GCRI · Systemic Risk Management
Resilience engineering
Resilience engineering studies how systems and organisations keep functioning when conditions exceed what designers expected. It looks at the capacity to anticipate, monitor, respond and learn, and at the margins that let people adapt when procedures run out. This page sets out how resilience is built and eroded, how it can be measured without false precision, and what the evidence serves for those who run critical systems.
Resilience engineering on the record.
Resilience engineering: how the risk develops.
Continuity, recovery and adaptive capacity. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Anticipation and monitoring
Resilient systems watch for signals that conditions are changing and prepare before a threshold is crossed. Monitoring that only tracks normal performance misses the drift toward the edge of safe operation.
Margins are traded away
Efficiency pressure removes spare capacity, staff and stock that appear unused. Each removal is reasonable alone, but together they erode the margin that absorbs disruption.
People fill the gap
When procedures do not fit the situation, operators adapt. That adaptive capacity is a source of resilience, and it depends on training, authority to act and time to think.
Learning closes the loop
Organisations that study what went right and what nearly went wrong, as well as failures, adjust designs and procedures. Without learning, the same weaknesses recur.
Hazards and exposure in Asia.
Population density, flood water and active fires over Asia, from NASA GIBS. Each layer carries its own date.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Hazards and exposure, for this page
About this layer
- Evidence
- Estimated
- Source
- Gridded Population of the World v4.11 (NASA SEDAC (CIESIN, Columbia University))
- Provider
- NASA SEDAC (CIESIN, Columbia University)
- Licence
- CC BY 4.0
- Vintage
- null; Census-based estimate, static (2020)
- Resolution
- about 1 km grid
- Uncertainty
- Census-based estimate of people per square kilometre in 2020, shown as exposure context; not a count of people affected by any hazard.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Observed (clouds leave gaps)
- Source
- VIIRS Global Flood Product (NASA LANCE)
- Provider
- NASA LANCE
- Licence
- NASA open data
- Vintage
- daily; Satellite detection; clouds leave gaps
- Newest at build
- 2026-10-14
- Resolution
- about 250 m grid
- Uncertainty
- Satellite detection; clouds leave gaps. Satellite or model raster as the provider publishes it. Clouds, swath gaps and retrieval error leave gaps and noise; values are indicators, not measurements at a place.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Observed (clouds and overpass timing leave gaps)
- Source
- VIIRS NOAA-20 375 m (FIRMS) (NASA LANCE FIRMS)
- Provider
- NASA LANCE FIRMS
- Licence
- NASA open data
- Vintage
- daily; Satellite detection; clouds and overpass timing leave gaps
- Newest at build
- 2026-10-13
- Resolution
- about 500 m grid
- Uncertainty
- Satellite hot-spot detections for the day shown, including gas flares and industrial heat; not a confirmed fire, an incident report or a warning.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Observed
- Source
- VIIRS NOAA-20 corrected reflectance (NASA LANCE)
- Provider
- NASA LANCE
- Licence
- NASA open data
- Vintage
- daily; Satellite image
- Newest at build
- 2026-10-14
- Resolution
- about 250 m grid
- Uncertainty
- Satellite image. Satellite or model raster as the provider publishes it. Clouds, swath gaps and retrieval error leave gaps and noise; values are indicators, not measurements at a place.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Modelled (latest year GIBS publishes)
- Source
- MODIS Terra and Aqua land cover (MCD12Q1) (NASA LP DAAC)
- Provider
- NASA LP DAAC
- Licence
- NASA open data
- Vintage
- yearly; Satellite classification; latest year GIBS publishes
- Newest at build
- 2024-01-01
- Resolution
- about 500 m grid
- Uncertainty
- Satellite land cover classes for the year shown, including croplands; a classification with known errors, not a farm register.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Observed (persistent cloud still leaves gaps)
- Source
- VIIRS NOAA-20 Level 3, 8-day (NASA LANCE)
- Provider
- NASA LANCE
- Licence
- NASA open data
- Vintage
- 8-day; Satellite 8-day composite; persistent cloud still leaves gaps
- Newest at build
- 2026-09-14
- Resolution
- about 1 km grid
- Uncertainty
- Satellite skin temperature of the ground over the 8 days ending on the date shown, a heat exposure indicator; not air temperature, heat index or a heat warning.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Hazards and exposure, framed on Asia.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.
Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONET · U.S. Geological Survey · NASA JPL OPERA DIST-ALERTSources and licences
- We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
- VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- NASA Fire Information for Resource Management System (FIRMS), VIIRS 375 m active fire product, NASA LANCE; vector tiles via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- MODIS land products (vegetation indices, gross primary production, land cover), NASA LP DAAC and LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
- Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
- © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). ODbL
- Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
- Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
- Live: NASA EONET Events are indicative, not authority warnings.
- Live: U.S. Geological Survey Events are indicative, not authority warnings.
- Observed (EO): NASA JPL OPERA DIST-ALERT (contains modified Copernicus Sentinel data 2026). We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS).
- NASA GIBS: We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS).
- River discharge forecast, 30 days with range (GloFAS via Open-Meteo): Contains modified Copernicus Emergency Management Service information 2026; not a flood warning.
- Weather data by Open-Meteo.com (https://open-meteo.com/), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
- Optional layers (11 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.
Layers and dates
- Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
- Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
- Active fires and thermal anomalies: VIIRS NOAA-20 375 m (FIRMS), NASA LANCE FIRMS · 13 Oct 2026
- True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026
- Land cover type (IGBP), yearly: MODIS Terra and Aqua land cover (MCD12Q1), NASA LP DAAC · 2024
- Land surface temperature, day, 8-day composite: VIIRS NOAA-20 Level 3, 8-day, NASA LANCE · 14 Sep 2026
Resilience engineering looks at how systems adapt, across domains.
- EnergyCouplingOperators keep grids stable through adaptive control and reserves.What to watchOperator interventions during disturbances
- HealthCouplingHospitals adapt through surge plans and workarounds when supplies fail.What to watchWorkarounds recorded in after-action reviews
- WaterCouplingUtilities adapt with alternative sources, pressure management and rationing plans.What to watchContingency supply options
Resilience findings are designed for the Global Sector Risk and Resilience series. The discipline, set out by Woods, Hollnagel and colleagues, studies the capacity to respond, monitor, anticipate and learn; evidence comes from operations and exercises, recorded under NS-11 of the proposed Nexus Standards.
- Operational accounts of how staff kept a service running.
- Exercise records with independent evaluation.
Stocks, flows, delays and a tipping threshold.
Two stocks, pressure and adaptive capacity, joined by a reinforcing growth loop, a delayed balancing response and damage when pressure outruns capacity; past the threshold the system can tip. Teaching model with stated illustrative values, not a prediction. The map on this page shows Asia; the model itself is not tied to a place.
Controls
- Growth of pressure
- 6.0% a year
- Efficacy of capacity in reducing pressure
- 4.0% a year
- Investment response to perceived pressure
- 20%
- Perception delay
- 4.0 years
- Tipping threshold of pressure
- 60 index
- Amplification past the threshold
- 2.0 times
- Years simulated
- 50 years
Readouts
- Peak pressure
- 113 index
- Capacity at the end
- 186 index
- Years over the threshold
- 15.8 years
Numbers, methods and sources
| Year | Pressure | Capacity | Perceived |
|---|---|---|---|
| 0 | 20.0 | 50.0 | 20.0 |
| 4 | 23.3 | 44.9 | 21.2 |
| 8 | 27.2 | 42.2 | 24.0 |
| 12 | 31.7 | 42.3 | 27.7 |
| 16 | 36.8 | 45.5 | 32.2 |
| 20 | 42.3 | 51.5 | 37.2 |
| 24 | 47.9 | 60.3 | 42.6 |
| 28 | 53.2 | 71.3 | 48.0 |
| 32 | 57.8 | 84.3 | 53.1 |
| 36 | 66.4 | 98.4 | 58.4 |
| 40 | 82.7 | 115.9 | 69.7 |
| 44 | 97.8 | 139.7 | 83.8 |
| 48 | 109.1 | 169.4 | 97.3 |
Methods
- System dynamics Forrester (1961), Industrial Dynamics, MIT Press; Sterman (2000), Business Dynamics
- Critical transitions and tipping points Scheffer and others (2009), Early-warning signals for critical transitions, Nature 461
- Causal loop diagram Sterman (2000), Business Dynamics, McGraw-Hill
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
No observed data enters this model: it runs on the teaching values set by the controls, to be replaced with a programme’s own evidence.
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Systemic Risk Management in Foundry
- Tested at Systemic Risk Management in Universe
- Codified in Systemic Risks in Standards
- Published in Systemic Risk Management in Reports
- Taught in Faculty of Risk Science and Methods in Academy
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Spare capacity | percent of peak demand available as reserve | monthly | Operational records | OBSERVED |
| Recovery time objective met | percent of tested services restored within objective | per exercise | Continuity test records | OBSERVED |
| Near misses reported | count per period | monthly | Safety and incident reporting systems | REPORTED |
| Lessons implemented | percent of recorded lessons with completed actions | quarterly | Learning and action tracking | REPORTED |
| Staff trained for degraded operation | percent of critical roles | annual | Training records | REPORTED |
| Single-skill critical roles | count of roles with one qualified holder | annual | Workforce records | OBSERVED |
Model resilience engineering as a system. Run the cascade.
Assembled from the Nexus Standards area profile Global and systemic risk: the hazards it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Choose the components, pick an initiating hazard and step through the cascade. The Map view places the run on an example geography with open data. Every coupling weight is a stated assumption you can change. A teaching model, not a forecast, an assessment or a certification. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- Financial contagion
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
- Sovereign debt crisis (set off downstream)
- Currency crisis (set off downstream)
Systems and couplings
- Global and systemic risk
- Compound and cascading hazard standards Mechanism
- Financial stability and prudential risk Mechanism
- Supply chain and trade risk Cascade
- Future generations and long-term risk Common driver
Controls
NS-0Constitution and principlesNS-3Risk record UNIs (grammar, legacy crosswalk, allocation authority)NS-9Contextual UNIs (deployments, instances, programme instances)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-14Conformance and crosswalk to external standardsNRS-H120Hazard family: Structural fragility of interconnected systems (NHS-1 sys.fragility)NRS-C6Systemic and cascading riskNRS-H61Hazard family: Cascading failure (NHS-1 sys.cascade)NRS-H62Hazard family: Compound and multi-hazard events (NHS-1 sys.compound)NRS-H94Hazard family: Systemic cyber events (NHS-1 cyber.systemic-cyber)NRS-H60Hazard family: Supply-chain and flow disruption (NHS-1 sys.supply-chain)
Observation
- INFORM Risk Index (listed for reference)
- World Bank Open Data and World Development Indicators API (listed for reference)
- IMF data services (WEO, IFS, FSI via SDMX) (listed for reference)
- Direct economic loss attributed to disasters in relation to global GDP
- Macroeconomic Dashboard
Example geography
- Bangladesh: 134 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Surface soil moisture (SMAP), NASA GIBS
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| ISO 22301 Business continuity management systems | Requirements for continuity planning, objectives and exercises | Licensed standard, purchase required |
| ISO 22316 Organisational resilience principles and attributes | Principles and attributes of organisational resilience | Licensed standard, purchase required |
| Safety investigation reports from transport and industrial safety boards | Detailed accounts of failures, near misses and contributing factors | Public records, terms per board |
| Resilience Engineering Association publications | Research on adaptive capacity, the resilience potentials and safety | Licence per publication |
| National critical infrastructure resilience guidance | Government guidance on resilience planning for operators | Public records, licence per government |
How resilience engineering is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
Model, equations and assumptions
The model structure used for resilience engineering, the assumptions it makes and how each is tested.
Ri = f(Hi, Ei, Vi, Ci)hazard, exposure, vulnerability and coping capacityEAL = ∑k pk · Lkover events k with annual probability pkxt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error| Assumption | Why it is made | How it is tested |
|---|---|---|
| Hazard and exposure are independent within an event | Keeps the loss integral tractable | Compare with a copula fit on joint records |
| Couplings are linear near the operating point | Lets shocks propagate through A | Perturb beyond the linear range and compare |
| Vulnerability curves transfer between places | Local curves are rarely available | Validate against observed losses where they exist |
- Inputs
- versioned datasets with provenance
- Outputs
- distributions, never single numbers
- Code
- released with the model card and tests
- Reproduction
- same data, code, environment and seed
Who decides, and what the evidence serves.
Systemic Risk Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Operators of critical systems | Where to restore margins and invest in adaptive capacity | Margin inventories; recovery tests; single-skill roles |
| Safety and continuity managers | Which exercises and learning reviews to run | Near-miss patterns; lessons implemented |
| Regulators of critical sectors | What resilience expectations to set for operators | Resilience assessments against named standards |
Outputs this topic produces
- Resilience assessments organised around anticipating, monitoring, responding and learning
- Margin inventories that show where spare capacity has been removed
- Exercise designs for degraded and manual operation
- Learning reviews that cover near misses and successful adaptation
What resilience engineers ask.
- Which services must continue under any disruption, and what is the longest interruption they can tolerate?
- How does the system degrade under stress: gracefully, or suddenly?
- How quickly can it recover, and what does recovery depend on?
- Can the organisation learn and adapt, or does it repeat the same failures?
Capacities that make systems resilient.
Resilience research distinguishes the capacity to absorb a shock, the capacity to recover from it and the capacity to adapt so that the next shock does less harm. Different investments strengthen each, and an organisation strong in one can be weak in another.
Buffers and margins
Spare capacity, stocks and slack that absorb shocks. Efficiency drives often remove them.
Restoration paths
Plans, spares, skills and relationships that bring services back quickly.
Learning and flexibility
The ability to change how the system works when conditions change, and to learn from near misses.
How resilience is studied and built.
- 01
Reliability engineering
Reliability and resilience engineering analyses failure modes, redundancy and recovery times. It is strongest for technical systems with known failure data.
- 02
Business continuity analysis
Identifies critical services, tolerances for disruption and dependencies. It depends on honest assessment of what is truly critical.
- 03
Resilience metrics
Measures such as time to recover and service level under stress. No single metric captures resilience, and metrics can be gamed.
- 04
Learning reviews
Studies of how work is actually done, including successful adaptation, not only failures. They require a culture that does not punish honesty.
How it is studied, and what the methods cannot say.
- 01Reliability and resilience engineeringRedundancy and diversity design · Graceful degradation planning · Recovery time analysisApplied here
- 02Network science and contagionDependency network mapping · Centrality and concentration · Failure propagation simulationApplied here
- 03Scenario design and stress testingCross-sector scenario design · Reverse stress testing · Second-round effectsApplied here
- 04Probability and statisticsFrequency and severity modelling · Dependence between risks · Combining data and judgementApplied here
Where this page’s references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
What is resilience engineering?
How is resilience different from robustness?
Can resilience be measured?
Is resilience the same as robustness?
Does resilience cost efficiency?
Contribute evidence from this page.
Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.