Tracking Progress in the Governance of Critical Risks

3. Risk anticipation – from critical risk assessments to financing frameworks

Abstract

This chapter examines how Adherents raise awareness of critical risks and encourage disaster risk mitigation actions to protect lives and livelihoods. It focuses on risk communication practices, incentives for risk‑reducing investment and measures aimed at strengthening resilience in critical sectors and communities. The analysis shows that most Adherents have expanded access to risk information and early warning systems, particularly for natural hazards awareness does not consistently translate into sustained behavioural change or investment in prevention and mitigation.

Persistent challenges include weak incentives for households and businesses to reduce exposure and insufficient attention to interdependencies within and across critical infrastructure systems. Support for business continuity planning remains uneven, especially among small and medium‑sized enterprises. The chapter concludes that more effective prevention and mitigation require stronger governance arrangements, improved incentives and systematic evaluation to convert awareness into durable resilience outcomes.

The second principle of the Recommendation calls on Adherents to build preparedness for critical risks using tools to develop a forward understanding of their complexities and wide-ranging impacts. The aim is to support development of disaster risk and crisis management policy decisions with an understanding of what the risks are and will be, rather than just what they have been in past.

The Recommendation calls on Adherents to develop a comprehensive overview of critical risks, i.e. risks of national significance, in terms of their likelihood and potential impacts. A comprehensive risk assessment is fundamental to all-hazards contingency planning and to inform efficient and effective investments in disaster risk reduction and emergency preparedness. Such risk assessments are not static and change over time, in some cases the risks evolve very quickly. Good practice in risk governance therefore includes periodic review of underlying risk analyses with updated data and information. This helps ensure the understanding of critical risks takes into account contextual shifts, the use of best available scientific evidence and a process to address blind spots.

After identifying and assessing a wide range of critical risks, Adherents are better positioned to monitor capabilities to manage their physical, social and financial impacts. Strong capability for risk analysis is also fundamental to effective risk communication disaster risk reduction measures and crisis management decisions taken in furtherance of implementing the subsequent principles of the Recommendation.

When asked in 2016, slightly under half the Respondents considered they had fully implemented the second principle, half considered that they had partially implemented it, and two reported that they were taking steps toward implementing it.

The 2017 Report called on Adherents that had not already performed an all-hazards national risk assessment to do so within the next five-year reporting period. It noted many good country practices available to learn from, including the use of inter-ministerial working groups to develop a government-wide portfolio of critical risks.

Box 3.1. Building preparedness to better anticipate complex and wide-ranging impacts

III. RECOMMENDS that Members [Adherents] build preparedness through foresight analysis, risk assessments and financing frameworks, to better anticipate complex and wide-ranging impacts.

To this effect, Members [Adherents] should:

1. Develop risk anticipation capacity linked directly to decision making […];

2. Equip departments and agencies with the capacity to anticipate and manage human induced threats […]

3. Monitor and strengthen core risk management capacities […];

4. Plan for contingent liabilities within clear public finance frameworks […].

Note: This report does not contain a separate section related to the provision above concerning anticipation and management of human induced threats (Principle III.2.), because it had been adopted primarily related to the risk of illicit trade. Subsequently the Council adopted the Recommendation on Countering Illicit Trade: Enhancing Transparency in Free Trade Zones in 2019, which covers management of this risk separately and is now under the responsibility of the Trade Committee.

Source: (OECD, 2014[1])

Identification and assessment of critical hazards and threats

A key function of a comprehensive, all-hazards and transboundary approach to country risk governance is the identification of the hazards and threats that could pose critical risks. Since 2016, the risk landscapes across Adherents have evolved due to such drivers as supply chain vulnerabilities, advances in technology (e.g. artificial intelligence, quantum computing and synthetic biology), political polarisation and social unrest linked to cost of living and police violence. Climate hazards, such as heat waves, wildfires, drought and floods, among others continue to increase in occurrence, duration and severity in many countries.

All Respondents were asked to identify the hazards and threats they consider to be critical risks and to categorise them as natural, technological or societal critical risks (see Figure 3.1 and Figure 3.3). When asked, 21 out of 27 Respondents reported that they had already assessed these risks, in whole or partially, as part of a national risk assessment.

Figure 3.1. Natural hazards assessed as posing a critical risk

Source: 2022 OECD Questionnaire on the Governance of Critical Risks

Adherents have experienced numerous challenges as a result of the growing frequency and severity of disasters with several of the highest years for disaster losses on record occurring over the last decade. Disaster losses are likely to continue to remain high in the foreseeable future in part due to climate risks such as floods, wildfires, drought, extreme heat and storms increasing in terms of frequency, duration and intensity. Slow-onset hazards such as sea-level rise and coastal erosion are also increasingly challenging Adherents. (OECD, 2021[2]), (OECD, 2019[3]) Climate also impacts less well-known hazards such as melting permafrost and some infectious diseases, which pose significant risks to communities, individual health and well-being, the economy, and the natural environment.

Amongst natural hazards, Respondents reported meteorological hazards, hydrological hazards and geohazards as the most prevalent hazard clusters that could trigger critical risks. The single most frequently identified natural hazard posing critical risk, however, was wildfire. In the period 2017-2022, extreme wildfires ravaged the national territories of several Respondents, in many cases causing unprecedented losses and damages. The growing occurrence of wildfires has driven increased interest among Adherents to share their experiences related to wildfire risk assessment, preparedness and response in the OECD High Level Risk Forum. To contextualise the growth in this critical risk, examples are provided below.

Australia was hit hardest by bushfires during the ‘Black Summer’ of 2019-20, the most catastrophic bushfire season ever experienced in the country’s history. Between 24 to 40 million hectares were burnt, including 12.6 million hectares primarily of forest and bushland. 33 lives were lost and more than 3,000 homes destroyed (Royal Commission into National Natural Disaster Arrangements, 2020[4]). Altogether, the direct economic damages of the 2019-20 wildfire season in Australia were estimated at USD 23 billion (OECD, 2023[5]).

In Canada, the Fort McMurray fire of 2016-2017 caused an estimated 88,000 people to evacuate, burned nearly 600,000 hectares and threatened Canada’s oil sands operations. Hundreds of structures were destroyed, including 2,579 homes and other dwellings. The estimated financial impact of the fire was CAN 8.9 billion (Zurich, 2019[6]). In 2017 and 2018, Canada suffered additional wildfires that burned over 1.2 million hectares. The record-breaking hot and dry summer of 2018 resulted in Sweden’s most extreme wildfire season in modern history, and again in 2019 and 2020.

In Portugal, where one-third of the national territory is considered to be at high or very high risk of wildfire, historic wildfires took place between June and October 2017. These disasters caused more than 100 deaths, hundreds of injuries and significant damages to infrastructure and disruption to business activity, as well as more than 500 thousand hectares of burned areas (EU Disaster Knowledge Centre, 2017[7]).

In Greece, the North-eastern Attica wildfire of 2018 was the second deadliest fire worldwide so far in the 21^st century with 102 fatalities and 150 people injured (OECD, forthcoming).In addition, wildfires have caused massive damages in the territories of the following Adherents since 2016: Chile, France, Israel, Japan, Latvia, Korea, New Zealand, Poland, Spain, Türkiye, the United Kingdom and the United States.

Attribution studies report that climate is a key contributing factor to the severity and extent of recent large-scale wildfire incidents. Record highs in summer temperatures coincided with drought conditions in many of the worst hit areas by wildfire. It has been estimated these conditions made the extreme 2019 / 2020 Australian bushfire season 30% more likely (van Oldenborgh et al., 2021[8]). The ongoing increase in fire activity in the western United States, and the trend towards more severe fires in the southwest United States, is reportedly fuelled by an increase in susceptibility to burning due to biomass dryness. Additional human factors that increase the risk of wildfire include significant growth in the ‘Wildland-Urban Interface’ (i.e. of areas where assets are constructed near or within vegetated areas), as well as ecosystem degradation and land-use changes, such as deforestation, that make ecosystems more prone and less resilient to extreme wildfires (OECD, 2023[5]).

Meteorological and hydrological disasters for decades have been the most costly and most frequent forms of disaster worldwide. Respondents from Asia, Europe, North and South America, as well as Australia and New Zealand reported suffering from floods, typhoon, hurricanes and extreme weather. For example, Austria faced significant torrential rainfall and flash flooding in 2018, 2019 and 2022, as did Belgium, Germany and Luxembourg in 2020 and Latvia in 2022. Ireland experienced a series of significant severe weather events throughout 2017 and 2018, including high winds due to Hurricane Ophelia in October 2017 and snowstorms associated with storm Emma during March 2018. In the Americas, Canada suffered a significant atmospheric river event in 2021 in British Columbia that led to severe floods and mudslides. Parts of Colombia, Costa Rica, Mexico and the United States have faced several significant hurricanes, tropical storms and drought in the past five years.

Figure 3.2. Critical social hazards and threats

Source: 2022 OECD Questionnaire on the Governance of Critical Risks

Amongst social hazards and threats, Figure 3.2 indicates numerous Respondents reported various forms of infectious disease as the most prevalent forms of potential critical risks. Despite the COVID-19 pandemic only about 80% of Respondents identified human infectious disease as a critical risk; roughly the same as in 2016. Adherents identified a range of anthropogenic risks, especially cyberattacks, but also armed conflict, social unrest, and massive irregular migration.

In 2016, two-thirds of Respondents reported terrorism as a critical risk. The revised questionnaire offered Respondents the option of identifying various categories of anthropogenic risks to capture detail missed by using a broader category, such as chemical, biological, radiation, nuclear (CBRN) attacks; organised crime; or conventional attacks / armed conflicts.

Fatalities from terrorism have seen a decline on average since 2014 across Adherents, however Respondents have continued to suffer numerous terror attacks with deep impacts on their communities. New Zealand experienced an unprecedented terror attack against a mosque and an Islamic centre in Christchurch on 15 March 2019, resulting in 51 fatalities and over 40 injured (Department of the Prime Minister and Cabinet, 2022[9]). In fact, most Adherents have continued to suffer acts of terrorism since 2016, but the majority and most significant of attacks have been concentrated in just seven Adherents: Canada, Colombia, France, Israel, Türkiye, the United Kingdom, and the United States.

Since 2017, seventeen terrorist attacks across Adherents resulted in 10 or more fatalities, and 55 attacks resulted in 10 or more injuries. Of the 17 most deadly attacks, six took place in the United States, and four took place in Türkiye. Of the 55 attacks causing the most injuries, more than half took place in Colombia, the United States, and the United Kingdom (START (National Consortium for the Study of Terrorism and Responses to Terrorism), 2023[10]).

In addition, various forms of cyberattacks were identified as critical risks although they generally do not lead directly to mass casualties. Indeed, 17 out of 27 Respondents consider them a critical risk, generally in connection with disruptions to critical infrastructure. Respondents highlighted the use of compromised software updates to conduct ransomware attacks on healthcare facilities, transportation systems, oil distribution and public administrations, but also noted basic vectors from infected USB keys to phishing emails still work to compromise systems in many organisations.

Respondents reported growth of cyber-attacks on public institutions, services and infrastructure, and notably the transboundary ransomware attack in May 2017 known as WannaCry that affected organisations in over 150 countries. Since then nearly every Respondent has reported cyberattacks on public services and institutions, e.g. on the email system of Norway’s Parliament, and the emergency call service in Slovenia. In 2022 Costa Rica declared a state of national emergency due to cyberattacks affecting nearly 30 institutions of the government, including potentially crippling bottlenecks in the customs administration.

Respondents reported particular concern over the rise in use of ransomware attacks affecting hospitals and health care administrations. Multiple reports of cyberattacks in France, Germany, Spain, Ireland and the United Kingdom have led to postponed operations, patient transfers and disorganised departments. A 2021 cyberattack on healthcare providers across Canada’s most eastern region resulted in the cancellation of almost all medical procedures, except emergencies, as well as theft of patient data. In Ireland, healthcare services across the country were severely disrupted with normal communication channels immediately lost, both at the Health Service Executive’s national center and within operational services, including email and networked phone lines. Staff switched to communicating using mobile and analogue phones; fax; and face to face meetings. The attack aimed to disrupt health services and IT systems, steal data, and demand a ransom for the non-publication of stolen data and provision of a tool to restore access to data they had encrypted (HSE, 2021[11])

Private sector operated critical infrastructure facilities are now frequent targets of cyber-attacks. A notable example is the 2021 ransomware attack on Colonial Pipeline in the United States, which led to temporary suspension of the pipeline’s operations and prompted the federal government to take emergency measures to relieve pressure this caused on fuel supplies across the country.

The frequency, sophistication and impacts of cyber risks are expected to accelerate in the period of digital transformation. In 2016 Respondents had pointed to the ‘Internet of Things’ as a technological development that could massively increase vectors to cyber risks. In 2022 Respondents added ‘Artificial Intelligence’ and ‘Quantum Computing’ as major technological developments that will increase the sophistication of cyber risks.

Incidents of social unrest have also occurred frequently across Adherents since 2016, usually sparked by dissatisfaction over economic disparities, the cost of living, performance of governments and institutions or environmental concerns. Developments in social unrest have broadly followed three periods. From mid-2019 until the onset of the pandemic, social unrest rose, peaking in late 2019 as a wave of protest related to cost of living affected South America. Once the pandemic hit, unrest declined sharply, coincident with lockdowns and voluntary social distancing (Barrett, 2022[12]). However, as Adherents loosened restrictions unrest resumed with new fervour. Major protests have occurred in cities where social unrest is usually rare, often with anti-government or anti-lockdown motives, including in Canada, New Zealand, Austria, and the Netherlands (Barrett, 2022[12]).

Protests occurred in multiple countries following the renewal of measures to control the spread of COVID-19, from school closures to vaccine mandates. Early in 2022, Canada experienced disruptions to trade flows with the United States as a result of a trucker convoy leading Canada’s federal government to declare a public order emergency under the Emergencies Act to end disruptions, blockades and the occupation of Ottawa. Exceptional powers under the Act were invoked for the first time since it became law in 1988. The convoy disruptions in Canada and the United States became a transboundary phenomenon of organised protest across several European countries as well as Australia and New Zealand.

Figure 3.3. Critical technological accidents or disruptions

Source: 2022 OECD Questionnaire on the Governance of Critical Risks

Among technological accidents and disruptions that Respondents identified as critical risks, two findings stand out. First, 21 out of 27 Respondents identified Chemical, Biological and Radioactive/ Nuclear (CBRN) accidents as a critical risk, making it the most prevalent form of hazard or threat across all three categories of potential critical risks (see Figure 3.8). Separately, CBRN attacks were also identified by 15 out of 27 Respondents as a critical risk (see Figure 3.7). While CBRN attacks have occurred in past, they are relatively rare in comparison to CBRN accidents. Two factors may explain the high number of Respondents that identified CBRN accidents as a critical risk. First is the possibility that SARS-COV-2 was accidentally released from a laboratory. Whether or not this is the case, biomedical research using artificial, pathogenic microorganisms has continued to grow and thus increase the number of laboratories where risk of accidental release could occur. Over 400 companies in 40 countries are working in the field of synthetic biology. Second, in the context of Russia’s war of aggression against Ukraine concerns are heightened that laboratory accidents or bioterrorism attacks could occur with contagion effects across borders.

After CBRN accidents, Respondents identified a cluster of critical risks related to disruption to various forms of transportation infrastructure networks. Transportation systems are frequently damaged during disasters and can present a prolonged source of knock-on effects that result in lost production as inputs cannot move to points of manufacture nor goods to distribution, nor labour to work sites.

Among the future technological risks Respondents noted were malevolent acts of artificial general intelligence, synthetic biological warfare, application of quantum computing to hack cryptographic keys and ground-based lasers capable of interfering with observation satellites.

Developing risk anticipation capacity linked to decision making

The Recommendation calls on Adherents to take a forward-looking approach to critical risks and to prepare for what extreme events may look like in future rather than assume they will repeat the past. The future is inherently uncertain, but Adherents possess numerous tools to improve preparedness for highly uncertain critical risks and increase understanding about their potential impacts (see Figure 3.4). Anticipating the future risk landscape entails such activities as monitoring known natural hazard sources and projecting how exposures to them might evolve. It also involves research on developments in climate, technology, society and the economy, that might lead to increases or decreases in exposures or vulnerabilities of citizens, their property and the environment to systemic risks.

The various means Respondents use to develop or exercise anticipation capacity in 2022 is generally similar to those identified in 2016: emergency exercises, local risk assessments, early warning systems, National Risk Assessments, research on emerging risks, research on multi-hazard scenarios and horizon scanning.

The most common means used to develop risk anticipation capacity remains emergency exercises (21 / 27 Respondents in 2022, compared to 33 / 36 in 2016). Respondents use post-exercise reports as a rich source of expert commentary and analysis on capacity to execute emergency plans, as well as key performance indicators on strengths and gaps in defined risk management capabilities. Taken together such information may contribute to inform decisions on risk tolerance and how to achieve maximum value from future investments in protective measures. The insights and analysis gained from exercises, however, are most applicable to the designed parameters of an exercise. Since exercises might not completely anticipate a novel threat or hazard with unusual characteristics, such as SARS-CoV2, governments should develop adaptive capacities in crisis management to pivot quickly and adapt to new situations characterised by high levels of uncertainty.

Figure 3.4. Means to develop and exercise risk anticipation capability

Source: 2022 OECD Questionnaire on the Governance of Critical Risks

A slightly lower proportion of Respondents noted the use of local risk assessments as a tool for risk anticipation (18 / 27 Respondents in 2022, compared to 31 / 36 in 2016). This process typically involves gathering and collating granular risk information from sub-national or regional level down to local levels, and can be used to inform building standards, zoning and land use prescriptions, structural protection measures, the location of evacuation routes as part of local emergency plans, and gap analyses of local response capabilities. In the context of critical risks, several Respondents with a small national territory tend to aggregate results from local risk assessments into a national level picture. Respondents with larger territories, however, have noted that this practice does not scale well and leads to misleading results if aggregated to national level.

A good country case example for countries with larger populations and/ or geographic areas can be found in the United States, where the Threat and Hazard Identification and Risk Assessment (THIRA) and Stakeholder Preparedness Review (SPR) were updated in 2018 to better fit the changing needs for local threat and risk identification. The new methodology asks communities to identify their threat/hazard that poses the greatest risk, and then identify what they will need to manage those risks. The SPR reports on progress made or lost concerning how communities fulfil the gaps. Communities utilise a standardised set of targets that increases the validity and relevance of data analytics (UNDRR, 2023[13]).

Although most Respondents now possess a National Risk Assessment (NRA), only 16 out of 27 Respondents reported that they use their NRA as a means for building risk anticipation capacity. A good country case example is found in Switzerland where emergency planners develop risk scenarios based on known events as much as possible, but they also take into account potential future developments. The descriptions focus on impacts that are expected to have a direct connection to the event. For example, due to the steady progression of digitalisation, the consequences of a mobile network outage are likely to be even more widespread and severe in future. Or, future low water levels in a river used for transportation of goods to a land-locked country could have disruptive effects on supply of petroleum products following a drought.

Figure 3.5. Features of National Risk Assessments

Source: 2022 OECD Questionnaire on the Governance of Critical Risks

To avoid the pitfall of recency bias that may lead to preparing capabilities suited for the most recent disaster or crisis, it is fundamental to forecast and understand emerging critical risks, i.e. novel risks, or conventional risks that take place in a new context. In 2016, Respondents had identified such emerging risk drivers as climate in addition to geographic concentrations of assets and populations in hazard exposed areas (especially along coastal zones), and new vulnerabilities that could arise from the ‘internet of things’, which might facilitate theft, distortion or destruction of data, or hold it for ransom, and to disrupt the delivery of essential goods and services. The 2017 Report recommended that Adherents pay more attention to emerging risks. However, the proportion of Respondents in 2022 indicating they provide support for public research on specific emerging risks as a means of risk anticipation has slightly decreased (16 / 27 in 2022 compared to 26 / 36 in 2016).

Adherents were invited to a dedicated workshop on ‘Emerging Critical Risks’ organised by the High Level Risk Forum and Secretary General’s Strategic Foresight Unit. The Secretariat has also supported the gap in research on emerging risks with an on-line, brainstorming on emerging critical risks open to participation of all OECD Members. OECD Member experts co-operated in a crowd source analysis of emerging risks that identified trends and drivers in diverse fields, such as climate, technology and security studies that point toward the development over time of new risks or that substantially alter existing ones. Among the most common drivers of emerging risks in 2022 were: climate, energy supply shortages, strategic and regional tension, rising prices of fertilizers, scarcity of raw materials that impact infrastructure restoration, and mis/disinformation.

Several drivers of emerging risks are driven by dependencies on supply chains affected by Russia’s war of aggression against Ukraine. Respondents noted the lingering effects of the COVID-19 pandemic impacts on supply chains which revealed excessive dependency on limited suppliers of essential goods. The war against Ukraine has likewise impacted supply of energy resources and food (Arriola et al., 2023[14]), and Respondents are assessing how different geopolitical tensions could affect supplies of rare earth metals and raw materials, chemicals and electronics that are indispensable for the digital transformation.

Figure 3.6. Implications of defining critical risk as priority

Source: 2022 OECD Questionnaire on the Governance of Critical Risks

The 2017 Report had specifically recommended that Adherents pay more attention to research and modelling on interlinkages between different types of critical risks. This might entail a multi-hazard analysis, for example, of the probability and impacts of an off-shore earthquake that triggers a tsunami and subsequently floods a coastal industrial site causing an ecological disaster. The COVID-19 crisis demonstrated how hazardous events do occur concurrently, such as a hurricane, wildfire, earthquake during time of a pandemic. A pandemic risk analysis needs to assess not only the impacts on human health, but the economic and social impacts that could result from intervening policy decisions to restrict movement of the population.

The proportion of Respondents that indicated they conduct such research has decreased from 26 / 36 in 2016 to 14 / 27 Respondents in 2022. Despite this slight decrease in the prevalence of research on interlinkages between different types of risks, several good case examples can be found.

Figure 3.7. How risk anticipation efforts are used by policymakers

Source: 2022 OECD Questionnaire on the Governance of Critical Risks

In addition to the tools and techniques that Respondents use to anticipate critical risks, they were asked how they use the results of risk anticipation tools. The country responses showed little variance, with 18 out of 27 Respondents reporting that they use the results to prioritise government actions aimed at risk treatment, and nearly as many Respondents using the results of risk anticipation for identification of civil protection gaps and developing specific training exercises (see Figure 3.6). Nevertheless, the COVID-19 pandemic revealed that even when a country assesses a risk as critical, such as human pandemic, the linkage to preparedness decision making can be reinforced.

Monitoring and strengthening core risk management capacities

As described above, the Recommendation calls on Adherents to identify and define core capabilities for risk management. The Recommendation also calls on Adherents to monitor and strengthen core risk management capacities through: i) the allocation of resources to develop and maintain the capabilities at all levels of government that are needed throughout the risk management cycle; ii) assistance for the development and continued training of specialised services (and the provision of modern and interoperable equipment; iii) the implementation of efficient inspection systems, supplemented by the power to impose and implement sanctions, to ensure that minimum standards are adhered to for civil protection services in local levels of government.

Overall, the implementation of monitoring and strengthening core risk management capabilities is quite low across Respondents as a group. More than half the Respondents reported that they do not conduct such monitoring. When asked what tools they use to monitor the development and readiness of core capabilities, 12 out of 27 Respondents noted that they report through channels established in line ministries, 10 out of 27 test capabilities and report on them through the conduct of exercises and 8 out of 27 collect information through a national survey. Relatively few Respondents have used peer reviews as a monitoring tool since 2016, although this was specifically recommended in the 2017 Report as a tool that should be more broadly adopted to foster cross-country benefits. Under the Union Civil Protection Mechanism, the European Commission organised seven peer reviews of disaster risk management and civil protection systems between 2017-2022, but only one Adherent, Portugal, took advantage of this offer of support from the Directorate General for Civil Protection and Humanitarian Assistance (DG ECHO).

Concerning the allocation of resources to develop and maintain the capabilities that are needed throughout the risk management cycle, a good case example is found in the European Union funded programme, ‘rescEU’, which strengthens European preparedness for disasters and reserve capacity.

Box 3.2. Maintaining reserve capacity in core risk management capabilities

The European Union established and fully funds ‘rescEU’ as an additional layer of protection and reserve capacity for disaster preparedness that can be drawn upon across EU Member States. The programme includes a fleet of firefighting planes and helicopters, medical evacuation planes, as well as a stockpile of medical items in 9 EU Members States that facilitates quicker reaction to health crises. The rescEU reserves also include shelters, transport and logistics assets and energy supply items. Reserves are also being developed to respond to chemical, biological, radiological, and nuclear (CBRN) risks, including decontamination and detection equipment, as well as reserves of CBRN medical countermeasures.

Following Russia’s invasion of Ukraine and related medical needs for Ukrainians inside the country and the whole region, the EU has deployed medical evacuation services as well as assistance from its rescEU medical, energy and shelter stockpiles hosted in various locations across the EU.

The rescEU deliveries include medical items such as ventilators, infusion pumps, patient monitors, masks and gowns, ultrasound devices, oxygen concentrators, antidotes, potassium iodide tablets, decontamination supplies, gas masks, chemical detectors, and it also encompasses generators to help Ukrainians with their basic needs and thousands of shelters to host people in different regions.

Source: (European Commission – Directorate‑General for European Civil Protection and Humanitarian Aid Operations (ECHO), n.d.[15])

Most Respondents that have identified core capabilities reported they also monitor whether sub-national levels of government develop them to expected standards. Member States of the European Union are supposed to share with the European Commission an assessment of their [disaster] ‘Risk Management Capabilities’ every three years. The Risk Management Capability Assessment (RMCA) Guidelines (Commission Notice 2015/C 261/03) provide EU Member States a methodology to evaluate the administrative, technical and financial capacities to carry out risk assessments and plan and implement risk prevention and preparedness measures. The RMCA Guidelines define ‘Risk management capability’ as the ‘ability of a Member State or its regions to reduce, adapt to or mitigate risks (impacts and likelihood of a disaster), identified in its risk assessments to levels that are acceptable in that Member State’. The use of capability assessment to link results of risk assessment to risk management actions is reported to be systematic in a few Member States, such as the Netherlands and Sweden, but not for others (Marin Ferrer and Casajus Valles, 2018[16]) . The RMCA guidelines have been tested several times, for example in the DG ECHO project “From Gaps to Caps”, which sought to establish a common understanding of capability assessment methods for the Baltic Sea Region. The Union Civil Protection Mechanism peer review of Estonia focused on risk management capability and provides a useful reference for how the RMCA guidelines apply to a specific country (European Union Civil Protection, 2016[17]).

In the United States, the ‘National Risk and Capability Assessment’ is a suite of connected risk and capability assessments developed to help better measure national preparedness and readiness for the most catastrophic threats and hazards (FEMA, 2022[18]).

Figure 3.8. Central government usage of monitoring results

Source: 2022 OECD Questionnaire on the Governance of Critical Risks

When asked how they used monitoring results, 12 out of 27 Respondents reported it is done to assist the development of continued training of specialised services. Only 7 out of 27 Respondents use the results of monitoring to inform budget allocations for development of core capabilities, to drive nationally led interventions or to conduct gap analyses and capability improvement plans.

Box 3.3. National Risk and Capability Assessment

In the United States, FEMA has developed metrics on national preparedness and readiness for the most catastrophic threats and hazards. Through the National Risk and Capability Assessment (NRCA) FEMA compares the level of capability that communities collectively intend to build and sustain to the estimated level of capability that the nation will need to manage a catastrophic disaster. By identifying and understanding gaps in capability, a strategy on how best to close these gaps is formulated with data-driven decision-making. The datapoints from the NRCA serve as a baseline for future engagements with federal agencies to identify strategies for addressing those national gaps and better prepare the nation for catastrophic threats and hazards. All these datapoints are fully reviewed by the Homeland Preparedness and Response Interagency Policy Committee (IPC) of the National Security Council (NSC) for concurrence.

FEMA’s all-hazards preparedness grant programs (Emergency Management Performance Grant and Regional Catastrophic Preparedness Grant Programme) have adjusted priorities to focus on the emerging climate risks and ensure that underserved communities are not disproportionately affected in their ability to recover from disasters. Through these programs FEMA also encourages regional and cross-state collaboration, such as evacuation planning and mutual aid agreements.

Source: (Federal Emergency Management Agency (FEMA), U.S. Department of Homeland Security, 2022[19])

Minimising the impacts of critical risks on public finances and countries’ fiscal position

The Recommendation calls for Adherents to plan for contingent liabilities within public financing frameworks. The aim is to minimise the adverse consequences of destructive impacts not just for public finances and fiscal position, but for the resilience of the economy as a whole. Even prior to the COVID-19 pandemic it was clear that critical risks were already associated with significant economic impacts as shown in Table 3.1.

Table 3.1. Annual average disaster losses across a sample of Adherents (2019)

	Annual average loss estimate (USD)
Australia	5.5 billion
Canada	3.2 billion
Colombia	3.8 billion
Costa Rica	280 million
France	1.24 billion
Japan	61.5 billion
Mexico	2.9 billion
New Zealand	769.2 million

Source: (OECD & The World Bank, n.d.[20])

In order to address the challenges associated with the potential impacts of critical risks on their public finances and fiscal positions, the Recommendation calls on Adherents to:

• establish cost effective mechanisms for compensating losses that are clearly spelled out in advance of a crisis;

• consider a mix of clear and agreed public finance rules and ex-ante funding mechanisms for areas with high exposures or high vulnerabilities;

• put in place policies that enable households and businesses to transfer financial risks to insurance and capital markets;

• take into account the distribution of potential losses among households, businesses and insurers, and encourage policies whereby all actors take responsibility within the context of their resources;

• establish mechanisms for estimating, accounting and disclosing contingent liabilities associated with losses to critical sectors in the context of national budgets; and

• adopt broad frameworks for assessing risk-related expenditures at both the national and local levels.

Most Respondents have pre-established mechanisms for compensating disaster losses of various types. Many Adherents have in place public compensation or financial assistance arrangements or programmes that have been established to provide public financial support to households, businesses or subnational governments. (OECD, 2022[21]) The majority of these relate only to natural hazards, nevertheless several Respondents, indicate they have programmes that provide financial assistance for losses due to terrorist attacks, and some also have discretionary mechanisms that enable central government to support the costs of local government response to and recovery from disasters.

In the United Kingdom for example, the Bellwin Scheme may be activated where an emergency occurs and, as a result, one or more local authorities incur expenditure on taking action to safeguard life or property, or to prevent suffering or severe inconvenience. The Bellwin scheme is intended to reimburse the cost of local authority actions taken in the immediate phase of an emergency, not those taken as part of the recovery phase. The scheme is not intended to fund longer term repairs or costs. This is reflected in the eligible spending period of one month from the date when a qualifying incident comes to an end. For the most part actions not taken within one month would be unlikely to be considered immediate. It may be activated at the discretion of the responsible minister after considering the circumstances of each individual case. There is no automatic entitlement to financial assistance.

In the European Union, for example, the European Commission can support Member States with funding to contribute to response and recovery costs linked to disasters arising from natural hazards or major public health emergencies (see Box 3.4. European Union Solidarity Fund).

The benefits of clear rules concerning government compensation for disaster losses are several. They reduce administrative burdens and facilitate timely disbursements, which is crucial to minimise the economic and social impacts of disasters. They strengthen predictability and transparency of the compensation process and help governments understand their own contingent liabilities. Finally, clear preestablished rules also should incentivise sub-national governments and the citizens they serve to invest in prevention, mitigation, self-protection measures and financial protection to the extent that they consider the available compensation limits might be insufficient.

Box 3.4. European Union Solidarity Fund

The European Union Solidarity Fund (the Fund) provides financial assistance to EU Member States and certain eligible countries that have been affected by a major disaster. The Fund may be activated in specific cases where the costs of a defined disaster type exceed a certain threshold. Its disbursements may be used to finance reconstruction and other eligible costs during recovery efforts.

These rules are clearly enshrined in European Union legislation (European Union Regulations Number 461/2020; Number 661/2014 and Number 2012/2002) that define the types of crises covered, a threshold for seeking support from the Fund and the types of spending eligible.

Since its creation, the Fund has been activated following 100 disasters covering a range of different extreme events including floods, forest fires, earthquakes, storms and drought.

In response to the COVID-19 pandemic, the original scope of the Fund was extended, as of 1 April 2020, to also encompass major public health emergencies. Since then, the Fund has supported countries with 20 public health emergencies responses.

Source: (European Commission – Directorate‑General for Regional and Urban Policy, n.d.[22])

The rules for the policies and programs implemented by Adherents to support households and businesses with the financial burden of losses during the COVID-19 pandemic were generally not set up in advance. In most cases, these policies and programs were developed in response to the ongoing crisis and were implemented on an expedited basis in order to provide timely assistance to those affected by the pandemic. For example, Ireland established the COVID-19 Pandemic Unemployment Payment in August 2020 as a social welfare benefit for employees who lost their employment from March 2020. Various forms of unemployment benefits were introduced across many Adherents at the time (OECD, 2023[23]).

A potential unintended consequence of these policies and programs is that they may create fiscal risks for governments. In some cases, the costs of these policies and programs may be larger than anticipated, which could lead to higher levels of government debt and increased fiscal pressure.

This has been shown during the first waves of the COVID-19 pandemic, when Adherents saw a sharp rise in their expenditures, both as a result of direct response costs incurred (such as medical supplies, personal protective equipment, tests and vaccines – to name but a few) and also due to comprehensive response packages that sought to protect households and businesses from the impacts of the measures implemented to curb the spread of the virus. Deficits for governments, because of this spend and the loss of revenue during the first wave of the pandemic, led to a sharp increase in debt levels (OECD, 2021[24]).

Figure 3.9. General government debt across G20 countries and OECD average total government debt as a % of GDP, 2015 – 2020

Source: (OECD, 2023[25])

Contingent liabilities refer to (government) obligations that are triggered when a potential but uncertain future event occurs. Contingent liabilities can cause large, unexpected increases in government debt (OECD/The World Bank, 2019[26]). Adherents do not share one common approach to management of such contingent liabilities. To mitigate the consequences of large unanticipated contingent liabilities many Adherents have set up contingency reserve funds; i.e. a budget provision or separate fund used to finance uncertain and unavoidable events. A total of 22 Adherents have set allowances for emergencies through such contingency reserve funds (OECD, 2019[27]). Some Adherents have also set-up special contingency funds in the context of the COVID-19 pandemic, for example Austria established a COVID-19 Crisis Management Fund to provide the federal ministries with the necessary financial resources to deal with the crisis (Federal Chancellery Austria, 2020[28]).

Box 3.5. Ireland’s National Reserve Fund

In October 2019, Ireland established the National Surplus (Exceptional Contingencies) Reserve Fund (commonly referred to as the National Reserve Fund or NRF). The Fund was set up in order to enhance the predictability of emergency response and recovery funding for departments and agencies. The fund received an initial €1.5 billion transfer from the Ireland Strategic Investment Fund in November 2019 and the Minister for Finance was mandated to allocate €500 million annually from the Central Fund or its generated income for the years 2019 through 2023. However, as a result of COVID-19, no such transfers occurred from 2019 to 2021, with the government withdrawing €1.5 billion in October 2020 for the government's pandemic response instead.

In September 2022, Parliament approved the Minister for Finance's motion, resulting in a transfer of €1.5 billion in 2022 and €3.5 billion in 2023 into the Fund. The cumulative transfers to the NRF since 2022 now amount to €6 billion. Replenishing the Fund strengthens the resilience of public finances, enhancing the state's capacity to address future crises and challenges.

Furthermore, when the financial impacts of a disaster exceed certain thresholds, Ireland may seek assistance from the European Union Solidarity Fund, which provides financial aid to EU Member States. While its primary focus is on major disasters, it extends help to regional disasters that meet specific criteria, ensuring timely financial support for affected regions.

Source: (Government of Ireland – Department of Defence & Department of the Taoiseach, 2021[29]); (Government of Ireland – Department of Finance, 2023[30])

Adherents have enacted various policies that illustrate an understanding of the sources of their explicit contingent liabilities. Case studies conducted by the OECD on a number of Adherents (including Australia, Canada, Colombia, Costa Rica, France, Japan, Mexico, New Zealand) indicate the main sources of explicit contingent liabilities Adherents face arise out of legal responsibilities of central government to finance disaster response and recovery (including cost-sharing arrangements between central and subnational government) and to reconstruct/ maintain government-owned public assets following a disaster (OECD/The World Bank, 2019[26]). 10 out of 18 Respondents indicated their national government had estimated potential exposures of public finances to catastrophe risks. Exposures were shown to mostly arise from the costs related to relief and recovery such as the reconstruction of public buildings; infrastructure, exposures to catastrophe risk insurance programmes; expected payments or transfers to affected households, businesses and subnational governments; and declines in economic activity and government revenues. Across Adherents, legal responsibility tends to lie with the national-level government for financing response and recovery for major disasters, being this is a nearly universal obligation (with only one country not having a legal duty covering such an obligation) (OECD/The World Bank, 2019[26]). Although a majority of Adherents understand the sources of disaster-related contingent liabilities, more effort needs to be devoted to achieving widespread reporting of these liabilities.  Reporting on disaster-related contingent liabilities can encourage Adherents to better understand and disclose the manner in which such risks are being managed and mitigated (OECD/The World Bank, 2019[26]).

Transparency in how disaster risk management funds are allocated is crucial, since the perception that generous or restrictive disbursements are politically motivated would undermine public trust. While the majority of Respondents have published some information on their explicit contingent liabilities and how they translate into fiscal risks, few Respondents disclose specific and comprehensive information on contingent liabilities nor do they make the methodologies employed to estimate such liabilities publicly available (OECD, 2022[31]).

The Recommendation on Disaster Risk Financing Strategies complements the provisions regarding the management of the impacts of critical risks on public finances found in the Recommendation of the Council on the Governance of Critical Risks. It stresses the need for Adherents to manage the financial impacts of disasters on public finances through a combination of actions that include evaluating potential financial exposures to disaster risks, developing ex ante plans for managing these impacts with various financing options, publicly disclosing these plans (where possible) to build confidence, and assessing the benefits of risk retention or transfer compared to ex ante investments in risk prevention. Taken as a whole, these measures help enhance the management of critical risks and protect public finances from the impacts of disasters (OECD, 2022[31]). These measures include the establishment of contingency/reserve funds, devising budget appropriations or reallocations, borrowing from financial markets; and risk transfer instruments like (re)insurance or catastrophe bonds. The timing and cost implications of these approaches vary, so they can be applied to different funding needs of the government. For instance, immediate funding for relief and recovery may be best covered by existing budget allocations or quick-access appropriations. On the other hand, larger funding needs for reconstruction or catastrophe insurance obligations might be addressed through debt issuance or risk transfer methods. Many Adherents have already established plans for adequate funding, with some countries utilizing municipal emergency funds or assessing adequacy through catastrophe risk insurance programs. Colombia, for example, has a financial protection strategy incorporating savings, debt financing, and risk transfer in their specific fiscal risk management plan (OECD, 2022[31]).

Box 3.6. Overall assessment of implementation: Enhancing anticipatory capacity for complex and wide-ranging impacts to build preparedness

The thrust of the second principle of the Recommendation is to build strong capability to identify and assess critical risks and use the resulting analysis to build effective disaster risk and crisis management capabilities that are fit for future. Overall implementation of the second principle is relatively high across Respondents, but still a work in progress in several respects.

Most Adherents have now developed a National Risk Assessment (or the equivalent) and updated it at least once. These tools can provide policymakers a comparative overview of the growing number of critical risks facing Adherents and help inform priority setting in their disaster risk management investment measures, whether these take the form of prevention, mitigation or preparedness capabilities. Adherents that have not yet done so should perform an all-hazards national risk assessment.

The COVID-19 pandemic revealed a key challenge consists in leveraging existing assessments of critical risks into decisions that require significant resilience investments (such as stockpiles and reserve capacity of essential goods and services). The opportunity to make use of anticipation to improve preparedness is present in the context of gas and fuel shortages driven by Russia’s war against Ukraine.

Risk scenarios and emergency exercises remain the primary tools for critical risk anticipation. Support for public research on emerging risks as a means of risk anticipation has slightly decreased despite a call for increased attention in the 2017 Report. In particular, there is a need to strengthen understanding of secondary impacts, such as supply chain disruptions, and to use this knowledge to inform preventative actions and decisions on mitigation strategies. There is an opportunity to strengthen understanding of critical emerging risks through foresight approaches such as horizon scanning to reinforce resilience planning in critical sectors. The results of forward-looking analyses may also support reflection on what additional authorities, policies, skills and equipment are missing, and setting priorities for building capabilities to the level of quality required.

In order to ensure risk understanding also feeds into proper risk financing strategies, Adherents should be more transparent on the exposures of public finances to critical risks (including contingent liabilities). Such transparency needs to be complemented with information on what governments are doing to manage these exposures (including contingency/reserve funds, budget appropriations or reallocations, borrowing from financial markets; and risk transfer instruments).

OECD could play a useful role in formulating a framework that helps Adherents use research and knowledge on emerging risks to inform budget planning and the development of responsibilities, authorities and capabilities needed to manage them.

References

[14] Arriola, C. et al. (2023), “Challenges to international trade and the global economy: Recovery from COVID-19 and Russia’s war of aggression against Ukraine”, OECD Trade Policy Papers, No. 265, OECD Publishing, Paris, https://doi.org/10.1787/5c561274-en.

[12] Barrett, P. (2022), “Reported Social Unrest Index: March 2022 Update”, IMF Working Papers, Vol. 2022/084, p. 1, https://doi.org/10.5089/9798400209253.001.

[9] Department of the Prime Minister and Cabinet (2022), New Zealand’s Countering Terrorism and Violent Extremism Strategy, https://www.dpmc.govt.nz/sites/default/files/2021-10/New%20Zealands%20Countering%20Terrorism%20and%20Violent%20Extremism%20Strategy.pdf (accessed on 4 April 2023).

[7] EU Disaster Knowledge Centre (2017), Super Case Study 4 Forest fires in Portugal in 2017, https://drmkc.jrc.ec.europa.eu/portals/0/Knowledge/ScienceforDRM2020/Files/supercasestudy_04.pdf (accessed on 1 September 2023).

[15] European Commission – Directorate‑General for European Civil Protection and Humanitarian Aid Operations (ECHO) (n.d.), rescEU – European Civil Protection Mechanism, https://civil-protection-humanitarian-aid.ec.europa.eu/what/civil-protection/resceu_en.

[22] European Commission – Directorate‑General for Regional and Urban Policy (n.d.), EU Solidarity Fund, https://ec.europa.eu/regional_policy/funding/solidarity-fund_en.

[17] European Union Civil Protection (2016), Peer Review Risk Management Capabilities Estonia, https://civil-protection-humanitarian-aid.ec.europa.eu/system/files/2017-07/estonia_peer_review_report_-_en.pdf.

[28] Federal Chancellery Austria (2020), Federal law: COVID-19 law (NR: GP XXVII IA 396/A AB 102 p. 16. BR: AB 10287 p. 903.), https://rdb.manz.at/document/ris.c.BGBl__I_Nr__12_2020#/doc-section-text (accessed on 2 October 2023).

[19] Federal Emergency Management Agency (FEMA), U.S. Department of Homeland Security (2022), 2022 National Preparedness Report, https://www.fema.gov/sites/default/files/documents/fema_2022-npr.pdf.

[18] FEMA (2022), National Preparedness Report, https://www.fema.gov/sites/default/files/documents/fema_2022-npr.pdf (accessed on 1 September 2023).

[29] Government of Ireland – Department of Defence & Department of the Taoiseach (2021), Ireland’s Strategic Emergency Management: National Structures and Framework, https://www.gov.ie/en/publication/7ff6f-strategic-emergency-management-sem-national-structures-and-framework/.

[30] Government of Ireland – Department of Finance (2023), Minister McGrath announces €4 billion transfer to the National Reserve Fund, https://www.gov.ie/en/department-of-finance/press-releases/minister-mcgrath-announces-4-billion-transfer-to-the-national-reserve-fund/.

[11] HSE (2021), “Conti cyber attack on the HSE”, https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf (accessed on 6 October 2023).

[16] Marin Ferrer, M. and A. Casajus Valles (2018), Workshop on Risk Management Capability Assessment, https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjTsKusua-CAxXEU6QEHdJMDcAQFnoECA4QAQ&url=https%3A%2F%2Fpublications.jrc.ec.europa.eu%2Frepository%2Fbitstream%2FJRC110784%2Fws_risk_management_capability_assessment_2018_final.pdf&u.

[25] OECD (2023), General government debt (indicator), National Accounts at a Glance, https://www.oecd.org/economy/national-accounts-at-a-glance.htm.

[5] OECD (2023), Taming Wildfires in the Context of Climate Change, OECD Publishing, Paris, https://doi.org/10.1787/dd00c367-en.

[23] OECD (2023), “Unemployment benefits were widely used to cushion the impact of the COVID‑19 crisis”, in Nordic Lessons for an Inclusive Recovery? Responses to the Impact of COVID-19 on the Labour Market, OECD, https://doi.org/10.1787/a28fd651-en.

[31] OECD (2022), Draft Report on the Implementation of the OECD Recommendation on Disaster Risk Financing Strategies and Proposed Draft Revised Recommendation, OECD, Paris, https://one.oecd.org/official-document/DAF/AS/WD(2021)15/REV2/en09 (accessed on 9 January 2023).

[21] OECD (2022), Report on the Implementation of the OECD Recommendation on Disaster Risk Financing Strategies, OECD, Paris, https://one.oecd.org/official-document/C(2022)166/REV1/en (accessed on 4 October 2023).

[2] OECD (2021), “Adapting to a changing climate in the management of coastal zones”, OECD Environment Policy Papers, No. 24, OECD Publishing, Paris, https://doi.org/10.1787/b21083c5-en.

[24] OECD (2021), Government at a Glance 2021, OECD Publishing, Paris, https://doi.org/10.1787/1c258f55-en.

[27] OECD (2019), Budgeting and Public Expenditures in OECD Countries 2019, OECD Publishing, Paris, https://doi.org/10.1787/9789264307957-en.

[3] OECD (2019), Responding to Rising Seas: OECD Country Approaches to Tackling Coastal Risks, OECD Publishing, Paris, https://doi.org/10.1787/9789264312487-en.

[1] OECD (2014), Recommendation of the Council on the Governance of Critical Risks, https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0405.

[20] OECD & The World Bank (n.d.), Fiscal Resilience to Natural Disasters: Lessons from Country Experiences, https://www.oecd.org/publications/fiscal-resilience-to-natural-disasters-2019.htm.

[26] OECD/The World Bank (2019), Fiscal Resilience to Natural Disasters: Lessons from Country Experiences, OECD Publishing, Paris, https://doi.org/10.1787/27a4198a-en.

[4] Royal Commission into National Natural Disaster Arrangements (2020), The Royal Commission into National Natural Disaster Arrangements Report, https://naturaldisaster.royalcommission.gov.au/publications/royal-commission-national-natural-disaster-arrangements-report (accessed on 6 April 2023).

[10] START (National Consortium for the Study of Terrorism and Responses to Terrorism) (2023), Global Terrorism Database 1970 - 2020, https://www.start.umd.edu/gtd (accessed on 4 April 2023).

[13] UNDRR (2023), The Midterm Review of the Implementation of the Sendai Framework for Disaster Risk Reduction 2015-2030, https://sendaiframework-mtr.undrr.org/media/84377/download?startDownload=true (accessed on 6 September 2023).

[8] van Oldenborgh, G. et al. (2021), “Attribution of the Australian bushfire risk to anthropogenic climate change”, Natural Hazards and Earth System Sciences, Vol. 21/3, pp. 941-960, https://doi.org/10.5194/nhess-21-941-2021.

[6] Zurich (2019), Fort McMurray Wildfire: Learning from Canada’s costliest disaster.