COVID-19.

The Russian war on Ukraine.

The affordable housing crisis.

Governments are faced with the job of assessing and responding to one issue after another. Too often, the response looks like a game of Whac-A-Mole as governments jump from one crisis to the next.

This is not new—”Events, dear boy, events,” the late former British prime minister Harold Macmillan replied when asked to describe that which was most challenging to a statesman.

Governments struggle to anticipate and prepare for major disruptions. Despite expert warnings of a 9/11-type terrorist attack prior to 9/11, the U.S. government’s inability to thwart the attack was described as a failure of imagination.

Following the SARS outbreak in 2003, the Canadian government was roundly criticized by three separate commissions for inadequate infrastructure to prepare for and respond to national health emergencies. Yet even with ample time to address these critical gaps, Canada’s response to the COVID-19 pandemic nearly two decades later was characterized as decentralized, uncoordinated and slow.

Classifying risk

In 2024, Policy Horizons Canada released a report identifying 35 potential disruptions that could trigger dramatic consequences. Some, such as “homemade bioweapons go viral,” may seem unlikely, while others like “people cannot tell what is true and what is not” ring as more urgent.

The intention of the report is clear: it behooves policymakers to consider the consequences of potential disruptions when developing policies, programs, and strategies. That said, the report itself offers little in terms of what planning for those disruptions ought to look like.

The International Risk Governance Council simplifies this task somewhat by classifying risks into one of four categories: simple, complex, uncertain, and ambiguous.

To demonstrate, consider three high-impact disruptions from the Policy Horizons report’s top ten list of threats: cyber attacks on critical infrastructure (complex); the collapse of health systems (uncertain); and the failure of democratic institutions (ambiguous).

Framing different risk types        

“Cyber-attacks disable critical infrastructure” (complex risk) is at its core technical: there are a mulititude of variables interacting in the system that are difficult to identify or quantify.  How the system works is a mystery for the most part to all but the experts, but we are familiar with what it’s like when it fails.

In appraising such a threat, we can draw on related real-world examples. Power and cell tower failures during natural disasters, for instance, provide useful insights. The consequences of systems failure will be determined largely by the robustness of and redundancies in the system.

Addressing complex risks such as these, however, goes beyond technical complexity. Policymakers need to understand why certain people or organizations would attack critical systems in the first place.

Equally, policymakers need to understand how malicious actors change perceptions of threat: the public reacts differently towards leaders when nefarious forces, such as hackers from other nations, are the source of the problem as opposed to systems failures brought about by natural disasters or insufficient upkeep due to budgetary constraints.

“The collapse of healthcare systems” (uncertain risk) involves factors which can be better understood than complex risks—an aging population and an emerging virus, for example. But, with uncertain risks, we struggle to appreciate fully the cascading effects of failure until we experience them.

The far-reaching impact of the COVID-19 pandemic and the various responses to it provide useful examples of unimagined consequences. Early on, we did not know what impact the pandemic would have on the health care system and more broadly across society, or for how long.

The pandemic revealed how interconnected social, health, and economic systems can be.

One important takeaway was that responses to uncertain risks in the absence of reliable data can be precautionary, which are approriate in the face of potentially consequential and/or irreversible outcomes.  Precautionary approaches, however, are expensive and often overlook trade-offs implicit in decision-making.

Solutions for uncertain risks focus on establishing minimum standards for service and adaptive capacity while not yet knowing the reach of the threat. In their haste to respond, policymakers can often overlook who is carrying the cost of that response and accountability can be opaque.

“The breakdown of democratic institutions” (ambiguous risk) involves divergent or contested perspectives on the justification, severity or wider meanings associated with a given threat. We have data, but we do not agree on what it means and what to do about it.

Ambiguous risks require more attention to how we collect data and apply it to frame risk. There can be disagreement between competing parties with legitimate and incompatible knowledge claims and priorities, underpinned by different worldviews and values.

In such situations, how we understand and value democratic institutions as well as what we expect from them can vary widely.

Provisional responses to address stand-offs, joint fact-finding, and multicriteria assessments can assist when policymakers are confronted with ambiguous risks. Policymakers must also be mindful of influential stakeholders whose sway may frame debates and how we understand the threat, and therefore have an outsized impact on decisions and outcomes.

Taking a concerted approach

Many of the disruptions outlined in the Policy Horizons report do not fit neatly into one category. They contain complexities, uncertainties, and ambiguities.

What constitutes a “collapse of the healthcare system,” for example, can be ambiguous, meaning different things to different people. Nevertheless, classifying the risk types in a general sense can be a helpful start in addressing the cases.

By classifying risk types, we establish a common understanding of the challenges and the vocabulary and tools to examine, discuss, and ultimately devise a concerted and effective process to address the risks. The approach can lead to more sophisticated risk governance and allow for a more strategic and considered response in the face of crises.

Failure to act now to adopt more effective threat preparation ensures that when a threat does materialize we will be underprepared and the consequences and costs will be greater.