Risk management is not enough: a conceptual model for resilience and adaptation-based vulnerability assessments

The US government has focused considerable attention on enhancing our society’s ability to protect critical systems and services from disruptive events. Over the past decade, federal agencies have bolstered their efforts to identify and minimize threats using traditional risk-based approaches such as continuity of operations and disaster risk reduction processes. However, these valuable risk identification and management tools are limited because they rely upon foreseeable factor analyses of steady-state systems with predictable hazard frequencies and severities. In assessing the capability of complex adaptive systems to cope with disruptions, an overemphasis upon engineering resilience through risk management and planning for what is predictable may cloud or detract from our efforts to better understand a system’s emergent capabilities to withstand disruptions that are unforeseeable. This article contends that augmenting traditional risk approaches through the incorporation of methodologies grounded in socio-ecological system (SES) resilience principles offers a potential avenue for improving our agencies’ abilities to assess and manage both known and unknown risks. We offer a notional rationale for broadening our examination of system vulnerabilities and present a conceptual model that combines engineering and SES resilience paradigms to facilitate the identification, assessment, and management of system vulnerabilities. The Military Installation Resilience Assessment model described herein applies risk and resilience principles to evaluate whole systems, focusing on interconnections and their functionality in facilitating response and adaptation.