Summary: Given that the Committee of Infrastructure Risk Management (CIRM) is new and recently launched a subcommittee in Infrastructure Finance Risk, I thought it useful to position our emerging use of terminology for community input. My background is in finance which colors my lens on the challenge. Infrastructure risk and infrastructure resilience represent two complementary concepts for understanding how public systems such as transportation networks, water and energy systems, and critical facilities perform under increasing environmental, operational, and social stresses. Infrastructure risk focuses on the probability and potential severity of damage or disruption, integrating hazard likelihood, exposure, and vulnerability into a measure of how and where failures may occur. This captures the likelihood and intensity of damaging events (hazard); people, assets, and services that could be impacted (exposure) and; weakness in design, condition, or operations (vulnerability). In contrast, infrastructure resilience emphasizes the capacity of systems to withstand, absorb, adapt to, and rapidly recover from such disruptions while maintaining essential functions. Typically, strength, backup systems or alternative pathways are reflective of resilience. Whereas risk quantifies the chance and consequences of adverse events, resilience evaluates performance during and after those events, including robustness, redundancy, flexibility, and recovery time. Combined, they provide a holistic view for planning, designing, and investing in (public) infrastructure. Understanding their distinctions, metrics and indicators is essential for governments, asset owners, and financiers seeking to manage climate impacts, mitigate the impact of cyberattacks, protect communities, and guide long-term infrastructure development.
Assessment Metrics: From an engineering perspective, risk assessment relies on probabilistic models that quantify the likelihood and consequence of failure, using tools such as hazard mapping, fragility curves, loss-exceedance analyses, and scenario-based damage estimation. These methods emphasize hazard frequency, exposure, and asset vulnerability to calculate expected annual losses or probabilities of service disruption. From a financial perspective, risk metrics include cash flow volatility, debt and credit risk, and value at risk (VaR) from climate or other exposure, for example.
In contrast, resilience assessment focuses on system performance before, during, and after disruptive events through dynamic, time-dependent models. Techniques such as network analysis, system-of-systems modeling, recovery trajectory curves, robustness and redundancy metrics, and agent-based simulations evaluate how infrastructure absorbs shocks, reconfigures, and restores function. The metrics are exemplified in the Table. While risk assessment identifies where and how failures may occur, resilience assessment evaluates how infrastructure continues to operate and recovers in the face of those failures. Integrating both approaches provides a holistic technical foundation for designing, investing in, and managing infrastructure that is both less prone to damage and better able to withstand and recover from the increasingly complex hazards of a changing climate, a cyberattack or a pandemic. Resiliency financial metrics comprise avoided losses, resilience ROI, financial market (e.g. bond pricing) and insurance premia adjustments among many others.
Risk and Resiliency Classification: A key challenge, given the multitude of metrics is how to classify infrastructure risk and resilience. As the risk of simplification, I have taken a page out of the business playbook (see 2x2 diagram). Infrastructure assets (and their supply networks) should be evaluated for risk and resilience because low risk does not mean high resilience and vice versa. A low-risk asset can also be low-resilience (rare event, catastrophic consequences), while a high-risk asset can be very resilient (frequent shocks, minimal downtime). Hence, we need both frameworks to assess the long term value and function of infrastructure assets.
An example of the former is a municipal water treatment plant located in a region with historically mild weather and low hazard exposure but with no backup power supply. It is low risk, because the facility sits far from floodplains, fault lines, and wildfire-prone areas. Historical weather patterns show limited extremes (few storms, moderate temperatures) and hazard probability (flood, drought, heat, storm) is statistically low. Hence, traditional risk assessments would therefore rate the plant as unlikely to experience damage. However, it is low resilience because the plant has no redundant power source (no generator, no microgrid, no islanding capability), and a single substation outage or regional blackout would completely halt treatment operations. Even a short loss of power disrupts water supply to hospitals, businesses, and residents, while at the same time recovery could take 24–72 hours, depending on utility repair schedules. Minimal operational flexibility or backup capacity render the asset low resiliency.
An example of a high-risk transportation infrastructure asset that also demonstrates high resilience is the New York City Subway System. The system is exposed to multiple, compounding hazards, including coastal flooding and storm surge (e.g., Hurricane Sandy inundated tunnels), extreme rainfall events that overwhelm drainage systems, aging (many components are more than 100 years old), high operational complexity (dense interconnections and limited downtime), and high criticality (any disruption affects millions of daily riders). Despite high risk, the system exhibits strong resilience characteristics, demonstrated during and after major shocks, including rapid recovery after extreme events (several flooded tunnels were reopened within days after Sandy, despite unprecedented damage, system restoration was prioritized using emergency procedures, mobile pumps, and accelerated inspection protocols. In addition, the system has redundancy and network flexibility (parallel lines, bypass capacity), and has experienced continuous 'hardening investments' (floodgates, raised vents, inflatable tunnel plugs, resilient power systems). Importantly, there is strong institutional coordination to mobilize resources quickly and execute continuity-of-operations plans.
Policy and Financial Implications: An agency or a city/municipality needs to combine risk (understanding threats) and resilience (strengthening response) metrics for robust functionality in design. These differing perspectives have significant policy implications as risk-based frameworks tend to guide investment toward protective measures and pre-event controls, while resilience-based frameworks promote integrated planning, multi-sector coordination, community continuity, and investments that enhance recovery and adaptive performance. Effective infrastructure governance requires policies that balance both quantifying and reducing risk while simultaneously strengthening resilience to ensure essential services remain reliable under evolving climatic, technological, and socioeconomic pressures. From a financial and investor confidence perspective, risk implies higher cost of capital, volatility in performance, and capital constraints because of potential loss of value over time. On the other hand, resilience projects financial stability and thus potentially lower risk premiums, as well as longer enhanced asset value.
Opportunity for CIRM: Since risk and resilience are two sides of the same coin in assessing infrastructure design and functionality, we have an opportunity to develop asset/sector/geography/shock-specific risk-resilience quadrants to profile the nation's infrastructure assets using the metrics from the table. Different assets are individual infrastructure projects, while sector refers to e.g. energy to water utilities. Shock is based on what committees have told us, and may refer to financial, cyber, or climate. These 2x2s and metrics table could be sent out to the various infrastructure committees/agencies for input after we develop a few examples to start populating a database with risk-resilience profiles.
A further CIRM opportunity pertains to exploring the relationship between infrastructure resilience ('Can the system continue to provide essential services during and after a disruption?') and risk mitigation ('How do we lower the probability or consequence of a specific risk?'). While these concepts serve different roles in managing uncertainty, protecting assets, and ensuring long-term system performance, one of CIRMs subcommittees is focused on 'Infrastructure Finance Risk' with emphasis on resilient infrastructure financing, risk allocation, contracting and design. The subcommittee seeks to encourage and advance approaches to assess how financial, operational, climate, and regulatory risks affect infrastructure assets and capital planning.
In the context of the risk-resilience 2x2 diagram, the implications are whether and how current infrastructure assets in the lower two quadrants could be 'hardened' and rendered less vulnerable to hazards, towards an optimized or managed state of higher resilience at its current or a lower risk profile. The solutions space for these assets thus leverages risk-pricing and revaluing, attracting alternative financing options and explore more right-weighted risk allocation strategies. Risk mitigation should be thought of as an input. Resilience is the desired outcome.
------------------------------
Peter Adriaens Ph.D., M.ASCE
Professor of Engineering, Entrepreneurship and Finance
Ann Arbor MI
------------------------------