Using microworlds to study critical infrastructure protection – The effect of incentives on risk management

Extended abstract

The functioning of modern societies is dependent on the services provided by an interconnected web of critical infrastructures (CI:s). An interruption to these services (e.g. electrical distribution, transport, and communication) will quickly lead to significant consequences. To understand risk management in such a context means understanding the behavior of the actors contributing to upholding the services. It is particularly important to understand how they react to various types of incentives to manage risk. Therefore, to advance our understanding of risk management we conducted an experimental study using a computer simulated microworld called MikroRisk. It allowed the participants to take control of a fictitious electric power company. Their goal was to maximize the profit of the company. They could choose to spend resources on regular investments or on investments to increase the robustness of the power grid. A more robust grid would lead to less consequences if a storm occurred.

The effect of differences in incentives was investigated by changing the magnitude of losses the company would suffer if a storm occurred. In one experimental condition the company would bear all losses, but in another condition there was an upper limit to the losses. We expected that limiting the potential losses would lead to less interest in investing in risk reduction. This was also confirmed in the study. Moreover, at the same time we also investigated the effect of letting the participants have access to a simple risk assessments or not. We wanted to determine if introducing such an assessments could counter the effect of changing the incentives.

The results show that introducing the risk assessments did increase the willingness to invest in risk reduction. The presence of the risk assessments essentially cancelled the effect of reducing the incentives to invest in a robust power grid. Moreover, the total losses, i.e. losses suffered by the electric power company and their customers, was also influenced by the two independent variables. Reducing the incentives of the company to invest in risk reduction lead to greater total losses. On the other hand, introducing the simple risk assessments resulted in less total losses. Both these factors are probably important when trying to understand risk management in practice. Moreover, it is also likely that the factors can be manipulated to produce predictable behavior in terms of risk management. And therefore they can probably be used as a basis for interventions aiming to influence risk management in practice.

Another interesting result of the experiment was similar to the “drifting into failure”-phenomenon (Dekker and Pruchnicki, 2013). In one of the experimental conditions the level of risk was almost constantly rising, i.e. the participants did not invest much in risk reduction. This happened when the participants had low incentives to invest in risk reduction and lacked a risk assessment. In the other experimental conditions, the level of risk was stabilized after a number of turns. It suggests that making CI-operators bear a larger part of the losses in case of a service interruption, and using simple risk assessments to inform their decision making, may both counteract economic pressure to neglect investing in risk reduction. Although the effects observed in the experiment are strong their practical importance remains unclear. More research is needed to investigate the importance of the investigated factors in practice.

References

Dekker, S. & Pruchnicki, S. 2013. Drifting into failure: theorising the dynamics of disaster incubation. Theoretical Issues in Ergonomics Science, 15(6): 534-544.