management is still a useful
approach or whether resilience management should augment it. Risk management is always an
appropriate methodology in domains in which adaptive system components are of minor
significance, which is right for "mechanistic" processes, such as some natural hazards. Fields in which
human factors have been dominating, such as geopolitical, social and financial hazards are calling for
a resilience-based management approach. As mentioned above, digitalisation has been amplifying
effect on the adaptive behaviour of humans, which will make this request even more critical.
Domains in which cyber-physical systems or cyber-physical-human systems are dominating are
requesting a resilience-based management approach, too.

Strategies to build resilience

In the introduction, we defined resilience in terms of generic system functions, consisting of four
biophysical functions: (1) resist within acceptable limits of degradation, (2) restabilize the crucial
functions, (3) rebuild functionality up to a sufficient level, and (4) reconfigure flows of services and
the enabling physical structures. These biological and physical capabilities are coupled with five
cognitive functions: (5) perceive the state of the system and its environment, (6) understand its
significance and meaning, (7) retrieve purposeful courses of actions, (8) release the most meaningful
action, and (9) learn and adapt. Each of those nine functions contributes to resilience, which
represents a multi-objective optimisation problem with an efficiency frontier (Pareto frontier), at
which no single function can be improved without decreasing the performance of at least one of the
other eight functions. Unfortunately, we do not understand the trade-space yet. We hypothesise
that three functions have a considerable leverage effect: resist within acceptable limits of
degradation (robustness), reconfigurability, and understanding the significance of the system state
and its environment (sense-making).

Robustness is a pre-event strategy to identify system designs that perform well when facing
variations in conditions of use, with time and use, and in production and manufacturing, whereas
variations mean deviations from design assumptions (Saleh et al., 2003). Robust optimisation proved
to be useful to identify optimal courses of action for the protection and the extension of large
infrastructure systems (Caunhye & Cardin, 2017; Costa et al., 2018; Rahmat et al., 2017). However, it
has not been widely used by policymakers and practitioners.

Reconfigurability is a post-event strategy to repeatedly change and rearrange the components of a
system cost-effectively, thus attaining different states with new or modified capabilities, over time
(Setchi & Lagos, 2004). The concept has its origin in reconfigurable computing of the 1960s,
appearing in reconfigurable robotics in the 1980s, and spreading to reconfigurable manufacturing
systems in the 1990s. To our knowledge, there is no significant research on reconfigurability of
infrastructure systems, which calls for a new research thrust to be developed. Of course, some of
the fundamental concepts, such as modularity, integrability, or convertibility seem to have
significant potential. Many resilience papers have been highlighting the role of adaptability, which –
in its narrow sense – means to move limit state thresholds without fundamental structural change.
Thus, this strategy is less effective than reconfigurability.

Mindfulness sense-making is a during-event organisational process, aiming to stay attentive to what
is going on in the present (mindfulness refers to staying in the present) and to create a meaningful
group-mental model that is useful to identify and to release useful courses of action (Weick et al.,
2008). For a long time, research in organisational behaviour has been focusing on decision-making,
thus neglecting what has to happen before, problem framing (Simon et al., 1986). It is problematic
and even misleading to map ambiguous and uncertain events to predefined mindsets and
assumptions, which bears high risk to result in wrong assessments of the situation and ineffective
actions. Weick (1993) started his research on mindfulness with so-called "Mann Gulch Forest Fire",
in which 13 firefighters lost their lives due to a wrong sense-making. Research is still at an early
stage, but it seems that organizational processes matter (Sutcliffe, 2018), in particular (1) staying
engaged with changing physical realities of the internal and external environments, (2)
communicating and coordinating, (3) meaning management, dealing with the meaning of people's
experiences, and (4) connection management to collectively bear the burden of adversity.

Previous considerations implicate that building resilience has a positive effect. The question is how
resilience affects the risks of a system of interest. Building robustness significantly reduces the
vulnerability of the system, and consequently, adverse events will result in lower consequences.
Modifying a system for reconfigurability reduces the rehabilitation efforts, which equals a reduction
in the cost of consequences. Overall, building resilience will result in a risk reduction (see resilience
gain in figure 1), which emphasises that resilience-based is augmenting risk-based management
strategies. Another question is if a transition of a system from a pre-event to a post-event state can
be actively managed. Managing disasters stems from organisational capacity and processes, which
means that there is some guiding idea how the rehabilitated system should look like that is driving
the disaster management activities. Experience yields that organisational capacities, processes and
culture have a significant effect how a society or societal group is managing a disruption cycle,
starting with a shock, going on to restabilization of critical functions, and ideally resulting in the
reconfiguration of the flow of essential services and their enabling physical structures.
Resilience of systems to individual risk and systemic riskHochrainer-Stigler, Boza, Colon, Poledna, Rovenskaya & DieckmannResilience of Systems to Individual Risk and Systemic Risk

Stefan Hochrainer-Stigleri, Gergely Bozai,ii, Célian Coloni,iii, Sebastian Polednai,iv, Elena Rovenskayai,v,
and Ulf Dieckmanni*

i International Institute for Applied Systems Analysis (IIASA), Laxenburg, Austria

ii Evolutionary Systems Research Group, MTA Centre for Ecological Research, Hungarian Academy of Sciences,
Tihany, Hungary

iii Laboratoire de Meteorologie Dynamique, Ecole Polytechnique, Palaiseau, France

iv Complexity Science Hub, Vienna, Austria

v Lomonosov Moscow State University, Faculty of Computational Mathematics and Cybernetics, Moscow,

Suggested citation: Hochrainer-Stigler, S., Boza, G., Colon, C., Poledna, S., Rovenskaya, E., & Dieckmann, U.
(2018). Resilience of systems to individual risk and systemic risk. In Trump, B. D., Florin, M.-V., & Linkov, I.
(Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected systems.
Lausanne, CH: EPFL International Risk Governance Center. Available on and

Keywords: Individual risk, systemic risk, diversification, transformation, integration

*Corresponding author:


The concept of resilience has a short but intense history and is now defined in as many ways as there
are corresponding schools of thought (e.g., Ilmola et al., 2013; Keating et al., 2014; Linkov et al.,
2016; Mochizuki et al., 2018). The popular understanding of resilience comes from engineering,
which traditionally referred to the resistance of a system to disturbance and to the speed at which
such a system returns to equilibrium (Davoudi, 2012). C.S. Holling, widely held to be the father of the
concept, defined resilience differently, focusing on the “persistence of systems and their ability to
absorb change and disturbance and still maintain the same relationships between populations or
state variables” (Holling, 1973, p. 14). For Holling, understanding this ability requires a careful
assessment of the dynamical interactions between a system’s components. Insufficiently resilient
systems are exposed to knock-outs, with perturbations potentially triggering large and lasting
system-wide collapses, a threat nowadays referred to as systemic risk. A distinguishing feature of
such risks is that they emerge from the complex interactions among individual elements or agents
and their associated individual risks; systemic risk is therefore also sometimes called network risk
(Helbing, 2013). In contrast, individual risk originates from single events that directly affect an agent,
in isolation from the rest of the system. It is often defined as the “effect of uncertainty on
objectives” (ISO, 2009), and is typically quantified by assessing the probability of an event and its
corresponding impacts (UNISDR, 2017).

While the realization of individual risks may lead to a disaster in part of a system, the realization of
systemic risks, by definition, leads to a breakdown—or at least a major dysfunction—of the system
as a whole (Kovacevic et al., 2015). This has major implications for strategies aiming at increasing
resilience. Modern societies typically manage individual risks through insurance (Geneva
Association, 2010) or, more generally, through diversification (Kunreuther, 1996; IPCC, 2012). While
moderate individual risks, such as car accidents, can be handled efficiently in this way, diversification

gets increasingly difficult for extreme risks (Kessler, 2014; Linnerooth-Bayer & Hochrainer-Stigler,
2015). For systemic risks, in contrast, fundamentally different approaches need to be applied, e.g.,
restructuring a network’s connectivity (Gao et al. 2016; Poledna & Thurner, 2016). Measures of
individual risk and of systemic risk are used not only to quantify risks, but also to identify strategies
aiming at increasing resilience. For the latter, an assessment of current resilience levels to absorb,
recover, and adapt to adverse events (National Research Council, 2012) is needed. This can focus on
different features of resilience (Linkov et al., 2016) including the critical functions of a system,
thresholds that if exceeded perpetuate a regime shift, the recovery time from degraded system
performance, and the possibility for adaptive management through the anticipation of emerging
risks or through learning from past events. Below, we discuss and compare some selected aspects of
the most prominent measures and strategies used today. This illustrates differences as well as
similarities, and thereby highlights options for developing a joint framework for increasing a
system’s resilience to both types of risks.

Measures of individual risk and systemic risk

Looking at a system’s elements separately, one can assess how they carry individual risks. The most
comprehensive quantification of such individual risks is the probability distribution of losses.
However, probability distributions are complex objects, so there is a need to capture their most
salient features using a minimal number of relevant characteristics. For frequent events, the
expected loss or the median loss may provide the most appropriate summary information. For
extreme events, on the other hand, tail measures such as the Value at Risk (VaR) or the Conditional
Value at Risk (CVaR; also called the expected shortfall) are more appropriate (Pflug & Römisch,
2007). Usually, these risk measures are used to determine risk-management options, e.g., when
setting up premium payments, determining the probability of ruin, or making cost-benefit analyses
of mitigation measures. In this way, probability distributions and their characteristics have a wide
area of application and play a prominent role in discourses about individual risks (Cardona et al.,

Systemic risk results from the interactions of individual risks, and, as any emerging phenomena,
cannot be measured by separately quantifying the contributing parts. Studies of systemic risk
typically construe systems as networks of interconnected elements and thereby focus attention on
the interdependencies among individual risks. In particular, systemic risks result from cascading
effects between the interconnected elements—which, in a network perspective, are often referred
to as nodes or agents. Recently suggested measures of systemic risk emphasize the role of the
structure of the entire network (e.g., Kharrazi et al., 2016) and the contributions of individual nodes
to systemic risk, including the dependence of these contributions on their positions in the network
(Poledna et al., 2015). In some systems, different types of perturbations can be studied through
controlled experiments: so-called pulse perturbations are applied only temporarily, whereas press
perturbations are imposed continuously (Dunne et al., 2002; Kondoh, 2003; Scheffer & Carpenter,
2003; Ives & Carpenter, 2007). Measures of systemic risk in such systems quantify a perturbation’s
full impact, such as the number of secondary species extinctions or biomass reductions resulting
from a primary species extinction or biomass reduction in an ecosystem. In other systems, only case
studies are possible, which may nevertheless help identify the mechanisms that cause systemic risks.
Using insights from such experiments and/or case studies, models can be built to quantify and
forecast systemic risks.

Financial systemic risk has become a focus of recent research, not only because of its immense
importance for society, but also because of the availability of high-precision and high-resolution data
and because financial systems are man-made, and thus—in principle—more amenable to
engineering than many natural systems. One of the most prominent systemic-risk measures in
financial network analyses today is the so-called DebtRank (Battiston et al., 2012). DebtRank
estimates the impact of one node, or group of nodes, on the others and is inspired by the notion of
centrality in a network. The centrality of a node takes into account the impact of the node’s distress
on other nodes in the network, with a high value indicating a more central location of the node.
Accordingly, DebtRank can be considered as a warning indicator for a node being too central to fail—
an important feature aggravating a node’s contribution to systemic risk, in addition to being too big
to fail (Poledna & Thurner, 2016). Other measures of systemic risk are also available, such as the
Systemic Expected Shortfall, which uses pre-defined thresholds—akin to Value at Risk—to quantify a
node’s anticipated contribution to a systemic crisis (Acharya et al., 2009).

Enhancing resilience by restructuring networks

As in the case of individual risks, measures of systemic risks have the potential to inform risk-
management strategies aiming at decreasing risk. Due to the increasing connectedness within
networks—e.g., financial networks—and across networks—e.g., financial systems interconnected
with supply chains—it is nowadays becoming more difficult to ensure that a portfolio is adequately
diversified, as hardly tractable pathways might connect events. Instead of looking for diversification
possibilities, a system’s resilience against systemic risk can therefore often more readily be improved
by modifying or transforming the topology of the underlying network toward safer configurations.

How a network’s structural diversity can enhance its stability has long been analysed in ecology (e.g.,
May, 1973; Pimm & Lawton, 1978). While this so-called diversity-stability debate has led to fruitful
distinctions among conclusions holding for different measures of diversity and for different
measures of stability, no generally applicable simple results have been found regarding the impact of
diversification on resilience (Tilman & Downing, 1996; McCann, 2000). This is because of several
reasons. First, diversification may not only enable risk sharing and facilitate post-failure recovery,
but can also multiply the number of pathways through which risks propagate (Gai & Kapadia, 2010;
Haldane & May, 2011; Allen et al., 2012; Battiston et al., 2012; Amini et al., 2016). Second, increasing
modularity—the degree to which the nodes of a system can be decoupled into relatively discrete
components—may decrease risks for most parts of the system, potentially at the expense of
impeding resilience for the system as a whole (May et al., 2008). Third, resilience and efficiency, e.g.,
of road systems, may not go hand in hand (Hochrainer-Stigler & Pflug, 2009; Ganin et al., 2017,
2018). Such trade-offs—e.g., between modular risk and systemic risk or between resilience and
efficiency—are implying social dilemmas and creating leverage for moral hazard, as the
constituencies bearing the costs or receiving the benefits of tipping trade-offs in either direction
typically differ. For example, companies maintaining utility or transportation grids are tempted to
make them more efficient to save costs and increase their profits, even when this decreases the
networks’ resilience—potentially at great expense to the citizenry depending on them. Fourth,
strategies to build resilience must take care to avoid so-called erosive strategies that lead to
medium- and long-term negative impacts on development and well-being (Keating et al., 2014), e.g.,
by the short-term over-exploitation of natural resources (Heltberg et al., 2012). Fifth, so-called levee
effects, through which increased safety is leading to much larger losses in case of risk realization

need to be accounted for, as exemplified by the case of New Orleans after Hurricane Katrina (Kates,
et al. 2006).

Hence, instead of one-size-fits-all rules of thumb, the reshaping of a network’s topology is therefore
best based on examining the specific contribution of each node to systemic risk (e.g., Gephart et al.,
2016; Colon et al., submitted). With this approach, managers try to identify those nodes that are too
big to fail, too interconnected to fail, and the so-called keystone nodes, which in times of failure
cause large secondary effects or lead to a network’s complete breakdown (Paine, 1969; see also the
critical comments on the latter concept by Mills et al., 1993). Restructuring a network can then be
enabled by acting on those nodes. For example, Poledna & Thurner (2016) propose a risk measure
based on DebtRank that quantifies the marginal contribution of individual liabilities in financial
networks to the overall systemic risk. They then use this measure to introduce an incentive for
reducing systemic risks through taxes, which they show can lead to the full elimination of systemic
risks in the considered systems. The resultant proposal of a systemic-risk tax is a very concrete
measure that can increase individual and systemic resilience (e.g., Adrian & Brunnermeier, 2008;
Cooley et al., 2009; Roukny, et al., 2013). In other cases, more broadly-based governance
approaches may be necessary (Linkov et al., 2016), which in turn might require changes in human
behaviour or cultural norms (as highlighted, e.g., through the current ‘loss and damage’ debate in
the climate-change community; Mechler et al., 2018).

Integrative management of individual and systemic risk

Before proceeding to the management of systemic risks (Cooley et al., 2009), one needs to be able
to measure and model them appropriately. Here we have outlined how increasing a system’s
resilience through the assessment and management of risks differs between individual risks and
systemic risks. For individual risks, market-based instruments exist, including insurance and
diversification strategies using the law of large numbers, whereas for systemic risk, transformational
approaches need to be developed and applied, assessing the contributions of nodes to systemic risk
and restructuring networks to reduce these contributions.

Ideally, individual and systemic risks should not be treated in isolation, but in a holistic manner. This
challenge has become even more pertinent through experiences showing how individual risks
resulting from extreme events can trigger systemic risks (e.g., Massaro et al., 2018). A case in point is
the 2011 Thailand flooding and its worldwide consequences (Chongvilaivan, 2012; Haraguchi & Lall,
2015), which has demonstrated the magnitude of potential knock-on effects and inspired the notion
of global systemic risk (Centeno et al., 2015). Another example is the self-immolation of Mohammad
Bouazazi in Tunisia in December 2010, which started the Arab Spring and caused large-scale
consequences as well (Pollack et al., 2011). Indeed, individual risk and systemic risk can be seen as
representing two ends of a continuum: with individual risk describing how an event changes a single
network node and systemic risk describing the propensity for cascading failures triggered by such
events across network nodes, the continuum is spanned by the affected proportion of nodes, with
larger proportions characterizing risks at the more systemic end of the spectrum. On this basis, new
mathematical methods are currently being developed for integrating measures and models of
individual risk and systemic risk, such as the copula method (Hochrainer-Stigler et al., 2018). In
addition, a major and yet unaddressed challenge is how to integrate the technical approaches
rooted in natural science, which we have outlined here, with innovative governance approaches
rooted in social science, which are crucial to build resilience in the face of systemic risks.


The authors would like to express their gratitude to Åke Brännström, Joanne Linnerooth-Bayer,
Georg Pflug, and Stefan Thurner for the inspiring discussions to which these colleagues have
contributed in the context of the crosscutting project ‘Systemic Risk and Network Dynamics’ at the
International Institute for Applied Systems Analysis (IIASA).
Technological surprise and resilience in military systemsKottTechnological Surprise and Resilience in Military Systems

Alexander Kotti*

i U.S. Army Research Laboratory, Adelphi, Maryland, USA

Suggested citation: Kott, A. (2018). Technological surprise and resilience in military systems. In Trump, B. D.,
Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex
interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available
on and

Keywords: Resilience, organizational recovery, technological surprise, mission impact

*Corresponding author:


This paper focuses on ways to build resilience and benefit from it when an unexpected adverse
event occur. The specific interest is in approaches – preferably supported by historical evidence of
success – that can help an organization overcome a significant negative impact on its ability to
continue its mission.

To make the discussion more concrete, the paper focuses on a particular class of detrimental events
– technological surprises in warfare. A technological surprise in warfare often unfolds as follows.
One of the sides in an armed conflict (let’s call that side Red) introduces a weapon system that the
other side (let’s call it Blue) did not expect to see on the battlefield. The new weapon may drastically
reduce the ability of Blue to fight Red. As a result, Blue may experience significant losses in
personnel, equipment, territory, etc. If Blue is sufficiently resilient, after a period of time it develops
countermeasures – often a combination of new tactics and new technical means – that negate the
effect of the new weapon, and restore the initial ratio of capabilities between Red and Blue. Two
commonly used examples are (1) in the summer of 1941, the introduction of the Soviet T-34 tank
which was nearly invulnerable to the German tanks of the time, and served as unwelcome surprise
to the Germans; and (2) also in 1941, the use of the German powerful 88 mm Flak gun against the
unprepared British tanks in North Africa. (Finkel & Tlamim, 2011)

Following the above description, and for the purposes of this paper, let’s define resilience as the
ability of a military organization to (a) avoid complete destruction in face of a technological surprise,
and then to (b) recover and return to effective performance against the adversary. This definition is
consistent with how resilience is defined by the National Academies of Science (2012) and Executive
Orders by both the Obama (The White House, 2013) and Trump Administrations.

For study of resilience, technological surprises are particularly convenient cases: the cause (e.g., a
new weapon), the effects (the handicap and the losses), and the resiliency-restoring actions
(countermeasures) are usually clearly understood, well documented, and often even quantifiable.

For many countries, technological surprise is becoming a growing concern as technology and science
are spreading ever broader across the globe. While generally, this is a highly welcome phenomenon,

the proliferation of knowledge about building sophisticated weapons continues to increase the
number of states and non-state actors that could spring a technological surprise at a given country.

The limits of risk-based approaches

By their very nature, technological surprises are hardly amenable to risk-management approaches.
Risk-based approaches require identification of threat, vulnerability and consequences. The space of
modern technologies is so broad and diverse that Red has almost unlimited opportunities to select a
particular research and development direction, and to build a novel effective weapon system. If
Blue’s intelligence services fail to detect the development (a common occurrence), Blue has no way
to know the nature of the new Red weapon, and cannot pursue any meaningful risk-mitigation
strategies that could help against the future encounter with the yet-unknown weapon.

In theory, Blue might try to undertake a very broad portfolio of R&D programs in order to investigate
the capabilities and the countermeasures against all likely future Red weapons. In practice, such an
exhaustive exploration and mitigation is unaffordable even for the wealthiest countries.

Therefore, resilience-based approaches are likely to be less costly than risk-based approaches.
Instead of (or perhaps in addition to) investing in a very broad (and very expensive) range of
mitigation mechanisms against an infinitely large spectrum of possible technological surprises, the
country may prefer to invest in skills and assets that would enable resilient responses to an
inevitable technological surprise. Although such investments are substantial, they are most likely to
be significantly smaller that potentially unlimited spending on avoiding all possible risks.

The limits of resilience-based approaches

Although potentially cost-effective, a resilience-based approach comes with its own set of

First, it does require significant investments. In order to be resilient to a technological surprise, a
military organization must invest in developing skills and competencies of its personnel and leaders.
It requires investments in expensive training and exercises. It requires investments in assets that are
suitable for resilient responses, and in additional, redundant assets that would be used when the
primary assets are destroyed or degraded by the adversary. And, all these investments have to be
made in addition to investments into more conventional assets and personnel, which are intended
for purposes other than resilience.

Second, as mentioned in the introduction, when faced with a technological surprise imposed by Red,
Blue may experience significant losses in personnel, equipment, territory, etc. The resilience of Blue
might reduce and contain the extent of such losses, but would not eliminate them entirely.

Finally, and perhaps most perniciously, improving the resilience of a military organization creates a
temptation to neglect other preparations for facing the risk of a technological surprise. Similarly, a
temptation may exist to remain complacent with an existing collection or technologies or the level of
personnel skills. Faced with tight budgets, a decision-maker might be inclined to argue that certain
upfront investments in material and personnel for reducing the risk of a surprise are unnecessary
because “we will face a technological surprise anyways, and then we will have to improvise some
resilient responses, so why do we need to invest in any new weapons at this time?”

Effective resilience in historical examples

Historical experiences with successful adaptations to technological surprises suggest several key
elements common to such successes. The following steps (not necessarily sequential, but often
taken in parallel) are commonly observed when a military organization (let’s call them Blue)
successfully – or partly successfully – recovers from a technological surprise.

First, Blue recognizes rapidly that its operation is degraded by a technological surprise, e.g., by a
novel Red weapon system. Then, Blue takes agile actions in order to minimize the immediate impact
of the surprising threat on Blue’s current operations. This usually requires Blue to accept a degree of
further deterioration in performance of the Blue organization. One approach is for Blue to isolate
itself from the Red threat, e.g., by creating a distance between Blue and the threat, or retreating to
well protect positions. For instance, in the battle of Kasserine Pass (February 1943, Tunisia), having
been surprised by the effectiveness of German forces, the US Army and its allies retreated to
defensive positions in order to minimize the impact of the German forces, to regroup and await
reinforcements (Finkel & Tlamim, 2011, p. 271)

While holding off Red, Blue works rapidly to identify weaknesses and vulnerabilities of Red’s novel
technology. This often involves the need to rapidly perform a forensic analysis of the known
engagements with the threat, and to hypothesize, design and execute a series of experiments. These
often happen organically, as various subunits of the Blue force try a variety of desperate
expediencies to fight back against the Red threat. For instance, in 1943, surprised by the German
acoustic torpedo against Allied ships, the British engineers rapidly improved a device that was towed
behind the ships and caused the torpedo to explode harmlessly (Handel, 1987). Similarly, in October
1973, when the Israeli air force was surprised by the new Syrian SA-6 anti-aircraft missiles, a scientist
at the Rafael Corporation rapidly developed a way for the Israeli planes to jam the radars of the
missile batteries. (Finkel & Tlamim, 2011, p. 175)

When the Blue force identifies a vulnerability or weakness of the Red technology, it proceeds to
converge on a small set of tactics and techniques that seem to be effective against Red. If feasible,
Blue may also develop and implement technical counter-measures against the Red surprise
technology. Blue rapidly disseminates instructions for executing these tactics or applying technical
countermeasures to all relevant sub-units; obtains additional equipment and performs training as
needed. For instance, in the battle of Kasserine Pass, the US and Allied Forces recognized that the
German forces would be vulnerable to artillery, and reinforced themselves with experienced artillery
units. (Finkel & Tlamim 2011, p. 271)

Finally, the Blue force aggressively and decisively applies the new tactical or technical counter-
measures, in conjunctions with any other effects available, against the Red force. This may defeat
the Red threat, may reduce or eliminate its efficacy, and may enable the Blue organization to return
to near-normal level of performance in its operations.

Desired organizational characteristics

Not every organization is capable of successful execution of approaches described in the preceding
section. Let’s consider – again, based largely on historical examples -- some of the key characteristics
that help an organization to succeed in resilient adaptations to technological surprise.

A particularly widely recognized characteristics of such nature is flexibility: the ability of the
organization to change its organizational structure, techniques, procedures, and other forms of its

operation, even if such changes are drastic and contradict established norms and past experiences.
For instance, although in 1941 in North Africa the British possessed excellent anti-aircraft guns, the
inflexible regimental culture prevented them from using the guns against the German tanks.
(Handel, 1987)

Another important characteristic is agility: the organization must be able to perform its actions
rapidly and to eliminate any barriers that may cause a delay in decision or execution. This often
requires the culture of delegating the authority to the lowest echelon of the organization and
encouraging initiative of even the most junior members of the organization. For instance, when in
1986 the Afghan guerrillas started to use Stinger missiles (a technological surprise) against Soviet
helicopters, the lack of independent initiative and creativity among the Soviet junior officers was a
significant factor in slow (about 18 months) adaptation of the Soviets forces. (Miller, 2014)

Both agility and flexibility must be supported by effective intelligence: the ability of the organization
to obtain, analyse and disseminate intelligence about the technological surprise – e.g., the novel
weapon system and its effect of the organization’s operations and assets, or a new tactical or
strategic context – completely and efficiently, in spite of the stress and disruption caused by the
threat. For instance, when in 1941 the Germans used their 88 mm gun against British tanks, the
British failed to collect sufficient intelligence about the events, and remained unaware of the
German weapon for several months after its initial use in a battle. (Handel, 1987)

Last but not least breadth and diversity are vitally important: the organization should combine a
diverse set of technical and cultural competencies, as well as assets that are capable of a variety of
functions under different conditions. This is necessary in order to re-orient an organization
effectively against the technological surprise and to combine the competencies and capabilities in
novel ways. For instance, when facing Egyptian anti-tank Sagger missiles – a technological surprise –
the Israeli homogenous tank units were unable to adapt until they were belatedly diversified with
infantry and artillery. (Miller, 2014)


Analysis of technological surprises in warfare – particularly the study of historical cases of such
surprises – is uniquely valuable for identifying the advantages and limitations of resilience-based
approaches, the approaches to conducting resilient activities after an unwelcome surprise, and the
characteristics that an organization must foster for the sake of improving its resilience.

Historical experiences offer insights into several key elements – typical activities and ways of
executing them – that are common to successful adaptations to technological surprises. However, to
build capabilities for effective execution of such activities, an organization must develop several
critical characteristics. These include flexibility, agility, effective use of intelligence, and breadth and

While resilience-based approaches are likely to be less costly and more practical than risk-based
approaches, leaders of an organization must recognize that improving the resilience of an
organization must not lead to neglecting appropriate measures for reducing the risk of a hazardous
Mindfulness and the risk-resilience trade-off in organizationsKudesia & RebMindfulness and the Risk-Resilience Trade-off in Organizations

Ravi S. Kudesiai,iii* and Jochen Rebii,iii

i Fox School of Business, Temple University

ii Lee Kong Chian School of Business, Singapore Management University

iii Future Resilient Systems, Singapore-ETH Centre

Suggested citation: Kudesia, R. S., & Reb, J. (2018). Mindfulness and the risk-resilience trade-off in
organizations. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2):
Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance
Center. Available on and

Keywords: Risk, resilience, mindfulness, organization, theory

*Corresponding author:

Through this chapter, we seek to contribute to ongoing discussion about risk, resilience, and how
they can be jointly managed (see Linkov, Trump, & Keisler, 2018), particularly in the context of
organizations. We start by reviewing the traditional image of organizations. In this traditional image,
processes related to risk and resilience are seen as complementary, as these processes pertain to
distinct aspects of the organizational environment. We then complicate this theoretical image by
introducing five underappreciated ways that risk and resilience processes may not be
complementary in practice—because the aspects of the environment to which these processes
pertain cannot always be easily distinguished and because enacting either of these processes can
produce tradeoffs that constrain the other. We conclude by suggesting three principles rooted in
mindfulness to help organizations manage these risk-resilience tradeoffs. In so doing, we hope to
offer an updated image of organizations. This updated image may enrich discussions about risk and
resilience within communities of theorists and practitioners alike—as well as across them.

Why risk and resilience appear complementary

The traditional image of organizations is one in which risk and resilience imply complementary
processes. Risk-related processes help organizations select among actions by predicting how the
actions will affect their environment, whereas resilience processes help organizations adjust actions
when the outcomes of action are uncertain and environments prove unpredictable. The implications
of this image are straightforward: organizations should resolve uncertainty into risk by increasing
information processing and then increase resilience for residual uncertainty through organization
design and social interactions. Both implications are elaborated below.

Resolving uncertainty into risk by increasing information processing

Uncertainty describes situations in which actions lead to potential outcomes with unknown
probabilities, whereas risk describes situations in which the probability distributions of actions are
objective and are quantitatively known (Luce & Raiffa, 1957). Organizations can resolve uncertainty
into risk by increasing their information processing (see Frame, 2003). For instance, an organization
may need to decide on production rates, knowing that faster production rates increase the number
of product defects. Increasing information processing can resolve the uncertainty of this decision by
objectively quantifying the relevant costs and benefits. Historical sales data from firm and industry

sources can help quantify the additional demand that could be met by increased production, legal
precedent can be used to estimate the costs associated with the sale of defective products, and
industry benchmarks can better delimit the acceptable range of defects-per-million.

By increasing the information processing used to decide on its production rates, the organization
resolved uncertainty into risk. As a result, the organization can use sophisticated quantitative tools
like Monte Carlo simulations to make predictions and enact risk management strategies such as risk
mitigation (e.g., preventive maintenance on machinery) or risk transfer (e.g., insuring against costs
of defective products). Once risk management strategies are used, the information processing
requirements for action diminish. Having predicted and planned for future outcomes, the selected
action can theoretically be executed in the present with less need for active information processing.
For instance, top managers must actively process a large amount of information to select the new
production rate, but the unit charged with executing this new production rate on the front-lines
need not process any of the information the managers used in selecting the new production rate.
They only need to know the new production rate in order to execute. Thus, a temporal separation
emerges between planning and execution in this traditional image—whereby planning is deliberative
and demands intensive upfront information processing and the subsequent execution is more
automatic and less intensive in its information processing.

Yet, there will always be some residual uncertainty that organizations cannot resolve into risk, as not
every aspect of the environment is predictable. For instance, the outcomes of setting production
rates in a manufacturing unit are more readily quantifiable than are the outcomes of entering a new
market in a strategy unit or developing a new product line in an R&D unit. Thus, different units in
organizations will face different levels of residual uncertainty (see Tushman & Nadler, 1978).
Organizations are typically designed such that most uncertainty resides atop the hierarchy, where
top management teams develop plans to cope with wicked strategic problems, and less uncertainty
resides near the bottom of the hierarchy, where plans are executed on the front-lines (March &
Simon, 1958). Thus, there is also a spatial separation between planning and execution—as planning
and execution processes are typically enacted by different units that are situated at different
locations in the organizational hierarchy.

In sum, this traditional image of organizations therefore presumes both temporal and spatial
separation between planning and execution, where planning occurs atop the hierarchy prior to its
execution on the front-lines and requires more active information processing than execution does.
As a result, this image portrays top management units in the hierarchy as mostly enabling resilience
in organizations because they handle the unexpected outcomes of planned actions and the
unpredictable aspects of the environment. Namely, to the extent that the outcomes of actions can
be rendered predictable by increased information processing, as in the case of risk, top management
units plan the actions and distribute the execution of these plans down the hierarchy to units on the
front-lines. To the extent that these plans produce unexpected outcomes, the front-lines are
presumed to make upward demands for guidance from top management. And, in this image, top
management also handles the residual uncertainty in the environment that cannot be adequately
planned for and distributed down the hierarchy.

Increasing resilience for residual uncertainty by organizational design and social interactions

Because the traditional image of organizations presumes a spatial and temporal separation between
planning and execution, it links resilience with an increased information processing capacity of top
management units, as these units should face the most residual uncertainty. The information
processing capacity of top management units can be increased by organizational design and by the
quality of social interactions among unit members. Organization design can protect the information
processing capacity of top management units by limiting upward demands posed by those executing
plans in the hierarchy below (see Galbraith, 1973). For instance, units at the bottom of the hierarchy
can be given greater slack resources (e.g., increased budgets, decreased time pressure for
production). Units can also be designed in ways that decrease their dependence on other units (e.g.,
using cross-functional teams so all needed expertise resides in-unit, granting more autonomy to the
unit, reducing resources it shares with other units). Organizational design can further reduce upward
demands by improving lateral relations across units at the bottom of the hierarchy (e.g., liaison roles
can solve problems between units and share best practices). And when upward demands are
necessary, information technology can make demands more efficient, reducing the time and effort
required of managers.

Information processing, however, is not a purely individual activity, but a collective one. A unit’s
capacity for information processing thus depends on the quality of its social interactions. In
particular, increased information processing capacity is associated with social interactions that occur
frequently because members work proximally, participate equally in decision-making, and trust each
other—as well as through interactions that are guided, but not governed, by established rules and
roles (Bigley & Roberts, 2001; Okhuysen & Bechky, 2009; Tushman & Nadler, 1978). Five social
interaction patterns in particular characterize units with high information processing capacity: unit
members often raise and openly discuss potential problems before the problems escalate into crises,
communicate enough to ensure all members have a good mental “map” of ongoing operations, seek
to question operational assumptions and received wisdom, rather than to confirm them—and, when
crises do arise, they listen to the members with expertise rather than the members with formal
power and they do their best to utilize and update their existing expertise by improvising solutions
to the crisis (see Weick, Sutcliffe, & Obstfeld, 1999).

When risk and resilience processes produce tradeoffs

This traditional image of risk management and resilience as complementary processes in
organizations, however, belies important tradeoffs, which we now introduce and explore.

When risk erodes resilience

Risk and resilience processes are appropriate for rather different aspects of the environment. But it
is not clear that managers can reliably differentiate between these aspects. Organizations tend to
romanticize the quantitative (Feldman & March, 1981), in part because investors, regulators,
customers, and business partners expect them to act according to rationality norms. Although
organizations can maintain the mere façade of rationality to satisfy their external stakeholders
(Abrahamson & Baumard, 2008), in many cases, the rationality norm prevails internally within
organizations as well. And when a rationality norm prevails internally, organizations may misapply
sophisticated quantitative risk management tools on non-quantifiable or computationally intractable
problems that are better suited for resilience processes (Artinger, Petersen, Gigerenzer, & Weibler,

2015). Risk management tools can enable more intricate plans held with greater confidence than the
data support. Misapplying these tools can therefore set organizations up for nasty surprises for
three reasons.

First, misapplied risk management separates planning from execution both temporally and spatially.
Adjustments to plans are thus subject to time delays (in how often those on the front-lines inform
those atop the hierarchy of issues) and reporting biases (in that near-misses or non-events are
unlikely to ever be reported). Such time delays and reporting biases limit the efficacy of managerial
action. Second, misapplied risk management disempowers those on the front-lines because risk and
resilience entail different logics of employee action. Namely, when front-line employees enact
resilience processes, they readily apply their direct access to information (from customers,
operations, suppliers, etc.) toward strategic priorities (Vogus & Rerup, 2018). Such a logic of action is
difficult to cultivate with risk-related processes, where front-line employees are disempowered to
adjust plans because of the separation between planning and execution. Thus, misapplying risk
management in situations where resilience is more appropriate foregoes a logic of action where
front-line employees adjust plans based on their privileged access to direct information. Third,
having limited the efficacy of managerial action and disempowered front-line employees, the
organization is left incapable of coping with eventual surprises. Coping with surprises can require an
extraordinary willingness to examine flawed model assumptions, to avoid the blame game, and to
transparently bring forward all relevant information (Argyris, 1990)—including across units that may
have previously been operating in silos (see Dunbar & Garud, 2009). But without having actively
developed these virtues during good times, the organization is unlikely to somehow do so during
crisis. In this way, risk management can erode resilience processes.

When resilience Increases risk

Conversely, resilience processes can increase risk in two ways. First, resilience can be treated as an
outcome (“100 days since an accident”), rather than a process that emerges from the everyday
actions of organizational members. If resilience is treated as an outcome, managers may act with the
assumption that resilience will remain a stable property of their organization, instead of realizing
that resilience is dynamic and responsive to their actions. For instance, after resilience had been
established for some time, managers at NASA assumed that resilience would remain a stable
outcome, and shifted priorities and funding away from resilience processes and toward
productivity—leading them to repeat critical mistakes (Haunschild, Polidoro, & Chandler, 2015).

Second, adaptation at one level of an organization can substitute for adaptation at another level
(Levinthal & March, 1993). This substitutability of adaptation can make resilience a risk, such that
not all adaptation is normatively positive for the organization as a whole. Particularly in
organizations where crises emerge from operations, highly resilient front-line employees can
prevent adaptation atop the hierarchy. For instance, nurses often “work around” problems that arise
during patient care. That is, they improvise on-the-spot actions that help them circumvent problems
in a temporary way. As a result, problems are seldom reported to managers who can address them
more systematically (Tucker, Edmondson, & Spear, 2002). A less resilient front-line would be unable
to handle these problems, thus informing managers and allowing adaptation at the managerial level.
Conversely, when selection pressures are most acute atop the hierarchy (from regulatory or
competitive sources), managers may change rules, routines, and resources. But the front-line may

lack a wider context to understand such changes, leading them to resist change and thereby increase
risk. In this way, resilience can increase organizational risk.

Mindfulness and managing the risk-resilience tradeoff

The cutting edge of organizational research asks how the risk-resilience tradeoff can be managed
through mindfulness. Early mindfulness work suggested that the deliberate mental processes people
use during planning could, and should, be retained during execution (Langer, 1989). Instead of
execution occurring on autopilot, people can use their experiences during execution to refine their
plans and assumptions. In time, mindfulness expanded from the individual to the group, referring to
the five social interaction patterns characterizing units with large information processing capacity
(Weick et al., 1999). Most recently, mindfulness is seen as requiring the integration of these mental
processes and social patterns with the organizational designs in which they occur (Kudesia, 2017b).
With such an integration, organizations can enact continuous improvisational change in which
planning and execution converge both temporally and spatially (Brown & Eisenhardt, 1997;
Moorman & Miner, 1998), thus limiting this key cause of the risk-resilience tradeoff. Instead of
predicting the environment, such organizations directly act on it, notice the impact of their actions,
and make adjustments through rapid feedback cycles.

We suggest this integration requires three principles. First, organizations must see expertise as not
just deliberate and conceptual, but also automatic and perceptual (Dreyfus & Dreyfus, 2005).
Mindfulness is less about constant deliberation. It instead requires that people switch mental
processes between deliberation and automatic action based on their expertise in a situation
(Kudesia, 2017b). This empowers useful improvisations to emerge from the automatic actions of
experts (Chia & Holt, 2009). Second, for such improvisational actions to benefit the organization,
they must be strategically aligned. Rather than relying on intricate plans to align actions, top
managers can offer heuristics: simple rules that identify strategic priorities and values (Artinger et
al., 2015; Brown & Eisenhardt, 1997). Heuristics give people a shared basis from which to improvise,
ensuring alignment. Third, middle management plays a crucial role in troubleshooting areas of
misalignment. Their position in the design best places them to reconcile differing priorities and
values across the hierarchy—and to notice valuable improvisations on the front-lines, help articulate
them, and encourage their adoption more broadly (Beck & Plowman, 2009; Eggers & Kaplan, 2013).

As such, expertise on the front-lines, simple rules from top managers, and troubleshooting from
middle management seem to be three necessary mindfulness principles for managing the risk-
resilience tradeoff in organizations. Although much remains to be understood about these
principles, they may underlie an updated image of risk and resilience in organizations. In this
updated image, planning and execution converge in a manner that allows organizations to transcend
the risk-resilience tradeoff through rapid, intelligent action.


The authors received support from the Future Resilient Systems project at the Singapore-ETH
Centre, which is funded by the National Research Foundation of Singapore under its Campus for
Research Excellence and Technological Enterprise program (FI 370074011).
Resilience and robustness in ecological systemsLevinResilience and Robustness in Ecological Systems

Simon A. Levini*

i Princeton University

This research was supported by the Army Research Office Grant W911NF-18-1-0325. Resilience and
Robustness in Ecological Distributed Decision-Making Dynamics.

Suggested citation: Levin, S. A. (2018). Resilience and robustness in ecological systems. In Trump, B. D., Florin,
M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex
interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available
on and

Keywords: Resilience, robustness, ecological systems

*Corresponding author:


The notions of resilience and robustness in ecological systems generally refer to the ability of the
system to continue to maintain its essential character in the face of disturbances, endogenous or
exogenous. In different traditions, the words “resilience” and “robustness” are alternatively used to
describe this property. In some usages, however, the term resilience is reserved for the ability of a
system to recover from displacement, and the more general term robustness used to combine
resistance to displacement with the ability to recover (see Levin & Lubchenco, 2008); in other
usages, as adopted for example by the Stockholm Resilience Centre, the term resilience refers to the
combination of both (Holling, 1973).

The notions of resilience and robustness in any system are tied to whatever macroscopic descriptors
are defined to be of interest. For an organism like us, the concept is clear - it’s what keeps us
healthy; and a physician has unambiguous descriptors that define the health of the organism. For an
ecosystem, the concept is more difficult, because an ecosystem is not a well-defined evolutionary
unit; rather, it is in general operationally defined in terms of the species that coexist in some area or
region, together with the abiotic environment within which they coexist, including especially the
nutrients whose dynamics sustain those species. The definition of resilience or robustness for such a
system is not unique, but depends upon the level of description. Species may come and go without
affecting the overall persistence of the features that make the system recognizable; and, in fact, the
dynamic nature of species turnover, for example during ecological succession, may be essential to
the maintenance of the more macroscopic features of the system.

The question remains as to what macroscopic features should be the focus of resilience and
robustness strategies for ecosystems. Are particular species essential to maintain in their own right,
or should the focus be on broader functional groups that sustain critical ecosystem processes?
(Kareiva & Levin, 2003). This is a key question, not easily answered, because which properties are
valued depend on one’s perspective. For some, the intrinsic nature of individual species is
paramount; while for others, the value of particular features of biodiversity are to be evaluated
through the filter of the services humans derive from ecosystems. The more general notion of
ecosystem services in theory combines services that can easily be given economic value with those,

like the intrinsic nature of species, that cannot unequivocally be assigned such values (Daily et al.,
2000). However, in practice, because of the difficulties in quantifying non-market values, the ethical
and aesthetic dimensions receive short shrift.

Any manager of an ecosystem, whether a natural one or an engineered one (such as in agriculture),
must first determine the goals of management - namely, what is to be preserved. There is basically
no unequivocal way to do this for natural systems, and hence the management objectives in general
cannot be separated from the socio-economic context.

Risk and resilience

A fundamental issue in assessing the robustness of any system is that of systemic risk, namely the
potential for localized disturbances to spread contagiously and become global problems (May, Levin,
& Sugihara, 2008; Frank et al., 2014). Ecological systems differ from many other systems, like
banking systems, in that they are essentially self-organized (Levin, 2005; Helbing, Yu, & Rauhut,
2011). When assessing the properties of resilience for engineered systems, one may rely on the fact
that design principles have guided the construction of those systems. Similarly, for individual
organisms, natural selection has shaped the regulatory processes and other characteristics to
maintain the resilience of critical functions. For ecosystems, however, no such feedback mechanism
has shaped their properties. There is, of course, another sort of process, a selection process that
biases what we observe in favor of systems whose properties allow them to persist longer
(Lewontin, 1977; Levin, 1999; Lenton & Lovelock, 2000), but this is different than a design principle.

Over time, organisms have evolved to balance exploration and exploitation in ways that
approximately optimize their fitnesses in a game-theoretic sense; successful organizations must do
the same. To the extent that resilience or robustness means the maintenance of the status quo, it
must be balanced against exploration, which carries risk. Whether systems are designed, evolved, or
self-organized, the most resilient and robust systems will find this balance, or else they will not be
able to persist in changing environments. Problems arise, of course, when the conditions that gave
rise to that balance are disturbed, as for example through climate change. Carlson and Doyle (2002)
describe a wide class of resilient systems that are “robust, yet fragile”; that is, they may be robust to
a class of perturbations for which they have been selected, yet fragile in the face of novel ones. For
example, comparing the resilience or robustness of tropical and temperate ecosystems only makes
sense with regard to appropriate classes of disturbances; tropical ecosystems may be more robust
with respect to normal stresses, but more fragile in the face of novel ones.

Design principles can be applied to managed ecosystems, like forests, fisheries and agricultural
systems, in order to balance success in current environments versus adaptive capacity to deal with
novel ones (Clark, Jones, & Holling, 1979). Redundancy and diversity provide insurance and allow for
innovation, while modular construction can limit systemic risk (Levin, 1999; Simon, 2002; Simon,
1962). More generally, managers have much to learn from how evolution has shaped robustness, for
example through the evolution of the vertebrate immune system (Levin & Lo, 2015). Evolution has
shaped the properties of the immune system to deal with the fact that, predictably, unpredictable
pathogenic threats will attack us all. The immune system is hierarchical in the sense that the first line
of defense involves barriers to invasion, things like skin. When those barriers are breached, the
threat must be recognized as such, generalized responses (like macrophages) invoked, while
adaptive responses (specific antibodies) evolve and provide memory. Such a hierarchy is very
suggestive for the development of protection for a wide class of systems.

Risk appetite and tolerance

One of the most basic concepts in fisheries management is that of maximum sustained yield, and
related concepts like maximum sustained rent (profit) similarity emphasize constancy of system
properties. Constancy is obviously an attractive feature in many respects, since it implies
sustainability and predictability. However, focusing entirely on robustness in this sense erodes the
capacity for learning and exploration, and may lock systems into domains of performance that are
suboptimal. In changing environments, the lack of innovation may in fact doom the system to

More generally, robustness may not be a desirable feature, for example if a system is stuck in an
unproductive configuration like a hypoxic or eutrophic lake. Economic recessions and depressions
provide familiar examples (Levin et al., 1998). Indeed, principles of sound investment carry over little
changed to ecological management. Risk tolerance and discounting dictate the degree to which bet-
hedging and insurance arrangements need to be applied to maintain long-term performance,
sacrificing short-term gains for long-term persistence.

In any context, from investment strategies to the management of businesses and natural systems,
and indeed to our own lives, one has to balance a tolerance for risk against the potential for the
greater rewards that risk can bring. Any management situation that involves collective agreements
necessarily involves trading off the ways different individuals discount the future. For example,
politicians and CEOs typically would have steeper discount rates (because they need to show results)
than stockholders and the general public; people who are worried about where their next meal is
coming from have steeper discount rates than those who can afford to plan for retirement. In
general, there is great heterogeneity within any population between risk-takers and more
conservative planners, and indeed even individuals in making decisions balance these tendencies.
This leads inexorably to non-constant discounting (for example, hyperbolic discounting), and all the
complexities it introduces (Weitzman, 2001; Dasgupta & Maskin, 2005; Laibson, 1997).

Societies aggregate individual preferences, just as individuals do for their internal conflicts, and
solutions typically average tolerances through compromise decisions and insurance arrangements.
The science and politics of how to do that effectively still needs a great deal of work, as evidenced by
the lack of agreement within our own societies on such fundamental existential issues as climate

Transition, adaptation, transformation

Transitions and transformations can affect systems in unplanned ways or can be designed to
transform systems from less desirable states to better ones. In the former case, it obviously would
be desirable to have early warning indicators, as well as built-in feedback loops that minimize the
damage. Certain classes of transformations show characteristic patterns of change, and efforts to
identify them in biological and other systems have been a focus of research for at least a half-
century (Guckenheimer, 1978). More recent efforts (Scheffer et al., 2009) have borrowed heavily
from the literature on phase transitions in physics. Like the earlier efforts, these are promising
directions, but care must be taken not to expect uniform patterns.

Management of any system must anticipate transitions, and plan for transformations that are as
painless as possible, while resisting the temptation to stick too long with losing strategies. Such
issues are at the center of current research in business strategies (Reeves, Levin, & Ueda, 2016;

Reeves, Levin, Harnoss & Ueda, 2018). Obviously, such issues are front and center for environmental
systems and societies as well.

In the face of global change in climate and other features, overall robustness must embrace change,
and the challenge becomes how we engender change without severe disruptions. There are
numerous examples in the environmental literature - for example, the recognition after years of
alternative practice that small controlled fires remove tinder and increase the robustness of forests
to major catastrophes, or the use of diversification in agriculture to minimize the potential for
pathogen outbreaks or other system-wide disturbances. In financial systems, small corrections are
generally regarded as healthy for the long-run viability of markets. Such principles must apply as well
to our social and ecological systems, embracing adaptability, if our societies are to survive.
Considerations of resilience management in transportationNogal & O’ConnorConsiderations of Resilience Management in Transportation

Maria Nogali and Alan O’Connori*

i Dept. of Civil, Structural & Environmental Engineering, Trinity College Dublin, Ireland

Suggested citation: Nogal, M., & O’Connor, A. (2018). Considerations of resilience management in
transportation. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2):
Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance
Center. Available on and

Keywords: Resilience, transportation, system, network, performance

*Corresponding author:


The aim of transportation systems is to enable movement of people and goods and to guarantee
supply chain, in terms of safety and security at the core level, in terms of reliability and sustainability
at an intermediate level, and in terms of efficiency at an outer level (Nogal & O’Connor, 2017).

Traditionally, transportation systems have been designed and managed under a risk-based
perspective, where serviceability level of the system should be guaranteed under any likely
circumstance. In that way, the service offered by the transportation system was established as the
input of the problem, and as a result of a number of engineering, social and economic
considerations, the infrastructure was designed or the services programmed.

The present transportation is characterized by its complexity and high interconnection with other
systems, such as information and communications technology systems (ICTs) (Roege et al., 2017).
Dependencies among systems imply that a perturbation in another system is likely to cause stress
in the transportation system, and vice versa, triggering sometimes an uncontrolled feedback
process. Thus, analyzing transportation systems without considering the relation with other
systems would lead to underestimating both risks and consequences. In addition, ageing of the
existing infrastructure that requires important investments to maintain acceptable service
conditions, worsened by an increasing transport demand during a time period characterized by
emerging threats, such as climate change and cyber-attacks, poses a special challenge to decision-
makers when trying to allocate scarce resources competing with the needs of other critical
infrastructures. Practitioners and managers have realized that the risk-based approach can be
improved by a resilience perspective, whose aim is to guarantee the critical functions associated
with a given level of disruption (Nogal & O’Connor, forthcoming), whereby the threshold relates to
the tipping point where the required services cannot be provided anymore, and might vary over
time with the improvement or worsening of the situation. For instance, it is a waste of resources to
design a railway that provides the same level of reliability in normal situations as under an extreme
(though statistically probable) snowstorm.

Resilience management of transportation systems might be defined as the culture, processes and
structures directed towards the effective management of passenger demand, goods supply, and
services under different internal and external shocks and stresses, compatible with the resilience of

other related systems.

This chapter is focused on resilience management applied to transportation systems, where the
user-oriented perspective is a key aspect to establish the role of the transportation system within
a larger system consisting of many other systems, such as health, finance, and power. In other
words, society is the guiding thread connecting them (Allen, Angeler, Garmestani, Gunderson &
Holling, 2014).

Resilience management in transportation networks following Hurricane Irma

In September 2017, Florida suffered Hurricane Irma, which impacted with maintained 298 km/h
winds for 37 hours in total, the longest period at this speed ever recorded, causing 84 fatalities.
Under the threat of Hurricane Irma, 6.5 million people were evacuated from Florida to head north
using land-based transport networks. To allow such a massive evacuation, tolls were suspended
and the left shoulder of I-75 (northbound) and I-4 (eastbound) were opened to traffic.

The shoulder-use plan for evacuations was put in place for the first time by the Florida Department of
Transportation. Supported by theoretical studies, in comparison with the traditional contraflow
plan, the new plan would provide similar evacuation capacity, reducing the personnel, resources
(e.g., highway patrol cars, orange cones) and time required to implement, and avoiding the
head-on collisions between confused drivers. Despite these measures, important traffic congestion
in major roads (e.g., northbound I-95, I-75, and Turnpike) was registered, exacerbated by the
long lines at fuel stations, which, in turn, suffered from fuel shortage as a consequence of
Hurricane Harvey (September 2017).

For the case presented, traffic jams, hours to obtain fuel and free toll-roads might be understood as
a clear failure of the transport system under a risk-based perspective, where a fixed threshold related
to a well-functioning system may be assumed. Indeed, the concept of system failure is a key aspect
to understand the transition from the risk-centered vision to a resilience-centered vision. Under a
resilience perspective, the main function of the transport system in this case was the safe
evacuation of the population. Thus, the evacuation of 6.5 million people in less than five days cannot
be considered as a failure. Nevertheless, there is room for improvement, e.g., four fatalities were
registered due to car crashes. If a fixed threshold in terms of mobility conditions were established
under any possible situation, the required effort and cost to guarantee that the system is always
above this threshold would be absolutely disproportionate. Therefore, it is crucial to prioritize
objectives and accept some non-optimal states compatible with the intensity of the hazardous

A distinguishing characteristic of the Resilience Management is the inclusion of a feedback process,
which allows the improvement of the system to future events, sometimes materialized by
adaptation plans (Florin & Linkov, 2016). In the aftermath of the hurricane, a Committee on
Hurricane Response and Preparedness was created to analyze the response and take advantage of
the lessons learned from the experience. Among the several themes discussed, some
recommendations were identified in terms of evacuation to improve the preparedness level to
future events. They can be summarized in (a) to extend the evacuation road networks, (b) to
include contraflow lanes were appropriate, (c) to use rail transport to evacuate people and meet
fuel demands, (d) to provide Floridians with real-time information regarding the evacuation choices,
and (e) community education (Florida House of Representatives, 2018).

Among these recommendations to improve the resilience of the system, the last two points are
highlighted. Risk management commonly focuses on the physical aspects of the system. The social
aspects and how information is created, shared and understood, if considered, are assumed as
secondary aspects. In the case of Hurricane Irma, the relevance of the social, the information and
the cognitive domains to improve the response of the system was identified by the Committee.
They are aspects that make a difference between a safe infrastructure system and a resilient
one. Besides, the coordinated response is crucial between different decision-makers,
infrastructure managers and operators, emergency responders, and other stakeholders. Given the
short time to coordinate the operations, an established protocol with clear objectives and
hierarchies is mandatory. Florida, an area commonly affected by hurricanes, has improved its
resilience to hurricanes over time through a loop process of preparedness, response, recovery and
learning with each event (Wood, Wells, Rice & Linkov, 2018) (Nogal, 2018).

As indicated, a few days before Hurricane Irma occurred, Hurricane Harvey had impacted the area,
causing fuel shortage, among other issues. The relevance of a recovery plan, strategically
designed prioritizing on key aspects, e.g., fuel supply, is here observed. Resilience management
extends the classical risk management by including this post-event layer. In terms of transportation,
one of the reasons to implement the shoulder-use plan is that allows a natural, smoother transition
to normal operation by drivers.

Hurricane Irma case has evidenced how transport systems are at the service of the overall
society, therefore, the needs of the society at each time should define the functions to be developed
by transport systems with an integrative vision that includes all other systems (e.g., health, power,
financial, etc.).

Building a resilient future

Let’s imagine that a practitioner designs a wall to avoid potential landslides affecting a road.
Because climate change might increase the risk of landslides in the area, the engineer, following
his/her risk-based perspective, thinks that a bigger wall should be built to guarantee the safety
level. Nevertheless, the combination of a smaller wall designed to resist the probable landslides,
with a number of soft measures, such as use of vegetation and surface drainage techniques (e.g.,
buried drains) (Gavin & Djidara, 2015), and monitoring and warning systems for very low-
probability events, might be a more inexpensive solution, which is also safer, not only in relation to
landslides, but to a wider range of threats. This simple example of a resilient solution is presented
to show that resilience-building is not about accepting a certain degree of risk but modifies the
point of how to deal with risk. Note that the core functions of the transportation system are safety
and security, and they should be always guaranteed.

Different performance of the transportation system is then expected under different disturbing
scenarios, e.g., a hurricane or a strike. Therefore, when a hazardous event occurs, it might be
expected that the system performance fulfils a series of functions (those identified as more
relevant) but not others, causing that some actors, such as some users, might feel not entirely
satisfied, if not negatively affected. The Florida case presented before shows that there is a number
of actors involved, from transportation authorities to rescue services, politicians and social media.
To avoid misunderstanding and even misuse of the decisions taken under a resilience umbrella,
resilience-based decisions should be backed by programs and protocols defined in advance seeking
consensus with stakeholders. To develop a well-defined resilient transportation system, it is

important to build on the social responsibility and awareness of the different stakeholders.

We claim that transitions to a resilient future require the definition of cross-sectorial visions and
feasible action pathways to achieve such visions. With that aim, a map of the desirable resilient future
considering a holistic perspective of the transport system as a part of a bigger system, should be
envisaged. Then, the feasibility should be assessed through backcasting, where policies and
programs connecting the future and present are identified. Here the main actors and their roles
within the process have to be clearly identified. Special attention has to be paid to coordination
among agencies, coordination among transport modes, cross-border governance arrangements,
adequate communication tools and social education to engage users.
Resilience: Moving forward from a metaphorPalma-Oliveira & TrumpResilience: Moving Forward from a Metaphor

José Palma-Oliveirai* and Benjamin D. Trumpi

i University of Lisbon, Portugal

Suggested citation: Palma-Oliveira, J., & Trump, B. D. (2018). Resilience: Moving forward from a metaphor. In
Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience
for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available
on and

Keywords: Resilience, complex systems, systemic risk, tipping point

*Corresponding author:

Resilience and complex systems

Resilience remains a field of tremendous potential to improve the management and sustainability of
ecological and environmental systems – particularly in the manner by which humans engage within
them. Many papers have argued that as a property of a system, resilience focuses upon ‘bouncing
back’ to an initial steady state. Further, others operate under the assumption that resilience is a
normatively positive characteristic to possess and tends to produce desirable outcomes. While in
many cases this is somewhat true, in others it raises the threat of misdiagnosis of systemic threats as
well as mismanagement of at-risk ecological systems.

In volume 1 of IRGC’s Resource Guide on Resilience (Palma-Oliveira & Trump, 2016), we argued that
the methodological promise of resilience is being overshadowed by its use as a metaphor for
sustaining a system’s ideal state. In this volume, we argue that an improved application and
scientifically-grounded understanding of ecological resilience can be formulated by an improved
understanding of when such systems reach tipping or transition points. Scholarly literature such as
Walker et al. (2004), Folke et al. (2010), Gallopin (2006), and Dai et al. (2012) offer scientifically-
grounded approaches to model and assess ecosystem and environmental resilience as a measure of
whether the current environmental system is stable, or whether it is nearing a tipping or
transformation point. We apply the logic of such literature to emerging environmental and
ecological concerns such as ocean pollution and climate change and describe how normatively
positive or negative influences have the potential to shift an environmental system into a differing
stable state.

Risk, resilience, and complex adaptive systems

Neither risk nor resilience are new disciplines. From an environmental perspective, the Ancient
Egyptians regularly reviewed risk-based predictions for the annual inundation of the Nile River –
excessive inundation could flood and destroy fields and rot crops, while too little flooding would
limit grain production and threaten starvation for the land. Likewise, resilience has been used as a
term to define systemic capacity to overcome disruption for at least two thousand years, such as
with resiliency in Roman Republican rule despite political infighting, economic woes, or natural
disasters (Alexander, 2013).

More recently, the risk/resilience divide has become clearer and more bound to methodological
practice (Linkov & Trump, 2019). On one hand, risk analysis in the environmental practice has
centred upon reviewing the potential hazards to a component of a system, mapping the
vulnerabilities of the system component to the hazard, and the ultimate consequences should that
vulnerability be exploited. This has allowed eminent scientists, government agencies, NGOs, and
scholars to better understand various environmental threats such as with the continual use of
dichlorodiphenyltrichloroethane (DDT) chemical sprays as insecticide to human or environmental
health, or the impact of chlorofluorocarbon (CFC) use upon the ozone layer. Decades of risk-based
research have demonstrated that when we can clearly identify and unpack a specific threat (or ‘risk
object’) to a specific target within the environment (or ‘object at risk’), we can often calculate the
relative riskiness that such a threat has and make specific determinations regarding its safe use and
good governance (Boholm & Corvellec, 2011).

However, when the risk object is poorly understood, or the object at risk is incredibly complex and
consists of many nested sub-systems, traditional risk analysis does not generate the same level of
quantitative rigor that decision makers normally require. Further, there is often a lack of consensus
amongst the different groups regarding whether something is a risk object or an object at risk
(Palma-Oliveira et al., 2018). This is reflected in many emerging challenges today, ranging from
global climate change to the sudden spread of harmful algal blooms generated by certain species of
phytoplankton and dinoflagellates (known colloquially as ‘red tide’), where complex systems
encounter a sudden yet poorly predicted shock to their equilibria. Without reliable risk forecasting
and signal detection, as well as data to unpack the hazard, exposure, and effects assessment
necessary to conduct risk analysis, systemic shocks to complex environmental systems are generally
difficult to predict or solve with a risk-based approach.

Resilience affords greater clarity over such threats (particularly systemic threats) by focusing upon
the inherent structure of the system, its core characteristics, and the relationship that various sub-
systems have with one another to generate an ecosystem’s baseline state of health (IRGC, 2018).
Walker et al. (2004) define ecosystem equilibria as a characteristic of “basins of attraction”, where
the components and characteristics of a system drive it towards a baseline state of health and
performance. For example, the Pacific Ocean is a huge and complex ecosystem with a tremendous
diversity of flora and fauna whose roles in complex food webs have been reinforced by millions of
years of evolution and adaptivity; a localized oil spill may damage small points of ecosystem health
but is unlikely to dramatically and permanently shift the species dynamics and food webs which
currently prevail across most of the Ocean. However, through constant exposure to trillions of
microplastics (i.e., the Pacific Trash Vortex) or continuous chemical and radiological contaminants
(i.e. bleaching of the Great Barrier Reef, radiological runoff from the Fukushima Daiichi Nuclear
Power Plant), system equilibria can be jolted in a manner that favours a differing basin of attraction.
Unfortunately, we are moving in that direction already, where huge regions of oxygen-depletion in
the Pacific Ocean are contributing to ‘dead zones’ where virtually no marine life can survive.

Figure 1: Illustration of a complex interconnected environmental system (Linkov & Trump, in press)

Both the initial Pacific Ocean baseline state of health (a larger, global system), as well as these dead
zones (sub-system within the Pacific Ocean global system), are fundamentally resilient systems that
are defined by basins of attraction which possess characteristics that reinforce the status quo in the
absence of a shock or disruption. On one hand, a biologically rich and diverse Pacific biological
system has recovered from a tremendous array of disruptions over the past century, or adapted
system processes in a way that address incoming challenges such as with large-scale commercial
fishing. However, continuous overfishing along with chemical and radiological runoff are disrupting
the Pacific ecosystem enough to potentially transition it towards a new and less biologically complex
basin of attraction. This will be further discussed in the last section.

More than just a metaphor, ecosystem resilience describes the intensity of a given ecological basin
of attraction to preserve the baseline state of health and activity within a given area, whether that
state is optimum, desirable or not. It could be normatively positive (i.e., a complex and biodiverse
Pacific Ocean) or negative (i.e., a Pacific Ocean comprised of huge dead zones and limited
biodiversity). Methodologically, such basins of attraction are comprised of complex interconnected
and adaptive systems that are constantly under stress, yet only shift to a new equilibrium if a tipping
point has been breached and the system is trending towards a new basin. More than just system
recovery and adaptation, ecosystem resilience is a property of natural selection and organism
interaction within their broader environment in a manner that produces some sustainable end-state.
Such resilience-based approaches can help us understand when and how certain ecosystems might
shift from one steady-state to another (Linkov et al., 2018), as well as define the biological and
ecological drivers which cause an ecosystem to arrive at a steady equilibrium altogether.

In the modern age, there is no socioecological system that is not influenced by human behaviour or
activity. Increasingly, many research organizations find that human activity is directly or indirectly
pushing environmental and ecological systems from an initial condition of high biodiversity and
systemic complexity, towards more simple, less diverse, and less hospitable climates and food webs.
Some human-derived disruptions are relatively abrupt (e.g., industrial logging in tropical rainforests)

or more gradual in effect (e.g., ocean pollution), yet both tend to drive such environmental and
ecological systems towards a tipping point that limits the potential for diverse environmental life.
Such a system is resilient yet normatively unfavourable, where significant energy and resources
would have to be dedicated towards returning an at-risk environment to its original basin of

Risk, resilience, and the nagging worry of brittleness

It is critically important for practitioners to acknowledge, in spite of the benefits of such a governing
strategy, the drawbacks of a resilience-based approach for ecosystem health. While facilitating the
expeditious recovery of normatively positive systems from disruption is a helpful goal for ecosystem
health, it is essential to acknowledge how developing ecological and biological properties resistant
to transition or transformation can contribute to inherent brittleness in certain areas of the
ecosystem. In essence, resilience-based drawbacks arrive in two areas: an ecosystem that is believed
to be resilient and thus can withstand and recover from virtually any disruption (and thereby taking
few steps to protect against such disruptions), or the simultaneous development of areas of
systemic brittleness while fostering resilience in others.

We have already seen countless examples of the former. Widespread overfishing, dumping of waste,
or atmospheric pollution have been rampant within the 20th and 21st Centuries despite evidence
that related ecosystems were more fragile, unsustainable and not resilient, and many international
agreements to reduce such damage. Many reference a belief in the inherent resilience of the system
as a root cause of the acceptability of such behaviour, contributing to classic tragedies of the
commons and anticommons. A belief in ecosystem resilience reinforces commons-related problems
worldwide by enabling feedback mechanisms and social traps which cause individuals to behave in
socially and globally harmful manners.

For the latter, developing resilient properties in some areas of complex ecosystems can generate
brittleness in others. For example, some scholars have discussed the use of gene drives to improve
the resistance of endangered species of coral to bleaching as well as to improve its ability to survive
and reproduce in various other hazardous environmental conditions (notably, the Great Barrier
Reef). Such genetic changes would foster increased capacity for at-risk coral to resist bleaching (vis-
à-vis a ‘risk-based approach’) as well as potentially enable various species of coral to quickly recover
from other possible disruptions in the future such as ocean acidification (a ‘resilience-based
approach’ which emphasizes quick recovery and adaptation to future potential threats). However,
the use of a gene drive for coral conservation and resiliency might have unintended side effects,
such as threats to biodiversity via horizontal gene transfer, or potentially through excessive growth
of such coral reefs in a manner that outstrips local food supplies. This is not to rule out such a
technological solution to a complex ecosystem concern, but a necessary governance challenge of
any effort to develop ecosystem resiliency must consider the unintended consequences of causing
one species of flora or fauna to outperform or proliferate in a manner outside of the current
ecosystem equilibrium. Further, one must acknowledge how an intervention to a specific sub-system
(e.g., the Great Barrier Reef) might trigger secondary effects to nested sub-systems (other marine
life) or the larger global system (the South Pacific Ocean).

Resilience means adaptation: Basins of attraction and transition points

Shocks and stresses are frequently discussed in scholarly literature as disruption events for complex
systems, yet rarely acknowledge that such disruptions can contribute to (a) a reorganization of the
same general system, or (b) contribute to a collapse of the original system, and foster the creation of
a new system and basin of attraction altogether. For the former, some disruptions can generate
substantial change in some areas yet preserve the overall system’s functions and characteristics. For
example, many forest fires can destroy large forests, yet in the aftermath of such fires an
environmental system can use the nutrients from the burned flora to foster new tree growth.
Elements or subcomponents of the forest system may change over time in response to such fires,
yet the baseline characteristics of that system are often able to return to prominence.

Other disruptions generate collapses in the status quo system altogether. If a disruption is
particularly consequential and removes the preconditions by which the system can recover and
reorganize in a manner similar to the initial system structure, such a disruption can instead cause the
destruction of the original system in favour of one that is entirely different in its characteristics and
baseline state of health. For example, the widespread dumping and persistence of plastic in the
Pacific Ocean is dramatically altering the capacity of ocean regions to sustain marine line, and limit
localized ecosystems to tolerate only those organisms which can persist with minimal sunlight or

All systems are dynamically interconnected and are continually interacting and adapting within and
across one another to best compete and operate within a given system paradigm. This idea, known
academically as panarchy, is particularly salient when describing environmental and ecological
systems as well as the foundational theories of evolution and natural selection. While there are
many drivers which influence and shift behaviour within one or more components of a system, we
identify three key influences of ecosystem adaptation and transition, including (a) solar and
climatological influences, (b) bio-geological forces, and (c) socioeconomic human activity.

More simply put, the interrelationships between humans, local ecosystems, and global climate and
solar activity collectively influence the (in)stability of environmental systems, as well as how certain
disruptions may or may not disrupt the current basin of attraction. Typically, bottom-up disruptions
at localized levels rarely can trigger greater systemic transformations, yet they can shift or alter the
characteristics of ecosystem health. Likewise, disruptions at the global level of a system (e.g., solar
storms, ozone depletion, etc.) can trigger rapid and disastrous systemic risks that can fundamentally
change the nature of life on Earth. The critical question of how such systems are governed depends
upon where and how a potential disruption may occur – on a local level that may be resolved via
limited or directed engagement such as with environmental remediation of a contaminated site, or
on a global scale that requires the coordination of many actors to reduce the threat of global
catastrophe, such as with the effect of CFCs upon the global ozone layer.

The purpose of developing a normatively positive, resilient system is to instil within it the capabilities
to incorporate new information within the environment, and adapt accordingly to such stimuli in
order to adapt to all the types of changes and tipping points described above. Reviewing Walker et
al. (2004), ecosystem resilience is defined by its tipping points, or transitionary periods, where a
shock or stress will push a system away from one basin of attraction and into another. The critical
question for policy- and decision-makers pertinent to environmental policy centers upon how can

we utilize opportunities to transition our system to not just maintain the status quo, but even adapt
to produce a more normatively positive outcome altogether?

Any ecosystem resilience effort must incorporate the realities of adaptation, transitions, and
transformations as a foundational component of evolutionary biology. Ecosystems are constantly in
flux and adapting to new stimuli – some of which have the potential to remove it from one point of
equilibrium to another. Sometimes this is relatively simple – an oil spill can be cleaned up, and its
harms addressed through intense bioremediation over a few months. Other times this is quite
difficult, such as the many steps needed to address harmful algal blooms in environmentally
sensitive waters or to remove tons of plastic waste from ocean gyres. In ecological and
environmental management, it is essential not only to identify the opportunities for such transitions,
but to accurately characterize the drivers which could influence a local ecosystem away from a
harmful or normatively negative basin of attraction, and towards one more beneficial to human and
environmental health.
Resilience assessment in homeland securityPetitResilience Assessment in Homeland Security

Frédéric Petiti*

i Decision and Infrastructure Sciences Division, Argonne National Laboratory

Suggested citation: Petit, F. (2018). Resilience assessment in homeland security. In Trump, B. D., Florin, M.-V.,
& Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected
systems. Lausanne, CH: EPFL International Risk Governance Center. Available on and

Keywords: Critical infrastructure, infrastructure interdependencies, resilience assessment, homeland

*Corresponding author:

Definition of resilience

The need to understand and enhance the protection of the United States critical infrastructure has
been a national focus since the President’s Commission on Critical Infrastructure Protection was
established in 1996 (President’s Commission on Critical Infrastructure Protection, 1997). Although
resilience has been defined and studied in several fields (e.g., ecology, social science, economy, and
computing) since the 1970s, it is only recently that this concept is used in homeland security for the
management of critical infrastructure systems.

In 2011 and 2013, the release of Presidential Policy Directive (PPD)-8 on National Preparedness and
PPD-21 on Critical Infrastructure Security and Resilience expanded on the importance of
understanding the resilience of citizens, communities, and critical infrastructure. PPD-8 aimed at
strengthening the security and resilience of the United States by directing the development of a
national preparedness goal that identifies the core capabilities necessary for preparedness and a
national preparedness system to guide activities that will enable the resilience enhancement of the
nation (DHS, 2011). PPD-21 is more specific to critical infrastructure because it establishes the roles
and responsibilities of the Secretary of the Department of Homeland Security (DHS) to strengthen
the security and resilience of all 16 critical infrastructure sectors. PPD-21 specifically calls for
operational and strategic analysis to inform planning and operational decisions regarding critical
infrastructure and to recommend resilience enhancement measures (The White House, 2013).

Following the work conducted by the National Infrastructure Advisory Council (NIAC, 2009) (NIAC,
2010) and the National Academies of Sciences, Engineering, and Medicine (The National Academies,
2012), PPD-21 defined critical infrastructure resilience as “the ability to prepare for and adapt to
changing conditions and withstand and recover rapidly from disruptions.” (The White House, 2013)

Resilience is therefore about the change of state of the infrastructure system and integrates the
system’s capability to adapt and transform its operations to deal with stresses and maintain an
acceptable level of functioning. Assessing resilience requires to consider the evolution of the state of
the infrastructure system over time, and to determine both the amount by which the activity/well-
being declines and the amount of time required to return to the pre-event level of operations or to a
new level of equilibrium. Therefore, elements characterizing the capabilities of the infrastructure
systems both before (i.e., anticipation, resistance, and absorption) and after (i.e., response,

adaptation, and recovery) an adverse event occurs are important to consider in resilience definition
and strategies.

The 2013 edition of the National Infrastructure Protection Plan followed PPD-21 and reinforced the
need to “enhance critical infrastructure resilience by minimizing the adverse consequences of
incidents through advance planning and mitigation efforts, and employing effective responses to
save lives and ensure the rapid recovery of essential services” (DHS, 2013).

These strategy documents are completed by government agencies’ strategic plans that
operationalize the consideration of both security and resilience measures in risk management
approaches. DHS has developed several of these plans. The DHS Office of Infrastructure Protection
(IP) Strategic Plan 2012–2016 establishes the goals for the DHS IP to improve risk management
activities and enhance resilience through better understanding of critical assets, systems, and
networks’ operations (DHS, 2012).

In 2015, the DHS developed the National Critical Infrastructure Security and Resilience Research and
Development Plan (CSIR) to guide prioritization of research and development efforts within DHS.
Among the tenets articulated for the CISR, is that “[m]etrics, standard methods of assessment, and
baselines must continue to be developed and refined to effectively measure resilience” (DHS, 2015).

DHS has also developed specific programs, such as the Regional Resiliency Assessment Program
(RRAP), to address the objectives of its strategic plans. RRAP is an interagency and cooperative
assessment of specific critical infrastructure within a designated geographic area (DHS, 2017). RRAP
projects are initiated to respond to stakeholders’ requirements. Some RRAPs specifically analyze
infrastructure systems and propose resilience enhancement options and operational alternatives to
reinforce the robustness of critical infrastructure.

Critical Infrastructure are complex networks mandated to provide resources and services that
support the functioning of a socio-economic society and to satisfy its basic needs. Thus, it is
necessary to keep these systems operational both on a daily basis and in time of emergencies.
Resilience strategies represent a shift in traditional risk and emergency management perspectives
from attempting to control changes in systems that are assumed to be stable, to sustaining and
enhancing the capacity of socio-technical systems to adapt to uncertainty and emerging threats.

Ultimately, the main goal of resilience strategies is to enable decision-makers to make informed
choices that will result in cost-effective reductions in the level and duration of consequences
associated with the range of potential natural and man-made threats. When risk management
strategies focus more on enhancing the protection of critical infrastructure to probable hazards,
resilience strategies seek more specifically to promote business continuity and continuity of
operations to enhance infrastructure systems’ emergency management capabilities to cope with
unanticipated threats (i.e., the famous black swan events).

In the last 20 years, U.S. policies addressing critical infrastructure evolved from privileging risk
management approaches focusing on protection against man-made threats to all-hazard approaches
considering both security and resilience management strategies.

Even if the concept of resilience is defined in national policies, discussions are still ongoing about the
resilience components, the relationship between risk and resilience, and the characterization of
resilience metrics. One of the main concerns is the absence of industry or government initiative to
develop a consensus on or to implement standardized assessment approaches (DOE, 2017). To

address this issue for the energy sector, the U.S. Department of Energy (DOE) developed the DOE
Grid Modernization Laboratory Consortium (GMLC) with the objective to help shape the future of
the electric grid and ensure its protection and resilience (DOE, 2018). Among all initiatives conducted
by the GMLC, one project specifically addresses the development and application of analysis metrics
(i.e., reliability, resilience, sustainability, flexibility, affordability, and security) for assessing the
evolving state of the U.S. electricity system and monitoring progress in modernizing the electric grid
(GMLC, 2017).

Resilience: A component of risk management

Over the ages, traditional approaches of critical infrastructure protection have focused mainly on the
consideration of consequences and vulnerability to man-made hazards. However, methods used to
define and analyze risk are constantly evolving. This evolution of homeland security from protection
to the resilience of the Nation and its critical infrastructure raises a question about the relationship
between risk and resilience.

Risk is traditionally defined as a function of three elements: the threats to which an asset is
susceptible, the vulnerabilities of the asset to the threat, and the consequences potentially
generated by the degradation of the asset. If risk is a function of threats and hazards, vulnerabilities,
and consequences, the challenge is to define where and how resilience fits into the determination of
risk? The answer to this question is difficult yet important because it supports the development of
risk and resilience assessment methodologies.

As identified in national policies, such as the 2013 National Infrastructure Protection Plan, (DHS,
2013) risk management includes resilience, as well as promoting an all-hazards approach that
integrates man-made threats and natural hazards. This evolution constitutes a major change of
paradigm in terms of homeland security. Ways to assess risk to critical infrastructure have evolved,
from methods that were based only on protective measures and vulnerability, to methods that
integrate resilience.

In order to manage critical infrastructure effectively from a “risk perspective,” it is necessary to form
an approach that is not based exclusively on protection and prevention. Risk and emergency
management must include a balance between preparedness, mitigation, response, and recovery.
The progression of risk management for critical infrastructure must consist of an evolution and
incorporation of resilience and service continuity, a more comprehensive involvement of all
stakeholders (including the public) based on strong information sharing, and training and education
processes that includes the effects from infrastructure interdependencies.

Even if in recent homeland security policies and business standards, resilience concepts are included
in risk management strategies, a distinction can be made between strategies seeking to eliminate or
transfer the risk and strategies seeking to maintain critical infrastructure operations. The first type of
strategies, usually named risk management strategies, tries to eliminate negative consequences by
implementing protection measures that reduce threats and vulnerabilities. The second type of
strategies tries to maintain consequences at an acceptable level by implementing preparedness,
mitigation, response, and recovery measures. In general, protective measures are specific to a threat
type and they obviously require knowing the threat.

Resilience measures, on the other hand, can be specific to a given threat or can be general to apply
to not yet identified threats. When, for protective measures, failure is not an option, resilience

measures require to envision failure as being possible and to implement capabilities that will allow
the system to react, adapt, and potentially transform. Resilience strategies require flexibility that can
be supported by strong collaboration and information sharing mechanisms, but also by the
development of business continuity and emergency management planning and exercises.

Risk management and resilience management strategies are inseparable and complementary. Risk
management strategies are implemented to mitigate known threats and resilience management
strategies are implemented in case the protection measures are not sufficient to prevent negative
consequences resulting from known or unknown threats. Comparing the costs of risk management
or resilience management strategies is difficult. It depends on so many factors including the difficulty
to define the return on investment and to prove that the absence or limitation of critical
infrastructure dysfunctions result from the implementation of management strategies.
Implementing resilience strategies requires changing traditional risk management approaches to
consider both known and unknown hazards, and to base the assessments on critical infrastructure
capabilities to cope with unidentified low probability high impact events. It is therefore difficult to
justify investments and define resulting return on investments when the threats and their
consequences are by definition unknown.

However, developing resilience management strategies to enhance the flexibility and adaptability of
critical infrastructure systems is always beneficial to maintain the systems’ operations at an
acceptable level and this whatever the type and importance of threat or hazard.

Resilience strategies to reduce undesired consequences

Comprehensive risk and resilience management strategies require collaborative and
multidisciplinary approaches to combine social, economic, and technical points of view to fully
elucidate the full range of influences acting upon an organisation, from the individual asset to the
system level. This requires combining social and system engineering methodologies to inform multi-
organisational decision-making and prioritize activities to reduce consequences duration and
importance, and therefore maintain acceptable levels of critical infrastructure operations.

The next generation of resilience management methodologies needs to be developed at a regional
level. The tendency for critical infrastructure to be managed and regulated in isolation from one
another hampers the understanding of challenges arising from interdependencies. Resilience
management approaches need to move beyond developing business continuity and emergency
management plans that focus mainly on facilities and assets, to developing plans that consider
regional resilience management capabilities and integrate elements that may be outside of one
organization’s control. It is not sufficient to have generators, fuel storage, and refueling priority to
prepare for a power outage. Enhancing the protection and resilience of critical infrastructure
requires the promotion of regional coordination, the definition of restoration priority, and the
reallocation of resources to limit consequences and channel potential cascading failures. Critical
infrastructure should determine which of their missions, functions, and assets are critically
dependent on the services or resources provided by other organizations.

After prioritizing their operations, critical infrastructure should organize collaborative and secure
exchanges with their suppliers and regional emergency managers to coordinate decision-making and
achieve the greatest benefit for the most critical needs. The definition of an acceptable level of
consequences is the first potential drawback for implementing resilience but also risk management

strategies. Conceptually (and before an event), it is relatively easy to decide to prioritize response
and recovery activities, and to decide to channel the consequences resulting from cascading and
escalating failures. The reality may be different when the adverse event occurs. The main challenge
is to define the risk ownership and to decide who will deal with the consequences, but also to prove
that the actions taken will be beneficial for most (if not all) stakeholders.

The second potential drawback is directly related to the need of regional coordination that requires
developing collaborative approaches and information sharing mechanisms. Communication is an
important, and too often forgotten, phase of risk management. A process for improving the
protection and resilience of critical infrastructure cannot be effective without considering the
several stakeholders involved in critical infrastructure management and regional emergency
management, including the public.

In risk management, it is always difficult to define what information must be communicated, to
whom, and how. The development of processes that maintain a balance between protecting
sensitive information (from a business and/or national security perspective) and providing
emergency managers with necessary information continue to be a challenge.

Understanding regional security and safety capabilities is beneficial for harmonizing resilience
strategies. However, an intelligent adversary can also use this information to exploit existing
weaknesses. Identifying and admitting that your system can fail can also generate a loss of public
confidence and affect critical infrastructure business activities. The difficulty to define what
consequences are acceptable and what and how information should be shared can be addressed by
building a trusted environment to promote a sustainable development culture based on education
and training. The development of trust must be supported by mechanisms to operationalize
standards and policies promoting collaborative approaches and partnerships between critical
infrastructure owners/operators and government representatives. Furthermore, the objective of
resilience management strategies is to complement risk management strategies, which primarily
address threats and vulnerabilities, by promoting flexible and adaptive approaches to further reduce
undesired consequences.

Resilience is a subset of risk specifically influencing the level of consequences resulting from
detrimental events. Therefore, the implementation of resilience strategies is generally beneficial to
decrease risk levels. However, all components of risk (i.e., threat, vulnerability, resilience, and
consequence) are interdependent. For example, vulnerability and resilience are strongly related to
the state of the system considered. Consequently, implementation of resilience strategies can affect
the vulnerability levels. Resilience strategies are based on information sharing of vulnerabilities,
protection and resilience measures, and regional capabilities, to lower the duration and importance
of negative consequences. This can create additional vulnerabilities and therefore increase risk levels
if this sensitive information is not protected and accessed by malicious people.

Integrating critical infrastructure interdependencies in resilience management strategies

Assuring critical infrastructure continuity of operations requires to consider the complexity of their
organization but also to understand the diversity of threats they could face. Critical infrastructure
assets are part of a “system of systems” and cannot be considered independently of their operating

As described by Rinaldi, Peerenboom, & Kelly (2001): “it is clearly impossible to adequately analyze
or understand the behavior of a given infrastructure in isolation from the environment or other
infrastructures”. These interconnections mean that disruption or failure of one element can lead to
cascading failures in others. Interdependencies among infrastructure systems can result in important
economic and physical damage on a citywide, regional, or even national or international scale. A
critical infrastructure is thus in constant interaction with its environment, using and transforming
inputs (i.e., critical services and resources) from the environment in order to provide outputs to the
same environment. Several elements of its environment may directly affect the operations of a
critical infrastructure, including economic and business opportunities and concerns, public policy,
government investment decisions, legal and regulatory concerns, technical and security issues, social
and political concerns, and public health and safety. (Rinaldi, Peerenboom, & Kelly, 2001)

The modern society faces an ongoing challenge of maintaining critical infrastructure performance
and avoiding significant damage caused by extreme weather events (e.g. floods, earthquakes,
hurricanes), manmade events (e.g., malevolence, terrorism), and aging equipment. As these events
continue to increase in both frequency and intensity, the efforts of owners and operators to
enhance the resilience of their systems are more crucial than ever. New technologies increase the
complexity of assessing the resilience and security of critical infrastructure and the whole society. As
a consequence, interdependency relationships among critical infrastructure assets and emerging
threats must be characterized to anticipate how a change in these connections could affect critical
infrastructure operations.

Based on the anticipation of what could constitute the future operating environment of critical
infrastructure systems, the implementation of resilience strategies, by promoting coordination and
collaboration at regional level, will help defining how critical infrastructure should modify (i.e., adapt
or transform) their operations. Several approaches exist for defining security and resilience metrics
but holistic risk and resilience assessments must go beyond traditional assessment approaches to
integrate currently unknown threats in order to improve sustainability of today’s complex global
systems (i.e., business, technology, society).

While organizational resilience and business continuity standards already exist, there is still a need
to find new ways to anticipate and be prepared for emerging and hybrid threats but also to
institutionalize security and resilience more holistically both nationally and internationally. Building
codes and standards need to be enhanced to better integrate the concepts of resilience, define
common terminology and protocols, propose indicators to compare and benchmark practices.
Standardization approaches cannot be sectorial; it is necessary to emphasize community-scale issues
in standardizing an approach to critical infrastructure and community resilience. Resilience
standards should propose procedures for early recognition/identification and monitoring of
emerging risks, and assessment framework for managing these new risks.

The challenge is to go beyond traditional risk management approaches based on historical data and
to design critical infrastructure systems that will be adapted to their future socio-ecological
environment and that will respond to current and future population needs.
Unlocking organizational resiliencePulakos & LuskUnlocking Organizational Resilience

Elaine D. Pulakosi and Derek Luskii*


ii Russell Reynolds Associates

Suggested citation: Pulakos, E. D., & Lusk, D. (2018). Unlocking organizational resilience. In Trump, B. D., Florin,
M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex
interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available
on and

Keywords: Organizational resilience, psychology, values, behavioral

*Corresponding author:

The meaning and measurement of resilience in industrial and organizational (IO) psychology

Resilience is a word we hear frequently today, cited as an essential element for survival in today’s
fast-paced, complex work environment that is characterized by disruptive change. In the field of IO
psychology, resilience is studied at multiple levels – individual, team, and organizational, sometimes
as a predictor of key performance outcomes and sometimes as the performance that is predicted by
other factors. At the individual level, resilience is often defined and measured as an individual
difference construct that is part of one’s personality – hence, it is a person’s innate disposition to
bounce back quickly (or less quickly) from hardship. Individual resilience is also defined in terms of
work behaviors that are critical for effective job performance; for example, “staying focused and
continuing to perform tasks at hand in the face of tragic situations” is an important behavioral
criterion in many jobs. As a criterion measure, resilient performance is typically measured through
scaled performance ratings made by those with opportunities to observe employees on the job.

The construct of resilience changes in nature at the team level as interest moves to how quickly an
entire team can recover or bounce back from failure to return to a prior positive state of
effectiveness. Assessing resilience at this level could entail measuring a variety of team processes,
attitudes, and outcomes following a derailing event and comparing these to baseline measures to
evaluate the recovery process. Hence the definition and measurement of resilience at the team level
is quite different from the individual level with respect to both what is measured and how
conclusions are drawn. At the organizational level, measuring resilience is yet different again,
entailing assessment of a number of organizational characteristics and outcomes that collectively
capture how effectively entire organizations bounce back from disruption or how long this takes. At
the different levels at which IO psychologists operate, then, resilience is defined, predicted and
measured in significantly different ways.

A further complication with resilience in the field of IO psychology is that aside from resilience
measured as an individual personality construct, there is no agreement about how resilience is
defined or a standard way it is measured from study to study. Definitions of resilience in the
literature range from narrower concepts, such as bouncing back, recovery, or re-invention after a
jolt to broader definitions that incorporate related concepts like agility, flexibility, and adaptability.

Resilience has been included in many models of individual, team, and organizational effectiveness
(e.g., Pulakos, Arad, Donovan, & Plamondon, 2001), with many different proposed antecedents and
outcomes. Summarizing and comparing all of these in a meaningful manner is beyond the scope of
the present article.

Recently, however, the concept of organizational resilience has become much more focal in IO
psychology, as organizations struggle to achieve competitive advantage and survive in a disruptively
changing world. Evidence-based models have begun defining resilience more clearly within this
context and examining its antecedents and consequences, as well as its relationship with similar
concepts, like agility and adaptability. The goal is to better understand how organizations can best
create competitive advantage in the face of today’s threats - hyper-competition, knowledge
commoditization, and relentless change. A recent, comprehensive model proposed by Pulakos,
Schneider, and Kantrowitz (2018) offers new insights about what must be in place as well as the
processes that rely on adaptability, resilience, and agility (ARA), with these concepts defined as

. Adaptability is reacting to externally imposed change to sustain or increase performance
. Resilience is recovering and bouncing back to a prior positive state following jolts
. Agility is proactively sensing and redirecting to chart a new path to success by reallocating
energy to building new capabilities and ceasing what no longer creates value.

Behavioral and values-based antecedents

Several organizational processes and characteristics need to be in place to create ARA that enables
competitive advantage. For the present purposes, however, we focus on the role of leaders because
leadership needs to create the conditions for ARA to exist. What leaders in organizations do and
their values define the context for performance and these have a tremendous impact on team and
organizational ARA (Pulakos et al., 2018). To enable resilience, in particular, leaders must create
certain types of foundational stability for organizations to flourish in disruption and change. They
need to articulate a compelling mission and strategy that engages employees, provides sufficient
resources to deliver the strategy, and embeds real time feedback to reduce ambiguity. They also
need to lead the way in the development of recovery plans to accelerate resilience in handling
failure and jolts. These things allow employees to focus on work, with less distraction and concern
about how they are viewed and what they need to do to succeed.

Certain leader values are also important for ARA. Values shine through in leader actions and
attitudes, providing powerful influences on the mindsets, engagement, and actions of organizational
members. Reason, acceptance, and achievement are particularly important values for resilience.
These come from a time-tested model, grounded in evolutionary biology, in which an organism’s
survival depends on its ability to adapt to change and transition from one situation or state to
another (Hogan & Blickle, 2018). These values have been associated with high performing
organizations across industries, sectors, and business cycles. These, like all values, are measured by
using structured assessments in which respondents select responses that best reflect their views,
principles, and beliefs.

. Reason is the process of working to find an objective reality that exists outside intuition or
faith (Pinker, 2018). The importance of reason as a value is supported by the scientific
revolution of the 16th-18th centuries in which progressive intellectuals, including astronomers

and mathematicians, challenged traditional dogma with a requirement for objective truth.
This shift to evidence-based inquiry resulted in innovations that conquered catastrophic
challenges such as epidemics, poverty, and famine. Reason thus helped humans to evolve
into a more resilient species capable of overcoming threats.
. Acceptance emphasizes cooperation, connectedness, and empathy, which have been
fundamental in our ability to survive against other species over time (Turchin, 2016). People
are hardwired to be part of communities and establish strong social bonds; hence, alienation
from these is distressing and disengaging. The innate need for connectedness drives societal
justice and behaving for the greater good, for example, ensuring that technological advances
simultaneously recognize the importance of shareholder value, environmental sustainability,
and employee engagement. Acceptance enables culture and strategy to be framed within a
larger ecosystem that gives meaning, ethics, and purpose to reason, which can otherwise be
robotic and inhumane. It is essential to creating an engaging work climate, which is a critical
antecedent of ARA.
. Achievement as a value stems from the innate human tendency to organize in status
hierarchies. Irrespective of how much a cooperative and connected culture tries to
downplay power dynamics, status hierarchies are needed to enable decision-making and
determine whose subjective values will be considered objectively true (Hogan, 1983). At the
group level, the individual search for power is the primary dynamic that is responsible for
disruption, innovation, and risk-taking, which are essential for competitive advantage in the
face of a rapidly changing business environment.

Complex systems built on finding truth, acceptance, and achievement have consistently been able to
compete and survive over time, outperforming others that operate on superstition, self-serving
ideologies, and complacency – all of which undermine interconnectedness and ARA at the group
level. The combination of these leadership values coupled with the critical behaviors that facilitate
ARA create enduring systems that can successfully adapt, withstand jolts, and redirect to survive the
threats and challenges organizations are experiencing today.

One final factor – a leadership characteristic – is important to creating and embedding ARA. Leaders
must demonstrate integrity. In a famous quote, Peter Drucker commented that “the only definition
of a leader is someone who has followers.” Evidence from psychology and biology suggests followers
need to feel that the benefits of cooperating with others outweigh the costs. They need to know
that the person in charge will keep their word and distribute resources, recognition, and influence
fairly. Integrity matters because the best predictor of employee engagement, which is an essential
precursor to ARA, across interconnected systems within an organization is trust in one’s immediate
leader. Engagement is the sine qua non of keeping individual units contributing to the system in a
cooperative manner, even when doing so may result in under-optimized outcomes for individuals.

The dark side

We now turn to discussing challenges that can result when leaders drive adaptability, resilience, and
agility to the extreme or themselves over-do related behaviors to the point of creating a level of
dysfunction that threatens organizational effectiveness. Extreme resilience, for example, can be
dysfunctional when individuals or teams bounce back so easily and so quickly that they blindly adjust
to any jolt thrown their way, even if it is harmful to themselves or others and detrimental in the
long-term. While quick recovery and moving on is important, doing this too quickly can by-pass

important reflection and time that is necessary to fully heal from tragedy or crisis, creating
unexpected reactions and consequences downstream.

Leaders must likewise balance the behavioral and values-based (e.g., reason, acceptance)
antecedents of ARA, avoiding over-utilization that creates their dysfunctional dark sides. The dark
side of extreme reason, for example, is neglect of the human need for emotional connection, instead
reducing people to numbers. While this may provide data to illuminate what’s going on and enable
evidence-based decisions that optimize outcomes, it can also result in dysfunction that drives
destruction. Devoid of humanism, systems lack the interconnectivity they need to modify
themselves in optimal ways to adapt over time.

The dark side of acceptance is extreme social sensitivity that results in stagnation and the lack of
innovation – a deadly combination in the face of fast-paced disruptive change. This occurs when
there is an excessive focus on harmonious relationships at the expense of productive conflict.
Productive conflict and challenging the status quo is the essence of creativity, innovation, risk, and
change. Thus, while cooperation, coordination, and smooth integration are necessary for effective
delivery by teams, too much can suppress individualization and, at the extreme, create cult-like
systems that reject destabilization and necessary risks that engender a better future state. In turn,
organizations will be unable to reconfigure themselves and inject new life into complacency.

Finally, the extreme search for achievement signals a decaying organization. When resources must
be shared across units, widespread selfish behaviors that compound on one another can diminish or
spoil the overarching system. Organizations that emphasize outputs (e.g., results and money), at the
exclusion of cooperation, understanding, empathy, and resilience tend to collapse over time.
Examples at the extreme are Enron, The Wolf of Wall Street, and many of the organizations involved
in the Global Financial Crisis of 2008. The fatal flaw of excessive achievement, at the expense of
cooperation, has been referred to by biologist Garrett Hardin as “the tragedy of the commons.”
Managers need to understand the importance of achieving the right balance in implementing key
behaviors, values, and ARA itself to avoid these dark side consequences.

Final thoughts

Today’s world is so complex that it is increasingly difficult to predict outcomes based on historical
data and experience. This challenge is exacerbated by game-changing disruptions that are
threatening the existence of many organizations. Survival requires developing organizational
ecosystems that are characterized by ARA – ones that take risks, innovate successfully, withstand
jolts, quickly recover, and know how and when to strategically redirect. There is not a simplistic or
one-facet solution to get there. This instead requires a more complex set of reciprocating conditions
– a compelling strategy, sufficient resources, specific evolution-based values, key leader behaviors,
engaged employees, and the right structure and processes to enable delivery – all of which need to
work together, without over-doing them – to achieve competitive advantage and organizational
Advances in analyzing and measuring dynamic economic resilienceRose & DormadyAdvances in Analyzing and Measuring Dynamic Economic Resilience

Adam Rosei* and Noah Dormadyii

i University of Southern California Sol Price School of Public Policy; USC Center for Risk and Economic Analysis
of Terrorism Events (CREATE); Critical Infrastructure Resilience Institute (CIRI) at the University of Illinois

ii The Ohio State University John Glenn College of Public Affairs; USC Center for Risk and Economic Analysis of
Terrorism Events (CREATE); Critical Infrastructure Resilience Institute (CIRI) at the University of Illinois

iii For example, the U.S. National Academies of Science defines resilience very broadly as: “Resilience is the
ability to prepare and plan for, absorb, recover from, and more successfully adapt to adverse events.”

iv The investment in dynamic economic resilience can also involve technological change and other forms of
adaptation that lower the vulnerability of the system to future disasters.

Suggested citation: Rose, A., & Dormady, N. (2018). Advances in analyzing and measuring dynamic economic
resilience. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.).
IRGC resource guide on resilience (vol. 2): Domains of
resilience for complex interconnected systems.
Lausanne, CH: EPFL International Risk Governance Center.
Available on

Keywords: Dynamic economic resilience, disaster recovery, resilience, definition

*Corresponding author:

This paper places into the broader context of an analytical framework recent research findings and
policy initiatives relating to dynamic economic resilience, which is usually defined as speeding up
and/or shortening the duration of recovery from disasters. Our purpose is to offer insights into the
operation and implications of both of these innovations. The first pertains to research that indicates
that accelerating the pace of economic recovery has much greater potential for reducing disaster
losses than does compressing its duration. The second pertains to supplementing the constructing
and protecting of the built environment with the resilience strategy of embedding ways of repairing
and reconstructing it more quickly in the aftermath of a disaster.

Basic definitions

The concept of economic resilience to disasters is often construed broadly to include actions taken
both before the event, as well as after the disaster strikes, in order to reduce losses in an overall risk
management strategy (Bruneau et al., 2003; Rose, 2016; Rose, 2017a).iii We find it useful to make
the distinction between mitigation, which is generally undertaken before the disaster and to define
resilience more narrowly to include actions implemented after the disaster strikes to promote
recovery.iv However, we emphasize that resilience is a process. Overall resilience capacity can be
enhanced prior to the disaster for implementation once it is needed (Tierney, 2007; Cutter, 2016;
and Rose, 2017a). Examples of such resilience capacity-enhancing actions include the purchase of
back-up electricity generators, stockpiling critical materials, and informational/learning actions such
as disaster resource planning emergency drills. These examples apply to the microeconomic level
(i.e., individual enterprises or organizations), but analogous pre-disaster resilience actions are also
applicable at the mesoeconomic, or industry/market level (e.g., the workings of markets through
price signals that reallocate scarce resources to their highest value use), and at the macroeconomic
level (e.g., importing goods that are in short supply within the affected region, reserve margins and
ancillary services markets in regional power grids).

Another important distinction is the difference between static and dynamic economic resilience.
The former refers to using remaining resources efficiently to maintain function (producing as much
as possible), while the latter is often characterized as investing efficiently in repair and
reconstruction in order to reestablish productive capacity as quickly as possible to regain function. It
is dynamic because it involves an active decision with a real opportunity cost that requires foregoing
the current use of resources in order to attain a higher level of future production capacity (Rose,
2017a).v Overall, static economic resilience works primarily within the existing system structure with
limited potential to promote full recovery, while dynamic resilience is intended to promote full
recovery through investment that can capitalize on revolutionary and evolutionary changes.

v The more general versions of static and dynamic resilience are usually ascribed to ecologists Holling (1973)
and Pimm (1984), respectively.

vi See, e.g., Hosseini et al. (2016), who provide a current comprehensive survey of related resilience research
for the interested reader.

Yet another important distinction is between inherent and adaptive resilience. The former pertains
to resilience that is naturally-occurring or otherwise already in place prior to the disaster (e.g.,
excess capacity, the operation of markets), and the latter pertains to deliberate enhancement (e.g.,
purchase of back-up generators and stockpiling). Adaptive resilience refers to improvisations made
after the disaster strikes (e.g., relocation, finding new substitutes for critical materials in short
supply). Practically all analyses to date have confined inherent resilience to the static
However, there is increasing awareness that it can also apply to dynamic economic resilience. A
major example is rethinking building materials and design considerations so that structures can be
repaired more quickly and cheaply.

Mitigation is the major strategy to reduce property damage from disasters. This refers to reducing
the frequency and magnitude of disasters by reducing the root cause(s) and “hardening” the target.
The outcome of the latter is often referred to as improving the robustness of the system. However, it
is important to note that mitigation also reduces lost production associated with property damage.
This is a major consideration for both individual businesses and the economy as a whole. The
magnitude of disasters is increasingly measured by the economic losses they cause. Most of the
attention to mitigation is on the destruction of buildings and infrastructure, but lost economic
output, often referred to as “business interruption” (BI), can be even larger than property damage in
major disasters. This is because supply-chain reactions radiate outward from the site of the disaster
and accumulate over the course of a protracted recovery. This was the case, for example, for
Hurricane Katrina, and the Wenchuan Earthquake. Mitigation reduces potential BI as a joint product
along with its protection of the capital stock, but the potential of dynamic resilience to reduce some
of the remaining BI losses has rarely been quantified.

Inherent dynamic economic resilience has important implications for risk, because it requires
investment prior to the occurrence of any disaster. This is in contrast to adaptive dynamic resilience,
which has been the subject of most of the literature (such as hastening the pays of insurance
payments from government assistance for repair and reconstruction of damaged), and which does
not require investment until after the disaster strikes. Hence, the benefits of the insurance dynamic
resilience require adjustment for the probability of occurrence of the disaster, while adaptive
dynamic resilience is implemented with perfect knowledge of the disaster having actually taken
place. Moreover, there are additional uncertainties pertaining to inherent dynamic resilience than in

the case of inherent static resilience in terms of the effectiveness of the resilience tactic. This is more
the case in the dynamic realm, as opposed to static inherent resilience (such as stockpiling or
purchasing backup generators), because various dynamic inherent resilience tactics to be discussed
below are relatively new and untested.

Dynamic economic resilience and the time-path of disaster recovery

Recovery from disasters is usually measured in terms of the time it takes the system to return to a
pre-disaster level, to a projected baseline level, or to what is now referred to as a “new normal” - a
sustainable post-disaster level of economic activity, such as the downsized economy of New Orleans
in the aftermath of Hurricane Katrina. On the one hand, economic recovery from disasters is about
the repair and reconstruction of buildings and infrastructure, along with social and political
institutions and the rehabilitation of the workforce. It is helpful to conceptualize this in terms of
stocks and flows. The major categories of economic inputs available for production (capital, labor,
and institutions) are fixed quantities, or stocks. What is variable, however, is the lost flow of
economic activity between the point at which the disaster strikes and the point at which it recovers.
This is determined primarily by the duration and time-path of the recovery. Recovery from disasters
and its time-path are linked through the concept of resilience. What has not been analyzed
adequately to date is the connection between the variability of disaster recovery and disaster flow
losses in terms of such indicators as economic output and employment, in contrast to property
damage. Dynamic resilience pertains to the reduction in these flow losses during the recovery period
by investment in repair and reconstruction so as to enhance future productive capacity, as opposed
to static resilience actions of efficiently reallocating resources to increase current production.

Referring again to Rose (2017a), dynamic economic resilience has two aspects:

. the ability to recover
. the ability to recover rapidly

The first aspect is typically straightforward and can readily be observed and measured; it is simply a
binary “yes” or “no.” The second aspect is more complex than might appear. Initially it is important
to distinguish resilience and recovery—they are not the same thing (Chang & Rose, 2012). Dynamic
resilience represents the possibility of both an acceleration in recovery and reduction in its duration
(the “recovered rapidly” aspect of the definition above). The measurement of dynamic economic
resilience thus requires a reference base, or baseline, recovery time-path to compare with the
accelerated, or more rapid, recovery path.vii The difference between the two, in terms of GDP or
employment, is the measure of BI losses averted by dynamic economic resilience during recovery.

vii In this brief essay, we do not address how to define this reference case and instead refer the reader to Pant
et al. (2012) and Xie et al. (2018).

Recent research by Xie et al. (2018) on the macroeconomic impacts of the Wenchuan Earthquake
indicates that jump-starting the disaster recovery will reap far greater BI loss reductions than
shortening its duration. This conclusion holds for recovery time-paths for disasters in general that
are linear, logistic (S-shaped), or exponential (i.e., most recovery paths), because relatively little of
the recovery is left to perform in the final year(s).

In effect, the earlier start and steepening of the recovery path has a compounding, or cumulative,
positive effect on loss reduction that increases with the rate of acceleration. This is particularly the

case for flows rather than stocks. Whereas stock losses are typically damaged plant and equipment
with a known, fixed replacement cost, flow losses early in a firm’s recovery period can also have an
additional adverse “snowball” effect over the duration of a recovery period with the potential for
significant secondary and tertiary losses in the future. For example, middle-size firms (firms with
annual revenues between $10 million and $1 billion, often referred to as the “middle market”),
which make up the bulk of the U.S. economy (Young, Greenbaum & Dormady, 2017), are in many
cases reliant upon contracts with larger firms (e.g., a machine shop contracted to make injection
molds for a multi-national electronics manufacturer). It behooves a small- or medium-sized business
to recover quickly so it does not lose its competitiveness for future contracts with current and
prospective customers.

The general time-path analysis and individual business example prompt us to reiterate the
importance of modifying standard definitions of dynamic economic resilience. The reference to
speed is too vague. It behooves analysts and decision-makers to distinguish between shortening the
duration of recovery and accelerating its time-path.

We offer one major caveat with respect to potential downsides of inherent dynamic economic
resilience. For example, in the haste to accelerate recovery, there is the possibility of giving an
adequate attention to tactics that can make the system (business, market, entire economy) less
vulnerable to future disasters. This also relates to promoting long-term considerations of adaptation
and sustainability. Therefore, assessment of the benefits of dynamic economic resilience of all forms
requires a careful examination of trade-offs between reducing current and future losses.

Inherent dynamic resilience tactics

Tactics to improve dynamic economic resilience are typically represented by: hastening debris
removal, reducing delays in the dispensation of insurance payments and government aid, increasing
the level of these investment funds for recovery, and technological change during the reconstruction
process. However, all of these examples are those of adaptive dynamic economic resilience, i.e., for
the most part, improvised after the disaster has struck and the rebuilding process has begun. Of
course, each of them can be enhanced prior to the disaster by having heavy equipment for debris
removal in place, reducing paperwork needed to obtain insurance payments and government
assistance, and having automatic triggers for government assistance to disaster areas. However, the
more prevalent approach in research and practice on this strategy is on improvising to increase and
accelerate each of these tactics, which pertains to the adaptive aspects.

Yet another strategy to improve dynamic economic resilience is via inherent resilience, exemplified
by modifying building materials and design, not only to make structures more robust, or disaster-
resistant, but also to make their restoration more rapidly forthcoming, and, ideally less expensive.
This goes beyond trying to make structures more durable toward the goal of making those that are
damaged capable of becoming operational again much faster. Examples would include materials less
likely to cause debris problems and more modular construction that facilitates repair (Benedetti,
Landi & Merenda, 2014; Jones, 2018).

Public policy can provide an additional stimulus to an inherent dynamic resilience strategy. There are
an increasing number of examples of local government regulations to establish target dates for
buildings and infrastructure to become habitable and operational more quickly following an
earthquake. Buildings and infrastructure provide the capacity for producing goods and services, and

providing jobs, upon which human well-being depends. This strategy is also being touted as a way to
promote recovery by preventing a protracted or even permanent mass exodus from a disaster area
(Rose, 2017b; Jones, 2018). Leadership in this initiative came from the San Francisco Planning and
Urban Research Association (SPUR) (SPUR, 2016). This was followed by similar efforts in Oregon and
Washington, and the attempt to standardize this in practice by the National Institute of Standards
and Technology (NIST, 2016; see also the comparison of approaches by Miles, 2018). Essentially, this
represents the setting of performance standards for recovery linked to time. The premier instrument
was building codes. However, the emphasis is not on reducing property damage for its own sake but
for reasons related to dynamic inherent economic resilience to promote recovery – stronger
structures are easier to repair. Over time, this will merge with the rationale in the previous
paragraph – more flexible structures are easier to repair.

Measuring dynamic economic resilience

We briefly summarize some aspects of our recent efforts to measure dynamic economic resilience
(Rose et al., 2017; Dormady et al., 2018). We are utilizing a survey instrument of disaster-affected
firms to pose questions such as:

1. How long did it take your business to recover?
2. How long did you originally expect it would take your business to recover?
3. What factors delayed recovery?
4. What factors expedited recovery?
5. Was the trend of your business’ time-path linear, logistic or exponential in shape?
6. What was your total business interruption (BI) loss during your recovery period?
7. What was your expected total business interruption loss during your recovery (assuming no
delays or expedited effort)?

Question 2 addresses the baseline or reference point. The difference between responses to Q1 and
Q2 provide the speed of recovery, a first step in measuring dynamic resilience. The difference
between Q6 and Q7 gives us a first approximation of the dollar value of dynamic economic
resilience. However, it is important to control for static economic resilience efforts that would also
affect avoided BI.

There are four main motivations for investment that have major implications for measurement:

1. Restoration/Replacement/Repair/Reconstruction of previous productive capacity. All of the
following have the goal of reestablishing original functionality:

. Restoration refers to efforts made in reinstating the equipment or facility to its original
character. This would be especially important if the original had historical, sentimental, or
special marketing value, but is not always possible.
. Replacement refers to obtaining or rebuilding a comparable piece of equipment or building.
However, in most cases one would be replacing equipment or facilities put in place in
previous years, and it is likely that the replacement goods would be more productive, even if
that were not the original intent.
. Repair refers to the range of patching up to overhauling damaged equipment or facilities to
reestablish their functionality.
. Reconstruction refers to extensive actions in rebuilding or re-fabrication.

2. Productivity Enhancement. This refers to explicit efforts to increase the level of output of goods or
services per unit of equipment/facility input. As noted above, it may not be intended, but is likely in
terms of replacing equipment. In other cases, it is an explicit decision. It may be attractive because it
affords an opportunity to achieve a goal that would not otherwise be economically viable if the
original equipment were still in place and did not actually need to be replaced.

3. Vulnerability Reduction in relation to future disasters. This is far from an automatic outcome. In
fact, many experts suggest that, as economic activity becomes more advanced, it becomes more
complex and less flexible, and hence more vulnerable within the firm and with respect to the supply
chain (e.g., Zolli & Healy, 2012). In one way, the situation is similar to productivity enhancement in
terms of the investment decision, whereby the disaster affords an opportunity, as well as the
realization of the worthiness, of reducing losses from future disasters.viii

viii We have omitted discussion of the expansion of productive capacity, which refers to the extension or
enlargement of equipment or facilities of the same type or nearly the same as the original during recovery.
We set this aside because it goes beyond recovery. One might say that this also applies to motivations 2 and 3
above, but they are part of the replacement process, even if they are intended for joint or other purposes.
Expansion investment is not.

In terms of obtaining data necessary to measure the cost-effectiveness of various types of
investment on avoided BI losses, caution is advised. Subtleties in the distinction between
motivations for investment often overlap or exist in complementarity on the effectiveness side. The
estimation of property damage represents a start as a reference point for quantifying the cost of
investment expenditures. However, investment need not equal standard damage estimates at
original cost minus depreciation, because the best estimate of the value of an asset (intact or
damaged) is replacement cost. The situation is also complicated by “demand surge,” which refers to
an oft-observed condition of increased construction cost following disasters due to a spike in
demand and damage to construction equipment and materials, as well as a shortage of construction
labor due to death, injury, or outmigration.


This paper has made the case for enhancing the standard definition of economic resilience, and
resilience in general. Dynamic resilience does in fact have an inherent aspect. In addition, the vague
reference in many definitions of dynamic economic resilience, and dynamic resilience in general, to
increasing the speed or reducing the duration of recovery is far too vague and actually emphasizes
the wrong attributes, where the more important one is jump-starting the process. A greater
emphasis needs to be placed on the time-path of the recovery and its shape. Both of these features
lead us to a revised definition of dynamic economic resilience as: inherent and adaptive efficient
tactics related to investment to reestablish functionality of the built environment so as to accelerate
and shorten the time-path of disaster recovery.


The authors wish to thank Igor Linkov and Ben Trump for their helpful suggestions for improving the
The case for systemic resilience: Urban communities in natural disastersStojadinovićThe Case for Systemic Resilience:
Urban Communities in Natural Disasters

Božidar Stojadinovici*

i Chair of Structural Dynamics and Earthquake Engineering, Swiss Federal Institute of Technology (ETH) Zurich,

Suggested citation: Stojadinovic, B. (2018). The case for systemic resilience: Urban communities in natural
disasters. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of
resilience for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center.
Available on and

Keywords: Systemic resilience, communities, natural disasters

*Corresponding author:

A system of systems: An urban community

A modern urban community bustles with life. We engage in work, business, entrepreneurship,
education, culture and entertainment to pursue our wishes and fulfil our goals. We flock to cities
that offer exciting opportunities and fulfilling experiences. As we take part and actively construct the
so-called higher-level societal functions of an urban community, seldom do we observe the built
environment that supports these functions (Figure 1). The roles of buildings that provide shelter, and
infrastructure systems that furnish basic services of power, water, transport and communication are
often taken for granted. The fundamental notion of resilience is far from the minds of average
citizens… until a natural disaster strikes.

Figure 1: Urban community functions (after (Southeast Region Research Initiative (SERRI) and Community
and Regional Resilience Institute (CARRI), 2009))

The systemic nature of a modern urban community, and the need for its resilience, becomes
painfully obvious in a natural disaster. Destruction of buildings crudely exposes their primary shelter
functions. Failure of an infrastructure system to deliver the expected services directly affects the
inhabitants and cascades to challenge other infrastructure systems as damage is absorbed.
Importantly, recovery is also systemic. Re-establishing the service of one infrastructure system
depends, often, on re-establishing the services of other infrastructure systems. Restoring the shelter
functions for community inhabitants is slower, with building repairs and reconstruction taking more
time and requiring more resources. Demand for infrastructure systems services is, in turn, directly
related to the re-establishment of the shelter functions, closing another systemic dependency loop.
And all this concerns only the resilience of the so-called front-line community systems, on which the
re-establishment of higher-level community functions clearly depends.

Systemic resilience of urban communities to natural hazards is a process of making the community
whole again or in some adapted form. Among the many definitions of resilience, some reviewed in
the first volume of IRGC’s Resource Guide on Resilience (
on-resilience/), I find the functionality-based concept, developed within the MCEER Centre and
presented by Bruneau and co-workers in (Bruneau, et al., 2003), appropriate for the built
environment and the civil infrastructure systems of modern urban communities. The swoosh-shaped
resilience curve they introduced is emblematic of the resilience process, while the four attributes
(robustness, redundancy, resourcefulness and rapidity) framed the engineering actions available to
increase the natural hazard resilience of communities, a goal aspired to by many and adopted in
practice by the select pioneering cities, such as those participating in the 100 Resilient Cities network

Community design for resilience

Lost in the shuffle of recovery are the unrecoverable missing, dead or wounded: it is the risk of large-
scale loss of life and limb that originally defined a natural disaster as a high-consequence low-
probability event. Civil engineers today routinely design elements of the built environment and
infrastructure systems of a community for life safety, under loads that span the gamut from
permanent and known to very rare and difficult to estimate, using the principles of performance-
based risk-informed design. In fact, it is because of robustness and redundancy built into the civil
engineering design codes that only low-probability events have high consequences in modern
communities. Thus, in the domains of risk and resilience for urban communities in natural disasters
are tightly intertwined.

Great earthquake disasters of the past decade (e.g. 2010 Maule earthquake in Chile, 2011-2012
Christchurch earthquake series in New Zealand, even the 2011 Tohoku earthquake in Japan)
demonstrate that a century of seismic design focused on life safety risks and investment in modern
built infrastructure paid off in terms of minimizing the casualties. On the other hand, damage to the
buildings and infrastructure systems was extensive, and the recovery and rebuilding is slow and
costly, straining not only the financial and material resources but also the social fabric of the
affected communities. The impetus for performance-based risk- and resilience-informed design is
strong: a probabilistic performance-based engineering paradigm developed within the PEER Centre
by Cornell and Krawinkler (Cornell & Krawinkler, 2000) provides a framework for defining and
attaining multiple design objectives. While life safety remains of ever-present concern, this
framework enables simultaneous consideration of damage and design for efficient and speedy

recovery. I find the resilience-based seismic design examples presented by Terzic and co-workers
(Terzic, Mahin, & Comerio, 2014) particularly illustrative because they explicitly include the costs of
business interruption during the recovery process in engineering decision making.

Civil engineers, however, design and build one element at a time. They are aware of systemic
aspects, but the design codes and the business practices in engineering design and construction
focus their attention on setting performance objectives for elements of the urban community and
achieving them element by element. This is significant drawback. Extending a performance-based
risk- and resilience-informed design paradigm from system element to the system level, and further,
to the community system-of-systems is clearly needed (Figure 2).

Figure 2: System- and element-level performance-based design process.

The first steps towards a systemic risk- and resilience-based urban community design have already
been made. Setting system-level urban community seismic resilience objectives was explored in the
San Francisco Planning and Urban Research Association Planning Resilient City project (San Francisco
Planning and Urban Research Association [SPUR], 2009). There, probabilistic targets for the provision
of shelter and infrastructure system functionality in a community struck by an earthquake are given
in terms of several points along the recovery curves. This is crucial: it embraces the dynamic nature
of the resilience process and sets out design acceptance criteria over a time horizon. De-convolving
the community-level resilience objectives to the level of the community’s built environment and
infrastructure system elements is the next step. One way to do this using a logic tree approach
borrowed from nuclear facility safety analysis was done by Mieler and co-workers (Mieler,
Stojadinovic, Budnitz, Comerio, & Mahin, 2015). Given element-level resilience objectives, engineers
can now design these elements considering their systemic resilience roles. To complete the design
loop, the system-(community)-level behaviour of the so-designed elements must be checked and
their individual and systemic resilience quantified. Composing the community systems (bottom-up,
building from their elements) and quantifying their system-level resilience during the recovery time
can be done using the Re-CoDeS framework (Didier, Broccardo, Esposito, & Stojadinovic, 2018).
Using Re-CoDeS, or another framework for system-level resilience quantification, a community
engineer can verify if the system-level community resilience goals have been achieved or not.

Our cities today

Today, urban planners and engineers seldom have a blank sheet to design urban communities from
scratch. Modern urban communities are systems of systems, built upon the constructions of
previous generations (i.e. legacy systems), and are continually transforming as they are being used.
The built environment and the infrastructure systems are not only interlaced spatially, but are also
interconnected in time, throughout their life cycle. Individual infrastructure elements and buildings
age and will, sooner or later, be transformed, re-engineered or replaced. Resilient urban

communities also transform with the changing needs and interests of their inhabitants, the evolving
population densities and resource flows, and the (r)evolution of technologies and industries. They
must also adapt to the changes in intensity and frequency of the natural disasters they may face on
an even longer time scale, a challenge of climate change that urban communities are just beginning
to recognize and tackle.

Systemic risk-based design against natural disasters tends to emphasize the robustness and
redundancy characteristics of urban communities. This can be costly: in the era of limited resources
and growing demands for them, dedicating a substantial portion to mitigate the effects of unlikely
events that may happen once in a relatively distant future, means depriving the community of other
more immediate needs and abandoning developments that may be more consequential in the
future. Conversely, systemic resilience-based design tends to emphasize rapidity and
resourcefulness of urban communities, investing future resources in effective damage absorption,
speedy and efficient recovery, and agile adaptation to new conditions. While placing the burden of
coping with natural disasters on future generations frees todays resources for other needs, the very
real life-safety risks must still be covered today by actively maintaining the service of existing
systems at the levels of function and safety needed to satisfy the community demands (for example,
the recent collapse of the Morandi bridge in Genova, Italy). This risk versus resilience trade-off
illustrates plastically the moral hazard facing the community decision makers.

Faced with continuous growth of risk exposure (primarily due to increase in wealth, asset
concentration and urban densification) and continuous degradation of the built environment and
civil infrastructure systems (primarily due to use and aging), modern urban communities must make
tough decision about their natural disaster resilience. These decisions are complicated by
uncertainties, not only about the likelihood and intensity of possible natural disasters but also about
future directions community development may take and the long-term implications of todays’
decisions that are difficult to foresee, and by constraints on the recourses a community can deploy
to increase its natural disaster resilience.

Resilient communities by systemic design

There is, clearly, a need for a balanced approach to increasing the resilience of modern urban
communities to natural disasters. Placing the problem solely in the context of civil engineering, even
using modern risk- and resilience-based design frameworks, is not sufficiently broad. Community-
level resilience objectives need to consider not only the consequences of a natural disaster, but also
the means the community has to deal with them now and its willingness to postpone dealing with
such consequences to the future (namely, the less risk versus more resilience conundrum).
Formulating resilience design objectives, as well as resilience metrics and ways to quantify systemic
community resilience, in terms useful to both civil and financial engineers is a start in the right
direction. Importantly, this expands the scope of possible actions to increase the natural disaster
resilience of communities from civil engineering measures to financial engineering measures and
combinations thereof. For example, a community could decide to implement some robustness- or
redundancy-increasing civil engineering measures now, while preparing for recovery by securing the
necessary resources in the future using financial instruments available on the bond or insurance
markets. Furthermore, such common resilience performance objectives and resilience metrics make
it possible to rationally quantify resilience in terms of costs and benefit. This is key to making
resilience-related community-level decisions, applicable over both short and long time horizons, that

fully account for the life cycle lengths of the built environment and civil infrastructure system
components as well as the long return periods of potent natural disasters.

Modern urban communities are complex systems of systems. They must be resilient to natural
disasters today, and their natural disaster resilience must only grow and become more systemic to
match community growth and meet the challenges of the future. Understanding their natural
disaster resilience requires a systemic approach, considering simultaneously the system-level and
element-level hazard exposures, as well as system and element risks and recovery patterns as well
as interdependencies. Increasing the resilience of modern communities is a systemic effort, requiring
synergistic civil and financial engineering actions, as well as consistent public policy, over a long
period of time. The civil and financial engineering community is developing frameworks and tools for
systemic resilience-based design, with the goal to make steering of complex community systems
through transformations towards a more resilient and, ultimately, a more sustainable state possible.
However, the crucial decision to implement such resilience-based community-level actions is with
the citizens. It is time to make the case for systemic resilience loudly and clearly: YES, it can be done!
Resilience of critical infrastructure systems: Policy, research projects and tools Theocharidou, Galbusera & GiannopoulosResilience of Critical Infrastructure Systems:
Policy, Research Projects and Tools

Marianthi Theocharidoui, Luca Galbuserai and Georgios Giannopoulosi*

i Affiliation European Commission, Joint Research Centre

Suggested citation: Theocharidou, M., Galbusera, L., & Giannopoulos, G. (2018). Resilience of critical
infrastructure systems: Policy, research projects and tools. In Trump, B. D., Florin, M.-V., & Linkov, I.
(Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected
systems. Lausanne, CH: EPFL International Risk Governance Center. Available on and

Keywords: Infrastructure, system, resilience, complexity, dependency

*Corresponding author:

Infrastructure resilience in EU policy and research

In the European Union, Council Directive 2008/114/EC (‘ECI Directive’) required Member States (MS)
to identify and designate European Critical Infrastructures (CI) towards improved protection. This
also triggered several MS to identify national CIs and sectors, promoting additional security
measures to be applied by operators (Setola, Luiijf, & Theocharidou, 2016). More recently, Directive
(EU) 2016/1148 (‘NIS Directive’) fostered increased security levels in networks and information
systems. Moreover, Horizon 2020 research funding is addressing topics such as CI protection, the
safety of transport and energy systems, and cybersecurity.

Complementing traditional risk management, security, and protection practices, resilience gains a
prominent role as the ‘umbrella’ term to cover all stages of crisis management. This aspect is also
prominent in emerging EU policy trends, wherein CI resilience acquires increasing importance and
links to a number of strategic priorities, as illustrated in Figure 1.

Figure 1: EU policy milestones towards resilience of CIs (see Annotated Bibliography for detailed policy

While risk concepts have undergone standardization (see International Organization for
Standardization [ISO], 2018), definitions and perspectives on resilience vary (Florin & Linkov, 2016).
At the EU level, differences in CI resilience interpretation are also reflected in research funded under
the Horizon 2020 programme (Herrera et al., 2018). Some projects focus on resilience aspects such
as resistance, absorption, response to a threat or hazard, timely recovery, and restoration of
systems/services. Some even include mechanisms for infrastructure hardening, for example, against
climate change. Others address the resilience of organizations, communities and social processes
that rely on these services and infrastructures. Another line of research tackles complexity and
emergent phenomena that cannot be solely understood by analysing individual components or

Valuable insights into the ‘science of resilience’ also originate at the boundary between research and
operational competencies. The EU-funded IMPROVER project has explored this thoroughly by
organizing workshops with critical infrastructure stakeholders, such as the series of ERNCIP-
IMPROVER joint workshops (Theocharidou, Lange, Carreira, & Rosenqvist, 2018) and three associate
partner workshops (Rosenqvist, 2018). Starting from experience gained from these experts
workshops, Petersen, Theocharidou, Lange, and Bossu (2018) argue that resilience implies a more
‘optimistic’ approach when compared to risk management, allowing operators to adopt a responsive
approach to crises. This empowerment is especially evident when they are faced with crisis response
exercises formulated in terms of resource unavailability, regardless of the cause. Also, Petersen,
Theocharidou, et al. (2018, p.1) highlight the progress inherent in passing “from protecting assets
from hazards to being able to continuously provide a minimum level of essential services to the
public”. These aspects are well reflected in the NIS Directive, which strongly focuses on resilience
and makes explicit reference to operators of essential services.

From threat-based to systemic thinking

Global scales and high degrees of interdependence are hallmarks of today’s networked
infrastructures (Rinaldi, Peerenboom, & Kelly, 2001). Dependencies may also federate exposures
associated with single assets and even originate new fragilities. Emerging systemic risks, which
“result from connections between risks” (Helbing, 2013; Kotzanikolaou, Theoharidou, & Gritzalis,
2013; Stergiopoulos, Kotzanikolaou, Theocharidou, Lykou, & Gritzalis, 2016), can result from various
triggers, bring multifaceted consequences, and display scarce predictability. The World Economic
Forum’s Global Risks Report (2017, p.7) points out how “greater interdependence among different
infrastructure networks is increasing the scope for systemic failures – whether from cyberattacks,
software glitches, natural disasters or other causes – to cascade across networks and affect society in
unanticipated ways”.

Comprehensively addressing the aspects mentioned above is one of the challenges in CI protection
today as we are moving from threat-based thinking towards a more systemic perspective (Zio, 2016).
This is characterized by an all-hazard approach to resilience analysis and strategy-making, wherein
exposures and failure likelihoods are integrated with concepts such as networked vulnerability and
coping capacity. The idea is that deeply investigating the architecture of networks can unravel
vulnerability paths inherent to systems and processes (Pescaroli & Alexander, 2016), laying the
groundwork for targeted prevention, mitigation, and recovery actions. Moreover, resilience
broadens the scope of what-if analysis with a proactive component, as it involves the ability of

systems to reconfigure, synergize and improve throughout critical circumstances, for example, by
means of adaptation.

Various frameworks have been proposed in recent times to articulate the overarching concept of
resilience. In O’Rourke's "Critical Infrastructure, Interdependencies, and Resilience" (2007) in
particular, key resilience qualities (robustness, redundancy, resourcefulness, and rapidity) are
combined with dimensions (technical, organizational, social, economic) into a “matrix of resilience
qualities”. The following discussion illustrates ways in which such dimensions are taken into account
in current projects and studies, in particular within the EU.

Technical dimension. The ‘Prevention, Preparedness and Consequence Management of Terrorism
and other Security-related Risks’ (CIPS) programme, 7th Framework Programme for Research and
Technological Development and Horizon 2020 include numerous projects devoted to CI modelling
and dependency analysis. These aspects are being addressed both in terms of structural complexity
and from the operational/dynamic perspective (Zio, 2016). Considering systems heterogeneity,
many emerging approaches are service-oriented, analyzing resilience in terms of supply-demand
balance throughout adverse perturbations (Ouyang, 2014). Scientific progress is also accompanied
by the development of tools such as JRC’s Geospatial Risk and Resilience Assessment Platformii and
Rapid Natech Risk Assessment Tooliii, which incorporate risk and resilience assessment methods for
various kinds of technological systems and promote the integration of layered analysis approaches.

ii GRRASP, available at

iii RAPID-N, available at

Organizational dimension. While working towards technological resilience remains a priority for CIs,
organizational processes (Hopkin, 2014, p. 108) need to be considered, too. A recent operators’
workshop (Theocharidou, Carreira, & Lange, 2018) highlighted how some CI operators don’t focus
exclusively on disruption likelihoods or causes, but also on the organization’s ability to stay
operational in spite of unexpected resource loss. Grote (2004) argues that, going beyond the
traditional uncertainty minimization approach, the industry needs to find ways to help people coping
with uncertainty. Employee resilience refers to an ability to thrive in a changing environment and it
is strongly linked with the organizational context. Resilient employees are better at handling
unexpected events, and training and learning mechanisms provided within the organization can be
the means to achieve these needed capabilities. Other aspects of interest include the ability of an
organization to re-assess itself and situations using a diverse set of skills and knowledge, to engage
all parts of the organization in problem-solving, to adapt and renew when necessary, to collaborate
in a dynamic network of actors, and more (Bram, Degerman, Melkunaite, & Urth, 2016b).

Social dimension. When considering the social context of a CI, national and local governments,
communities and households are important actors. In these contexts, CI resilience links with
city/regional resilience and, as such, interacts with civil protection and crisis management
mechanisms. Petersen, Fallou, Reilly, and Serafinelli (2018) point out that, during disasters, a gap
may be observed between public expectations and the realistic supply capabilities of operators.
Nevertheless, their study results indicate that the public may appear willing to tolerate reductions in
service during crisis. Thus, CIs should not be assessed in isolation from the community that they
serve. Indeed, the expectations and resilience capabilities of end users can play a significant role for
operators to set more realistic resilience targets or performance goals during crises.

Economic dimension. CIs today can be to a large extent privately owned. Thus, a key challenge for
regulators and governments is to encourage private industry to invest in resilience, especially within
current economic conditions and considering the changing environment infrastructures operate in
(World Economic Forum, 2017). Resilience should be viewed not only as cost but also as an
investment. From the resilience analysis perspective, interesting progress has been made on disaster
impact assessment of CI failures from an economic perspective, for example, by means of
input/output models and other techniques (Casagli, Guzzetti, Jaboyedoff, Nadim, & Petley, 2017).
Tracing economic flows can also allow us to understand plausible failure propagation patterns
involving CIs as part of a multi-sectoral system. Relevant topics involve the characterization of shock
types, as well as direct/indirect and stock/flow losses with their relative importance, non-market and
behavioural effects (Galbusera & Giannopoulos, 2018). Economic impact models are also being
integrated in analysis tools such as the above-mentioned GRRASP, and they can be considered a key
component of the overall resilience assessment cycle relevant to regulators and policy makers.

In addition to the above-mentioned matrix of resilience qualities, a number of other approaches
have been proposed for CIs. These include, for instance, the infrastructure report card from the
American Society of Civil Engineers (2017), the resilience matrices proposed in Linkov et al. (2013)
and the resilience cubes proposed in the SmartResilience projectiv, the IMPROVER framework for CI
resilience assessment (Lange, Honfi, Sjöström, et al., 2017b) (see Figure 2 for an illustration), the
Critical Infrastructure Resilience Index from the same project (Pursiainen & Rød, 2016), the
Resilience Measurement Index (RMI) by Argonne labs (Petit et al., 2013), the Benchmark Resilience
Tool (Lee, Vargo, & Seville, 2013) and the Guidelines for critical infrastructures resilience evaluation
by the Italian Association of Critical Infrastructures Experts (2016).


technicaleconomicorganisationalsocialCI risk assessmentCI risk identificationCI risk analysisCI risk evaluationCI risk treatment
(reducing threat, vulnerability, impact, etc.)
Communication and consultationMonitoring and reviewCI resilience assessmentCI resilience analysis(technological, organisational)
CI resilience treatment
(Improving the absorptive, adaptive and
restorative capacity)
User needs,
expectations or
CI resilience evaluationEstablishing the context
Figure 2: IMPROVER CI REsilience Framework ICI-REF (Lange, Honfi, Sjöström, et al., 2017b; Lange, Honfi,
Theocharidou, et al., 2017). Core areas of interest are, in this case, the technical, organizational and – to some
extent – social dimensions.

As for the development of structured analysis approaches, current trends include, for instance, the
complexity-based tiered approach proposed in Linkov et al. (2018) and dimension/scale-based tiered
approach from Galbusera and Giannopoulos (2016a). As illustrated in Figure 3, the latter approach is
being implemented in the GRRASP platform, which includes models belonging to different tiers.

Tier 1SECTORALANALYSIS-ontology-based data
retrieval-graph metrics on service
networks (e.g. power, ICT,
gas, traffic)
Tier 2CROSS-SECTORALANALYSIS-Interdependencies (e.g.
ICT/electrical grid)
-Dynamic Functional
Modelling of for CIs (DMCI)
Tier 3HIGH-LEVELSERVICE IMPACTANALYSIS-Leontief I/O modelstechnicaleconomicorganisationalsocial
Figure 3: Implementation of the dimension/scale-based tiered approach in GRRASP, with an emphasis on
technical and economic dimensions. Observe that many relevant techniques applied in the different tiers
involve network-based approaches, which allow for the assessment of both infrastructure topologies and
associated processes over time, for example, by means of flow-based models. Applications can involve, for
instance: specific infrastructures, such as transportation networks (Ganin et al., 2017); multi-layer systems,
such as in the case of the power grid and ICT infrastructure (Galbusera, Theodoridis, & Giannopoulos, 2015;
Theodoridis, Galbusera, & Giannopoulos, 2016); service and emergency recovery networks (Galbusera, Azzini,
Jonkeren, & Giannopoulos, 2016; Galbusera, Giannopoulos, Argyroudis, & Kakderi, 2018; Trucco, Cagno, & De
Ambroggi, 2012); cross-tier applications (Jonkeren, Azzini, Galbusera, Ntalampiras, & Giannopoulos, 2015).

Coping with potential resilience drawbacks: Prudential regulation and chains of trust

When considering CIs, many different resilience-building priorities coexist, given the number of
actors involved in service management, delivery, and consumption. Historical trends such as
liberalization and the development of global supply networks are radically affecting the investments
in efficiency, competitiveness, and complementarity among providers. At the same time, service and
liability fragmentation may introduce new threats, for example, in situations wherein service chains
operate with dangerously low safety margins (de Bruijne & van Eeten, 2007). In such situations,
detrimental failures may emerge also in the absence of external shocks (Helbing, 2013). Recent
studies observe how, today, systemic risk can emerge not only from technical factors but from moral
hazard as well (Dow, 2000). Moreover, moral hazard may, in turn, have both an individual and a
collective component.

Some propose the concept and practice of Corporate Social Responsibility (CSR) as a means for
organizations to self-regulate and meet social needs (Ridley, 2011). Complementary action channels

can be prudential mechanisms by regulatory bodies or the development of chains of trust (Boin &
McConnell, 2007). In current practice, prudential regulation can translate into collective actions such
as the running of stress tests (Borio, Drehmann, & Tsatsaronis, 2014). These and other similar
initiatives can allow for a better and more timely detection of misbehaviours, the design of
incentive/disincentive mechanisms to mitigate risk appetite and unawareness, as well as the
promotion of resilience strategies that meet public expectations and needs. An effective risk and
resilience strategy should not only mediate among diverse objectives (e.g. asset preservation, profit,
public safety and security). Instead, it should favour and benefit from synergies between private and
public resilience-building priorities. In this perspective, the development of chains of trust is another
emerging trend and aims at improving communication and understanding of complexity both among
operators and in a dialog between them and public authorities.

The European Reference Network for Critical Infrastructure Protection (ERNCIPv) is such a trusted
network of security-related experts volunteering to address pre-standardization issues at the EU
level (Gattinesi, 2018; Ward, Kourti, Lazari, & Cofta, 2014). Articulated into thematic groups (TGs),
ERNCIP addresses security-related technological solutions for CIs (see Figure 4). Despite its clear
security focus, most of the TGs have incorporated a resilience and systems thinking. This allows for
breaking down silos, reusing knowledge developed in one area to address security problems in other
areas where threats call for affine approaches, despite technological differences (e.g. CBRNE threats
to the water distribution network and to indoor environments), always taking into account the need
for business continuity and uninterrupted delivery of services.

v More information on the ERNCIP project available at:

Figure 4: ERNCIP Thematic Groups 2018 (Gattinesi, 2018).


As discussed above, CI resilience integrates traditional risk concepts while focusing on the entire
disruption-recovery cycle and underlying complexities. Transition, adaptation and transformation
processes seem fundamental both to observe, in order to enhance systemic understanding, and to
steer, in order to mitigate immediate and long-term impacts and to prepare for future events. These
concepts have not been fully explored or operationalized in the CI field, but there is on-going
interest, as reflected by recent EU-funded research (Herrera et al., 2018). Examples include the
H2020 RESIN project on adaptation measures for citizens infrastructuresvi, the H2020 EU-CIRCLE
projects on infrastructure resilience to today’s natural hazards to climate changevii or the H2020
HERACLES project on resilience of cultural heritages against climate change effectsviii. Beyond climate
change, other aspects are driving focus on transition, adaptation and transformation of
infrastructures, such as social changes, for example population rate increase, urbanization and
emergence of megacities.




This multidimensional treatment of resilience is also in agreement with current policy trends in
disaster risk reduction. This is the case of the Sendai Framework for Disaster Risk Reduction 2015-
2030 (United Nations Office for Disaster Risk [UNISDR], 2015), which “aims to guide the multi-hazard
management of disaster risk in development at all levels as well as within and across all sectors”. The
framework includes an articulated set of global targets, with CIs playing an ubiquitous role through
developing their resilience by 2030, including the ‘build back better’ principle. It considers the dual
aspect of damages both to facilities and services and links to the economic dimension.

The body of knowledge on CI resilience currently built is a valuable source for authorities and
operators to explore. Enabling the operationalization of resources, models and tools still requires
substantial efforts. A potential approach could include inventories of models, methods and tools
provided by specialists. Work on the interoperability of models is also needed, especially in relation
to current risk practises. Indeed, this volume aims to contribute to knowledge sharing in this domain.

Understanding technical, financial, political, reputational, and further priorities and constraints that
operators face can be a valuable tool for policy makers when they develop strategies for resilience.
At the policy level, challenges to be addressed include stakeholder engagement and incentives for
resilience in spite of conflicting interests and objectives.


This work has received funding from the European Union’s Horizon 2020 research and innovation
programme under grant agreement No 653390.


The views expressed are purely those of the authors and may not in any circumstances be regarded
as stating an official position of the European Commission.
Resilience analytics by separation of enterprise schedules: Applications to infrastructureThorisson & LambertResilience Analytics by Separation of Enterprise Schedules:
Applications to Infrastructure

Heimir Thorissoni and James H. Lamberti*

i Department of Engineering Systems & Environment, University of Virginia
Suggested citation: Thorisson, S., & Lambert, J. H. (2018). Resilience analytics by separation of enterprise
schedules: Applications to infrastructure. In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide
on resilience (vol. 2): Domains of resilience for complex interconnected systems. Lausanne, CH: EPFL
International Risk Governance Center. Available on and

Keywords: Resilience analytics, scheduling, systems engineering, strategic planning, scenario

*Corresponding author:


This article identifies literature and other resources for resilience analytics applied to infrastructure,
in particular when the emphasis is the disruption of preferences by alternative scenarios. It
recognizes that multiple, possibly conflicting, perspectives of politics, economics, demographics,
technology, environment, etc., are an inherent part of decision-making and plans and processes
need to be resilient to emergent and future conditions that might bring one or more perspectives
closer to the front. In a previous volume, the authors provided a review of definitions and
quantifications of resilience analytics (Thorisson & Lambert, 2016). Here, the focus is on applications
to infrastructure, with a motivating demonstration to building capacity for wireless broadband for
public safety agencies (Hassler & Lambert, forthcoming).

Infrastructure risk and disaster management

Agencies are put under considerable strain during disasters. The disruptive effects of disaster can
cascade across geographic, political, institutional, and other boundaries. For example, in September
2018, hurricane Florence made landfall on the United States East Coast. Populations in three states,
South Carolina, North Carolina, and Virginia, were evacuated from their homes and sought shelter
across the Southeast region of the country. Agencies responsible for transportation, public health,
education, and others needed to cooperate with local and federal first response and emergency
management agencies. In such a scenario, sharing of information and resources across different
agencies is critical. To support such data exchanges and facilitate communications, the United States
Congress approved in 2012 the creation of a nationwide interoperable public safety broadband
network (FirstNet). The enterprise systems planning for the FirstNet accounts for the interests of
local, state/territory, tribal and federal public safety agencies across the United States. In particular,
FirstNet planners are collaborating with public safety stakeholders and leadership from each state
and territory. The coming nationwide broadband network is thus aimed to meet needs of the agency
users as they protect communities and lives across the nation. Design and implementation of such a
system is subject to a variety of stressors and sources of risk. The objectives of several groups of

stakeholders must be balanced. Resilience analytics can be useful to explore the tradeoffs between
meeting objectives, accepting risk, and cost.

Risk and resilience

Resilience analytics as described in this article focuses on methods for identifying the perspectives of
a system (or particular risk scenarios related to the perspectives), that are most in need of
investigation, including risk analysis, simulation, experimentation, data collection and analysis, etc.
(Karvetski et al., 2009, Teng et al., 2012). It is complementary to traditional risk management by
focusing on how differences in priorities between stakeholders can pose risks to the system.

Resilience analytics identifies the perspectives that have the greatest potential to disrupt a
prioritization of system milestones/initiatives (Linkov & Trump, forthcoming). The perspectives that
are found to have a high disruptive potential are candidates for an in-depth investigation, including
an assessment of the consequences and likelihood of risks associated with the particular
perspective. Risk analysis often relies on being able to assess likelihood and consequences, while
resilience analytics can proceed without that assessment (Thorisson et al., 2017b).

In application, milestones of a system are prioritized such as to most effectively meet system goals
and objectives. This prioritization can vary between different system perspectives. In the
development of a public safety broadband network, at least three perspectives must be considered,
each representing a distinct group of key stakeholders:

. The government/regulatory perspective represents the owners of the system (and the
constituents they represent)
. The vendor perspective represents the technical developers and operators of the system
. The public safety perspectives represent the system users, public safety agencies

If there are large discrepancies between the perspectives about the prioritization of system
milestones, the system is less resilient as stakeholders do not agree on how to mitigate losses or
recover from disruptions. Multiple success criteria, measuring the goals and objectives of the
system, need to be considered. Table 1 describes ten identified criteria along with their relevance in
each perspective. Using multicriteria analysis (e.g., Karvetski et al., 2009), the coverage of criteria by
the system milestones (Hassler & Lambert, forthcoming), can be used to prioritize the milestones.
An aspect of resilience analytics is to identify milestones with large differences in priority between
perspectives to help guide further risk management. The different relevance of criteria to the
various stakeholder groups results in a different prioritization in each perspective.

Table 1: Success criteria to prioritize schedule milestones in public safety broadband networks, and their
relative relevance for three stakeholder perspectives.




Vendor relevance

Public safety

















Quality of Service








Standards Based












Risk Aversion





Figure 1 illustrates the prioritization of milestones in the development of a public safety broadband
network. The figure shows 22 milestones, ranging from promoting cyber security, to investing in
customer service, to developing data standards. The milestones are prioritized from the three
perspectives, allowing for comparison of prioritization across the perspectives. Some milestones,
such as x20: Invest in satellite services, have a wide range in priority among the three perspectives
(described above), suggesting these are vulnerable in case the schedule is disrupted. Others, such as
x04: Improve data source access, are consistently prioritized similarly. The variation of a milestone in
priority between perspectives can help guide risk management as a milestone with a large difference
could be a point of contention when negotiating recovery strategies following a disruption.

Figure 1: Prioritization of schedule milestones towards a public safety broadband network from three
perspectives: owner (regulatory), operator (vendor), user (public safety community).

System transitions and negotiations

The resilience (as a separation of priorities between system perspectives) has been quantified as the
absolute value of change in prioritization (Connelly et al., 2015, Parlak et al., 2012), the sum of
squares of ordering change (Hamilton et al., 2012), Spearman rank correlation coefficient (Thorisson
et al., 2017b, Kendall tau rank correlation (Hamilton et al., 2016, You et al., 2014a; You et al., 2014b).
Table 2 demonstrates the quantification of resilience from one perspective to another, measured by
the Kendall Tau correlation coefficient. The coefficient takes value 1 when all combinations of pairs
of milestones have the same order in two perspectives and value 0 when all pairs have the opposite
order. Thus, the agreement between the prioritizations in the vendor and public safety perspectives
is the lowest among the three perspectives, followed by the agreement between the vendor and the
regulatory perspective. Conversely, the regulatory and public safety perspectives have higher
agreement. This means that stakeholders in the vendor community have the most distinct priorities
among the three stakeholder groups, including priorities during adaptation or recovery from a

Table 2: Quantification of resilience from one perspective to another (Kendall Tau correlation coefficient)

Regulatory perspective

Vendor perspective

Public safety perspective

Regulatory perspective




Vendor perspective




Public safety perspective




Assessing how separate priorities of different perspectives are can be helpful when negotiating a
schedule, or a recovery plan following a disruption. Acknowledging the differences allows for
studying and addressing their root causes or building flexibility.

The methods described have been applied in various other sectors of infrastructure and
transportation, including power grid development (Hamilton et al., 2016; Thorisson et al., 2017),
disaster recovery (Collier & Lambert, 2018; Connelly et al., 2015; Lambert et al., 2013; Parlak et al.,
2012), development of electric vehicle bidirectional charging (Almutairi et al., 2018; Thorisson et al.,
2017a), aviation biofuels industry development (Connelly et al., 2015), and others.


Resilience analytics should be considered in the context of negotiations (Thekdi & Lambert, 2015) or
development of terms for design and operations of systems (Lambert et al., 2012). Resilience
analytics as described in this article does not replace traditional approaches of consequence and
likelihood-based procedures that analyze the effects of particular events or risk scenarios. However,
it adds a layer of preliminary analysis that considers the connections and interactions of
stakeholders on an enterprise level. Resilience analytics studies systems based on their schedules
and milestones, and disruption, recovery, and adaptation are considered in this light. Quantifying
how schedule priorities differ across stakeholder perspectives, and what milestones have the largest
discrepancies, provides a starting point for negotiating terms and furthermore identifies urgencies
for risk management. Thus, resilience is achieved by anticipating and accounting for the perspectives
and other factors that are identified to have the greatest potential to have cascading effects on the
overall schedule of implementation.
Resilience is a verbWoodsResilience is a Verb

David D. Woodsi*

i Department of Integrated Systems Engineering, The Ohio State University

Suggested citation: Woods, D. D. (2018). Resilience is a verb. In Trump, B. D., Florin, M.-V., & Linkov, I.
(Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience for complex interconnected
systems. Lausanne, CH: EPFL International Risk Governance Center. Available on and

Keywords Resilience engineering, adaptive capacities, graceful extensibility, adaptation

*Corresponding author:

Introduction: Poised to adapt

The title of this paper appears to violate grammar rules. But the violation runs in the opposite
direction — much too often we see resilience as a state to be achieved — something a system has,
when it refers to a set of capabilities for action, actually future action when conditions, challenges,
opportunities change. As Erik Hollnagel has said repeatedly since Resilience Engineering began
(Hollnagel & Woods, 2006), resilience is about what a system can do — including its capacity:

. to anticipate — seeing developing signs of trouble ahead to begin to adapt early and reduce
the risk of decompensation
. to synchronize — adjusting how different roles at different levels coordinate their activities
to keep pace with tempo of events and reduce the risk of working at cross purposes
. to be ready to respond — developing deployable and mobilizable response capabilities in
advance of surprises and reduce the risk of brittleness
. for proactive learning — learning about brittleness and sources of resilient performance
before major collapses or accidents occur by studying how surprises are caught and resolved

Resilience concerns the capabilities a system needs to respond to inevitable surprises. Adaptive
capacity is the potential for adjusting patterns of activities to handle future changes in the kinds of
events, opportunities and disruptions experienced. Therefore, adaptive capacities exist before
changes and disruptions call upon those capacities. Systems possess varieties of adaptive capacity,
and Resilience Engineering seeks to understand how these are built, sustained, degraded, and lost.

Adaptive capacity means a system is poised to adapt, it has some readiness or potential to change
how it currently works— its models, plans, processes, behaviors (Woods, 2015; 2018). Adaptation is
not about always changing the plan, model, or previous approaches, but about the potential to
modify plans to continue to fit changing situations. Space mission control is a positive case study for
this capability, especially how space shuttle mission control developed its skill of handling anomalies,
even as they expected that the next anomaly to be handled would not match any of the ones they
had planned and practiced for (Watts-Perotti & Woods, 2009). Studies of how successful military
organizations adapted to handle surprises provide another rich set of contrasting cases (Finkel,

Adaptive capacity does not mean a system is constantly changing what it has planned or does so all
the time, but rather that the system has some ability to recognize when it's adequate to continue
the plan, to continue to work in the usual way, and when it is not adequate to continue on, given the
demands, changes and context ongoing or upcoming. Adaptation can mean continuing to work to
plan, but, and this is a very important but, with the continuing ability to re-assess whether the plan
fits the situation confronted—even as evidence about the nature of the situation changes and
evidence from the effects of interventions changes. The ability to recognize and to stretch, extend,
or change what you're doing/what you have planned has to be there in advance of adapting. This
capability can be extended or constricted as challenges arise, expanded or degraded over cycles of
change, and redirected or become stuck as conditions evolve into new configurations. Extensibility is
fundamental to adaptive capacities that support resilient performance when future challenges arise
(Woods, 2015; 2018).

Systems are messy

All systems are developed and operate given finite resources and live in a changing environment. As
a result, plans, procedures, automation, agents and roles are inherently limited and unable to
completely cover the complexity of activities, events, demands. All systems operate under pressures
and in degraded modes (Cook, 1998). People and operations adapt to meet the inevitable
challenges, pressures, trade-offs, resources scarcity, and surprises. To summarize the point vividly,
Cook and Woods (2016) use a coinage from the American soldier in WWII: SNAFU is the normal state
of systems—where SNAFU stands for Situation Normal All ‘Fouled’ Up. With SNAFU normal, SNAFU
Catching is essential— resilient performance depends on the ability to adapt outside of the standard
plans as these inevitably break down. SNAFU Catching, however technologically facilitated, is a
fundamentally human capability essential for viability in a world of change and surprise (Woods,
2017). Some people in some roles provide the essential adaptive capacity for SNAFU Catching,
though this may be local, underground, and invisible to distant perspectives (Perry & Wears, 2012).

All organizations are adaptive systems, consist of a network of adaptive systems, and exist in a web
of adaptive systems. The pace of change is accelerated by past successes, as growth stimulates more
adaptation by more players in a more interconnected system. Growing technological and
productivity capabilities also grow interdependencies and scales of operation that invoke complexity
penalties and require trade-offs to cope with finite resources. The complexity penalties occur in the
form of changing patterns of conflict, congestion, cascade and surprise. Regardless of the advance,
SNAFU will re-emerge.

Improvements drive a pattern in adaptive cycles: effective leaders take advantage of improvements
to drive systems to do more, do it faster, and in more complicated ways. Growth creates
opportunities for others to hijack new capabilities as they pursue their goals. Success drives
increasing scale complexity which leads to the emergence of new forms of SNAFU and SNAFU
Catching, as systems become messy again. This can be observed in the rise of high frequency trading
in financial markets, in ransomware, and the influence of internet bots in elections, among others.

SNAFU Catching is essential for the viability of adaptive systems in complex worlds. But
organizations rationalize this core finding away on grounds of rarity, prevention, compliance. The
first claim is: SNAFUs occur rarely given the organization’s design thus investing in SNAFU Catching is
a narrow issue of low priority. The second claim is: there is a record of improvement that reduces

the likelihood/severity/difficulty of SNAFUs. Third, when SNAFUs occur, poor response is due to
people who fail to work to the rules for their role within the organization’s design.

These rationalizations are wrong empirically, technically, and theoretically. As organizations focus on
making systems work faster, better, and cheaper, they develop new plans embodied in procedures,
automation, policies, and forcing functions. These plans are seen as effective since they represent
improvements relative to how the system worked previously. When surprising results occur, the
organization interprets the surprises as deviations—erratic people were unable to work to plan, to
work to their role within the plan, and to work to the rules prescribed for their role. The
countermeasures become more stringent pressures to work-to-plan, work-to-role and work-to-rule
(Dekker, 2018). The compliance pressure undermines the adaptive capacities needed for SNAFU
Catching (such as initiative), creates double binds that drive adaptations to make the system work
‘underground,’ and generates role retreat that undermines coordinated activities.

In every risky world, improvements continue, yet we also continue to experience major failures that
puzzle organizations, industries, and stakeholders. SNAFU recurs visibly—in June 2018 IT failures
stopped online financial trading (TSB in the UK and Canadian Stock exchanges). Befuddlement arises
from a background of continued improvement on some indicators, coupled with surprising sudden
performance collapses.

This combination IS the signature of adaptive systems in complex environments. The scale
complexity that arises from changes to increase optimality comes at the cost of increased brittleness
leading to systems “which are robust to perturbations they were designed to handle, yet fragile to
unexpected perturbations and design flaws” (Carlson & Doyle, 2000, p. 2529). As scale and
interdependencies increase, a system’s performance on average increases, but there is also an
increase in the proportion of large collapses/failures.

Given that pursuit of optimality increases brittleness, why don’t failures occur more often?—SNAFU
Catching. Adapting to handle the regular occurrence of SNAFUs makes the work of SNAFU Catching
almost invisible (Woods, 2017). The fluency law states: well adapted activity occurs with a facility
that belies the difficulty of the demands resolved and the dilemmas balanced (Woods,
2018). Systems that continue to adapt to changing environments, stakeholders, demands, contexts,
and constraints are poised to adapt through enabling SNAFU Catching (Cook & Woods, 2016).

Continuous adaptability

How can organizations flourish despite complexity penalties? Answers to this question have
emerged from research on resilient performance of human adaptive systems. For organizations to
flourish they need to build and sustain the ability to continuously adapt. Today this paradigm exists
in web engineering and operations because it was necessary to keep pace with the accelerating
consequences of change as new kinds of services arose from internet fueled capabilities (Allspaw,
2015). Web-based companies live or die by the ability to scale their infrastructure to accommodate
increasing demand as their services provide value. Planning for such growth requires organizations
to be fluent at change and poised to adapt. Because these organizations recognize that they operate
at some velocity, they know they will experience anomalies that threaten those services.

Web engineering and operations has served as one natural laboratory for studying resilience-in-
action (emergency medicine and space mission management are other examples). Outages and near
outages are common even at the best-in-class providers. Past success fuels the pace of change.

Systems work at increasing scale in a constantly changing environment of opportunity and risk. Web
engineering and operations is important also because all organizations are or are becoming digital
service organizations. For example, recently multiple airlines have suffered major economic losses
when IT service outages led to the collapse of the airlines ability to manage flights. Results from this
natural laboratory help reveal fundamental constraints on how human adaptive systems function.

Organizational systems succeed despite the basic limits of automata and plans in a complex,
interdependent and changing environment because responsible people adapt to make the system
work despite its design—SNAFU Catching.

Four capabilities provide the basis for continuous adaptation. Initiative is essential for adaptation to
conflicting pressures, constant risk of overload, and inevitable surprises (Woods, 2018).
Organizations need to guide the expression of initiative to ensure synchronization across roles
tailored to changing situations. This requires pushing initiative down to units of action (Finkel,
2011). Initiative can run too wide when undirected leading to fragmentation, working at cross-
purposes, and mis-synchronization across roles. However, initiative is reduced or eliminated by
pressure to work-to-rule/work-to-plan, especially by threats of sanctions should adaptations prove
ineffective or erroneous in hindsight. Emphasis on work-to-rule/work-to-plan compliance cultures
limits adaptive capacity when events occur that do not meet assumptions in the plan, impasses
block progress, or when opportunities arise.

Resilience engineering is then left with the task of specifying which system architecture balances the
expression of initiative as the potential for surprise waxes and wanes. The pressures generated by
other interdependent units either energizes or reduces initiative and therefore the capacity to
adapt. These pressures also change how initiative is synchronized across roles and levels. The
pressures constrain and direct how the expression of initiative prioritizes some goals and sacrifices
other goals when conflicts across goals intensify.

Effective organizations build reciprocity across roles and levels (Ostrom, 2003). Reciprocity in
collaborative work is commitment to mutual assistance. With reciprocity, one unit donates from
their limited resources now to help another in their role, so both achieve benefits for overarching
goals, and trusts that when the roles are reversed, the other unit will come to its aid.

Each unit operates under limited resources in terms of energy, workload, time, attention for carrying
out each role. Diverting some of these resources to assist creates opportunity costs and workload
management costs for the donating unit. Units can ignore other interdependent roles and focus
their resources on meeting just the performance standards set for their role alone. Pressures for
compliance undermine the willingness to reach across roles and coordinate when anomalies and
surprises occur. This increases brittleness and undermines coordinated activity. Reciprocity
overcomes this tendency to act selfishly and narrowly. Interdependent units in a network should
show a willingness to invest energy to accommodate other units, specifically when the other units’
performance is at risk.

Third, a key lesson from studies of resilience is that tangible experiences of surprise are powerful
drivers for learning how to guide adaptability. Tangible experience with surprises helps organizations
see SNAFU concretely and to see how people adapt as difficulties and challenges grow over time.
Episodes of surprise provide the opportunity to see when and how people re-prioritize across
multiple goals when operating in the midst of uncertainties, changing tempos and pressures.

Fourth, proactive learning from well-handled surprises contributes to re-calibration and model
updating (Woods, 2017). This starts with careful study of sets of incidents that reveal SNAFU
Catching (Allspaw, 2015). What constitutes an ‘interesting’ incident changes. Organizations usually
reserve limited resources to study events that threatened or resulted in significant economic loss or
harm to people. But this is inherently reactive and many factors narrow the learning possible. To be
proactive in learning about resilience shifts the focus: study how systems work well usually despite
difficulties, limited resources, trade-offs, and surprises—SNAFU Catching. In addition, effective
learning requires organizations to develop lightweight mechanisms to foster the spread of learning
about SNAFU Catching across roles and levels.

Resilience is a verb that refers to capabilities that build and sustain the potential for continuous
adaptability. Only few organizations can ‘do’ resilience, but these systems provide the ‘proofs’ of
concept that can guide all organizations to develop the adaptive capacities needed to flourish in an
increasingly interdependent world as the velocity of change accelerates.
Managing energy transition through dynamic resilienceYoung & WilkinsonManaging Energy Transition Through Dynamic Resilience

Martin Youngi* and Angela Wilkinsoni

i World Energy Council

Suggested citation: Young, M., & Wilkinson, A. (2018). Managing energy transition through dynamic resilience.
In Trump, B. D., Florin, M.-V., & Linkov, I. (Eds.). IRGC resource guide on resilience (vol. 2): Domains of resilience
for complex interconnected systems. Lausanne, CH: EPFL International Risk Governance Center. Available on and

Keywords: Dynamic resilience, energy transition, learning, practice

*Corresponding author:

Energy transition in a new era of emerging and systems risks

Energy transitions are not new with modern societies flourishing through previous technology-led
energy transitions, including steam-power and electrification. However, managing a global scale
energy transition is an unprecedented recent phenomenon which presents new risks and
opportunities for societies across the world. Some of the risks could manifest with disruptions of
current arrangements, and some incumbents may be abruptly and very negatively affected.
Developing resilience ahead of potential regime shifts could help them recover, rebound and adapt.
“With accelerating energy systems integration, resilience is no longer just about returning single
assets to full operation after a disruptive event. When interdependent parts of a system are blacked
out, the system as a whole is at risk of being deadlocked” (WEC 2016a).

The Grand Transition described by the World Energy Council (WEC 2016b) is not restricted to energy
with faster and fundamental changes becoming apparent. Energy challenges emerge from an
interplay of global megatrends – digitalisation, decarbonisation, and decentralisation – and combine
with regional and local developments to transform energy demand, services and systems. A new era
of digital economic productivity and emerging artificial intelligence is raising big questions about the
role of energy and the outlook for human-centric well-being / flourishing.

Recent progress in aligning international action on reducing energy-related carbon emissions are not
sufficient to guarantee a successful and timely low carbon global energy transition. And other
energy-related challenges are evident in enabling a next era of global productivity, inclusive
prosperity, human-centric wellbeing and peace.

Successfully navigating energy transitions presents a wicked situation, rather than a simple problem
(Rittel & Webber, 1973). Defining and driving successful and well-managed energy transitions
requires attention to the socially messy, multi-scale, and multiple dimensions of the connected
challenges of better lives for all and a healthy planet. The diversity of regional energy systems and
national energy security contexts has led to increasing recognition that ‘one size fits all’ solutions are
ineffective to the common problem of global energy transition. Each country will have its own
unique energy transition dependent upon its culture, natural resource endowment and policy

Energy systems themselves are becoming more diffuse, due to market fragmentation and
technological change with a more diverse cast of energy actors that are also dividing responsibility
for energy security and grid reliability.

The global energy transition is not just about managing new types of emerging and systemic risks
but also realising new opportunities for energy systems to evolve faster than ever before. This
introduces two new imperatives for action beyond conventional competitive strategies and better
risk management – improvisation, cooperation – and, in turn, shifts the emphasis from better risk
management tools to building dynamic resilience capabilities to sudden or unpredictable changes.
The resilience of energy firms to specific events or systemic shifts is not in their direct control but
can be enhanced by situational awareness of different types of risk and preparedness for new future

Integrated risk management and the search for dynamic resilience capabilities

The risk space that the energy market players manage is evolving into a broader landscape of
systemic and emerging risks - such as increasing price volatility, cyber security, and extreme weather
events - due to a combination of urbanisation and climatic variability, and in some cases increasing
evidence of impacts of global climate change.

The unfolding and evolving risk landscape is fast moving and unpredictable, which is likely to leave
some energy system players blind to emerging threats and less prepared if they continue to rely on
passive system buffers to provide energy security, such as strategic reserves or grid integrity. New
risks such as cyber security challenges to operation systems can overwhelm the unprepared where
existing response strategies are not necessarily useful.

In parallel with the evolving risk landscape, a new opportunities agenda for global energy systems
transition is being emphasised, which aims to deliver deep decarbonisation and other goals.
Achieving the UN Sustainable Development Goals and Paris Climate Agreement will require flexible
cooperation across energy- and policy domains and adjacent sectors (e.g., transport, finance, and

The new risk landscape requires a more agile and adaptive response framework with a greater
emphasis on resilience and rapid recovery. In this environment, energy stakeholders are starting to
experiment with responsive, networked and innovation-rich strategies as energy leaders shift their
focus from better risk management to building new dynamic resilience capabilities. This shift reflects
a gradual recognition that the traditional risk management approaches to control risk are no longer
sufficient and that greater systematic resilience is required to enable more agility, adaptation and
regeneration by energy firms, sectors and communities.

An energy-focused framework

The World Energy Council has been developing a Dynamic Energy Resilience (DER) framework for
the purpose of helping energy firms and communities improve their approach to resilience to
endogenous or exogenous shocks and disruptive innovations. It integrates three previously separate
systemic and emerging risk themes i) extreme weather or natural hazard, ii) digital or cyber risks and
iii) food-energy-water nexus with a practical focus on risk identification and assessment, situational
awareness and prevention-mitigation plans (WEC 2018).

Extreme Weather / Natural Hazards

Extreme weather event impacts on energy systems can be associated with i) repeating patterns or ii)
shifting weather regimes due to climate change. Energy systems are already impacted by extreme
weather events such as flooding, drought, hurricanes etc. as well as weather patterns (e.g., El Niño,
Monsoon) but climate change is anticipated to increase the frequency and severity of extreme
weather events.

Digital / Cyber Risks

Digital risks are a novel and evolving challenge that is difficult to assess using conventional risk
analysis methods. Cyberattacks are expected to increase with the shift from mechanical and
centralised energy assets to the new operational-plus-digital systems implied in the digitalisation-
decentralisation transition. The key interface between operational and digital elements can
mismatch and increase the risks for human error or malicious attack (Ciborra, 2001). Energy firms
and others are highly sensitive about discussing cyber risks and their impacts so a different approach
is required where a dialogue between leaders in digital and energy sectors could be useful.

System Risks – Food-Energy-Water Nexus

Systemic risks of increasing connectivity, like the food-energy-water nexus when managing global
value chains, requires attention to interdependencies between the different sectors and levels.
Systemic risk emerges from within the complex adaptive systems characterised by the many-to-
many interests and needs. Energy players need to anticipate how they can prepare for systemic risks
emerging from the dynamic interactions of multiple systems and global supply chains, particularly in
the drive to “circularity”.

The DER framework identifies a combination of four capabilities: i) situational awareness of all risks
(current / potential); ii) agility (speed); iii) adaptive capacity to prevent or mitigate impact on
performance (flexibility/optionality); and iv) regenerative development i.e. the evolution / self-
transformation of energy organisations and systems to promote synergies in human-centric
wellbeing, planetary health and socio-economic flourishing.

The framework is being developed thorough engagement with the emerging global community of
practice to draw on the new and different experiences and new solutions firms within the energy
sector and beyond are using to improve their organisational and energy system resilience – agility,
adaptability, regenerative capabilities – including:

• Governance and culture
• Financial mitigation
• Operating through crisis
• Short vs. long term energy security
• Diversification/pricing in redundancy

Comparing approaches to risk governance and dynamic resilience

The Council’s Dynamic Energy Resilience framework and the IRGC’s Risk Governance Framework
(IRGC 2017) overlap with each other although they focus on differing aspects and derive from
different approaches.

The academic-led IRGC framework provides greater delineation of the differing tasks for risk
identification, categorization and evaluation while the practise-led DER framework reflects more on
the organisational capabilities for agile risk management, adaptive capacity, and ability to self-
transform, i.e., on strategic renewal.

The IRGC Risk Governance Framework challenges the linear, predictive and control-based approach
of identify, assess, manage, communicate risks and highlights the need for a more integrated,
learning-based approaches to risk management.

Similarly, the DER framework highlights systemic risks that emerge between conventional risk
categories or policy silos, and impact before significant trends are fully visible. This suggests new
capabilities for horizontal learning, improvisation in crisis and integrated innovation are needed
which are enabled through a “team of teams” culture and connects risk appetite with context and

An iterative, four capabilities framework, in turn, can help develop double -and even triple-learning
loops which involve systems thinking and futures framing about the co-evolution of context and
capabilities, and avoid the trap of looking only for expected performance. Dynamic resilience is not a
theory-led risk-based tool, it is a practice-led, organisational capability which is supported by a
culture that does not rely on either the numbers to speak the truth or winning through competitive

Dynamic resilience adopts a stance of learning with multiple futures, rather than the conventional
risk-based approach of reducing uncertainty to enable control of the future. The emphasis is on
anticipating, appreciating and addressing disruptive changes, which are characterised by novelty and
uncertainty, by triggering improvisation and accelerating experimental, interactive and collaborative

Barriers and facilitators of dynamic resilience

Knowledge sharing across diverse energy firms and communities has already highlighted the
following insights about progressing dynamic resilience:

1. Energy players need to move beyond passive security measures and develop capabilities in
dynamic resilience, working across different realities of weather, water, cyber, price volatility,
and other systemic and emerging risks. Dynamic resilience also involves creativity – improvisation
through crisis.

2. Regional integration can enhance energy systems resilience but is not straightforward. Political
economy risks such as politicians exposed in event of national shocks, and lack of mutual trust
between diverse energy actors and systems can constrain regional interconnectivity.

3. Digital technologies provide many new opportunities but may also expose the energy system to
new risks such as cyber-attacks. Substantial technological coordination is required to avoid
regionally integrated and physical-digital interfaces suffering catastrophic cyber failures, whether
from malicious or unintentional causes.

4. Regulation can empower resilience by encouraging energy systems to plan for resilience and
counteract the tendency to focus on economic efficiency alone that can remove shock absorbers
from the system and accelerate path dependency towards a crisis from ‘lock in’. But energy
system resilience cannot be achieved without economic efficiency, and regulation can be slow.

Some level of productive or regenerative redundancy is beneficial although how to create buffers
that are economically productive is poorly understood. Moreover, the opportunity to enable
system circuit breakers has yet to be considered where policymakers and regulators could do
more to promote policies to encourage dynamic resilience. More secure systems are costly and
while those costs will fall with time, it is unclear if countries are evaluating the cost of security in
terms of resilience by assessing energy system risks against affordability.

5. Mutual aid schemes can help and there are mutual resilience fund clusters in the nuclear sub-
sector which also has peer reviewed security policies and a common insurance fund. This
approach could benefit other sub-sectors.
Style Switcher

NOTE: Vertical headers will not work on pages that have the naked header enabled