Main

Increasingly we hear suggestions from scientists1,2,3 and intergovernmental organizations4 to separate the analysis of risk and resilience. The justification, however, seems to be narrow perspectives on (and characterizations of) risk that have been rejected as insufficient. For example, one persistent misconception is that risk is restricted to situations where known probabilities exist (that is, ‘objective’ or measurable uncertainty) and so cannot be used in situations with considerable uncertainties and potential for unknowns and surprises5,6,7. Another misconception is that risk is simply a threat or an event8,9 or is limited to immediate impacts (following an event) on critical functionality, which ignores recovery2,3. These narrow characterizations, which are increasingly used by government and multinational organizations4, imply that risk is unsuitable for situations involving complexity or uncertainty. This issue is not simply semantic but one that could seriously hamper efforts to tackle today’s wicked challenges, to which uncertainty and complexity are inherent. An approach that separates risk from resilience will not only fail to find balance and synergy but may also dissuade practitioners and scholars alike from leveraging existing risk-based approaches. If they end up reinventing the wheel, they do so not just at the expense of scientific progress but also the communities that lack the luxury of time and resources.

To illustrate the limitations of separating robustness and recovery2,3, consider a seaside community. Perhaps this community can quickly return to its existing state when impacted by a hazard2,10,11,12. However, if the hazard repeats, the resulting perpetual damage–rebuild–damage cycle is a waste of life, resources and time; this is not a reasonable long-term solution13. Similarly, investing solely in robustness—the ability to absorb or withstand impacts—may be devastating if the community is unable to recover in the event of a failure. However, even balancing robustness and recovery is insufficient, given ongoing global environmental changes. Instead, to ensure its future viability the seaside community needs the capacity to persist, recover, adapt and transform so that it can maintain stability when appropriate and can change when necessary14.

Many of the misconceptions of risk, described above, would make this integrated management impossible. However, such limitations are not (or, at least, are no longer) the case due to the advances in contemporary risk science. This makes the divergence between the fields of risk and resilience unnecessary; instead, we can and should maintain their integration to benefit management and policy development, balance trade-offs and optimize resource use15. In this Perspective, we demonstrate how modern risk science provides a framework that enables integrated analysis of all dimensions of resilience.

Risk

Risk science has advanced substantially since the 1920s when Knight described risk as ‘measurable uncertainty’6 and even more so from the 1700s when it was first defined as expected loss16. If such views are adopted, risk would be unsuitable for contexts including the COVID-19 pandemic, terrorism or climate change where uncertainty is inherent. However, the contemporary view of risk is more holistic and embraces uncertainty as a necessary consideration17,18,19,20,21. In this Perspective, we adopt the most general definition of risk to discuss its relationship with resilience. This general definition of risk encapsulates the previous definitions of risk without being limited to them. That is:

Risk, related to an activity (α), is the consequences (C) and associated uncertainties (U)22.

This is denoted Risk = (C,U), or alternatively (A,C,U)(τ,η) by denoting the events (A) that lead to C and the relevant time dimensions (τ,η), where τ is the time frame over which the activity is considered and η is the time following the occurrence of an event over which the consequences are considered (Box 1). The concept of risk can be illustrated using a branching tree, which represents the possibilities of how an activity may eventuate (Fig. 1)23. The activity could be the operation of a system, whether a community, ecosystem or person, and, as shown in Fig. 1, could be impacted by events that influence the future paths (shown as branching points). Ultimately, there are outcomes or consequences that will arise over time as a result of the activity. The magnitude of these consequences is dependent on τ and on η, which dictate the number of indirect consequences that are included23. There are also uncertainties about which events will occur, when and what the subsequent consequences will be.

Fig. 1: Illustration of the general concept of risk.
figure 1

The diagram shows the consequences (C) that may arise from an activity (α) over the time interval τ, represented by a branching tree, and the uncertainty (U) surrounding the occurrence of the events (A) and their C23, occurring during time η following A. The size of the question marks corresponds to the U of A. Figure adapted with permission from ref. 23, Wiley.

Full size image

As an example, consider the seaside community. To conduct a formal risk assessment, we would define the activity and the time frame over which it is observed; for instance, this could be the community over a year. We are interested in whether any serious events occur within that time frame. If one does, we can evaluate the direct and indirect consequences over a period of time following the event (for example, the number of lives lost due to a hurricane in the subsequent two years). Naturally, there is uncertainty as we do not know whether an event will occur within the observed time, nor do we know what the consequences (both positive and negative outcomes) will be.

The above conceptual definition of risk enables us to understand whether risk is present. To then understand and measure the risk, we require the information denoted in the description of risk: (A′, C', Q, K). This is based on the assessments of the two main features of the risk concept: C and U. To assess C, we must identify potential events and their effects; these are referred to as the specified events (A′) and specified consequences (C′). The associated U is expressed using a quantitative and/or qualitative measure (Q) coupled with a statement of the knowledge (K)—the supporting data, information, beliefs, models and analysis that the assessment is based on. In addition, a judgment of the strength of this knowledge is required. This judgement must evaluate, for example, the amount of relevant data and information, reasonability of assumptions, and understanding of the phenomena considered. As before, we must be explicit about the time frame over which we observe the activity and the time horizon over which we evaluate consequences.

To confront the misperceptions previously mentioned, it is important to note that:

  1. (1)

    Conceptually the consequences include everything that occurs as a result of an event (direct and indirect). That is, the consequences are not limited to measurable units such as the number of fatalities, but instead include things such as cascading failures through a complex system. However, a risk assessment (as with any assessment) is limited by what can be evaluated with the resources available (K, as well as computational, time and financial resources).

  2. (2)

    The system’s recovery is an important consideration when determining the consequences of an event. This is affected by η (ref. 23).

  3. (3)

    Risk is not limited to situations where uncertainty is measurable or objective (frequentist), as uncertainty can be expressed quantitatively, qualitatively, or both. The knowledge supporting the assessment is also included and judged to evaluate the limitations and the potential for surprises.

Resilience

To establish the relationship between risk and resilience, we now describe the concept of resilience. Resilience is widely used in many fields and, as a result, numerous definitions have arisen (Table 1). These definitions have also diverged into several types of resilience. An example of one of these types is a dictionary definition of the term: “the capacity to recover quickly from difficulties”24. This is an example of static (or engineering) resilience, which is concerned with the ability of the system to maintain or return to its previous state in the face of a disturbance11,25,26. Another example is the definition used by the Intergovernmental Panel on Climate Change in 2012: “the ability of a system and its component parts to anticipate, absorb, accommodate, or recover from the effects of a hazardous event in a timely and efficient manner”27. These definitions of resilience suggest a single equilibrium state. In contrast, dynamic, or ecological, resilience28 broadens from the view that resilience is simply about resistance and recovery to the previous state. Instead, this alternative view incorporates the potential for change and shifting between equilibrium states: “the capacity of a system to absorb disturbances and reorganize while undergoing change so as to still retain essentially the same function, structure, identity, and feedbacks”29. A third category of definition has emerged in social and development contexts that includes a system’s ability to transform. For example, the IPCC in 2018 used: “The capacity of social, economic and environmental systems to cope with a hazardous event or trend or disturbance, responding or reorganizing in ways that maintain their essential function, identity and structure while also maintaining the capacity for adaptation, learning and transformation”30.

Table 1 A sample of resilience definitions from the literature
Full size table

Despite these differences in views of resilience, a common theme is the notion that resilience is a system’s ability (in the broad sense) to maintain or achieve desired functionality following some event. The debate between the three views, although seemingly focused on what the term ‘ability’ or ‘capacity’ encompasses, truly centres around the meaning of ‘desired functionality’. For instance, the scholars arguing that resilience definitions are limited to the ability to persist (in the current state) are speaking of systems that are generally operating at their desired state; those that take the view of dynamic resilience are referring to systems that can achieve desired functionality from several states; while those others arguing that resilience must include the capacity to transform are describing systems that have not reached the desired function. Modern definitions of risk (although commonly being defined “with respect to something that humans value”20) avoid this debate as they do not prescribe what is of value. In a similar manner, resilience theory should accept that desired functionality is system- and context-specific, rather than prescribing what is valued. The resilience-enhancing abilities are also therefore system- and context-specific. For example, most coupled human and natural systems have not achieved desired functionality as they remain environmentally unsustainable and, as a result, their ability to reorganize and transform is essential if they are to achieve and maintain desired function.

The consequence (positive or negative) of some event on a system is critical to assessing desired functionality. This is where risk analysis can provide insight. To illustrate, consider the bow-tie diagram (Fig. 2)—a common tool for risk management. The bow-tie depicts how risk sources lead to an event and on to consequences31. Risk treatment options are shown as the preventative and responsive controls or barriers. Preventative controls aim to prevent or withstand events, whereas responsive controls mitigate the consequences. The success of these controls is affected by the system’s resilience-enhancing capacities or characteristics. For example, in a coastal community, preventative controls could include a seawall or other action that increases the community’s robustness. These actions may reduce the likelihood of a disruptive event or prevent the event from causing damage. Responsive controls occur post-event; in the context of the hazard cycle, these occur during the immediate response, rehabilitation and recovery. If the system has strong capacities to prepare, absorb and recover, then it is better equipped to implement these controls as their efficacy is enhanced.

Fig. 2: The pathway between risk sources and consequences.
figure 2

Bow-tie diagrams such as this are a common tool in risk assessments.

Full size image

However, the long-term consequences and functioning of the system are essential considerations for resilience, especially in the context of climate change, natural hazards and development. Although the capacity to recover is critical to reducing the total consequences of a single event, we must also consider reducing the consequences from future events. This may require adaptation and transformation. Consider now a chain of bow-ties (Fig. 3) representing two subsequent events. Figure 3 illustrates how risk treatments and controls implemented for one event have implications for future events. Responsive controls that include or enable adaptation and transformation are synonymous with preventative controls for subsequent hazards. Adaptive and transformative interventions reduce the likelihood of, or can even eliminate, future risk sources.

Fig. 3: Chain of two bow-tie diagrams.
figure 3

Risk treatments for one event influence the system’s risk from future events.

Full size image

The chain of bow-ties, and how actions and events change a system, intuitively fits within the illustration of the risk concept in Fig. 1. Each branch or bifurcation point in the tree is a bow-tie, influencing future events and their likelihoods on the basis of previous outcomes and interventions (Fig. 4). Figure 4 illustrates how resilience influences the system’s risk. Higher resilience means that the system is better able to achieve desired functionality and reduce negative consequences, and in doing so influences the system’s risk.

Fig. 4: Risk and resilience are inherently integrated.
figure 4

The bow-tie chain and the tree illustration of the risk concept show how both concepts can be reconciled within this framework. The size of the question marks corresponds to the U of A.

Full size image

Furthermore, this illustration of resilience and risk highlights the consistency in terms of describing risk and resilience. That is, to describe risk information on the specified events (A′), specified consequences (C′), a measure of uncertainty (Q), and the underlying knowledge used in the assessment (K). This is the same information required for specific resilience: of what (the system), to what (A′: what events are considered), and for whom (C′: what consequences are being considered, for example, fatalities, economic loss and so on). An example in practice is the IPCC’s description of climate resilient development (IPCC’s AR6 WG2 Figure SPM.5)32. This shows how the risk is the uncertain consequences from cumulative societal choices, interventions, and shocks. In this case, climate resilient development are that processes and characteristics that will increase our global societal system’s likelihood of achieving desirable consequences in the future, thus influencing our risk.

Resilience in terms of risk

As we have shown, resilience and risk are inherently integrated, which raises the potential of defining and evaluating resilience in terms of risk. Although many definitions of resilience are in terms of resilience-abilities, others identify that these abilities are about creating resilience30. Therefore, instead of defining resilience as an ability or set of abilities, one approach is to define it directly as the risk to the system:

  • The [un] resilience of a system is the risk of [not] achieving desired functionality, during a specifictime, following an event.

This definition also has the corollary that

  • A system is judged resilient if the risk of not achieving the desired functionality is sufficiently low.

This corollary is consistent with the approach in safety science that defines a system as safe when the risk is acceptable.

In this manner, resilience can be described (either qualitatively or quantitatively) in terms of our belief—for example, expressed in terms of a subjective/knowledge-based probability, combined with a judgment of the strength of the knowledge supporting its assessment—about whether the system will maintain or achieve desired functionality in the face of shocks and stresses. Such a description covers the main components of any risk description, namely specified consequences (the system maintaining or achieving desirable functionality given a shock or stress), a measure of uncertainty related to the occurrence of these consequences (for example, the probabilities of the consequences occurring, along with a strength of knowledge judgment) and the knowledge supporting the consequence specification and the uncertainty measure assignment. That is, a system is judged to have high resilience if it is believed that the consequences following some event will be favourable. For example, in Fig. 5, futures with undesirable consequences are indicated. A resilient system would be expected to avoid these situations from occurring. The advantage of this approach to resilience is that, when attempting to measure resilience, we are not attempting to measure the capacities, many of which will interact in complex ways.

Fig. 5: Resilience and the risk to desired functionality.
figure 5

A system is judged resilient when the risk to the system is sufficiently low, meaning that the combination of negative consequences and associated uncertainties is judged to be sufficiently low. The size of the question marks corresponds to the U of A.

Full size image

The advantages of an integrated approach

Taking this proposed integrated approach enables us to leverage techniques and tools from fields of both resilience and risk. To illustrate this, consider the coastal city of Christchurch, New Zealand. In 2010 a series of earthquakes began that lasted several years and dramatically changed the city. In 2020 the city began its coastal hazards adaptation planning (https://ccc.govt.nz/environment/coast/adapting-to-sea-level-rise/our-coastal-hazards-adaptation-planning-programme). As the city seeks to build resilience to coastal hazards, the best outcome will be achieved by taking a holistic approach, rather than independently managing the critical aspects.

Taking a modern risk analysis approach (Box 1) has several advantages as it enables us to semi-quantitatively assess the risk and evaluate potential interventions that will build the community’s resilience.

Balancing synergies and trade-offs

One key advantage is that the risk-based approach is focused on the overall consequences and impact on functionality, not solely the means of getting there. Therefore, we must consider any intervention that will reduce the negative consequences and enhance favourable ones (that is, leverage opportunities). Such interventions include fostering the community’s resilience-enhancing abilities (including the capacity to anticipate, absorb and so on). Recovery, for example, is a critical factor in the consequences of an event. Restricting risk treatment to robustness-enhancing measures is a self-imposed limitation that will not lead to the best outcome for the community.

To evaluate the overall consequences, we must consider indirect and cascading impacts through potentially highly complex systems. For example, in Christchurch’s adaptation assessment, the impacts on the human domain are often indirect and result from impacts to the built environment. Furthermore, some of the impacts are difficult (if not impossible) to quantify—such as how the community may recover from an event decades in the future. In these cases, we can qualitatively assess the anticipated impact of various interventions while recognizing the limited knowledge.

A long-term view

We must also consider the future long-term implications of interventions. As shown in the bow-tie chain, interventions can influence the long-term risk and enhance the system’s resilience. Considering the future impacts is critical in climate change adaptation as the coastal hazards are changing over time. If we only consider immediate impacts in the analysis, or consider only events in the short-term, the proposed interventions could increase the exposure and vulnerability of the community in the future. If we only consider the recovery, our interventions could leave the community exposed. Instead, this integrated approach requires a balance to be sought and enables solutions to be more flexible and creative for each community.

Managing uncertainty and avoiding maladaptation

We must attempt to anticipate surprises and unknowns. By evaluating the knowledge underlying the assessment the aspects with high uncertainty should be identified and can be further investigated. This may entail further quantitative or qualitative analysis. This process is intended to help with identifying potential unforeseen events or failures.

Through the process of looking for potential unforeseen events and surprises, we should evaluate for the potential of maladaptation; where reducing the risk from one hazard increases the risk from another33,34. In adapting to the coastal hazards, the interventions must be evaluated (even if at a high level) for their potential to increase exposure to other hazards.

This approach clearly identifies the hazards that are being prepared for and avoids the potential for a false sense of readiness. The notion that resilience is ‘threat agnostic’35 is similar to the ‘all-hazards approach’ in disaster risk which is potentially flawed36. The all-hazards approach is “an integrated approach to emergency preparedness planning that focuses on capacities and capabilities that are critical to preparedness for a full spectrum of emergencies or disasters”37. It has been criticized due to the often vast differences required to respond to different hazards and given the alleged commonalities may not be simple36. Clearly stating which hazards are being prepared for avoids a false sense of readiness that may lead to failure to prepare for other threats36.

In short, this approach enables us to leverage approaches and tools from fields of both resilience and risk. Owing to the time pressures on our response to the climate crisis, we should avoid imposing non-existent challenges and limitations. Instead, using an integrated, long-term-focused approach, we can be holistic in our response.

Manage risk and resilience interdependently

We argue that risk and resilience should not be arbitrarily separated or managed independently. Instead, we present a framework for risk and resilience that is integrated and holistic. By considering resilience within a risk framework and acknowledging the temporal element of risk, it is clear that both pre- and post-event interventions affect the consequences of an event and are highly interdependent. That is, risk includes not only the concepts of ‘withstand’ and ‘respond’35, but also ‘adapt’ and ‘recover’. The calls for independent and insular management of these components may hamper efforts to enhance resilience. Only holistic, integrated management can promote efficient use of resources. This framework enables considerations of trade-offs and synergies.

An integrated approach also enables the use of risk science—with its significant body of literature, tools and methods—to inform and support resilience efforts. For example, in risk science we have learned not to confuse a conceptual definition with a measure; Pimm et al.26 are confusing these by claiming that we can only advance our understanding of the concept of resilience if we can measure it. In risk science, this same conflation has limited people’s understanding of risk, leading to misconceptions like those presented by Stirling5: although risk can be measured as probability or expected loss, the concept of risk is not limited to this. A measure for a concept is not necessarily its definition. For example, as science and computational ability evolves, so too does our ability to measure complexity.

Another major advantage of the integrated approach is the ability to implement resilience through disaster risk reduction plans. For example, a review of climate adaptation plans identified Baltimore’s and Los Angeles’ plans as the most effective; these are the two cities that integrated their adaptation plan into their disaster risk reduction plan38. This was considered effective because they mainstreamed adaptation by embedding it into a well-established policy area with a strong regulatory framework. Similarly, resilience planning integrated into risk planning would benefit from the existing policy mechanisms.

Ultimately, situating resilience within a risk framework presents a series of opportunities for our communities and the interested research disciplines. The framework we propose enables the components of resilience to be managed in an interdependent and holistic manner. This means that trade-offs and synergies between interventions can be evaluated and leveraged. It means that we will enable communities to avoid the trap of the continual hazard–rebuild–hazard cycle. It clarifies the terminology and provides opportunities for leveraging approaches and techniques in the existing risk literature. Tackling the resilience challenge requires us to move past the pervasive siloing and divergence of related fields. Instead, all tools need to be considered for adoption (or adaptation) so we can get on with operationalizing resilience in our communities.