Let’s start by asking ourselves if our book « Improving Sustainability through Reasonable Risk and Crisis Management (Oboni F., C. Oboni,, ISBN 978-0-9784462-0-8, 2007, www.oboni.net ) could have been entitled instead “Improving Resilience through Reasonable Risk and Crisis Management “?
First of all let’s note that some authors rightly consider and explicitly state that Risk Assessment/ Risk Management are the first step towards a resilience improvement study, and remain at the heart of any attempt to increase the resiliency of a system. We also note that Riskope’s approach has always covered risks as well as crises, and we have always encouraged our clients to establish Crises Plans/ Business Resumption and Continuity Plans, Disaster Recovery Plans, based on scenarios developed during Riskope’s studies.
After a wide spectrum literature search, it appears that a first major difference between a “classical” (meaning “current”) risk mitigation study and a “pure” (meaning “extreme”) resilience improvement study lies in the fact that the second does not examine in detail the causes of negative outcomes against which the system has to be protected.
That approach sounds however rather simplistic, as shown in the following example: assume that the subject under scrutiny is a ship-loader and that the metric for risk is business/ service interruption (BI). In a risk assessment we will seek to assess the probability of occurrence of certain BIs and formulate scenarios capable of producing them aiming then to define appropriate risk mitigation measures. A resilience improvement study would instead define what should be done to reduce the impacts of a BI of more than, say, 1,000 hours, regardless of the cause. Of course, without knowing what caused the arbitrarily selected 1,000 hours BI, it would be difficult to imagine how to protect the system! Undoubtedly, if the cause was for example a local fire, which would leave the entire adjacent civilian infrastructure intact, we would be in a very different situation than in the aftermath of a major earthquake or a nuclear accident “Fukushima-style”!
The only “excuse” to justify the use of “extreme” resilience improvement studies rather than a risk mitigation study seems to be able to prepare protective plans for events with a very low estimated probability; as a matter of fact, the slogan used by promoters of this approach is “let’s think about the unthinkable”. So, we could say that “extreme” resiliency improvement studies would protect users against the “Human universal optimism” trend in the estimation of probabilities. Unfortunately, we Humans also have very short memory and bad habits such as the one of considering rather common events as Black Swans would push users of “extreme” resilience improvement studies to unsustainable mitigative investments. Let’s not forget that a proper, logical risk assessment process defines scenarios and pushes the reasoning to “think about the unthinkable” as well, where “unthinkable events” have a probability -p- set at the limit of human credibility (10-5 (one in hundred thousand) to 10-6 (one in a million)), a range that is “universally agreed” through many industries . No need to invent “new unthinkable” stuff!
“Extreme” resilience improvement studies ” bypass the risk scenarios definition and look at possible extreme damages (Consequences-C-) caused by unspecified “catastrophes”, placing themselves systematically at –Max C-, with -p- as low as an unspecified “unthinkable” can be, regardless of the scenario that could have led to this point …. asteroid, terrorist attack, etc. Resilience improvement studies thus avoid relying on probability estimates, which, if presented improperly or ill-conceived, might give a false impression of precision. Instead they will look to major consequences scenarios, and discuss how to mitigate them.
If this seems to constitute a very conservative approach, it is very likely that it would lead to higher “unjustified”mitigative costs , and almost certainly to biased allocation of funds, compared to what would result from a proper risks assessment taking into account estimates of the probabilities of occurrence.
Some resilience improvement studies seem to follow a more balanced process analyze the hazards, develop a list of possible scenarios, define p, C for each scenario; however, they generally end up biasing for unspecified small p / large C scenarios.
It can be concluded on this basis that resilience improvement studies and risk mitigation studies are virtually identical except for the phase of risk prioritization and decision making / action plan. Naturally, as already in proper day-to-day practice, risk mitigation studies will address extant mitigative measures and controls (NB: in fact, these controls and mitigations are already part of the system’s resilience).
Resilience is generally defined as the:
“Capacity to maintain the continuity of activities Even In The Face of Threats, disaster, and adversity ….”
So a resilience improvement study has to formally include actions that are already part of good management practices such as Business Continuity and Resumption Plans, Recovery Plans, Disaster Recovery, etc. …
These points having been clarified, the first question still remains open: what distinguishes a risk mitigation study from a resilience improvement study?
In Riskope’s (www.riskope.com) daily practice studies, for example on logistic nodes (critical infrastructure) such as mineral ore ports, risk studies consistently turn in the direction of resilience because, if a disaster strikes the node, it is essential to ensure operations continuity with alternative solutions/routes. We would even say that a good Risk Management approach must necessarily lead to solutions aimed at increasing resilience to avoid massive and too costly insurance contracts. Incidentally, if an industry is hit by disaster, and is unable to react, thus displaying insufficient resilience, it will have its image severely tarnished, perhaps forever!
This view is also supported by other professional groups / researchers, such as, for example, http://www.cmcc.it/research/research-projects/concluded-projects/freeman , T. Mitchell and K. Harris, Resilience: A risk management approach, ODI Background Notes, January 2012; S. McManus et Al., Resilience Management, A Framework for Assessing and Improving the Resilience of Organisations, Resilient Organizations, New Zealand, Research Report 2007/01.
At this point let us note that none of the elements listed above (Business Resumption/ Continuity Plans, Recovery Plans, Disaster Management, etc..) has the power to change the cost of the immediate consequences of an event, but may strongly influence the duration to recovery, which causes a reduction of -C-. Note also that none of the above alters the value of -p-, whatever it might be.
So ultimately it is not really necessary to invent new buzzwords to solve problems that we have known how to solve for a long time!
