26 minute read
5 IGEM system level assurance
This chapter outlines IGEM's interpretation of the intent of the arrangements based on the objectives and roles for government and industry established in the Act and based on the vision, principles, strategic priorities and roles for government and industry described in the Strategy. It goes on to outline some of the key observations IGEM made in 2016 and 2017 about the implementation of the arrangements. Finally, this chapter explains why IGEM is transitioning from monitoring implementation of the arrangements to assessing the efficiency, and eventually the effectiveness, of the arrangements.
5.1 Intent of the arrangements
Broad context
Given IGEM’s function is to monitor, review and assess critical infrastructure resilience at a system level, IGEM considers it important to consider the arrangements in their broad context. The Strategy gives effect to Part 7A of the Act and Part 7A contains the provisions which authorise a number of key activities under the arrangements.17 IGEM reads significance into Part 7A having been embedded in the Act rather than in another piece of legislation. The Act is the principal legislation for emergency management in Victoria. As such, the arrangements should be interpreted in the context of emergency management and consideration should be given to how the arrangements interact with the emergency management system. IGEM understands the emergency management system to encompass fields of activity beyond emergency response operational decision making – as is reflected by the Act and associated legislation and policy (refer to Figure 3 on the next page). While the Act is the principal legislation for emergency management in Victoria, it is not the only legislation, regulation or policy which contains provisions for emergency management in relation to essential services in Victoria from a Victorian perspective or from a national perspective – examples include:
The Essential Services Act 1958 which enables a minister to operate, control, regulate and direct any essential service during a period of emergency which has been proclaimed by the Governor in Council in relation to the essential service.
Legislation which enables government action in an emergency in relation to the supply of essential services such as the Electricity Industry Act 2000, Gas Industry Act 2001, Fuel Emergency Act 1977, Road Management Act 2004, Rail Management Act 1996, Port Management Act 1995, and Water Act 1989.
17 IGEM appreciates that activities such as sector resilience networks and plans are called for in the Strategy, and IGEM notes that the Strategy states that it ‘gives effect to recent legislative changes to the Act which came into effect on 1 July 2015’.
A range of national legislation with provisions for emergency management in relation to essential services, such as the Liquid Fuels Emergency Act 1984 (Commonwealth) which enables the relevant Australian Government minister powers to control fuel stocks, fuel production and fuel sales across Australia where the Governor General has declared a national liquid fuel emergency. Hazard specific legislation which operates at the Victorian and national levels, for example, in relation to terrorism there is the Terrorism (Community Protection Act) 200318 in Victoria and the Defence Act 1903 (Commonwealth) as a national level overlay.19
IGEM focuses on the essential service sectors of energy, transport and water. However, IGEM’s assurance approach also considers the other five sectors recognised by the Strategy in their own right and because of the interdependencies with essential services. The Strategy asks government and industry to consider all hazards.20
Figure 3: Examples of emergency management activities clustered into groups from the Emergency Management Manual Victoria Part 1 – Emergency Management in Victoria
18 Section 21F Authorisation of special powers to protect essential services from a terrorist act. 19 Part IIIAAA – Utilisation of Defence Force to protect Commonwealth interests and States and self-governing Territories. 20 IGEM understands that disruption to the supply of an essential service can constitute a hazard source of an emergency and/or an effect of an emergency and/or a consequence of an emergency.
Intended outcome
IGEM interprets that the intended outcome of the arrangements is to limit disruption to the supply of essential services to the Victorian community. The Strategy describes a vision of:
Arrangements for Victorian critical infrastructure resilience, founded on a strong partnership between government and industry sectors, that limit the disruption to the supply of essential services to the Victorian community.
The Ministerial Foreword to the Strategy sets an expectation that government and industry will work together to build critical infrastructure resilience:
Building the resilience of the State’s infrastructure is the responsibility of government, public and private sector stakeholders working in partnership. This demonstrates our commitment in working together to build a strong and resilient community and to position Victoria to meet the future challenges ahead.
Means to achieve the intended outcome
IGEM interprets the key activities under the arrangements to be risk management activities which enable information provision between government and industry to support decision making to limit disruption to the supply of essential services. Statements of intent from the Act support this interpretation:
The first objective of the Act is to foster a sustainable and efficient emergency management system that minimises the likelihood, effect and consequences of emergencies. The object of Part 7A of the Act is to provide for emergency risk management arrangements for critical infrastructure resilience.
Likewise, the second reading speech from the passage through Parliament of the amendments creating Part 7A of the Act reads that “The purpose of the bill is to amend the Emergency Management Act 2013 to provide for risk management arrangements for building critical infrastructure resilience.”21
The key activities under the arrangements, as outlined in Chapter 4 ‘Key activities under the arrangements’ of this report, generally conform to a model where:
Subject matter experts (such as the owners or operators of infrastructure, portfolio departments,
EMV and Victoria Police) are involved in identifying and assessing risks to the continuity of supply of essential services and identifying potential mitigations.
This risk and mitigation information is brought to the attention of appropriate decision makers (such as owners or operators of infrastructure, portfolio departments, EMV, Sector Resilience Networks, the
State Crisis and Resilience Council, relevant ministers, the Minister for Police and Emergency
Services, the Governor in Council, and persons who have functions or powers in respect of critical infrastructure, counter terrorism or emergency management).
Appropriate decision makers have this risk and mitigation information at hand so that they can make decisions which contribute towards limiting disruption to the supply of essential services.22
21 As recorded in Hansard of the Legislative Assembly 6 August 2014 at page 2563. 22 IGEM does not assume that the key activities under the arrangements will generate real-time risk status and vulnerability information to be provided for the purposes of emergency response operational decision making.
There are a range of decisions under the arrangements which could contribute towards limiting disruption to the supply of essential services. Examples of such decisions could include but are not limited to:
Industry and government members including a resilience improvement initiative in their Sector Resilience Plan to mitigate a risk identified during the discussions of a Sector Resilience Network meeting, and taking appropriate measures at their respective organisations to implement the initiative.23
When assessing or reassessing the criticality of infrastructure, the owner or operator and the portfolio department24 considering the upstream and downstream dependencies identified in a Sector Resilience Plan.
The responsible entity adjusting its emergency risk management plan informed by the findings of the evaluation of its exercise and the audit of its emergency risk management processes, as part of the Resilience Improvement Cycle.25
The State Crisis and Resilience Council determining that further actions by portfolio departments are required based on the briefing in the All Sectors Resilience Report produced annually by EMV through the Risk and Resilience Sub-Committee. IGEM considers that risk and mitigation information generated and provided in actions required or encouraged under the arrangements may also support decision making under other parts of the Act and in emergency management more broadly.26
A primary example of this is the legislative requirement that the relevant minister provide a copy of an Order designating vital critical infrastructure to the responsible entity, EMV, the Chief Commissioner of Police and the Chief Executive Officer of any municipal council in which the infrastructure is wholly or partly located.
23 The Strategy at page 30 explains: “Through industry collaboration, they [Sector Resilience Plans (SRPs)] provide an overview of the sector’s critical assets and operations. The SRPs develop a profile of risks facing the sector, including an evaluation of the risks identified. Responding to this identification and evaluation of sector risks, the SRPs identify resilience improvement initiatives to address significant risks posed to the sector. The implementation of these initiatives is monitored by government.” 24 The Guidelines at page 6 explain: “While relevant ministers have primary responsibility for assessing the criticality of the infrastructure within their portfolio, as per section 74D of the Emergency Management Act 2013 (the Act), the final recommendation considers input from a self-assessment process from owners and operators of critical infrastructure, and an assessment from the relevant department.” 25 The Guidelines at pages 8-9 explain: “The following principles are provided to guide responsible entities in the development of their risk management plans: …2. RMPs [risk management plans] must consider the impact on responsible entities and the response to an emergency risk event experienced by a service on which the responsible entity is dependent… 3. RMPs must contain the emergency response procedures to be implemented in response to the occurrence of an emergency risk event. Emergency response procedures must be aligned to and be consistent with the State Emergency Response Plan and its sub-plans and the Emergency Management Manual Victoria… 4. RMPs must contain the procedures for recovery of the Vital Critical Infrastructure from an emergency risk event, and for its continued safe operation...” 26 IGEM’s assessments start with information provision explicitly anticipated in the arrangements and, in consultation with stakeholders, consider interactions which may improve performance of the arrangements and the emergency management system.
5.2 Key observations from 2016 and 2017
This part presents again some selected key observations from IGEM’s 2016 Report and 2017 Report to highlight how improved provision of risk and mitigation information generated under the arrangements could support decision making which contributes towards the Strategy’s vision of limiting disruption to the supply of essential services to the Victorian community.27 IGEM anticipates that these key observations will be examined as part of its assurance approach going forward.
Providing value
In the 2016 Report, IGEM noted that the critical infrastructure resilience governance arrangements were in their infancy. IGEM observed that the supporting role provided by government could be further enhanced by maximising the critical infrastructure resilience governance arrangements depicted in the Strategy.
IGEM anticipated that, as the new arrangements became embedded over time, maximising the governance arrangements could include tabling long-standing industry challenges at the State Crisis and Resilience Council or its sub-committees so that common issues could be addressed at the appropriate levels.
IGEM anticipated that addressing common issues at the appropriate levels would strengthen linkages and build stronger government–industry partnerships, and also raise awareness of industry issues that have the potential to affect longer-term government planning considerations.
Stretching capability to stimulate learning and cross sector-exercising
In the 2017 Report, IGEM observed the good practice of some responsible entities who were moving away from exercising only for compliance purposes, towards exercising to stretch capacity and stimulate learning and improvement. IGEM also observed the good practice of portfolio departments organising additional exercising which involves industry and government from multiple sectors to explore crosssector dependencies. With deeper understanding of cross-sector dependencies, decision makers may have higher quality information about dependencies, risk to the continuity of the supply of essential services and the limits of existing risk mitigations.
The purpose of the audit under the Resilience Improvement Cycle is to evaluate the efficiency, effectiveness and appropriateness of the management by the responsible entity of risks to its capability in relation to planning, preparedness, prevention,28 response or recovery. In the 2017 Report, IGEM observed that if the responsible entity consults with the portfolio department on the scope of its audit and if the portfolio department provides structured feedback to the responsible entity on the audit it submits then, over time, audits may become more closely aligned with the intent of the arrangements. With better quality audits, decision makers may have higher quality information about the limitations of the responsible entities’ emergency risk management processes.
27 Refer to the 2016 and 2017 Reports for the full detail of IGEM’s findings and observations. 28 Amendments to the Act not yet in operation include amendments substituting the word “mitigation” instead of “prevention”.
Statements of assurance – consultation and progress reporting of actions
In the 2017 Report, IGEM observed the good practice of portfolio departments providing feedback to responsible entities on their draft statements of assurance to validate risk assessments and improve the level of information provided.
IGEM also observed the good practice of a responsible entity describing in its statement of assurance how actions in the previous year were progressing in terms of the intended outcome.
With validated risk assessments and a meaningful description of improvement in risk treatments, portfolio departments may have higher quality information about risk and the effectiveness of existing risk mitigations.
Sector Resilience Plans – status of each sector’s overall resilience
The Strategy establishes that the purpose of a Sector Resilience Plan is to provide the Victorian Government with the status of, and continuous improvement arrangements for, each critical infrastructure sector’s overall resilience.
In the 2017 Report, IGEM observed that if a Sector Resilience Plan noted the residual exposure of the sector’s services to key emergency risks or critical dependencies29 then this would provide a clearer sense of the status of a sector’s overall resilience.
IGEM appreciates that a measure of risk is not necessarily a direct measure of resilience. IGEM observed that the compilation of data on inherent risk and residual risk from responsible entities’ statements of assurance30 could serve as evidence substantiating statements about the status of the energy, transport or water sector’s overall resilience. In other words, this compilation of data could be used to validate the risk assessments presented in a Sector Resilience Plan.
In the absence of data and a direct measure of resilience, a portfolio department may find value by tracking changes in risk from year-to-year for key risk exposures and critical dependencies for a sample of critical infrastructure assets and operations in their sector or in the constituent sub-sectors.
IGEM appreciates that changes in levels of inherent and residual risk may be driven by factors which are not within the control of an owner or operator of critical infrastructure, a portfolio department, the sector or government as a whole. The Sector Resilience Plan template asks that any significant changes in the emergency risk environment from previous years should also be included, along with an explanation of the change. With validated risk measurements about a sector or its constituent sub-sectors, a portfolio department may have higher quality information about risk and the effectiveness of existing mitigations over time.
29 The Guidelines provide guidance to support portfolio departments to complete Sector Resilience Plans. For each of a sector’s key emergency risk exposures or critical dependencies, the Sector Resilience Plan template asks that a brief qualitative description be provided of the sector’s overall exposure to the risk or dependency, noting the residual exposure of the sector’s critical services to the risk or dependency. 30 The Guidelines provide guidance to assist responsible entities to effectively manage emergency risk, and to prepare the annual statement of assurance. For each identified emergency risk, the statement of assurance template asks for summary details of the assessed likelihood, consequence and level of risk and for summary details of the status and assessed effectiveness of the risk management actions or activities.
Such higher quality information may support performance of the accuracy and appropriateness attestations in relation to Sector Resilience Plans which are anticipated in the Strategy.
Analysis across all sectors
The Strategy anticipates that the All Sectors Resilience Report will brief or inform three audiences – the State Crisis and Resilience Council, the Minister for Police and Emergency Services and the public.
The All Sectors Resilience Report is intended to summarise the resilience of Victoria’s critical infrastructure sectors, including an overview of the key emergency risks and the resilience improvement measures being adopted by government and industry in response to those risks. It is also intended to identify interdependencies between sectors.
In the 2017 Report, IGEM observed that an analysis of the resilience of Victoria’s critical infrastructure, including common risks or dependencies, across all sectors may validate or improve existing prioritisations of risks and resilience improvement initiatives. Such an analysis might also help identify risks and interdependencies which may not be immediately apparent when considered from the perspective of a particular sector. IGEM acknowledged such an analysis would take time, resources and opportunity given the challenges involved. IGEM appreciates that the All Sectors Resilience Report may not be appropriate as a single form of communication of the findings of such an analysis to all audiences given the security implications and commercial sensitivities. Therefore, the level of detail provided to each audience may need to be different.
As noted in the 2017 Report, while EMV considers that the Sector Resilience Plans serve the purpose of briefing the State Crisis and Resilience Council, IGEM anticipates that the State Crisis and Resilience Council may also be assisted by being briefed on the overall resilience of Victoria’s critical infrastructure. Also, EMV advised that the Minister for Police and Emergency Services would be briefed using other processes. With an analysis of resilience from a cross-sector perspective communicated at the appropriate level of detail to the respective audiences, decision makers may have higher quality information about interdependencies, risk and the effectiveness of existing mitigations.
Measurement and reporting and coordination
Under the Strategy, EMV has a responsibility to develop and support effective communication, monitoring and reporting networks to provide assurance on the effective implementation of the Strategy. In the 2017 Report, IGEM observed that the development of a robust performance measurement and assurance framework by EMV, in partnership with and adopted by all sectors, would enable the system to measure its own performance against key indicators and monitor the achievement of outcomes. It would also assist in the identification of good practice and lessons, which can then be embedded back into the system.
IGEM also noted EMV’s advice that it faced a key constraint when undertaking its lead role maintaining and coordinating whole of government strategy and policy for critical infrastructure resilience to ensure a consistent approach across government. The constraint was EMV’s limited visibility and involvement in the Resilience Improvement Cycle. With robust performance measurement and assurance and better visibility of the Resilience Improvement Cycle, EMV and portfolio departments may have higher quality information about risk and mitigation areas of priority going forward.
Resourcing
In the 2016 Report, IGEM observed that departmental staff were mission critical assets to the implementation of the arrangements. IGEM identified four characteristics as most relevant to successful implementation of the arrangements:
The value of experience and knowledge of individual staff affects levels of initial and continued engagement with industry and government stakeholders.
Informal relationship management plays a major role – informal relationships require significant time and effort to develop and to realise the benefits.
Trust is a key element in resilience building, with transparency and clarity fundamental factors to securing stakeholder buy-in. A central tenet of resilience is that collaborative approaches are more effective than directive ones.
In the 2017 Report, IGEM reiterated this theme adding that the teams within portfolio departments and EMV which implement the arrangements are small and many are also required to perform operational, policy and administrative roles in relation to broader emergency management responsibilities. IGEM observed that, in order to ensure the intent of the arrangements can be realised in the years to come, there may be a need for government to consider the resources dedicated to the implementation of the arrangements from a sustainability and business continuity perspective – particularly if more infrastructure is assessed and designated as vital critical infrastructure. IGEM appreciates that the stability of teams and their level of resourcing impact the rate at which continuous improvements can be considered and, if appropriate, implemented.
5.3 Assurance approach going forward
IGEM has a function to monitor, review and assess critical infrastructure resilience at a system level under section 64(1)(ga) of the Act. IGEM undertakes this function in accordance with its objectives under section 62 of the Act, which are to provide assurance to the government and the community in respect of emergency management arrangements in Victoria, and to foster continuous improvement of emergency management in Victoria. The scope of IGEM’s assurance role includes, but is not limited to, consideration of:
the performance of the arrangements how the arrangements interact with the broader emergency management system to limit disruption to the supply of essential services to the Victorian community
improvement opportunities. IGEM is not able to acquit every aspect of its assurance role every year given the resource requirement and the burden it would place on stakeholders. IGEM approaches assurance with a view to adding value. Since 2015, IGEM has built its understanding of the arrangements in the course of monitoring the implementation of the arrangements. To continue to provide assurance and foster continuous improvement, IGEM is adapting its assurance methods towards assessing critical infrastructure resilience at the system level.
IGEM has developed an assurance plan for 2018 and 2019 in consultation with key stakeholders (portfolio departments, EMV and Victoria Police). The remainder of this chapter outlines some of the key considerations behind IGEM’s assurance approach going forward and the assessment methods which will be used.
Critical infrastructure resilience
The Act does not readily define ‘critical infrastructure resilience’ or ‘resilience’. The arrangements, and reports generated under the arrangements, seem to offer related but varied definitions of resilience:
As outlined in part 5.1.3 ‘Means to achieve the intended outcome’ of this report, IGEM understands the key activities under the arrangements to be risk management activities which are intended to be done at the organisation, sector and cross-sector levels. The implication is the arrangements envisage that critical infrastructure resilience is built by managing risk at the organisation, sector and cross-sector levels.
The Strategy explains that ‘resilience of infrastructure’ is provided through good design of the network and systems to ensure infrastructure has the necessary resistance, reliability and redundancy, and by establishing good organisational resilience to provide the ability, capacity and capability to respond and recover from disruptive events which is gained through business operations and appropriate support for business continuity management. The All Sectors Resilience Report 2017 defines ‘resilience’ as the capacity of individuals, communities, institutions, businesses and systems to survive, adapt and thrive no matter what kind of chronic stresses and acute shocks they experience.31 Three Sector Resilience Plans include the same or a similar definition. One of these three includes a relatively advanced discussion of what resilience means for its sector.
Part 5.2.7 ‘Measurement and reporting and coordination’ of this report highlighted that a robust performance measurement and assurance framework developed by EMV, in partnership with and adopted by all sectors, would enable the stakeholders to measure their own performance against key indicators and monitor the achievement of outcomes. If such a framework were developed to accommodate definitions of critical infrastructure resilience which respect each sector’s context, including national obligations, then IGEM could proceed with reference to it. In the absence of a framework developed by the stakeholders, IGEM proceeds with its assessments based on its understanding of the arrangements as outlined in part 5.1 ‘Intent of the arrangements’ of this report. IGEM’s methodologies for assessing critical infrastructure resilience at the system level have been and will continue to be developed iteratively in consultation with stakeholders.
Assessing the efficiency of the arrangements
As explained in part 5.1.3 ‘Means to achieve the intended outcome’ of this report, IGEM interprets the key activities under the arrangements to be risk management activities which enable information provision between government and industry to support decision making to limit disruption to the supply of essential services. Systems evaluation theory provides a method to examine the provision of information in terms of efficiency and assumes efficiency is a prerequisite for effectiveness.32
31 This definition is referenced to the Community Resilience Framework for Emergency Management which defines “chronic stresses” as long-term issues that weaken the fabric of a community on a daily or cyclical basis, for example: high unemployment, inefficient public transport system, poor health, endemic violence, food or water shortages and the impact of climate change, and which defines “acute shocks” as sudden, sharp events that can threaten individuals, households and the community, for example: bushfire, floods, earthquakes, disease outbreaks and terrorist attacks. 32 IGEM’s approach is guided by systems evaluation theory as described by Professor Ralph Renger and colleagues in a series of articles published in the Evaluation Journal of Australasia between 2015 and 2017.
IGEM has begun the process of assessing whether risk and mitigation information generated in the key activities under the arrangements is being provided to the appropriate decision makers33 in a timely34 manner to inform decision making that contributes to the Strategy’s vision of limiting disruption to the supply of essential services to the Victorian community. The key activities under the arrangements which IGEM will focus on are outlined in Chapter 4 ‘Key activities under the arrangements’ of this report, namely: sector resilience networks, plans and reports assessment, designation and the Victorian Critical Infrastructure Register the Resilience Improvement Cycle.
IGEM has worked with and will continue to work with stakeholders to:
map and prioritise the provision of risk and mitigation information (generated from key activities) to the attention of appropriate decision makers
for the priority flows of risk and mitigation information, assess the timeliness and quality of the information provided to decision makers. IGEM’s assessments will focus on how risk and mitigation information is passed on or communicated to appropriate decision makers, rather than the effectiveness of the decisions made. IGEM will also consider how the decision makers provide feedback to those who generated the information. IGEM’s assessments start with the information provision explicitly described in the arrangements, and then consider interactions which may improve performance of the arrangements or the emergency management system to limit disruption to the supply of essential services to the Victorian community.35,36
IGEM anticipates that its assessments will prove suitable for assessing the improvement opportunities highlighted in part 5.2 ‘Key observations from 2016 and 2017’ of this report including those improvement opportunities which reflect on the performance measurement and assurance aspects of the key activities under the arrangements. IGEM plans to report findings of this efficiency assessment in 2020, and the findings will also be used to inform IGEM's approach to assessing the effectiveness of the arrangements. In line with its usual practice, IGEM plans to report findings in context.
Assessing the effectiveness of the arrangements
IGEM has not yet determined its methodology for assessing the effectiveness of the arrangements. IGEM appreciates that ‘resilience’ is at times used as an umbrella term to accommodate different concepts for different purposes. As discussed in part 5.3.1 ‘Critical infrastructure resilience’ of this report, the arrangements, and reports generated under the arrangements, seem to offer related but varied definitions of resilience based on:
risk management resistance, reliability, redundancy, response and recovery
the capacity to survive, adapt and thrive.
33 Appropriate decision makers are discussed in Chapter 4 ‘Key activities under the arrangements’ and in Part 5.1.3 ‘Means to achieve the intended outcome’ of this report. 34 The Macquarie Dictionary Revised Edition (1985) defines ‘timely” as an adjective which means “occurring at a suitable time”. IGEM uses the phrase “timely manner” or the variant “timeliness” in acknowledgement that the purpose of information in question determines the appropriate timeframe for its provision. 35 IGEM understands the emergency management system to encompass fields of activity beyond emergency response operational decision making – as is reflected by the Act and associated legislation and policy. 36 IGEM does not assume that key activities under the arrangements will generate real-time risk status and vulnerability information to be provided for the purposes of emergency response operational decision making.
Some portfolio departments have advised IGEM of progress in their efforts to develop concepts of critical infrastructure resilience which are appropriate for their sector, and which are able to be assessed. Consistent with past practice, IGEM will consult with stakeholders about methods for assessing effectiveness of the arrangements. Key considerations which will inform the development of IGEM’s methodology include:
Definitions of critical infrastructure resilience which exist in the arrangements or in reports generated under the arrangements as discussed in part 5.3.1 ‘Critical infrastructure resilience’ of this report.
Defined outcomes for critical infrastructure resilience.
EMV's development of the performance measurement and assurance framework in partnership with all sectors as discussed in part 5.2.7 ‘Measurement and reporting and coordination’ and part 5.3.1 ‘Critical infrastructure resilience’ of this report.
Data and measures that are already being collected and reported in relation to the critical infrastructure sectors.
In the course of IGEM’s assessment of efficiency, measures to assess the effectiveness of the arrangements may become clearer. As part of public sector reform, the Victorian Government has developed an outcomes approach that seeks to provide a clearer and more effective way to measure the impact of activity in key priority areas. Departments are developing outcomes frameworks relevant to their vision and programs. There is also a process within the emergency management sector, which has been in development since 2015, to define a set of outcomes and outcome measures for emergency management in Victoria. In the absence of a performance measurement and assurance framework developed by the stakeholders, IGEM may proceed with its effectiveness assessment based on its interpretation that the intended outcome of the arrangements is to limit disruption to the supply of essential services to the Victorian community as explained in part 5.1.2 ‘Intended outcome’ of this report.
IGEM anticipates that outcome measurements over time may provide results which show whether disruption to the supply of essential services is improving, is stable, or is deteriorating. A time-series of outcome measurement results may indicate where further improvements are necessary and where further assurance is required. Such an approach may add value in that it may help to move along conversations among stakeholders about the meaning of ‘critical infrastructure resilience’. IGEM appreciates that outcome measurement comes with challenges such as:
Attribution – a range of environmental conditions and decisions of so many different people, including in government, industry and the community, over long periods of time contribute towards an outcome. The contribution of any risk mitigation to limiting disruption to the supply of essential services will be difficult to pinpoint.
Counterfactuals – determining the extent to which the risk mitigations have limited disruption to the supply of essential services is inherently challenging as we are unable to observe the outcome if systems had been set up differently.
Scale and scope – a disruption to the supply of essential services which is catastrophic for a street of neighbours may only calculate as minor if considered across the whole population of Victoria. In line with its usual practice, IGEM will report any findings in context.
