A hazard is a potential adverse natural or human-induced physical event or trend that may result in business closure, injury or other health impacts, loss of life, damage and loss to property, infrastructure, service provision, ecosystems, and environmental assets. Potential hazards both proliferate and become more complex and drive the need for improved resilience. They tend to be extreme events and may include, and be exacerbated by pandemics, disruptive technologies, increasing levels of interdependent infrastructure systems, terrorist attacks, cyber-attacks, climate change and more frequent natural disasters of greater severity, global financial shocks and large-scale disruption of supply chain systems, and higher levels of customer expectations.
Risk management approaches often overlook events that are unpredictable or that have a low probability of occurrence coupled with high consequence. Resilience analysis supplements standard risk management frameworks and aims to identify these unpredictable or low probability/high consequence events so that mitigation processes and measures can be implemented to deal with these.
Resilience analysis can include, depending on the nature of the hazard, the complexity of asset systems, operating environment, and other factors such as:
-
Identification of critical customers, processes, and assets, to determine minimum levels of service requirements for these.
-
Assessment of the consequences of hazards in terms of service disruption and other economic, social, and environmental impacts. This could be done by assessing all the hazards or by assessing the consequences for a particular type of hazard. Determining current levels of vulnerability or resilience of assets or asset systems, considering factors such as assets’ design parameters and ability to withstand shocks, asset redundancy, system modularity and the interconnectedness of infrastructure systems.
-
Determining current levels of organizational resilience and ability to deal with and recover from shocks, whether the organisation’s leadership and culture is suitably agile and adaptable to deal with hazards, and the systems, processes, and relationships in place to deal with contingencies.
-
With consideration of the needs of critical customers, other customers, and assets, determine appropriate levels of resilience during the crisis or emergency response as well as asset system or business recovery phases.
-
Develop strategies, actions, and plans to meet the requirements of resilient levels of services.
-
Contingency plans, also referred to as business continuity plans, include crisis management plans, disaster management plans or emergency response plans, and depending on context, other factors such as:
-
Identification of critical services, functions, and assets.
-
Identification and classification of hazardous events, crises, incidents and disasters by type and the strategies and actions for responding to these, based on prepared and tested scenarios.
-
Strategies and planned actions that should, as appropriate, deal with emergency responses, crisis management, asset system recovery, business recovery, and business resumption.
-
Establishing the level of command and the person in charge of each event type, inclusive of responsibilities and authorities, as well as escalation processes defining changes in structures, communication and reporting lines as an incident escalates.
-
Identifying other support organizations with their specified responsibilities, needed for each type of event (or phase of an event).
-
Reference to all needed contacts required during all scenarios.
Contingency plans should be formally approved by senior management and communicated and coordinated with stakeholders including customers, suppliers and other crisis or disaster management agencies as appropriate. Contingency planning is a continuous process of implementation, review, testing and updating or improvement. Personnel responsible for the management of contingencies must be periodically trained and responses tested to ensure preparedness. Contingency planning also requires identification and responses to new hazard types as the organisation’s operating environment changes and evolves.
Following the realization of a hazard event, the organization should undertake an appraisal of the event, its impact, the effectiveness of the organisation’s ability to adequately respond to the event, and improvement needs.