Incorporating Resilience across the Preparedness, Protection, Response, and Recovery Spectrum – Findings from Organizational and Systems Theory and Practice

Abstract

Organizational theory and disaster research provides vital insights into the behavior and complexity of the systems we want to protect and the organizations that manage them. This presentation examines their trajectories and contribution to the emerging idea of resilience as an infrastructure security paradigm that is distinctly different from protection.

Triggered among others by the Three Mile Island meltdown in 1979, analysts started using insights from systems design, decision theory, and organizational theory to propose a theory on failure of systems and, more importantly for CIP purposes, recovery from failure. Leitmotifs such as “normal accidents” reflect an era with widespread concerns regarding catastrophic threats to our way of life not unlike the ones triggered by the 9/11 attacks and recent natural disasters. Later, in what could be called the “glass half full” version of Perrow’s “glass half empty” view of system failure, a body of work developed that asserts that certain organizational structures can contribute significantly to the prevention of disasters. Interestingly, these so-called high-reliability organizations often coincide with high-risk environments such as nuclear power plants and ships. Around the same time, complex-adaptive systems theory informed studies on the capabilities of organizations to respond to unexpected change.

For resilience to become a viable security paradigm, the grounding in such theories and the analytic differentiation from protection is necessary but not sufficient. The work ahead lies in defining the range of possibilities and then agreeing on the acceptable level of what a resilient company, industry, and community will look like. What services at what costs can be expected from an energy company that invests in a resilient electricity grid? How can a government agency that is turned into an auto-adaptive system be held to uniform accountability and performance standards? If there is no 100% protection for everyone and everything at all times, what are the acceptable levels of lives lost (or saved) and of assets destroyed or recovered?