Polycentric risk governance across safety and security risk logics

When Safety Meets Security: Toward Polycentric Risk Governance, the Case of the Norwegian Oil & Gas Industry in the Face of the Risk of War

Recent geopolitical events have provided a stark reminder that some industrial sectors must now manage not only accidents, but also intentional malicious acts. The invasion of Ukraine, and especially the sabotage of the Nord Stream pipelines, prompted Norway to make far-reaching changes to its regulatory framework for the oil and gas sector. A field historically governed by the principles of industrial safety (safety) is now subject to new requirements concerning protection against intentional acts (security). 

Our summary

 Written in part with the assistance of an AI system.

Crises and events can give rise to new categories of risk that may disrupt and call into question regulatory regimes built around well-established approaches to risk. This article supports this argument by examining changes to the regulation of Norway’s oil and gas sector in the context of the war in Ukraine and the sabotage of the Nord Stream I and II pipelines.

An Industry Built on Trust, Now Facing Threats

For several decades, safety in Norway’s oil and gas sector has relied on a governance model based on trust, dialogue, and cooperation among companies, regulatory authorities, and worker representatives. The core principle is that organizations have an interest in improving their own level of safety and are therefore given considerable autonomy. Regulations establish general objectives but leave companies broad discretion to determine the measures they consider appropriate.
The emergence of new geopolitical concerns has changed this balance.

Almost overnight, regulators and companies in the oil and gas sector, all focused on technical and operational safety (safety), had to address new categories of risks related to security (security).

The Norwegian government introduced a national Security Act to force adaptation to a new reality, in which a regulatory system designed to manage errors, technical failures, and accidents must suddenly incorporate deliberate threats, acts of sabotage, and attacks by adversaries.
 

Two Worlds That Are Not Based on the Same Assumptions

In its first section, the article points out that the current version of the Security Act, the new Norwegian law that came into force in 2019, represents a significant shift from previous legislation.

While previous approaches focused primarily on protecting specific assets or facilities designated as strategic, the new law places greater emphasis on prioritizing the protection of functions that are essential to the nation. It requires organizations to identify their own vulnerabilities, assess threats, and implement appropriate protective measures.

This approach is both functional and risk-based. The government no longer simply prescribes what must be done; it requires companies to continuously assess their level of exposure and demonstrate that they maintain an adequate level of security. This philosophy is similar to modern regulatory approaches that have long been developed in major-hazard industries, but here it is being applied to national security.

Extending this approach to the oil and gas industry remains controversial within the industry. Part of the sector believes that risks arising from malicious acts could be managed within the existing industrial safety regulatory framework, while security authorities argue that this infrastructure should be explicitly brought within the scope of national security. The events of 2022 ultimately accelerated this shift.

One of the article’s major contributions is to show that safety and security differ not only in the risks they address, but also in the fundamental principles that underpin them.

Three logics that structure action: governance logic, risk logic, and regulatory acts

Logic, governance, and acts are interdependent concepts that, taken together, form the basis of management and regulation.

Logic, governance, and acts thus form the conceptual foundation of this article, while the notion of “risk logic” lies at the heart of the analysis. This risk logic refers to the fundamental principles and thought processes that shape the perception, assessment, and management of risks in a given industrial context. It provides a conceptual framework that shapes how the key stakeholders in the Norwegian petroleum industry's regulatory system, including regulators, organizations, and individuals, approach risk-related decisions. It is an intellectual framework that influences the decisions made by regulators, companies, and professionals. It determines what is considered a credible threat, what knowledge is deemed relevant, and what actions are considered legitimate.

This shift reflects a broader trend observed in contemporary societies: institutions no longer govern solely by responding to crises, but increasingly by anticipating risks. This “riskification” of public action leads to thinking in terms of vulnerabilities, resilience, and future scenarios rather than immediate threats.

Thus, in the field of national security, threats are gradually being transformed into risks that can be analyzed. Risk becomes a management tool for organizing action in the face of uncertainty. This shift also increases reliance on experts, as decisions increasingly depend on complex analyses and judgments about uncertainty.
 

Safety and Security: Two Different Worlds

The most interesting aspect of this first part of the article is undoubtedly the in-depth comparison between the logics of safety and security.

This distinction leads to very different ways of working.

Industrial safety relies heavily on trust, openness, and information sharing. Information about incidents and errors is shared to support organizational learning and improvement. Transparency is seen as a driver of progress.

By contrast, security against malicious acts relies more heavily on confidentiality. Information about vulnerabilities, defense capabilities, or threat scenarios cannot be freely shared without potentially creating new vulnerabilities. Protecting information therefore becomes an essential component of the defense system.

This contrast goes far beyond the methods used. It extends to the very values underpinning regulatory regimes. On one side are openness, trust, and learning; on the other, discretion, control, and, at times, deterrence.
 

The boundaries are less clear-cut than they may seem

In the field of industrial safety (safety), intentional behaviors also exist. Deliberate violations of procedures, circumvention of rules, and certain forms of conscious risk-taking play an important role in accidents. Conversely, some security-related actions are not directly intended to cause harm. The mere presence of intent is therefore not always sufficient to draw a clear boundary between the two fields.

This observation has led several researchers, notably in a book published in 2020 by Foncsi in our “SpringerBriefs in Safety Management” series, edited by Corinne Bieder, our scientific director, and Kenneth Gould, with a major contribution from Nancy Leveson, to propose a more systemic approach.

From this perspective, accidents and malicious acts can be analyzed as different manifestations of the same problem: a loss of control over a complex sociotechnical system. The focus should therefore be less on the intent of the person responsible and more on the system’s overall ability to maintain its essential functions despite the disruptions to which it is exposed.

The interfaces between safety logic and security logic provide the foundation for integrating their approaches into a unified risk management framework. The two fields converge in the attention they give to technical, organizational, and human factors, since incidents, whether unintentional (safety) or intentional (security), often require similar mitigation measures, such as safety barriers and defense in depth.

However, a major distinction lies in how human intent is considered: traditional industrial safety focuses on unintentional events. It is based on failure analysis, the study of actual work practices, an understanding of organizational factors, and the open sharing of information to support collective learning. Trust plays a central role.
Security against malicious acts, by contrast, focuses on adversaries, their intentions, and their capabilities. It places greater emphasis on confidentiality, the protection of sensitive information, deterrence, and control.

This divergence creates a “gray area,” such as insider threats, where trusted individuals may pose security risks. In addition, safety emphasizes openness and structured, data-driven analyses, whereas security requires confidentiality and frequently relies on qualitative, scenario-based methods. These divergent approaches complicate efforts to integrate the two perspectives. Additional challenges arise from contrasting methodologies, cultural expectations, and regulatory frameworks, particularly when addressing external threats or combining safety and security governance.
 

Toward polycentric risk governance

The first part of the article concludes with the idea that will serve as a guiding thread throughout the rest of the article: today’s security challenges can no longer be managed by a single organization or authority.

The second part of the article proposes moving beyond this traditional divide. The authors use the concept of polycentric governance to describe a situation in which multiple decision-making centers, both public and private, are simultaneously involved in risk management.

Critical infrastructure lies at the intersection of numerous stakeholders: public authorities, regulatory bodies, companies, labor unions, technical operators, intelligence services, and international partners. This multiplicity of decision-making centers leads the authors to advocate a “polycentric” approach to risk governance.

The goal, therefore, is not to replace industrial safety with national security, but to build a framework capable of bringing these two logics together. The key challenge is to preserve the benefits of industrial safety culture, including trust, lessons learned from experience, transparency, and learning, while incorporating the new requirements associated with protection against intentional threats.

In such a system, the state, regulators, companies, contractors, experts, and worker representatives all contribute to risk governance without any single authority exercising complete control.

The idea, therefore, is not to replace a safety logic with a security logic, but to create an integration layer that makes it possible to manage the trade-offs between the two.
 

The authors describe a form of governance capable of:

• reconciling transparency and confidentiality;
• combining collective learning with information protection;
• maintaining trust while developing control capabilities;
• simultaneously integrating industrial, economic, and geopolitical considerations.
   

From regulatory oversight to regulated self-regulation

Another important question concerns the very nature of regulation.

Historically, many sectors have been governed by detailed prescriptive rules specifying exactly what had to be done. The authors contrast this model with regulation based on expected outcomes and on organizations’ ability to analyze their own risks.

The Norwegian National Security Act clearly falls into this second category. It requires companies to identify their critical functions, analyze their vulnerabilities, and demonstrate that they have the risks to which they are exposed under control. This shift increases companies’ responsibility but also raises a difficult question: do they really have the knowledge and skills needed to analyze complex threats, which are often linked to international geopolitical dynamics?

The authors thus emphasize that the shift toward self-regulation does not eliminate the need for oversight. It simply shifts where responsibility lies.
 

The limitations of traditional risk analysis methods

The article also highlights a methodological challenge.

Industrial safety risk analysis now has a relatively solid theoretical foundation. It often draws on the study of past accidents, operational experience feedback, and probabilistic estimates. 

Risks associated with intentional attacks have different characteristics. Events are rare, historical data is limited, adversaries adapt their strategies, and probabilities are often impossible to estimate reliably.

The authors advocate an approach based more on uncertainty, scenarios, and resilience than on probabilities alone. They see this as an opportunity to bring the two approaches to risk closer together.

 

Trust put to the test

One of the most interesting passages in the article concerns the impact of new security requirements on the Norwegian petroleum industry’s longstanding culture.

Openness in information sharing, the sharing of information about incidents, and dialogue among social partners have long formed the basis of the Norwegian industrial safety model. However, the confidentiality requirements associated with threats of sabotage or espionage are partly challenging this tradition.

The authors report several tensions that have recently emerged among authorities, companies, and unions over the sharing of information about security threats.

Stakeholders accept the need for a certain degree of confidentiality but also recognize that safety cannot be effectively managed without at least some flow of information.

This tension between trust and secrecy appears to be one of the major challenges involved in the coexistence of safety and security.
 

Conclusion

The article argues that recent geopolitical developments are forcing high-risk industries to rethink their governance models. Industrial safety and security against malicious acts can no longer be managed separately. However, integrating them is not straightforward, as they are based on different assumptions about the causes of events, the role of information, stakeholders’ responsibilities, and risk analysis methods.

This article shows how the introduction of the Norwegian National Security Act has reshaped existing risk management approaches in the Norwegian petroleum industry, highlighting the trade-offs between safety and security, as well as the resulting regulatory dilemmas.

These issues are addressed in part through a polycentric model of regulated self-regulation, combining legally binding requirements, industry standards, and internal control systems. However, this shift redistributes responsibilities between public- and private-sector stakeholders, creating challenges in terms of accountability, coordination, and the suitability of risk assessment practices.
 

Three key recommendations emerge

First, regulators should strengthen accountability, meaning the obligation to explain and justify actions and be held responsible for them before an authority or the public, within risk-based regulatory regimes by clarifying how responsibilities are allocated between government authorities and industry stakeholders, particularly with regard to security. This means setting clearer expectations for internal control systems, strengthening oversight capabilities, and ensuring that risk assessments and mitigation measures are systematically reviewed and audited.

Second, governance frameworks should institutionalize mechanisms for adaptive coordination and information sharing that foster effective collaboration among stakeholders while balancing transparency and confidentiality requirements. This could include establishing coordination forums, developing protocols for graduated information sharing, and ensuring meaningful involvement of key stakeholders, including workers and their representatives, in security-related dialogue without compromising the confidentiality of sensitive information. 

Third, regulators and industry should promote integrated risk assessment methodologies that better reflect the combined nature of safety and security risks. This includes supplementing probabilistic approaches with uncertainty- and scenario-based methods, prioritizing systemic perspectives, and investing in capability building so that organizations can effectively conduct and interpret these analyses in practice.

Although rooted in the Norwegian petroleum industry, these recommendations have broader relevance for regulatory regimes undergoing similar transitions. In high-risk industries characterized by an increasing distribution of responsibilities and an evolving threat landscape, effective governance depends on aligning accountability structures, strengthening coordination, and developing analytical tools capable of addressing complex, interconnected risks.