Resiliens – hva er det og hvordan kan det integreres i risikostyring?

FFI has been tasked by the Ministry of Justice and Public Security to study methods for identifying cross-sectoral vulnerabilities in critical societal functions. This study is a contribution to this work, with emphasis on the term "resilience". The main research question for this study has been: How can resilience be integrated into - and possibly strengthen - holistic risk management? Through a comprehensive literature review, FFI has examined various definitions and operationalisations of the concept resilience. In addition, various studies that attempt to combine resilience and risk assessment have been reviewed. Findings from this study show that resilience is defined and understood in different ways, and the term is used within several disciplines. Common for the definitions are that they describe a systems ability to adapt so it can maintain its functionality despite being subjected to stress or impact. In addition, a long time perspective and the ability to learn apply to several of the descriptions. FFI acknowledges the value in different definitions for different purposes and does not consider it expedient to define one common definition of the resilience concept. However, FFI conclude that it is necessary to describe clearly what is included in the concept and how to understand the term, when used for different purposes. Resilience is often considered in relation to risk. In order to integrate resilience into risk management, one should apply an alternative risk perspective, with use of knowledge-based risk assessments that include both known and unknown factors. The review of the attempts to apply resilience within risk assessments has not given a uniform answer to how to apply this for the critical societal functions. The methodology is largely in the initial phase, with few concrete examples. Nevertheless, there are some elements that FFI has considered appropriate to further include. For example, resilience will contribute to the inclusion of known, but also new and unknown risks. Furthermore, resilience also encompasses a broad time perspective where being prepared for unwanted events, how a system should adapt to and maintain functions during an event, and quickly recovering lost functions after an event is emphasised. If resilience is to be integrated with risk management and in the work of identifying cross-sectoral vulnerabilities for critical societal functions, there is a need for clarifications regarding how the concept is to be understood and operationalised in such a context. The ICI-REF method from IMPROVER is recommended as a starting point for further studies on how to implement resilience in risk management for critical societal functions.