Building Resilience into Systems

Download PDF
2 downloads 0 Views 2MB Size Report
Comment
development of a 'Blueprint' for resilience. SSM is used to draw together .... gains; the requirement for continued survival; and that the enterprise operates within ...
Building Resilience into Systems Jeremy Hilton

Clare Wright

Department of Informatics and Systems Engineering Cranfield University, Defence Academy of the UK Shrivenham, UK [email protected]

School of Computer Science and Informatics Cardiff University Cardiff, UK [email protected]

Vasiliki Kiparoglou Centre for Disaster Studies University of Glamorgan Glamorgan, UK Abstract—This paper presents the results of the CuReSS Project and demonstrates how the use of systems thinking principles and systems thinking methods, combined with an exploration of the human body’s achievement of resilience, have contributed to the development of a ‘Blueprint’ for resilience. SSM is used to draw together viewpoints from fields including ecology, physics, sociology, psychology and disaster management. The incorporation of an enterprise systems model enables resilience concepts to be contextualized for enterprises and is used to develop a set of key features of a resilience system, providing a framework for investigating resilience. Keywords - Resilience; Systems Thinking; Soft Systems Methodology; Patterns

I.

INTRODUCTION

Resilience is not a purpose of an organisation, community or system per se, but successful organisations and systems will have relevant functions and features, the capability, to be resilient. However, it is difficult to identify those functions and features of an organisation or a system that contribute to resilience such that one can extract them to produce a generalized model of resilience for broad applicability. The first step to achieving an understanding of how complex adaptive systems can be made more resilient is to understand what is meant by ‘resilience’. The CuReSS Project, funded by the UK EPSRC and ESRC, and included within the UK Research Councils Global Uncertainty Programme, has investigated the feasibility of using the metaphor of the human body as a resilient system to explore what patterns of activity enable its resilience. A scoping study has been completed that has identified an approach to develop knowledge from the biomedical metaphor using multiple methods. These have included the development of a conceptual model of resilience using Soft Systems Methodology and incorporating multiple definitions such that activities relevant to an organisation that wishes to be resilient can be identified, and also to provide a framework for research. Insults to the human body were described in order to explore how the human body responds. Secondary effects of the body’s response to insults, which in themselves became insults the

The CuReSS Project was sponsored by EPSRC and ESRC and is included in the RCUK Global Uncertainties Programme.

body had to deal with, were identified. This understanding was captured using system dynamics influence diagrams to identify the causal loops and patterns of response and through the building of dependency models. We explored the use of Beer’s Viable Systems Model to capture the decision-making and communication patterns. Finally, we built on work by Peppard and Ward to describe the relationships between capability and competences. This paper presents the results of the project and demonstrates how the use of systems thinking principles and systems thinking methods, combined with an exploration of the human body’s achievement of resilience, have contributed to the development of a ‘Blueprint’ for resilience. II.

BACKGROUND

The living being, the biomedical metaphor, is capable of many things and can address a multiplicity of purposes, often simultaneously. It is also resilient. It has no essential purpose unless directed consciously. Therefore, exploring the biomedical metaphor (specifically the human being) in order to identify those functions and features that contribute to resilience will enable the identification of those that, in an organisation or community context, could contribute to resilience – if incorporated by those organisations and communities. Social systems are innately complex, with social agents “enmeshed in a web of connections with one another and, through a variety of adaptive processes, they must successfully navigate through their world”[1]. Complex adaptive social systems are often modeled to help “understand the behaviour of both the agents within the systems and the system themselves”[1]. Behaviour, being the outcome, is difficult to predetermine and a challenge of model building is to include the appropriate agent actions and incorporate those results to capture a specific behaviour such as resilience within the context of a set of human social systems that include citizens, communities and organisations. The hypothesis was that using other system methods to explore an essentially resilient, complex adaptive system, such as the human being, would provide insight into the necessary

lower-level components, and the behavioural rules of those components, such that a specific model could be developed and validated. Of the range of systems methods, three have a particular suitability for this stage: Soft Systems Methodology (SSM) [2], System Dynamics (SD) [3], [4] and the Viable Systems Model (VSM) [5]. Individually the methods help provide insight into complex human activity systems from different perspectives and record the related mental models and consensus of those involved to provide a basis for discourse on the findings. However, it was hypothesized that, when used together, even greater coherence and insight can be gained. Exploring this was an additional benefit from the scoping study. Collectively, these methods provided multiple ways of accessing the outcome of exploring the bio-medical metaphor that are coherent and mutually supportive. III.

WHAT WE TAKE RESILIENCE TO BE

To be able to examine these aspects, it is important to be explicit about what we mean by “resilience”. This is problematic because resilience appears to mean different things to different people, especially people from different disciplines. Reviews of the resilience literature are already available and aim to draw together the broad array of ideas on resilience, but as yet, there is no single, clear definition of “resilience” which can be applied universally, or specifically for enterprises. Therefore, a framework for resilience thinking was developed by applying systems thinking principles and using SSM. From this a definition emerged [6]: Resilience (of an enterprise1) is: “ensuring an enterprise has the current and ongoing capacity and capability to continue to achieve its specified (or unspecified) purpose(s) in the face of predicted and unpredicted exposure to hazards, disruptive events and continual stress” Resilience is achieved by: “anticipating, preventing, mitigating, responding expediently to minimize the extent, duration and cost of any disruption, learning, adapting and recovering” Activities related to resilience need to take into account: “hazards, disruptive events and continual stress which may originate externally from the environment, via interdependent system connectivity and/or internally; potential hierarchy of purposes and emergent behavior within the enterprise; the need for a balance between efficiency losses and protection gains; the requirement for continued survival; and that the enterprise operates within recognised legal and ethical constraints.” The Framework incorporated a number of sub-systems containing activities that any enterprise should consider undertaking in order to be resilient [6]: •

Event anticipation

1 What is meant by “enterprise” is “a human endeavour (or human activity system) such as a community or an organisation”

•

Enterprise preparedness

•

External relationship management

•

Enterprise management

•

Resource management

•

Situational awareness

•

Response management

With regard to all of the above, the enterprise should consider: •

Constraint management

•

Strategic management

•

Review, optimization and improvement.

And finally, with regard to all of the above, the enterprise should maintain Knowledge management and Learning management. Because the activities defined in the sub-systems refer to ‘what’ an enterprise might consider undertaking, rather than ‘how’ it might undertake it, the activities can be used a s a framework for enquiry. We could then explore a range of insults to the human body that might provide an insight into whether, and/or how the body undertook the activity. This same framework allowed the exploration of enterpriseequivalent ‘how’s. IV.

RESULTS FROM THE EXPLORATION OF INSULTS TO THE HUMAN BODY

“You don’t see something until you have the right metaphor to perceive it.” Thomas Kuhn quoted in [7]. The CuReSS project addressed the question of whether the human body is a suitable metaphor for resilience in other types of systems by exploring how the human body responds to and recovers from the disruption of heat. Themes and patterns of resilient behavior were identified which were then applied to other types of systems. Biological systems are different in characteristics and function from human activity systems such as organisations or communities. However, the power of a metaphor is that it can allow learning by comparing unrelated things [8]. Work was undertaken to establish a definition of resilience (see Section III). The definition derived was discussed at a consultation workshop, and also with an organisation that considers itself resilient; Severn Trent Water. Severn Trent Water had undergone a significant review following its experiences of the Gloucester Floods in 2007. The definition of resilience, and the sub-systems identified were confirmed as being useful and relevant, with no obvious omissions. To investigate resilience in the human body a five-stage framework of resilience was developed from the work of Henry and Verma [8] (Table 1). This framework was used to explore the different responses to the disruption of heat on the human body, such as occurs when moving from a temperate to

hot climate. It takes around fourteen days to acclimatize, which is viewed as having recovered to a normal state of functioning. Stage 1 Stage 2 Stage 3 Stage 4 Stage 5

Normal state Disruption Disrupted state Recovery Recovered state Table 1: Five stage framework

The details of how the body responds to heat is set out briefly below. Some of the key principles of resilient behavior shown by the body in stages 3 - 4 were identified and an analysis undertaken of their applicability to other types of human activity systems. A number of system thinking methods were used to obtain the themes identified, which are set out in section II. A. Outline findings Figure 1 outlines the thermoregulatory mechanisms for cooling. Using System Dynamics (Figure 2), the cascade and interrelated actions of the body to the heat disruption were modeled. Blood vessels dilate to move heat from the core to the surface; sweating occurs to reduce heat by evaporation; and appetite is suppressed to reduce heat generated by burning food. A key point derived was the series of unconscious responses that occur within the body. There are also a series of conscious actions that can be taken to reduce the impact of the heat insult; remove clothing, sit in a breeze or use a fan; move into the shade, or a cooler place, and reduce exercise/movement. However, the body’s unconscious reactions to the heat insults cause other insults to the body. For example; the blood pressure falls, which can reduce effective brain function and muscle capability; and salt loss and water loss that leads to the need for more salt to be taken and water to be drunk during

acclimatization. A range of unconscious adaptations takes place over time. For example, the blood volume is increased to replenish the volume of blood diverted to the surface; muscle efficiency is improved; the size of blood vessels at the surface is increased to enable greater transport of heat to the surface; the amount of sweat produced increases and sweat begins at a lower temperature; and a reduced amount of salt is present in sweat to protect the salt resources needed for muscles. The System Dynamic models provide an insight into the numerous interactions. Further understanding about critical adaptations, gained when considering the whole body and its environment, can be gained from using dependency modeling [9] as illustrated in Figure 3. Figure 4 summarizes the types and locations of decision responses made by the human body. Whilst this Figure appears to be hierarchical, that is not necessarily the assumption as fully understanding the complex interactive feedback within the body is beyond the scope of this study The CuReSS Project identified patterns relevant to decision-making and communication, competencies and capabilities, relationships between internal entities and external interdependencies. It is this set of patterns that forms the Blueprint. In depicting the patterns of competencies and capabilities, a model of the Information System capability in Peppard and Ward [10] is used to map the human body’s capabilities to respond to the heat insult. However, that model, when applied to Information Systems in an organisation, appears to focus on the rational and conscious. A key learning point from the human body is the unconscious resilience capability that can work in partnership with the conscious and rational decision-making and actions of the person. In summary it is argued that resilience within the human body is an emergent property of the whole [11]. The hypothesis is that if enterprises are structured such that similar patterns can be

Figure 1. Thermoregulatory mechanisms for cooling, and examples of related regulatory mechanisms which are affected by thermoregulation

Figure 2. Dynamics involved in the Bio-medical response to the heat insult

seen, then resilience may also be an emergent property of the enterprise. Considering resilience as an emergent property for enterprises raises a number of important issues. Approaches to enterprise resilience make little reference to the unconscious and informal mechanisms that can be deployed [12-17], although some suggest that it is an emergent property [18]. It may be argued that concepts found in the accident theory literature, such as shared situational awareness, sense-making and organisational culture [19-22] may be comparative to the informal and unconscious. The concepts of emergence and related complexity are evident in the management literature [23-25]. Yet many of the ideas associated with those concepts have not been widely adopted in developing theory about resilience in enterprises. A human body has a very sophisticated nervous and immunological system that works at an unconscious level. It is argued that within an enterprise there is a corresponding type of unconscious level of communication which may not be explicitly attended to by decision makers. B. Four Dimensions A subsidiary consideration within the project was the development of an approach to developing an agreed set of systems methods to be used collaboratively to provide insight into the biomedical metaphor such that we could develop the blueprint. The patterns identified appeared each to support a different dimension of thinking about the model of resilience. Though two current approaches were considered, Critical

Systems Practice [26] and Multi-methodology [27], work by Emery and Trist and that of Angyal, as explored by Baburoglu [28] gave some confidence in considering four dimensions; each with a related method for capturing and exploring the dimension. Resilient enterprises are considered to be at the turbulent level of complexity as defined by Emery and Trist in [29]. Angyal considers 4 dimensions of a system that should be considered simultaneously [28]: the transverse dimension of breadth, positioning of parts of the organisation, coordination; the progression dimension of means and ends; the vertical dimension of depth to surface (ability to see deeper orders and see patterns and relationships); and the dynamic whole “constellation of parts”. It is argued that these relate to the resilience patterns identified: Decision-making and communication (recorded using the Viable Systems Model (VSM)) for the transverse dimension, competencies and capabilities for the Progression dimension (using the adapted Peppard and Ward model), relationships between internal entities for the vertical dimension (System Dynamics) and interdependencies (internal and external) for the dynamic whole (dependency modeling). C. Resilience Blueprint The Blueprint is considered to be resilience patterns in the 4 dimensions, supported by a method of use and repository that links the 4 tools that display the patterns. The Viable Systems Model [30] can be structurally neutral in that it does not necessarily reflect the specific organisational roles, responsibilities and reporting chains within an

Figure 3. Dependency model for the human body (example extract)

organisation. Consequently it is believed that this is a useful method for capturing the patterns of decision-making and communication and the iterative nature of the model will be exploited to record the central unconscious, central conscious and local unconscious decision-making that takes place, as well as the various methods and lines of communication for initiating activity and receiving information on responses taken. Figure 5 illustrates the dimension that provides the context of capabilities and competencies. It provides the links to process, structures and roles and will help to identify the elements required for adaptation in light of the response to insults. Below the level of competencies, the structure would be specific to the organisation and so would not have a pattern identified in the Blueprint. However, the method would make suggestions as to how best to consider the Process/ Organisation/Role perspective. The analysis of insults to the human body and communities will enable an understanding of response through the identification of the balancing mechanisms, relationships and capabilities using System Dynamics. Also through the development of simulations it is feasible to explore the results of different policy decisions within organisations without actually having to experiment on a live organisation. This is shown in Figure 2. A dependency model of the capabilities necessary to achieve resilience was developed in outline (Figure 3) by exploring a range of insults. This would include the metrics required by the range of ‘set points’ (Cell temperature, blood pressure, hydro-mineral balance, etc) relevant to the capabilities in order to determine the resilience quotient at any given time. The dependency model captures the interdependencies between capabilities and will also indicate the failure modes of the organisation. This dimension will also be able to indicate the resilience ‘state’ of the enterprise; that being the sum of the current states of all that the enterprise depends upon.

D. Insights from the Influence Diagram & Discussions In the way the body responds, with regard to the heat insult, it is trying to balance the heat coming into the body and the heat generated within the body against the heat going out of the body. There is not just one response to the insult, there is a range of responses (illustrated in part in Figure 3) including: outside responses (e.g. outside behaviour to reduce the insult such as getting out of the sun, spraying cold water on the body to improve through external means the response to the insult). Within the body, a number of mechanisms are utilized – cooling mechanisms to emit more heat, and countermeasures to reduce internal heat production. The mechanisms work in combination, and the combined effect is bigger than any one mechanism can achieve. Things happen on a range of scales with some immediate effects, and others (including adaptations) that take longer. Adaptations start to happen straight away due to the mechanisms being deployed. There are a number of adaptations that take place, and all are associated with the regulatory mechanism loops in the model (Figure 2). The model allows understanding of the loops, and potential points of adaptation, as well as illustrating the inter-related nature of the loops. However, contrary to expectation, the set point for core body temperature does not become adapted, because this is the optimum operating condition for cell function. What happens is the body becomes more effective at maintaining the set point under hotter conditions. A similar model of an organisation can be developed [31]. The set points within the body equate to the Critical Success Factors (CSF) within an organisation. The organisation deploys capabilities in accordance with a strategy and investment allocation to achieve its CSFs. Similarly, the body deploys its capabilities (thermoregulation, hydro-mineral balance, etc) to achieve its set points.

relative heat values inside and outside the body. (heat travelling inwards). Again, decision-making is involved in initiating these adaptations. Many are unconscious decisions and equivalents would need to be enabled in resilient enterprises. Delegated authority is one way of achieving this, as is trusting staff to make the right decision; possibly based on a common understanding of what the organisation is trying to achieve [25]. Figure 5. Types and locations of responses in the human body

If the set point is not achieved, the body changes its allocation of existing competencies, adjusting its capabilities (conduction, evaporation, etc). If this doesn’t achieve the set point, the body adapts its competencies, developing more blood, lowering the temperature at which it begins to sweat, reducing the slat content of sweat, etc. The same could be done by organisations, but they do not necessarily have the same capability for decision-making as the body. E. Adaptations The scenario matters – this determines the combination of insults and range of responses required, and shows how too heavy a load on a single part of the overlapping regulatory systems can cause the body to become overwhelmed. E.g. altitude and heat and infection would be overwhelming. Finding the failure states is as important as understanding the achievement of resilience. Through the heat insult, a range of adaptations result, on different scales: •

Water intake peaks during adaptation but settles to a slightly higher level than original.

•

Huge increase in resource intake initially in order to respond to insult, but adaptation takes place to make regulatory systems more efficient, so resource intake falls back to an only slightly increased level.

•

F. Decision and Control There are a number of decision and control types: central and local; and conscious and unconscious. This is illustrated in Figure 4. The thermoregulatory centre in the hypothalamus controls body temperature; this equates to central unconscious decision and control. It receives input from two sets of thermoreceptors: receptors in the hypothalamus itself monitor the temperature of the blood as it passes through the brain (the core temperature), and receptors in the skin (especially on the trunk) monitor the external temperature. The thermoregulatory

More blood can immediately be brought to the surface. This brings heat out of the core of the body, but will impact on the heart rate, blood pressure, and blood volume. For short periods this can be tolerated, but over a sustained period, this causes cascade insults requiring adaptation to produce more blood.

•

•

The adaptations made in order to respond to one insult, themselves caused additional insults as a cascade. This is illustrated in Figure 5 below by the horizontal arrows emerging from the central thermoregulation capability in the process of responding to the heat insult. The adaptation of the thermoregulation capability insulted the hydro-mineral balance capability requiring that to be adapted. Therefore the decision and control mechanisms must be sensitive to the potential for cascade insults caused by any particular adaptation and react accordingly. This places an emphasis on having suitable decision and control mechanisms in enterprises to respond to the equivalent insults in the enterprise.

HEAT

CAPABILITY

E.g.

STRATEGY (e.g. Maintain body and cell function)

The body uses sensors to anticipate and detect insult. Sweating occurs at lower skin and core body temperatures after adaptation than before, meaning deployment happens sooner. More sweating occurs after acclimatization to improve efficiency of heat loss through evaporation. Sweating is the key adaptation in conjunction with heat transfer to the surface, as well as the supporting water-balance adaptations, as evaporation is the only effective means of heat transfer in a positive-heat climate. Conduction, convection and radiation are made ineffective by the

INVESTMENT (i.e. Allocation of resources)

water blood energy cells

E.g.

COMPETENCY COMPETENCY COMPETENCY

Ability to emit heat through evaporation Ability to transport heat to the surface

E.g. sweat production vasodilation blood manufacture blood distribution

Process Process

i.e. systemic arrangement of cells and organs

Process

Structure

Roles E.g. sweat gland blood vessel blood cell

Figure 4. Competencies and Capabilites

centre sends impulses to several different effectors to adjust body temperature. An example of local unconscious decision and control can be seen when the body deals with a local infection. Local capabilities respond to the insult and only if they are overwhelmed might the central unconscious processes take over. Indeed, if the body is still overwhelmed, then a conscious decision to seek external help may be taken. The first response to encountering hotter or colder condition is voluntary (take clothes off or put extra clothes on); this equates to central conscious decision and control. The thermoregulatory centre is stimulated when the above responses are not enough. This is a part of the autonomic nervous system (ANS), so the various responses are all involuntary. In the hypothalamus, the heat loss centre is stimulated when we get too hot (sweat, vasodilation, lower metabolic rate) whereas, the heat conservation centre is stimulated when we get too cold (shivering, vasorestriction, increased metabolic rate). There is perhaps a hierarchy of decision-making, a capability in order to respond to a range of insults (over and above day to day operations). A taxonomy of regulatory systems of the body can be described, based upon the optimum operating conditions for the body, which appear to be directly related to optimizing the function of the cells. The body has a number of mechanisms aimed at maintaining “homeostasis” (of the body as a whole). In order to achieve homeostasis, body/cell have capabilities that include (but not limited to): •

Thermoregulation

•

Hydromineral balance

•

Etc.

When considering thermoregulation, it needs heat transfer competencies in the form of: •

Conduction

•

Convection

•

Radiation

•

Evaporation

There are mechanisms associated with providing/ supporting all of these competencies, and some are combined. Each of the loops of the model (Figure 2) explains how this is done. For example, for evaporation is achieved by sweating in combination with vasodilation (in order to evaporate need water and heat). A picture of these dependencies which might provide insight into the hierarchy of decision-making can be gained with dependency modeling (Figure 3): body function depends upon thermoregulation which depends upon conduction, convection, radiation, evaporation – which depends upon sweating and warm blood supply to the skin. It is noted that, in the human body, communications are essential for coordinated decision-making and control. An interesting insight is the three aspects of decision-making and

control. Potential failures in organisations are failure to recognize and design all three types (perhaps only two). Also, the decision-making policy may be incorrectly supported (e.g. local decision-making but with an information system designed for central control or vice-versa). It considered that there are limits to the metaphor due to the fixed nature of body/cell and free choice of people in organisations, even though it might be accepted that cells agree to collaborate and be a body. G. Graceful Degradation The body protects its capabilities in order, compromising the least important first, and so on until the key capabilities of decision-making and communications are overwhelmed /seriously impaired. It is therefore important to understand the range of capabilities and the priority given to each. This order of priority needs to be included in the taxonomy. There is a similarity in business in that most have core functions that can be lost for a period without impacting on the success of the organisation. For example, a water supply company has decided it can degrade its meter-reading service in order to adapt to enhance is call-centre capability by transferring staff from meter-reading services to taking customer calls via a short training programme. The use of estimated bills continues to keep revenue coming in. V.

FEEDBACK FROM A CONSULTATION EXERCISE

A full-day consultation exercise was held with a number of representatives form academia, industry and government departments. The use of the bio-medical metaphor was seen as positive: the advantages included its familiarity to more people; easier to understand and, therefore a good starting point; it is intuitive and works well to communicate ideas to multiple stakeholders; it has the requisite complexity, with known responses/adaptations; important similarities – e.g., stabilization, constant, stochastic threats, interaction between agents (cells). Disadvantages included not comparing like with like; adaptation rather than radical change oriented, suggests you have to control responses with very narrow margins; no clear matching for every single item – may just be a rough metaphor. With regard to the impact of the work, much of the discussion considered how to encourage organisations to engage and exploit the findings, particularly with information management support for communication and dissemination. A major challenge given was in how to deal with the complexity and make finds accessible to practitioners, as well as how to conceptualize the problem in a simple way. The project had already considered the need for resilience in the Critical National Infrastructure and how this approach might improve it. Representatives from engineering disciplines recognised the potential benefits of this approach to improving the resilience of large-scale engineered systems, whether information systems or manufactured (defence, rail, aerospace) systems. VI.

EXPLOITATION

The focus of the project was to consider the improvement of resilience to human activity systems such as enterprises. It is

intended to continue with the development of a multidisciplinary project to develop the full Blueprint. The approach and set of methods identified is being considered to enhance community resilience to crime and in better understanding the causal links and dependencies between the various ‘systems’ of the body, thus bringing together homeostasis and resilience. Taking such a systems view is seen as a significant benefit to enhance research work already being undertaken. Additionally, however, it is believed that the framework for resilience, and the Blueprint, can be exploited to enhance resilience in large systems engineering projects. Work has begun to assess whether resilience of rail systems can be improved, as well as exploring the ability to identify the value and contribution of operational rail staff in degraded-mode operation, as well as exploring the response of the rail system to a cascade of insults. ACKNOWLEDGMENT Data was gathered from individuals at the EPSRC/ESRC Sandpit: Contributions to Next Generation Resilience, “What do we mean by resilience?”, October 2009, and from subsequent email contributions by sandpit participants in Sept/Oct 2010. Feedback was provided by participants at a consultation workshop held at University College, London on 16 May 2011. The project is also grateful to Intradependency Ltd for their support with Dependency Modeling. REFERENCES: [1] [2] [3] [4] [5] [6]

[7]

[8]

[9]

Miller, J. H. and Page, S. E., Complex Adaptive Systems; an introduction to computational models, Princeton University Press, 2007 Wilson, B. Soft Systems Methodology, John Wiley & Sons Ltd. 2001. Meadows, D. H., Thinking in Systems, Ed Wright, D., EarthScan London, Sterling VA, 2009 Sterman, J. D. Business dynamics: systems thinking and modeling for a complex world, Irwin McGraw-Hill, Boston, 2000 Beer, S., The Heart of the Enterprise, John Wiley 1979. Wright, C., Kiparoglou, V., Williams, M., and Hilton, J., A framework for resilience thinking, New challenges in Systems Engineering and Architecture Conference on Systems Engineering Research, 2012, in press Hudak, P.L., P. McKeever, and J.G. Wright, The metaphor of patients as customers: Implications for measuring satisfaction. Journal of Clinical Epidemiology, 2003. 56(2): p. 103-108 Henry, D. and D. Verma, Usefulness of the human body as a metaphor to study resilience of systems and enterprises: A preliminary investigation, in 7th Annual Conference on Systems Engineering, R.S. Kalawsky, et al., Editors. 2009, Loughborough University: Loughborough. Rinaldi, S. M., Peerenboom, J. P., and Kelly, T.K., Identifying, understanding and analyzing critical infrastructure interdependencies, IEEE Control Systems Magazine, Dec 2001

[10] Peppard, J. and Ward, J., Beyond strategic information systems: towards an IS capability, Journal of Strategic Information Systems, 2004, 13 pp 167-194 [11] Emmeche, C., S. KØppe, and F. Stjernfel, Explaining emergence: Towards an ontology of levels. Journal of General Philosophy of Science, 1997. 28: p. 83-119. [12] Hollnagel, E., D.D. Woods, and N. Levenson, eds. Resilience Engineering; Concepts and Precepts. 2006, Ashgate: Aldershot [13] Weick, K.E. and K.M. Sutcliffe, Managing the Unexpected. 2001, San Francisco: Jossey Bass [14] Mallak, L., Putting organizational resilience to work. Industrial Management, 1998. 40(6): p. 8 [15] Williams, M.D. Designing system resilience in NHS hospitals. in Ergonomics Society Improving Patient Safety Conference 16-18 July. 2008. Cambridge [16] Woods, D.D., Essential characteristics of resilience, in Resilience Engineering, Concepts and Precepts, E. Hollnagel, D.D. Woods, and N. Leveson, Editors. 2006, Aldershot: Ashgate. p. 21-34 [17] Wreathrall, J., Properties of resilient organisations: An initial view, in Resilience Engineering: concepts and precepts., E. Hollnagel, D.D. Woods, and N. Leveson, Editors. 2006, Aldershot: Ashgate [18] Hollnagel, E., C. Nemeth, and S. Dekker, eds. Remaining sensitive to the possibility of Failure. Resilience Engineering Perspectives. Vol. 1. 2008, Ashgate: Farnham [19] Flin, R., P. O'Connor, and M. Crichton, Safety at the sharp end. 1 ed. 2008, Aldershot: Ashgate. 317. [20] Roth, E.M., J. Multer, and T. Raslear, Shared situation awareness as a contributor to high reliability performance in railroad operations. Organization Studies, 2006. 27(7): p. 967-987. [21] Weick, K.E., Organisational culture as a source of high reliability, in Making Sense of the Organisation. 2001, Blackwell: Oxford. [22] Weick, K.E., Sense making in organisations. 1995, Thousand Oaks: Sage. [23] Stacey, R., Strategic Management and Organisational Dynamics. 4th ed. 2003, London: Prentice Hall. [24] Lewin, R. and B. Regine, The soul at work: Unleashing the power of complexity science for business success. 1999, London: Orion Business Books. [25] Wheatley, M.J., Leadership and the New Science. 1999, San Francisco: Berrett-Koehler. [26] Jackson, M.C., Reflections on the development and contribition of critical systems thinking and practice, Systems Research and Behavioural Science, 2010 [27] MIngers, J. and Brocklesby, J., Multimethodology: Towards a framework for mixing methodologgies, Omega 25(5), 1997 [28] Baburoglou, O.N., The vortical environment – The 5th in the EmeryTrist levels of organizational environments, Human Relations 41(3), pp. 181-210, 1988 [29] Emery, F.E., and Trist, E.L., The causal texture of organizational environments, Human Relations 18(1), pp. 21-32, 1965 [30] Beer, S., Diagnosing the System for Organizations, John Wiley & Sons, 1985 [31] Hilton, J., Using system techniques to define information requirements. In IT Architecture Practitioners Conference, January 23-25, The Open Group, 2006.