A classification system for characterizing the integrity and quality of evidence in risk studies.

Risk management requires a balance between knowledge and values. Knowledge consists of justified beliefs and evidence, with evidence including data, assumptions, and models. While quality and integrity of evidence are valued in the sciences, risk science involves uncertainty, which suggests that evidence can be incomplete or imperfect. The use of inappropriate evidence can invalidate risk studies and contribute to misinformation and poor risk management decisions. Additionally, the interpretation of quality and integrity of evidence may vary by the risk study mission, decision-maker values, and stakeholder needs. While risk science has developed standards for risk studies, there remains a lack of clarity for how to demonstrate quality and integrity of evidence, recognizing that evidence can be presented in many formats (e.g., data, ideas, and theories), be leveraged at various stages of a risk study (e.g., hypotheses, analyses, and communication), and involve differing expectations across stakeholders. This study develops and presents a classification system to evaluate quality and integrity of evidence that is based on current risk science guidance, best practices from non-risk disciplines, and lessons learned from recent risk events. The classification system is demonstrated on a cyber-security application. This study will be of interest to risk researchers, risk professionals, and data analysts.

On the use of the term "real risk".

The term "real risk" and variations of this term are commonly used in everyday speech and writing, and in the scientific literature. There are mainly two types of use: i) in statements about what the real risk related to an activity is and ii) in statements about the risk related to an activity being real. The former type of use has been extensively discussed in the literature, whereas the latter type has received less attention. In the present study, we review both types of use and analyze and discuss potential meanings of type ii) statements. We conclude that it is reasonable to interpret a statement about the risk being real as reflecting a judgement that there is some risk and that the knowledge supporting this statement is relatively strong. However, such a statement does not convey whether the risk is small or large and needs to be supplemented by a characterization of the risk.

Artificial intelligence for risk analysis-A risk characterization perspective on advances, opportunities, and limitations.

Artificial intelligence (AI) has seen numerous applications for risk analysis and provides ample opportunities for developing new and improved methods and models for this purpose. In the present article, we conceptualize the use of AI for risk analysis by framing it as an input-algorithm-output process and linking such a setup to three tasks in establishing a risk description: consequence characterization, uncertainty characterization, and knowledge management. We then give an overview of currently used concepts and methods for AI-based risk analysis and outline potential future uses by extrapolating beyond currently produced types of output. We end with a discussion of the limits of automation, both near-term limitations and a more fundamental question related to allowing AI to automatically prescribe risk management decisions. We conclude that there are opportunities for using AI for risk analysis to a greater extent than is commonly the case today; however, critical concerns about proper uncertainty representation and the need for risk-informed rather than risk-based decision-making also lead us to conclude that risk analysis and decision-making processes cannot be fully automated.

Cases of real-life policies related to risk: How can they enhance risk analysis and risk science?

Policies on risk constitute a core topic of risk analysis and risk science, and it is common at risk conferences to present real-life cases of such policies, for example related to the handling of climate change and pandemics. Although these are of broad interest, showing how important issues in society are dealt with, it can be questioned to what extent and how these cases contribute to enhancing risk analysis and risk science. The present paper addresses this concern. It is argued that, in order to learn from the cases, they need in general to be more thoroughly followed up with discussions of concepts, principles, approaches, and methods for assessing, characterizing, communicating and handling risk. Describing a governmental policy on, for example, the handling of COVID-19 is a point of departure for interesting discussions concerning its justification and performance, in particular in relation to risk and the most updated knowledge from the risk analysis field. Such discussions are, however, often lacking. The paper points to some key obstacles and challenges for the learning process, including the difficulty of distinguishing between policies, policy analysis, and politics.

Risk literacy: Foundational issues and its connection to risk science.

A new research area is developing, risk literacy. The term "risk literacy" basically refers to one's ability to understand and evaluate risk, in order to support and make appropriate decisions. In this article, we discuss how risk literacy relates to risk analysis/science with its topics of risk fundamentals (concepts), risk understanding, risk assessments, risk characterizations, risk perception, risk communication, and risk handling (covering risk management, risk governance, and policies on risk). We question how issues and research topics addressed in risk literacy relate to risk analysis/science knowledge, particularly on risk understanding. The main conclusion of the article is that risk literacy addresses an important topic-from both a theoretical and a practical societal relevancy perspective-and brings the potential for many additional developments and further insights if the topic is better integrated with risk science knowledge more broadly.

A risk science perspective on liability/guilt and uncertainty judgements in courts.

This article aims to provide new insights about risk and uncertainty in law contexts, by incorporating ideas and principles of contemporary risk science. The main focus is on one particular aspect of the law: its operation in courts where a defendant has been charged with a violation of civil or criminal law. Judgements about risk and uncertainty-typically using the probability concept-and how these relate to the evidence play a central role in such situations. The decision on whether the defendant is liable/guilty or not may strongly depend on how these concepts are understood and communicated. Considerable work has been conducted to provide theoretical and practical foundations for the risk and uncertainty characterizations in these contexts. Yet, it can be argued that a proper foundation for linking the evidence and the uncertainty (probability) judgements is lacking, the result being poor communication in courts about risk and uncertainties. The present article seeks to clarify what the problems are and provide guidance on how to rectify them.

Risk science applied to major risk events in history.

Major risk events in history are often labeled as black swans or as unforeseeable given the risk policies and procedures existing at the time. Hindsight suggests that many of these events could have been foreseeable. This article explores past risk events, (1) analyzes how risk science principles apply to those events, and (2) studies gaps and opportunities for risk science using the lenses of consequences, uncertainty, and knowledge as they relate to evidence used for risk assessment prior to the risk event. New insights are obtained, relating to general foundational risk science issues and a classification system for characterizing the integrity and quality of evidence in risk studies. The analysis results are used to identify how risk science approaches contribute to the overall management of risk and societal safety, and where improvements can be obtained.

Understanding the implications of low knowledge and high uncertainty in risk studies.

Risk analysis has existed for thousands of years and will continue to grow in importance across professions and industries. Of special importance is the need to understand and manage risk when there is low knowledge and high uncertainties. Even with pristine and high-quality risk analysis in these situations, integrity and credibility can be questioned, and risk events can happen. Although these issues do not prove some shortcoming in risk analysis and risk management, they can directly impact the risk analyst and decision-makers. The risk literature has addressed the issues of defining and promoting integrity and credibility for risk studies, but there is little existing guidance for the analyst when handling the commonly encountered low knowledge and high uncertainty contexts. In this article, we explore the implications of low knowledge and high uncertainty in risk studies to understand how the risk analyst can acknowledge those features in a risk study, with recognition that those features may be questioned later. The topic of this article will be of interest to risk managers, professionals, and analysts in general who are tasked with analyzing and communicating with studies.

Risk analysis under attack: How risk science can address the legal, social, and reputational liabilities faced by risk analysts.

The role of the risk analyst is critical in understanding and managing uncertainty. However, there is another type of uncertainty that is rarely discussed: The legal, social, and reputational liabilities of the risk analyst. Recent events have shown that professionals participating in risk analysis can be held personally liable. It is timely and important to ask: How can risk science guide risk analysis with consideration of those liabilities, particularly in response to emerging and unprecedented risk. This paper studies this topic by: (1) Categorizing how professionals with risk analysis responsibilities have historically been held liable, and (2) developing a framework to address uncertainty related to those potential liabilities. The result of this framework will enable individual analysts and organizations to investigate and manage the expectations of risk analysts and others as they apply risk principles and methods. This paper will be of interest to risk researchers, risk professionals, and industry professionals who seek maturity within their risk programs.

A risk science perspective on vaccines.

Vaccines can be seen as one of the greatest successes in modern medicine. Good examples are the vaccines against smallpox, polio, and measles. Unfortunately, vaccines can have side effects, but the risks are considered by the health authorities and experts to be small compared to their benefits. Nevertheless, there are many who are skeptical of vaccination, something which has been very clearly demonstrated in relation to the COVID-19 disease. Risk is the key concept when evaluating a vaccine, in relation to both its ability to protect against the disease and its side effects. However, risk is a challenging concept to measure, which makes communication about vaccines' performance and side effects difficult. The present article aims at providing new insights into vaccine risks-the understanding, perception, communication, and handling of them-by adopting what is here referred to as a contemporary risk science perspective. This perspective clarifies the relationships between the risk concept and terms like uncertainty, knowledge, and probability. The skepticism toward vaccines is multifaceted, and influenced by concerns that extend beyond the effectiveness and safety of the vaccines. However, by clarifying the relationships between key concepts of risk, particularly how uncertainty affects risk and its characterization, we can improve our understanding of this issue.

Data-driven predictive modeling in risk assessment: Challenges and directions for proper uncertainty representation.

Data-driven predictive modeling is increasingly being used in risk assessments. While such modeling may provide improved consequence predictions and probability estimates, it also comes with challenges. One is that the modeling and its output does not measure and represent uncertainty due to lack of knowledge, that is, "epistemic uncertainty." In this article, we demonstrate this point by conceptually linking the main elements and output of data-driven predictive models with the main elements of a general risk description, thereby placing data-driven predictive modeling on a risk science foundation. This allows for an evaluation of such modeling with reference to risk science recommendations for what constitutes a complete risk description. The evaluation leads us to conclude that, as a minimum, to cover all elements of a complete risk description a risk assessment using data-driven predictive modeling needs to be supported by assessments of the uncertainty and risk related to the assumptions underlying the modeling. In response to this need, we discuss an approach for assessing assumptions in data-driven predictive modeling.

On Some Foundational Issues Concerning the Relationship Between Risk and Resilience.

"Risk" and "resilience" are both terms with a long history, but how they are related and should be related are strongly debated. This article discusses the appropriateness of a perspective advocated by an active "resilience school" that sees risk as a change in critical system functionality, as a result of an event (disturbance, hazard, threat, accident), but not covering the recovery from the event. From this perspective, two theses are examined: risk and resilience are disjunct concepts, and risk is an aspect of resilience. Through the use of several examples and reasoning, the article shows that this perspective challenges daily-life uses of the risk term, common practices of risk assessments and risk management, as well as contemporary risk science. A fundamental problem with the perspective is that system recovery is also an important aspect of risk, not only of resilience. Risk and resilience analysis and management implications of the conceptual analysis are also discussed.

Risk Analysis in the Age of Big Data: The Promises and Pitfalls.

Despite its rising popularity, the novelty and merits of big data risk analysis are still debated. This perspective article contributes to the debate by clarifying what constitutes big data in the context of risk analysis and proposing that the discussions of big data attributes (i.e., scale, speed, and structure) and big data methods should go hand in hand. Simple examples are used to illustrate the differences between big data risk analysis and traditional approaches. Finally, a distinction is made between the conceptual definition of risk and how risk is measured to clarify the contributions of big data to risk assessment, and to highlight the importance of explicitly accounting for strength of knowledge in conducting big data risk analysis.

Risk Science in Higher Education: The Current and Future Role of Risk Science in the University Curriculum.

Risk and uncertainty are critical elements for decision making across fields, such as business, policy, engineering, and healthcare. As universities maintain and adapt curriculums to ensure their graduates are prepared for risk-related roles, there is momentum for risk science to be included in the curriculum. The study of risk science can be observed in programs devoted to risk fundamentals (for example on basic concepts like risk and probability) and risk assessment, risk perception and communication, and risk management and governance. Additionally, selected concepts related to risk science, such as safety and resilience analysis and management, are increasingly being embedded into a broader range of university curriculums. The present article presents a structure for classifying these programs, by distinguishing between generic (fundamental) risk science and applied risk science, with subcategories reflecting both subject (topic) and domain (application area). An overall evaluation of the broad offerings in risk science through devoted curriculums and selected topics within other specialized fields is conducted on the basis of the study programs currently offered. Perspectives are also provided on how to further enhance risk science studies at our universities and colleges.

A Risk-Science Approach to Vulnerability Classification.

Advancements in the risk literature and recent events have highlighted the need for recognizing and managing system vulnerabilities. However, established definitions of vulnerability typically involve only static concepts that are limited to measurement of system characteristics. Advancements in risk modeling, combined with the dynamic nature of data availability, and processing call for the need to understand the various dimensions and time-dependent properties of vulnerability within risk-informed decision making. There is need to: (1) Understand and classify aspects of vulnerability that exist in various systems, such as related to engineering, business, and healthcare, while recognizing both properties of the system and associated knowledge, (2) reconcile these definitions of vulnerabilities with existing concepts, such as sensitivity analysis and fragility, and (3) explore the implications of various types of vulnerability on risk management decisions. The main contributions of this work include classifying dynamic characteristics of system vulnerability and leveraging information about the multidimensional properties of vulnerability within risk management decisions that apply to a collection of risk events. As a proof of concept, we illustrate the vulnerability classification on the COVID-19 pandemic. This article will be of interest to both risk researchers and practitioners.

The Role of Time in Risk and Risk Analysis: Implications for Resilience, Sustainability, and Management.

There is a persistent misconception that risk analysis is only suited for considering the immediate consequences of an event. Such a limitation would make risk analysis unsuitable for many challenges, including resilience, sustainability, and adaptation. Fortunately, there is no such limitation. However, this notion has stemmed from a lack of clarity regarding how time is considered in risk analysis and risk characterization. In this article, we discuss this issue and show that risk science provides concepts and frameworks that can appropriately address time. Ultimately, we propose an adjusted nomenclature for explicitly reflecting time in risk conceptualization and characterizations.

Risk Science Contributions: Three Illustrating Examples.

This article aims to demonstrate that risk science is important for society, industry and all of us. Rather few people today, including scientists and managers, are familiar with what this science is about-its foundation and main features-and how it is used to gain knowledge and improve communication and decision making in real-life situations. The article seeks to meet this challenge, by presenting three examples, showing how risk science works to gain new generic, fundamental knowledge on risk concepts, principles, and methods, as well as supporting the practical tackling of actual risk problems.

Foundational Challenges for Advancing the Field and Discipline of Risk Analysis.

Risk analysis as a field and discipline is about concepts, principles, approaches, methods, and models for understanding, assessing, communicating, managing, and governing risk. The foundation of this field and discipline has been subject to continuous discussion since its origin some 40 years ago with the establishment of the Society for Risk Analysis and the Risk Analysis journal. This article provides a perspective on critical foundational challenges that this field and discipline faces today, for risk analysis to develop and have societal impact. Topics discussed include fundamental questions important for defining the risk field, discipline, and science; the multidisciplinary and interdisciplinary features of risk analysis; the interactions and dependencies with other sciences; terminology and fundamental principles; and current developments and trends, such as the use of artificial intelligence.

Review and Evaluation of the J100-10 Risk and Resilience Management Standard for Water and Wastewater Systems.

Risk analysis standards are often employed to protect critical infrastructures, which are vital to a nation's security, economy, and safety of its citizens. We present an analysis framework for evaluating such standards and apply it to the J100-10 risk analysis standard for water and wastewater systems. In doing so, we identify gaps between practices recommended in the standard and the state of the art. While individual processes found within infrastructure risk analysis standards have been evaluated in the past, we present a foundational review and focus specifically on water systems. By highlighting both the conceptual shortcomings and practical limitations, we aim to prioritize the shortcomings needed to be addressed. Key findings from this study include (1) risk definitions fail to address notions of uncertainty, (2) the sole use of "worst reasonable case" assumptions can lead to mischaracterizations of risk, (3) analysis of risk and resilience at the threat-asset resolution ignores dependencies within the system, and (4) stakeholder values need to be assessed when balancing the tradeoffs between risk reduction and resilience enhancement.

The Call for a Shift from Risk to Resilience: What Does it Mean?

In recent years calls have been made for a shift from risk to resilience. The basic idea is that we need to be prepared when threatening events occur, whether they are anticipated or unforeseen. This article questions the extent to which this call will have and should have implications for the risk field and science. Is the call based on a belief that this field and science should be replaced by resilience analysis and management, or is it more about priorities: Should more weight be placed on improving resilience? The article argues that the only meaningful interpretation of the call is the latter. Resilience analysis and management is today an integrated part of the risk field and science, and risk analysis in a broad sense is needed to increase relevant knowledge, develop adequate policies, and make the right decisions, balancing different concerns and using our limited resources in an effective way.