<figure><img src="image_1.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# The Strategic Management of Disaster Risk Mitigation

Colin Eden¹[0000-0002-6449-2046] and Jose J. Gonzalez²[0000-0002-1056-2758]

¹ Strathclyde Business School, Glasgow,
United Kingdom, and Stepchange AS,
Norway
colin.eden@strath.ac.uk

² Centre for Integrated Emergency Management (CIEM),
Dept. for ICT, University of Agder,
and Stepchange AS,
Norway
josejg@uia.no

**Abstract.** Systemic risks are embedded in the complex networks of an increasingly interconnected world. Achieving the Sendai Framework for Disaster Risk Reduction, the Paris Agreement on Climate Change 2015 and the 2030 Agenda for Sustainable Development require that risk mitigation involves not only experts but ‘power-brokers’ – those with the power to act. Impactful risk assessment and mitigation development requires high levels of ownership of the assessment and mitigation strategies, and so needs to be done fast and involve relatively small amounts of the power-brokers time. This requirement means that the analysis of the risk system will need to be transparent and relevant. We describe a method employing causal mapping with experts and power-brokers stakeholders. These stakeholders interactively undertake a qualitative systemic risk assessment and subsequently develop and agree strategies for risk mitigation explicitly considering i) the direct purpose of mitigation (the other risks that are likely to be at least partly mitigated – the risks that are directly linked from the mitigated risk), and also ii) the negative goals that will be mitigated.

**Keywords:** Systemic risk, Risk systemicity, Risk interdependencies, Cascading effects, Risk mitigation, Disaster risk reduction strategies, Sendai Framework.

# 1 Introduction

## 1.1 Interconnections create systemic risk

“Systemic risk – risk that is endogenous to, or embedded in, a system that is not itself considered to be a risk and is therefore not generally tracked or managed, but which is understood through systems analysis to have a latent or cumulative risk potential to negatively impact overall system performance when some characteristics of the system change” [1, p. 45]. In particular we note the familiar adage about systems thinking: that the whole is greater than the sum of the parts.
Systemic risk has been explicitly recognised since the 1990's in project risk management [2] and in the context of financial risk [3]. Systemic risk became a hot topic for disaster risk reduction with the Sendai Framework for Disaster Risk Reduction 2015-2030 [4]. While the term "systemic risk" does not appear explicitly in this document intended for politicians, the systemic nature of risks affecting humankind is revealed by numerous wordings in the Sendai Framework. E.g. "underlying disaster risk drivers, such as the consequences of poverty and inequality, climate change and variability, unplanned and rapid urbanization, poor land management and compounding factors such as demographic change, weak institutional arrangements, non-risk-informed policies, lack of regulation and incentives for private disaster risk reduction investment, complex supply chains, limited availability of technology, unsustainable uses of natural resources, declining ecosystems, pandemics and epidemics." [4, §6].

Following the Sendai Framework, the United Nations Office for Disaster Risk Reduction explicated the Sendai Framework thoroughly in terms of systemic risk in its Global Assessment Report on Disaster Risk Reduction (GAR2019) 2019 [1]. (The concept of systemic risk appears 141 times in GAR2019.) The centrality of systemic risk for the Sendai Framework is summarised this way: "The Sendai Framework stipulates that the global community must come to terms with a new understanding of the dynamic nature of systemic risks, new structures to govern risk in complex, adaptive systems and develop new tools for risk-informed decision-making that allows human societies to live in and with uncertainty" [1, p. 36]. The critical importance of systemic risk is characterised by "understanding the systemic nature of risks, and the opportunities afforded by new approaches and new concepts of risk, will be the central challenge of the first half of the twenty-first century" [1, p. 65-66].

Risk in complex societal challenges, and major projects, is systemic. Interconnections create a system of associated risks and outcomes, where the outcomes of risks are risks themselves. Risks are a system where a single risk can cause a plethora of other risks, and, in particular, cause vicious cycles of risks.

The notion of systemic risk is central for disaster risk reduction. There are linkages across three major international agreements, viz. the Sendai Framework Disaster Risk Reduction, the Paris Agreement on Climate Change 2015 and the 2030 Agenda for Sustainable Development. The three agreements recognize that risks increasingly have interdependencies that are responsible for cascading effects within sectors and across multiple sectors, in some cases with global impact [5]. Risk interdependencies imply that risks are causally connected. The systemic risks "are embedded in the complex networks of an increasingly interconnected world. The behaviour of these networks defines quality of life and will shape the dynamic interactions among the Sendai Framework, the 2030 Agenda, the Paris Agreement, New Urban Agenda, and the Agenda for Humanity. Ultimately, the behaviour of these networks determines exposure and vulnerability at all scales." [1, p. 36]

The Guidelines for the Governance of Systemic Risk from the International Risk Governance Center [6] define systemic risk as threats that individual failures, accidents, or disruptions present to a system through the process of "contagion" (i.e., active risks causally affecting and activating other risks). As prominent examples of such threats,
the guidelines mention the desertification and collapse of the Aral area, the 2008 finan-
cial crisis, fish stocks depletions, pandemics, cyber-security, and global climate change.

Those in the project management field have highlighted the importance of taking
account of the ramifications through such a chain of risks, where a single risk can have
a greater impact beyond the immediate impacts of a risk [2,7]. Notably disruption and
delay in major projects are consequences of systemic risk [8].

Risk is “a phenomenon that has the potential to deliver substantial harm, whether or not the probability of this harm eventuating is estimable.” [9]. But then “harm” is in the eye of the beholder.

In this paper we present two types of risk system: a simple hierarchical system and a potentially much more complex feedback system. The feedback system is more common for societal situations. We consider the properties of these systems and how these properties help in focusing attention when looking to design risk mitigation. We argue that if mitigation is to be successful then it is crucial to not only involve experts but also ‘power-brokers’ – those with the power to act. In addition, we suggest that this requirement means that risk assessment and mitigation development will need to be done in a manner that provides high levels of ownership of the assessment and mitigation strategies, and so needs to be done fast and involve relatively small amounts of the power-brokers time. This requirement means that the analysis of the risk system will need to be transparent and relevant.

2 Hierarchical risk systems

2.1 Hierarchical risk: an example

In relatively simple risk systems, the causal interactions create a simple hierarchical
system where risks cascade to risk outcomes that are increasingly influenced by several
other risks. As the risk cascade unfolds the risks tend to become of greater strategic
significance until outcomes are risks to established goals.

Figure 1 shows an example of a personal risk system that maps out potential disaster. It shows a hierarchical risk system related to the purchase of a new sailing yacht by one of the authors. The reason for using this example is that it is simple and yet demonstrates the key aspects of a hierarchical risk system. The system of risks was created to facilitate thinking about how to resolve the ‘potential personal disaster’ and is the result of a quick ‘dump’ of risks as they were thought about. The reference numbers show the order in which they were noted. No formalisms were used in creating the risk system, rather the statements in the system derived from thinking “I am risking a disaster because...”.
<figure><img src="image_2.png" /><figcaption>Fig. 1 Hierarchical risk illustrated with a potential personal disaster. Each arrow represents a belief about causality, where A→B implies that A is believed to cause B.</figcaption></figure>

(A -ve sign on an arrow as in B means a belief that more of A causes less of B).
Exploring some of the characteristics of this simple hierarchical risk system (represented by figure 1) we note that:

1. Some of nodes in the hierarchy are not obvious risks – but cause risks – they are explanations (e.g., #17 ‘requirements to be present…’). They need to be explained because they can be points of possible mitigation actions.

   "It is imperative that our understanding of risk is developed without resorting to reductive measures that isolate and remove from context and ignore systemic characteristics. This applies as much to our institutional arrangements for risk governance as it does to community organization, research endeavours or policy formulation." [1, p. v]. Context is important.

2. Some risks may be particularly significant because they impact more final risk outcomes (e.g., #25 ‘contract was good for me…’ impacts all outcomes: #3, #9, and #5). The number of final outcomes that a risk impact may indicate an appropriate place to focus mitigation.

3. Adding explanations for risks is often useful and provides useful context and, within the network of risks, may be significant drivers. "However, failure or even intentional ignorance to capture the role of underlying drivers of systemic risk will allow small risks to grow into major problems, increasing the opportunity costs of failed interventions and missed opportunities." (Our emphasis) [1, p. 71].

4. Some risks identified are *historical risks* (e.g., #28 ‘lots of visits…’, #29 ‘previous customers had problems…’, #38 ‘signed contract when they were short of work…’). Traditional risk assessment would likely exclude such risks because although they offer some explanatory content, they are irrelevant since nothing can be done about them. However, although history cannot be changed the impact of that history may be changed, and so mitigation of impact may be possible.

5. The order in which risks are surfaced (#1 ‘boat delivery unpredictable…’ came first) may provide a clue to the most worrying risk. Mitigation of these risks may be a priority for relieving anxiety.

## 2.2 Implications of hierarchical risk SYSTEM for risk assessment

A risk assessment that recognises systemicity can usefully show historical impacts where the causality (impact) may be mitigated.

Explanations of causality, including the role of history, are a natural part of explaining a risk system. They provide important context, but more importantly, although not risks, they may be identified as potential intervention points that promote the mitigation of consequential risk.

## 2.3 The Significance of a ‘Negative goals system’

Inevitably when mapping out risks the final outcomes in a hierarchical system will be expressed as risks – as disastrous outcomes. Negative goals are expressed as such through natural speech. The statements being classified as a goal can be problematic but is based on the notion that the outcome is unquestionably a disaster that must be
avoided at all costs, and thus if expressed positively then it would be an unquestioned
desired outcome. Given that risk assessment is undertaken in order to develop effective
mitigation strategies, then the final outcomes will be outcomes that matter to the organ-
isation – expressions of the goals of the organisation, or more properly expressions of
the ‘negative goals’. “Goals are aspirational, that is to say they are not statements about
what an organisation is but rather what it wants to become” [10, p. 11]. A negative goal
is an aspiration to avoid and thus are not simply the final outcomes in a hierarchy. For
negative goals the contrasting circumstance would not be expressed as a goal, but the
outcome (disaster) itself is of the same status as a goal and must be avoided. (Op. cit.,
p. 13.)

In Figure 1 the negative goals are shown with a grey background (with the exception of the positively expressed goal #10) and represent a *network* of mostly negative goals (as in Figure 2) – risks that are bad outcomes in their own right and that must be avoided.

<figure><img src="image_3.png" /><figcaption>**Fig. 2** A *negative goals system*: a network of interacting goals (Note #10 is a positive goal)</figcaption></figure>

A risk register is a document commonly used as a risk management tool. It contains
as a repository for all risks identified and includes additional information about each
risk. Risk registers focus on the probability of an event occurring multiplied by the
consequence of that event [11]. The idea that the extent of a risk probability multiplied
by impact assumes that risk invariably behaves in a linear intuitive fashion and yet, as
we will see below, risk can multiply exponentially [12]. A significant danger of risk
registers is that “Disaggregation means that there is a danger of inter-related risks like
the aforementioned being seen in isolation and ‘ticked off’ one by one” [13], in other
words, the interaction between risks is not acknowledged.

Risk registers often miss the significance of understanding and reaching agreement
about why risks matter. Without being explicit and clear about negative goals any anal-
ysis of the risk system cannot focus attention on what matters.

When managers are asked what their goals are then they are typically unlikely to talk
about the way in which their behaviour is framed by the avoidance of negative out-
comes rather instead they are more likely to believe it is appropriate to focus on positive
outcomes. Much management literature argues that “problems are to be formulated
against an idealised conception of where the organisation wants to be” [14,15]. And yet, to focus on avoiding disastrous outcomes is a perfectly legitimate activity and one that reflects the reality of organisational life [10], let alone when addressing disasters. Thus, rather than supposing that goals should not only be known but also should be positive, it is appropriate to encourage a legitimacy for expressing negative goals.

## 2.4 Implications of acknowledging negative goals as a system

Develop an understanding about how many negative goals impact each other, by exploring the negative goals as a system in its own right.

Consider the benefits from mitigation not just in terms of final outcomes but also with respect to other negative goals that are a part of the goals system.

# 3 Feedback risk systems

More complex disaster risk reduction situations typically show as a more complex risk system where the system contains feedback loops [as also noted by, for example, 18,19]: usually vicious cycles but with some occurrence of virtuous cycles and controlling cycles. Feedback loops show dynamic behaviour – change over time, with for example, vicious cycles showing a situation getting worse over time. Archetypes of feedback are powerful illustrated in [20], however in risk systems the specifics of the situation matter, and archetypes can be unhelpful. Feedback though is fundamental to understanding social systems [21].

## 3.1 Vicious/Virtuous and Controlling Feedback loops

Vicious and virtuous cycles are two side of the same coin, and whether they are vicious or virtuous depends on your point of view.

Consider the simple extract from a risk system developed in relation to the Covid pandemic [22,23] and shown in Figure 3. The risk system was developed by a group of 16 experts/power-brokers and the group was multi-disciplinary. Here we see that they identified two double-headed arrows where the risks at either end of the arrow are parts of a reinforcing vicious cycle: for example, as the risk of credibility being lost increases then there is a risk that individuals and businesses abuse the situation, which in turn increases the loss of public trust. In total there are three single vicious cycles that interact with each other. But, note there is also a fourth nested vicious cycle where loss of credibility reinforces abuse, which reinforces shortage, which reinforces abuse which reinforces loss of credibility.
<figure><img src="image_4.png" /><figcaption>**Fig. 3** An example of reinforcing feedback – showing three single vicious cycles (loss of trust causes criminality, and criminality causes loss of trust; shortage causes criminality, and criminality causes shortage; loss of trust causes criminality, criminality causes shortage, shortage causes lack of vaccines, lack of vaccines causes loss of trust) and one nested vicious cycle (loss of trust causes criminality and criminality causes shortage which reinforces criminality which reinforces loss of trust).</figcaption></figure>

Paying attention to nested feedback loops is important because their consideration can pinpoint a key focus for mitigation – in the case above it increases the significance of the chaotic situation.

However, we also note that from a public ‘common good’ perspective these are labelled as vicious cycles, but from the perspective of a criminal they are virtuous cycles – they would prefer the situation to become more chaotic.

Within any risk system there will be some ‘controlling’ (or ‘balancing’) feedback loops. In this risk situation the risks tend to reduce over time and move to some equilibrium. Figure 4 shows another extract from the Covid pandemic risk model, where increased infection rates caused by non-socially distanced infected interactions increases fear among the population and so reduces the risk of the population breaking quarantine rules. Often balancing loops are unstable, as might be the case in this example. Gradually infection rates drop to a level where fear is no longer of significance, and so the population returns to breaking quarantine rules.
<figure><img src="image_5.png" /><figcaption>**Fig. 4** An example of a controlling or balancing feedback loop, where the minus sign on an arrow represents an increased fear of infection from others decreases the population breaking quarantine rules.</figcaption></figure>

Figures 3 and 4 are, as we stated, extracts from a larger system and in most risk systems there are many vicious cycles and few controlling feedback loops, and they all interact with each other making the risky situation particularly complex. In our Covid model we faced over 5 million feedback loops! Loops originate when causal links from a closed cycle. There is a large number of feedback loops in the Covid risk model because of the high number of causal interconnections among the high number of risks (owing to combinatorial complexity). It is notable that without the availability of powerful software (Strategyfinder™) it would not be possible to identify the feedback loops or the risks that are most potent drivers of the feedback loops.
## 3.2 Feedback from ‘negative goals’

<figure><img src="image_6.png" /><figcaption>**Fig. 5** An example of feedback from a negative goal to other risks. Here the double headed arrow shows a vicious cycle (feedback): increased use of drugs causes personal isolation, and personal isolation causes an increased use of drugs.</figcaption></figure>

In discussing hierarchical risk systems we have also suggested that a negative goals system is also hierarchical. However, of course, in complex systems there is also a possibility of feedback that encompasses a negative goal. Figure 5 shows an extract from the Covid risk system where a negative goal related to mental health is a part of a feedback loop and prompts another loop (double-headed).

## 3.3 Implications of acknowledging feedback

The interactions between risks set up chains of risks, where the resulting consequences can be complex. The interactions between risks, chains of risks, can become self-reinforcing cycles of escalating risks: vicious cycles.

# 4 Implementing mitigation – the ‘big challenge’

## 4.1 Disaster risk reduction depends upon power-brokers

We noted in the introduction that if mitigation is to be successful then it is crucial to not only involve experts but also ‘power-brokers’ – those with the power to act. A good assessment of the risks and analysis of the risk system is of no use if risk mitigation does not follow. Disaster risk reduction depends upon the people with power, usually across multiple organisations, need to have ownership of the risk mitigation strategies. This requirement means that risk assessment and mitigation development will need to be done in a manner that provides high levels of ownership of both the risk assessment (construction of the risk system network) and development of mitigation strategies.
Without such involvement there is a danger that those with the power to act (or ability to influence those with the power) will not believe in the basis for action.

For the development of a reliable map of the risk system we need the involvement of an inter-disciplinary group of ‘experts’, and yet we also need the involvement of power-brokers/influencers. There is always a trade-off between getting the right participants to add expertise and knowledge and getting those who need strong ownership of the agreed outcomes. Those who need ownership and commitment to the outcomes will be those with the power to act. It is possible that there will be participants in both categories who are not stakeholders – they have no personal stake in the problem or its solutions. Experts might be there simply because they know things that are useful. Powerful players might be there because they can be persuaded to become stakeholders and care about the problem and its solutions.

Getting the right mix of expertise is difficult because often it will only be possible to know what the right expertise is after you have the beginnings of a disaster 'definition' emerging from the first part of developing the risk system.

## 4.2 Implications of the 'big challenge'

'Fast and furious' risk assessment (construction of the risk system) and development of effective strategies is probably crucial to ownership and so implementation. Both experts and power-brokers must be involved.

The ability to construct the risk system quickly and directly with the group (whether they be together in the same location or located in their workplace/home) is likely to increase the speed of working. Similarly, the ability to visualise the risk system as a causal map speeds up an appreciation of the nature of the risky situation. Visualisation makes developing strategies that appreciate the systemic nature of the risky situation easier and faster.

# 5 Analysis of Risk Systems

"The complexity that underlies systemic risk may be sufficiently intricate that quantification and prediction of risk is not easy." [1, p. 43]. Taking account of the dependencies between risks can significantly change the prioritisation of risk factors, as compared to the traditional risk register [24].

Risk registers focus on the probability of an event occurring multiplied by the consequence of that event [11]. Thus, when analysing a risk system, it would make sense to also consider both probability and impact. However, recognising that risks interact systemically must play an important part in risk analysis [25-27].

In a risk system assessing probability and impact is extremely problematic. Probability can be i) the probability the risk occurs, and/or ii) the probability that the risk impacts another stated risk: a Bayesian judgement – the probability that if risk occurs then the consequential risk occurs. This issue reflects the issues identified by Ackoff and Emery [28, p. 82-88] where they differentiate strength of belief from intensity of belief and degree of doubt. When asking experts (or managers) for their judgment about
probability and impact in a network of causal beliefs we cannot be certain as to what ‘definitions’ are being used, let alone know how to analytically compute their implications. There is, therefore, a danger that “by reducing risk to a set of numbers, the system of notation can impart an appearance of scientific precision where none exists” [13].

Even if there was clarity about what impact and probability mean in a network, and that clarity could be consistently applied, gathering judgements about impact for an entire network of risks is both time-consuming and laborious [29]. Some authors have argued for a process which begins with assessing the probability and impact of all the individual risks, often using a linguistic scale [see, for example, 30-31], then immediate dependencies between risks [32]. The strength of these dependencies is also judged using linguistic terms [24, 30, 33]. In a corporate environment we have found that such a process could be undertaken only if completed in under 45 minutes, beyond this time limit the judgements are hurried and sloppy [8].

Given the need for ‘fast and furious’ work the analysis must, preferably, be capable of being undertaken with a group in real time. In the first stages of gaining ownership, there needs to be useful ways of analysing a qualitative network of risks. Any such analyses must be transparent and easily understood by those expected to decide on mitigation strategies. Faster and transparent processes involving qualitative modelling lead to a higher probability of engagement and ownership of the risk system developed.

Once ownership has been developed and tentative commitments to strategies for mitigation then there is an opportunity to offer further quantitative exploration of proposed strategies. System dynamics simulation models, such as [34, 35], are an obvious approach for quantitative exploration because they are designed as feedback systems [36-37] and so the model will be constructed using the qualitative model as the basic structure for the model. The processes of engaging the group involved in developing the qualitative model for estimating parameters used in the simulation model typically forces the group to extend and question their causal assumptions, and this process leads to the refining of strategies agreed during the qualitative strategy development stage using the risk system causal model [38].

## 5.1 Centrality

Perhaps the easiest measure of significance of a risk, and one that is easily understood, is that of computing the centrality of a risk within the network. However, there are several measures that can be used. The simplest and most easily understood is to consider the number of immediate links into and out of each risk, known as the ‘passivity and activity degree’ or ‘degree centrality’ of a risk [39, 40]. This measure considers only the local setting of a risk in the network. Measures that take a greater account of the wider context are closeness and betweenness analyses that derive from social network analysis. Yan and Ding [41] and Lu, et al. [42] provide an interesting exposition on centrality measures. These centralities assist in identifying the ‘hubs’ in the network that play a role as key passages for risk propagation. Betweenness centrality is a measure of how often a node is a bridge between other nodes. Nodes with high betweenness centrality are often important controllers of power or information. Score increases with the number of shortest paths from each statement to any other statement passing
through the statement of interest. The measure identifies that risk that if deleted through
effective mitigation *would change the risk situation significantly*. Closeness centrality
measures the average distance to the other nodes in the network. A statement with high
score has shortest distance to all other statements. Other than ‘passivity and activity
degree’ (counting ins/out to a risk) these measures are relatively opaque to a group of
managers.

## 5.2 Hierarchical potency

Consider again the hierarchical risk system in Figure 1. When a group is asked to identify where they should initially consider mitigation, they do not find it difficult to understand that mitigating some risks is more useful than others, i.e., that some risks impact more ‘negative goals’ than others. In Figure 1 risk #25 (a historical statement) impacts every negative goal – it is highly potent. Thus, even though it is a statement about a past action, which has now become a risk, it will be worth considering whether its impact can be changed (the arrows out) by, for example, changing perceptions.

Those risks that impact the maximum number of negative goals are primary candidates for mitigation and may provide the highest level of robustness [43]. Needless to say, they are only candidates and sound judgment may override these suggestions.

5.3 Feedback potency

As we have noted, feedback loops are crucial to risk mitigation. Mitigating the dynamics derived from a vicious cycle will be more important than hierarchical potency simply because it unfolds over time. When vicious cycles interact with one another they will produce a complex dynamic. Thus, finding which risk, if mitigated, would close down the most vicious cycles is a crucial demand on analysis. Consider the nested vicious cycles shown in Figure 6 (another extract from the Covid risk system [22, 23]): there are 12 vicious cycles (5 of which nested). Risks #147 (distrust of vaccination) and #26 (credibility) are in 11 of the 12 vicious cycles and so mitigation of either of these risks would close down the most vicious cycles. Mitigating both risks closes down all vicious cycles. Thus, unless sound judgement suggests otherwise, then focusing attention developing strategies to mitigate the risks would be appropriate.

Similarly, analysis also reveals that if a strategy could be developed that destroys the
causal link from #147 (distrust) to #26 (credibility) then this would have the greatest
impact on the risk system shown in Figure 6.

Risk #147 and #26 are in 11 loops (and in all the five nested loops) and so are most
potent. The link from 147>26 is the potent link.
<figure><img src="image_7.png" /><figcaption>**Fig. 6** Extract from the Covid risk system showing five of the twelve vicious cycles. Examples of those not shown are long loop paths such as: 26>163>153.36>205>138>147>26 and 26>147>153>36>42>84>80>26.</figcaption></figure>

**5.4 Implications of acknowledging the issues in the analysis of a risk system**

Use analyses that most easily understood by those who i) need to understand the properties of the risk system, and ii) have the power to mitigate.

Potency analysis, and particularly the potency of both risks and causal links in a feedback system, focuses attention on those risks that are likely to have the greatest impact on disaster reduction.

**6 Mitigation and Implementation**

We have shown that identifying centrality, potency of risks and potency of causal links can provide a basis for effective strategy development. In managing a risk system there is a danger in not recognising that most organisations (and multi-organisations) never have enough resources to combat all risks. Thus, the development of mitigation strategies must focus initially on those that can most significantly reduce the potential for disaster – the most potent risks. Risks and causal links that are a focus for strategy development need to not only be impactful and potentially mitigate the risk, but also practical.
The two dimensions of impact and practicality will need to be evaluated for the portfolio of proposed strategies. Those strategies that are both impactful and practical will be the most likely strategies to be agreed. However, within a group there will often be disagreement – a lack of consensus – and this disagreement will often be the basis of fruitful discussion that leads to refinement of the strategy through a sort of Delphi process [44, 45]. Sometimes some strategies are seen as highly impactful but not practical, and this leads the group to consider ways in which the strategy can become more practical. Similarly, highly practical mitigation strategies may be refined so that they become more impactful.

We argued earlier that one important benefit of disaster reduction through considering systemic risk is that the risk system makes explicit the purpose of risk mitigation – the causal links out from a risk. This means that when moving from strategy development to implementation there is clarity about i) the direct purpose of mitigation (the other risks that are likely to be at least partly mitigated – the risks that are directly linked from the mitigated risk), and also ii) the negative goals that will be mitigated.

Implementation depends on someone (power-broker) taking responsibility for ensuring the strategy is implemented. This person may not act but will be responsible for ensuring action is taken.

Thus, implementation that is effective becomes more likely because purpose is clear and also because responsibility for implementation is clear. Figure 7 shows an extract from the Covid risk system work [22]. The extract shows how the risk system map converts to a ‘normal’ document that shows strategy, purpose, responsibility.

## Shortage of Health Care Workers in Hospitals

### Agreed Strategies, their Purpose, and Implementation Teams

<figure><img src="image_8.png" /></figure>

<table><tr><td><strong>Establish high-level infection protection (PPE) for healthcare and emergency workers</strong><br>In order to:<br>Directly avoid shortage of Health Care Workers in Hospitals, and<br>Control local outbreaks in hospitals, and so avoid having exhausted health care workers<br>and so reduce possibility of low productivity of working health care staff because o<br>shortage of staff</td></tr><tr><td><strong>Implementation Team: Chief physician at short-term nursing home, Hospital contingency<br>planner</strong></td></tr></table>

<figure><img src="image_9.png" /></figure>

<table><tr><td><strong>Priority of vaccination for health care workers</strong><br>In order to:<br>Directly avoid shortage of Health Care Workers in Hospitals, and<br>Avoid local outbreaks of virus in nursing homes, and in hospitals<br>Avoid delays in ordinary medical education</td></tr><tr><td><strong>Implementation Team: Crisis manager Kristiansand Municipality, Physician specialist in public<br>health</strong></td></tr></table>

**Fig. 7** An extract from an agreed strategy document: a part of strategy agreements for managing the negative goal of ‘shortage of healthcare workers’.
# 7 Conclusions

In this paper an approach to systemic risk mitigation is proposed involving not only experts but ‘power-brokers’ – those with the power to act. Impactful risk assessment and mitigation development requires high levels of ownership of the assessment and mitigation strategies, and so needs to be done fast and involve relatively small amounts of the power-brokers time. This requirement means that the analysis of the risk system will need to be transparent and relevant. There is ample additional evidence from model building with stakeholders (Group Model Building) that working with groups directly facilitates team learning [48] and organizational intervention [49], and that it affects the stakeholders attitudes and behaviours [50].

Taking a holistic view of the impact of risks and the interdependencies between risks across different disciplines highlights the need for trans-disciplinary approach to risk assessment and developing risk mitigation strategies [8, p. 49-50].

In order to meet most of the implications identified in this paper the use of specially
design software can be particularly helpful. The software needs to be capable of:

* Quickly pulling together the expertise of a range of experts and power-brokers.

* Showing the expertise about risks and causality as a causal map.

* Visualising the risk system as a 'transitional object' and 'boundary object' [53-56] so that the 'whole can be more than the sum of the parts', where the interaction of expertise creates new insights.

* Analysis of the risk system can be undertaken in real-time directly with the group, and the analysis must be transparent.

* Permitting group members to work together from their own locations and so construct the risk system and develop effective strategies with all able to both contribute and see the developing map.

* Enabling group members to make judgements about both impact and practicality of potential strategies, and so develop agreements with a reasonable degree of consensus.

Our approach to meeting this requirement has been to encourage and advise on the
development of such a software platform: *Strategyfinder™*. The platform manages all
of the requirements above and works through a browser, rather than requiring any
download of software to the local computer (most organisations are extremely hesitant
to allow downloads).

# References

1. United Nations Office for Disaster Risk Reduction (UNDRR): Global Assessment Report on Disaster Risk Reduction (Fifth Edition). United Nations, 2019.

2. Williams, T.M., Ackermann, F., and Eden, C.: Project Risk: systemicity, cause mapping and a scenario approach. In: Kahkonen, K., Artto, K.A. (Eds.), Managing Risks in Projects (pp. 343-352). E&FN Spon, London (1997).

3. Schwarz, S.L.: Systemic risk. The Georgetown Law Journal, 97, 193-249 (2008).
4. UN world conference on disaster risk reduction: Sendai Framework for Disaster Risk Reduction 2015-2030. (2015) Available from: http://www.wcdrr.org/uploads/Sendai Framewor_k_for_Disaster_Risk_Reduction_2015-2030.pdf. (Accessed 25th July 2022).

5. Handmer, J., Stevance, A.-S., Rickards, L. and Nalau, J. Policy Brief: Achieving Risk Reduction Across Sendai, Paris and the SDGs. Available from: https://council.science/wp-content/uploads/2019/05/ISC_Achieving-Risk-Reduction-Across-Sendai-Paris-and-the-SDGs_May-2019.pdf. (2019). (Accessed 20th July 2022).

6. International Risk Governance Center (IRGC). Guidelines for the Governance of Systemic Risks. Lausanne: International Risk Governance Center (IRGC). DOI: 10.5075/epfl-irgc-257279. (2018)

7. Williams, T.: The Nature of risk in complex projects. Project Management Journal, 48, 55-66 (2017).

8. Ackermann, F., Eden, C., Williams, T., Howick, S.: Systemic Risk Assessment: a case study. Journal of the Operational Research Society, 58, 39-51 (2007).

9. Lupton, D.: Risk (2nd edn.). Routledge, London (2013).

10. Eden, C., Ackermann, F.: Problem structuring: on the nature of, and reaching agreement about, goals. EURO Journal of Decision Processes, 1, 7-28 (2013).

11. Adams, J.: Risk. Routledge, London (1995).

12. Masuch, M.: Vicious Circles in Organizations. Administrative Science Quarterly, 30, 14-33 (1985).

13. Drummond, H.: MIS and illusions of control: an analysis of the risks of risk management. Journal of Information Technology, 26, 263 (2011).

14. Kepner, C.H., Tregoe, B.B.: The Rational Manager: A Systematic Approach to Problem Solving and Decision Making. McGraw Hill, New York (1965).

15. Ackoff, R.L.: Redesigning the Future: A Systems Approach to Societal Problems. Wiley, New York (1974).

16. Ozbekhan, H.: Thoughts on the emerging methodology of planning. Fields within fields, 10, Winter, 63-80 (1974).

17. Checkland, P.: Systems Thinking, Systems Practice. Wiley, Chichester (1981).

18. Cavallo, A., Ireland, V.: Preparing for complex interdependent risks: A system of systems approach to building disaster resilience. International Journal of Disaster Risk Reduction, 9, 181-193 (2014)

19. Bloomfield, K., Williams, T., Bovis, C., Merali, Y.: Systemic risk in major public contracts. International Journal of Forecasting, 35, 667-676 (2019).

20. Senge, P.M.: The Fifth Discipline: The Art and Practice of The Learning Organization. Doubleday, New York (1990).

21. Richardson, G.: Feedback Thought in Social Science and Systems Theory. University of Pennsylvania Press, Philadelphia (1991).

22. Gonzalez, J.J., Eden, C., Abildsnes, E., Hauge, M., Trentin, M., Ragazzoni, L., Berggren, P., Jonson, C-O., and Abdelgawad, A.A.: Elicitation, analysis and mitigation of systemic pandemic risks. Adrot, Anouck; Grace, Rob; Moore, Kathleen, and Zobel, Christopher W., Editors. 18th International Conference on Information Systems for Crisis Response and Management. Blacksburg, Virginia: ISCRAM. (2021); pp. 581-596.

23. Gonzalez, J.J., Eden, C.: Insights from the COVID-19 Pandemic for Systemic Risk Assessment and Management. In: Sasaki, J., Murayama, Y., Velev, D., Zlateva, P. (eds) Information Technology in Disaster Risk Reduction. ITDRR 2021. IFIP Advances in Information and Communication Technology, vol 638. (2022) Springer Nature. Cham, Switzerland. https://doi.org/10.1007/978-3-031-04170-9_9
24. Jamshidi, A., Ait-kadi, D., Ruiz, A., Rebaiaia, M. L.: Dynamics risk assessment of complex systems using FCM. *International Journal of Production Research*, 56, 1070-1088 (2018).

25. Ren, H.: Risk lifecycle and risk relationships on construction projects. *International Journal of Project Management*, 12, 68-74 (1994).

26. Kwan, T.W., Leung, H. K.: A risk management methodology for project risk dependencies. *IEEE Transactions on Software Engineering*. (2014).

27. Zhang, Y.: Selecting risk response strategies considering project risk interdependence. *International Journal of Project Management*, 34, 819-830 (2016).

28. Ackoff, R.L., Emery, F.: On Purposeful Systems. *Tavistock, London* (1972).

29. Marchwicka, E., Kuchta, D., 2017. Modified optimization model for selecting project risk response strategies. *Operations Research and Decisions*, 27(2), 77-90.

30. Wirba, E.N., Tah, J. H. M., Howes, R.: Risk interdependencies and natural language computations. *Engineering, Construction and Architectural Management*, 3, 251-269 (1996).

31. Fang, C., Marle, F.: A simulation-based risk network model for decision support in project risk management. *Decision Support Systems*, 52, 635-644 (2012).

32. Fang, C., Marle, F., Zio, E., Bocquet, J. C.: Network theory-based analysis of risk interactions in large engineering projects. *Reliability Engineering and System Safety*, 106, 1-10 (2012).

33. Aloini, D., Dulmin, R., Mininno, V.: Risk assessment in ERP projects. *Information Systems*, 37, 183-199 (2012).

34. Rich, E., Gonzalez, J.J., Qian, Y., Sveen, F.O., Radianti, J., Hillen, S.: Emergent vulnerabilities in Integrated Operations: A proactive simulation study of economic risk. *Int. J. Crit. Infrastr. Prot.* 2, 110-123 (2009).

35. Qian, Y., Fang, Y., Gonzalez, J.J.: Managing information security risks during new technology adoption. *Computers & Security*, 31, 859-869 (2012).

36. Sterman, J.D.: Business Dynamics. *Systems Thinking and Modeling for a Complex World*. McGraw-Hill Education: Columbus, OH, USA (2000).

37. Mani, K.E., and Cavana, R.Y.: *Systems Thinking, System Dynamics. Managing Change and Complexity*. Prentice Hall: New Zealand (2001).

38. Howick, S., Eden, C.: Supporting strategic conversations: The significance of a quantitative model building process. *Journal of the Operational Research Society*, 62, 868-878 (2011).

39. Harary, F., Norman, R., Cartwright, D.: *Structural Models: An Introduction to the Theory of Directed Graphs*. Wiley, New York (1965).

40. Hage, P., Harary, F.: Eccentricity and centrality in networks. *Social Networks*, 17, 57-63 (1995).

41. Yan, E., Ding, Y.: Applying Centrality Measures to Impact Analysis: A Coauthorship Network Analysis. *Journal of the American Society for Information Science and Technology*, 60, 2107-2118 (2009).

42. Lu, L., Chen, D., Ren, X.-L., Zhang, Q.-M., Zhang, Y.-C., Zhou, T.: Vital nodes identification in complex networks. *Physics Reports*, 650, 1-63 (2016).

43. Rosenhead, J.: Planning Under Uncertainty: II. A Methodology for Robustness Analysis. *Journal of the Operational Research Society*, 31, 331-342 (1980).

44. Dalkey, N., Helmer, O.: An experimental application of the Delphi Method to the use of experts. *Management Science*, 9, 458-467 (1963).

45. Rowe, G., Wright, G.: The Delphi technique as a forecasting tool: issues and analysis. *International Journal of Forecasting*, 15, 353-375 (1999).

46. Vennix, J.: Group Model Building: Facilitating Team Learning Using System Dynamics. *Wiley, Chichester* (1996).
47. Rouwette, E.A.J.A., Vennix, J. A. M.: System Dynamics and organizational interventions. Systems Research and Behavioural Science, 23, 451-466 (2006).

48. Rouwette, E.A.J.A.: Modeling as persuasion: the impact of group model building on attitudes and behavior. System Dynamics Review, 27, 1-21 (2010).

49. Ackermann, F., Howick, S., Quigley, J., Walls, L., Houghton, T.: Systemic risk elicitation: using causal maps to engage stakeholders and build a comprehensive view of risks. European Journal of Operational Research, 238, 290-299 (2014).

50. Solarz, J.K., Waliszewski, K.: Holistic framework for COVID-19 pandemic as systemic risk. European Research Studies Journal, XXIII, 340-351 (2020).

51. Carlile, P.R.: A Pragmatic View of Knowledge and Boundaries: Boundary Objects in New Product Development. Organization Science, 13, 442-455 (2002).

52. Black, L.J., Andersen, D. F.: Using visual representations as boundary objects to resolve conflict in collaborative model-building approaches. Systems Research and Behavioral Science, 29, 194-208 (2012).

53. Luna-Reyes, L.F., Black, L. J., Ran, W., Andersen, D. L., Jarman, H., Richardson, G. P. et al.: Modeling and Simulation as Boundary Objects to Facilitate Interdisciplinary Research. Systems Research and Behavioral Science, 36, 494-513 (2018).

54. Eden, C.: Behavioural Considerations in Group Support. In: Kilgour, D.M., Eden, C. (Eds.), Handbook of Group Decision and Negotiation (pp. 777-792). Springer Nature, Switzerland (2021).