Resilience Engineering: An Integrative Review of Fundamental Concepts and Directions for Future Research in Safety Management

This paper reviews the literature on resilience engineering as a safety management approach. Preferred Reporting Items for Reporting Systematic Reviews guidelines were used to search, select and evaluate 46 published works. The terms organisational resilience and resilience engineering are clarified, and functionalist and interpretive research frameworks used to analyze articles. This review suggests there is no universally agreed definition of resilience engineering; but it involves a collective aspect, is multifactorial, multilevel and multidimensional; associated with four key principles (anticipation, response, learning and monitoring) and successful outcomes. The gap between work as imagined and work as performed is an important aspect. Studies on resilience engineering have predominantly involved qualitative investigations; with data collected through site observations, safety audits and surveys. Eight research gaps were identified, and suggestions made on how these gaps can be addressed through empirical research.


Introduction
Effective management of safety is an integral part of organisation's risk management throughout the world. This is because more than 2.7 million workers die from work-related accidents and diseases, over 374 million people suffer from non-fatal accidents and injuries [1]. These are expected to increase further been previously used to synthesize topics such as risk management [28], resilience [29] [30] and safety culture [31].
The specific method used included an adaptation of the recommended guidelines for Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) [32]. The four key steps used included identification of the relevant literature, screening the abstracts, full-text reading to check for eligibility and inclusion and excluding criteria [19], illustrated in Figure 1. PsycINFO, Social Science Index (SSCI) and Cumulative Index to Nursing and Allied Health Literature (CINAHL) databases were searched through the EBSCOHost platform using organisational resilience* and resilience engineering* as keywords.
The initial search resulted in 103 articles after duplicates were removed. This included four books [13] [33] [34] [35], which also included chapters picked up in the initial selection. An additional 20 identified through Google Scholar. Abstracts of these 123 articles were read, and 66 removed because they focused on topics other than safety management (resilience in communities, psychological, children and youth, climate change, ecology, sustainability, state-space theory) [19]. Full texts of the remaining 57 articles were fully reviewed to see they could be included or excluded from the final review. In order to be included, articles needed to be published in English, peer-reviewed, and include one or more of the following: definitions, measures/dimensions/factors or key concepts. Nine articles were removed at this stage, resulting in a sample of 46 papers for final

Findings and Discussion
The next section examines the definitions used to explain RE. Because the published works referred to OR constantly, no review of RE can be considered complete without a summary of those aspects of OR that have been suggested to play an important role [19]. As such these are reviewed first.

Definitions of OR
There is no common understanding of OR, fifteen definitions extracted from the articles reviewed are summarised in Table 1.
The most common theme from the above definitions of OR is an ability to cope with adverse circumstances, disasters and disturbances. This is reflected in the key ideas such as recovery [39] [45], withstanding major disruptions [40] [48] [49], absorbing disturbances and change [50], and adjust, adapt and/or maintaining function and structure [42]. Most of these definitions see it as a reactive capability, and many of these are also attributes of complex adaptive systems (CAS) [51].
However, there appear to be two things that set resilient organisations apart from CAS.
The first is their ability to continue performing well without being affected significantly during a catastrophe or disaster; the fact they "operate smoothly even in difficult situations" [37], "recover quickly to a stable state" [41], and even "thrive during adversity" [47] serve to illustrate this point. The reaction of any organisation or system always depends on the severity of the catastrophic event. Organisations or systems that can thrive in the face of catastrophe are also rare. While most organisations react to stress by shutting down completely or operating at reduced capacity, resilient organisations absorb such stresses and continue to operate normally. They are able to this very well because this is what they are exposed as part of their normal operations [41] [49]. These organisations can (and sometimes do) fail, but their repertoire of capabilities allow them to recover, recalibrate and continue operations without being significantly affected.
The second is their ability to deal effectively with more than normal, every-day threats and disturbances. This involves going beyond past experiences and being prepared to deal effectively with unknown events, threats, and/or "unexampled hazards" [39]. For Malakis and Kontogiannis [50] it was about effectively dealing with disturbances, disruptions and changes "beyond the textbook envelope". Resilient organisations assumed their models safety management were incomplete, so they proactively tested their assumptions and approaches, with the belief that they would be able to perfect this over time through learning from events and near-events [43]. These created an opportuni-Open Journal of Safety Science and Technology ty for imagination, innovation, and creativity; all of which provided opportunities for learning and bouncing forward. Mallak [36] "the ability of an individual or organization to expeditiously design and implement positive adaptive behaviours matched to the immediate situation, while enduring minimum stress" Hale and Heijer [37] "the characteristic of managing the organisation's activities to anticipate and circumvent threats to its existence and primary goals" McDonald [38] "the capacity (of an organisational system) to anticipate and manage risk effectively, through adaptation of its actions, systems and processes, so as to ensure its core functions are carried out in a stable and effective relationship with the environment" Westrum [39] "the ability to prevent something bad from happening, or the ability to prevent something bad from becoming worse, or the ability to recover from something bad once it has happened" Woods [40] "the art of managing the unexpected, or how a team or organization becomes prepared to cope with surprises" Wreathall [41] "the ability of an organisation (system) to keep, or recover quickly to, a stable state, allowing it to continue operations during and after a major mishap or in the presence of continuous significant stresses" Patterson, et al. [42] "the ability to adapt or absorb disturbances, disruption, and change" Vogus and Sutcliffe [43] "the maintenance of positive adjustment under challenging conditions such that the organization emerges from those conditions strengthened and more resourceful" Bracco, et al. [44] "emergent property of a complex system and comes from the joint interaction of a structure, its functions and an environment where they can take place" Epstein [45] "the capability of a strained body to recover its size and shape after deformation caused especially by compressive stress… for general usage it can be defined as the ability to recover from or adjust easily to misfortune or change" Grote [46] "the ability of the organization to handle unanticipated uncertainties that arise from changes in the environment and/or because the textbook envelop is incomplete, limited or wrong" Stephenson, et al. [47] "the ability of an organisation to survive, and potentially thrive in an environment of change and uncertainty" Haimes [48] "the ability of a system to withstand a major disruption within an acceptable degradation parameters and to recover within an acceptable time and composite costs and risks" Hollnagel [49] "(a resilient system) is able effectively to adjust it functioning prior to, during, or following changes and disturbances, so that it can continue to perform as required after a disruption or a major mishap, and in the presence of continuous stresses"

Malakis and
Kontogiannis [50] "the ability of a system to adapt or absorb disturbances, disruptions and changes, especially those that fall outside the textbook operation envelop"  Table 2.

Definitions of RE
Three of the definitions suggest it is a new paradigm of safety management, which specifically focuses how people cope with complexity under pressure [52] [54] [60]. A paradigm "is an overarching conceptual construct, a particular way in which scientists make sense of the world or segment of the world" [61]. As a construct, it is not something that can be seen, felt, heard, tasted or smelt. The Open Journal of Safety Science and Technology Table 2. Definitions of RE.

Author(s) Definitions
Woods and Hollnagel [52] "a paradigm [emphasis added] of safety management that focuses on how to help people cope with complexity under pressure to achieve success" Chialastri and Pozzi [53] "the broader definition of adaptation, whether the system can handle variations that fall outside the design envelop" Costella, et al. [54] "a paradigm [emphasis added] of safety management that focuses on how to help people cope with complexity under pressure to achieve success" Dekker, et al. [14] "a way of thinking about safety that departs from conventional risk management approaches …" Komatsubara [55] Resilience engineering is the human factors approach for minimizing damages to a system arising from an unexpected situation, and restoring it promptly to its original state through human performance and teamwork Mendonça [56] "monitoring and managing performance at the boundaries of competence under changing demands" Schafer, et al. [57] "the intrinsic ability of a system or an organization to adjust its functioning prior to and/or following changes and disturbances, so that it can sustain operations even after a major mishap or in the presence of continuous stress" Han, et al. [58] "a proactive management approach that allows future risk to be anticipated and the safety level in an organization to be maintained, based on perceptions of current and changing safety levels and recognition of acceptable limits" Pillay, et al. [11] "developing an organisation's behavioural and cognitive capability such that it is able to effectively adjust and continue performing optimally near its safe operating envelop in the presence of everyday threats and environmental stressors at all levels of the organisation" Shirali, et al. [59] "inherent capacity of a plant to cope with complex and unexpected events" Shirali, et al. [60] "a paradigm [emphasis added] for safety management that concentrates on how to help people to create foresight, and to anticipate the different forms of risk in order to cope with complexities under pressure and move towards success" reference to complexity suggests RE is associated with systems, elements, interactions and emergence [62].
A second definition suggests it involves adaptation from disturbances, changes, major mishaps [49]; or those stressors that impact an organisation's day to day operations. In this regard RE involves some level of changes, and these can be at any or all of a number of different levels, including process, practices or structures. Some aspects of the process, including behaviours and cognition; are captured in the seventh definition: "(RE) looks for ways to enhance the ability of organizations to monitor and revise risk modes…create processes that are robust yet flexible, and… use resources proactively in the face of disruptions or ongoing production and economic pressures" [11].
In conventional risk management suggested by Dekker, et al. [14], safety management aims to maintain adverse outcomes as low as reasonably possible, so is reactive. This is because it is based on responding to something that has ei-Open Journal of Safety Science and Technology ther gone wrong (failed), or has been identified as a risk, so is expected to go wrong (or fail) in the future. The alternative approach suggested by RE is to focus on success, i.e. what goes right [52], with the aim of ensuring intended outcomes achieved are as high as possible. This shift in focus towards success also means that efforts in safety and safety management are aimed more at developing a better understanding of why and how things go right in the first place. This was a more proactive approach because organisations could make adjustments well before something happened, be better prepared to respond to hazards, threats and/or challenges by moving from state of normal operations to a state of high alert. In this alternative approach, safety showed only by the events that did not happen [52], hence represented a positive outcome.
The fifth definition suggests it is an approach for minimising damages to systems arising from uncertain events; this is similar to the seventh which suggests it is a proactive approach to risk management, by anticipating of future risks and maintenance of safety. Risk management itself involves a process [63]. In safety management this includes identification of hazards, assessment of risks, and management and controls based on a hierarchy [64]. The identification does include an aspect of anticipation, but is usually associated with those that are known, based on what has been experienced in the past. In RE, however, there is also an emphasis on unexampled and irregular hazards as well [39] [45].
The sixth definition suggest it is an ability of a system or organization, and therefore is the same as OR.
The eighth definition suggests it is a process of development, associated with everyday operations, can be decomposed at cognitive and behavioural dimensions, and present at all levels. This suggests that RE is multi-dimensional and multifactorial, associated with processes and can be examined, explored, investigated, assessed and/or measured in normal, everyday work settings; and decomposed at cognitive and behavioural levels. This is somewhat different to the next definition by Shirali, et al. [59], who suggested the capacity was mainly in dealing with unexpected events. The last definition captures three key capabilities (creating foresight, anticipating risks and coping with complexities), conditions under which these become essential (under pressure) and a pathway (towards successful operations).

Towards a Unified Definition of RE
The above examination suggests that a clear formulation of RE is lacking, and it is still in the "midst of defining itself" [56] (p. 32). Sheridan [20] probably captured the concept best as "a family of ideas." What is clear that it is a complex phenomenon, involves adjustments and/or adaptations, associated with proactive management of safety risks, and is a feature that extends beyond individuals.
In other words, while an individual may exhibit capabilities or traits of resilience, this is not sufficient to drive RE. In this regard RE represents a sophisticated way for managing organisational safety; the sophistication not being in the technology, but in the way one thought about safety, accidents and risks, and Open Journal of Safety Science and Technology how these could be better managed using existing approaches, methods and approaches but in more innovative ways [19]. The main shift being from reactive to proactive approaches, a focus on successes (in addition to failures), and on everyday operations (instead of only during emergencies and/or crises situations).

Theoretical Perspectives on RE
In seeking to address the relationship between knowledge, theory and research, Burrell and Morgan [65] claimed that knowledge was paradigmatic, encompassed a distinct worldview and governed the choice of research strategies and methods. The author suggested social and organisational research could be located along four paradigms; functionalism, interpretivism, radical structuralism and radical humanism. Mendonça [56] suggested that positivist and interpretive perspectives were two of the most commonly used frameworks in RE studies.
Positivism suggests that social phenomena can be scientifically investigated by decomposing it into objective constructs, and any link and association between them can be discovered using methods of the natural sciences [61], so is similar to the functionalist perspective [65]. Interpretivism, on the other hand, suggests there is no objective truth of the social world so they cannot be discovered, but any linkages or connection that may exist can be constructed by examining and/or exploring different aspects of that social world. The next section reviews articles published from these two perspectives.

RE from a Functionalist Perspective
Thirteen papers were published from a perspective, these are summarised in Ta [74].
While these studies continue to add to the body of knowledge of RE, they have their limitations. In part, this is based on the assumptions that are inherent in the functionalist perspective, which assumes that society has a concrete existence, follows certain order, and the existence of an objective and value-free social science which can produce true explanatory and predictive knowledge [61].
According to this perspective, RE is expected to be a concrete, objective "thing"; which can be objectively measured using scientific methods, through "formal propositions, quantifiable measures of variable, hypothesis testing, and drawing inferences from a representative sample" [56]. However, as discussed previously, there is no uniform definition of RE (although it is associated with a range of abstract, social phenomena normally associated with organisations). Open Journal of Safety Science and Technology Proposed a 20-item checklist for assessing institutional resilience (CAIR) for healthcare organisations.
Wood, et al. [72] Used a customized version of CAIR [66] to investigate factors most likely to facilitate safety culture and institutional resilience in airlines.
Wreathall [41] Derived a set of factors that could be used for measuring and/or exploring RE based on previous work on leading indicators of organisational health (LIOH).
Back, et al. [74] Introduced cognitive resilience as a behavioural ability, utilised the notion of reflection-in-action (RIA) and reflection-on-action (ROA) and a repetitions-distinctions-descriptions model [75] to assess cognitive resilience.
Akselsson, et al. [71] Conducted a RE audit to examine "holes in safety culture" in the European Aviation industry.
Costella, et al. [54] Proposed a new method for assessing safety management systems from an RE perspective and conducted a RE audit at a Brazilian manufacturing company.
Huber, et al. [73] Conducted a RE audit in a chemical company using a set of dimensions suggested by Wreathall [41] Jeffcott, et al. [67] Introduced RE as a concept and suggested how these could be used to enhance patient safety during handover.
Øien, et al. [68] Discussed a new method for developing early warning indicators based on RE principles suggested by Wreathall [41].
Pillay, et al. [11] Proposed a six-factor questionnaire based on managerial resilience [76] and LIOH [41] which could be used for assessing RE in gold mining; introduced realty gradient of safety (RGS) as a quantitative measure of RE.

Saurin and Carim
Júnior [77] Presented a framework for evaluating OHS management systems based on method previously develop by Costella, et al. [54] and audited RE in an electrical distribution company Grecco, et al. [69] Proposed a method for assessing safety and resilience based on the key indicators suggested by Wreathall [41] Shirali, et al. [59] Conducted a survey of RE using safety culture and management factors.
Many of the indicators used in some these studies appear to be inconsistent with the basic tenets of RE, including the understanding that resilience can be measured and/or quantified through tabulations of errors, behavioural and/or other factors [52]. Resilience itself has been suggested to be a dynamic and emergent ability, and cannot be measured, at least not until after an impact [45].
There are also limitations with the two main methods used in the studies above, safety audits and surveys.
Safety audits are widely used in safety practice, and have been used in three studies. A common shortfall with audits is that it limits the inquiry to those elements identified in the audit tool [54] [73]. This is one of the reasons why its effectiveness has been criticized by authors such as Hopkins. In his analysis of the Longford Esso gas explosions, he argued that auditing only provided only good news and failed to identify problems that later acted as precursors to the disaster [78]. Learning from failures is an important aspect of RE, in addition to learning from success, so audits may not be adequate in identifying deep, latent sources of failures that is common with most incidents.
Surveys collect data through a series of standardised questions based on a number of psychometric indicators. Many of the aspects included in these studies have also been associated with safety culture, which itself has been suggested to be ill-defined and largely misunderstood [79]. As the author argued, "aggregated numbers, like frequencies or means, do not offer much insight into an or-Open Journal of Safety Science and Technology ganisational safety culture, much less understanding of it" [79]. The measurement of a similar concept would be expected to generate a relatively superficial description of RE. What these approaches are unable to extricate are the dynamic work practices and social interactions that occur every day in teams and groups, between managers and workers, and between those conducting the work and the work itself; because these cannot be described in the words of a survey question [80]. Recognizing and understanding these interactions are clearly important as they contribute to the 'success' aspects of safety, and resilience [81].
The quantitative results of surveys and audits are generally relied upon as measures of safety performance in many organisations. High results would generally be treated as better performers; hence the scientific merits of the data produced from both surveys and audits have an important bearing on organisational decision-making. However a systematic review on content validity of audits suggests there has been little research in this area [82]. Moreover, the inter-auditor reliability was also poorer than expected in integrated ISO 9001/ 14001 assessment instruments [83]. The limited number of empirical published research on the validity and reliability of survey instruments for measuring RE is limited. This is a significant gap in the literature, therefore there is a clear need to develop, test and validate these instruments further.
Both audits and surveys provide a snapshot of selected aspects of RE using a selected set of indicators and factors. This can be useful for diagnosing an organisation's potential for RE. However, in order to be more useful in safety practice, it is necessary to have a clear understanding of the key interactions that occur among or between those factors, the influence of these factors and whether these hinder or enhance RE for safety management.

RE from an Interpretive Perspective
In contrast to the functionalists, the interpretive perspective seeks to understand the world as it exists [65]. This perspective views the social world as an emergent process, so is consistent with the views of RE, which suggests that safety is an emergent property of a socio-technical system [14]. Thirty-three papers published from this perspective are summarised in Table 4 [106], and lab experiment [74]. Woods [16] Discussed five general patterns of organisational behaviour that were apparent in the Columbia space shuttle disaster and, identified four properties which could be used to enhance RE in organisations.
Abech, et al. [93] Investigated resilience in a Fuel distribution plant, focusing on its ability to adapt and manage goal conflicts, through the gap between work as imagined and as practiced.
Carvalho, et al. [94] Investigated the ability of nuclear power plant operators to deal with procedures, rules and norms amidst organisational constraints in order to understand whether i) following procedures always constituted best practice, ii) violations of NPP procedures improved safety, and iii) skills operators needed to optimize performance.
Chevreau [95] Suggested a managerial approach for safety culture which took into account RE, and argued there was no need for RE as this was already included in safety culture.
Cook and Nemeth [96] Explored resilience in the healthcare industry through observations of 'soft emergency' at an anaesthesia department and at a major hospital.
Da Mata, et al. [97] Investigated disturbances which affected offshore helicopter transportation and how the system adapted to unforeseen events, and coped with multiple pressures, goal conflicts and dilemmas.
Dekker [85] Reviewed key themes presented at the 1st Symposium on RE, identified the distance (gap) between work as imagined and work as performed as an important marker for RE.
Dijkstra [86] Presented a case of how RE principles were integrated into Safety management systems in the Airline industry Flin [76] Decomposed RE at behavioural level, introduced managerial resilience, and suggested how these could be investigated empirically.

Nathanael and Marmaras [75]
Proposes a model explaining the interplay between prescription and practice of work, which could be used to explain flexibility in operations.
Woods [17] Presented some basic concepts related to RE and adaptive capacity, and argued safety culture and learning from accidents were essential aspects.
Woods [40] Proposed a number of factors and dimensions for monitoring resilience (balancing acute and chronic goals, sacrificial judgments.
Patterson, et al. [42] Investigated whether collaborative cross-checking enhanced resilience of healthcare settings.
Antonsen, et al. [98] Investigated the conditions which facilitated operators to balance work as designed (in formal procedures) versus actual conduct of work (operations) through a change process.
Back, et al. [88] Decomposed RE at five levels of granularity (individual, small team, operational, plant and industry) and explained how these could be investigated in nuclear power plants.
Carvalho, et al. [89] Presented a framework for analysing micro accidents as an opportunity for examining sacrificial decision-making in nuclear power plants.
Herrera and Hovden [99] Explored leading indicators and their reasons, as a basis for looking forward and monitoring safety performance Le Coze and Pettersen [100] Explored whether RE was a realist or constructivist approach to safety, argued that both were useful for applied research.
Mendonça [56] Explored interpretive and positivist approaches to assessing RE, argued that combining the two was a way of advancing research, and applied this to investigate key abilities in two case studies.
Sheridan [20] Reviewed error/risk analysis and RE, argued that RE complemented traditional risk analysis but needed to include quantification.
Boring [101] Reviewed human reliability assessment and RE and suggested ways in which these can be integrated to enhance organisational performance. Open Journal of Safety Science and Technology

Continued
Madni and Jackson [84] Reviewed resilience from multiple perspectives, provided a conceptual framework for understanding and analysing disruptions, and presented a number of principles that could be used to build resilient systems.
Schafer, et al. [57] Reviewed origins and concepts of RE, made propositions for implementing RE through lean manufacturing principles in the construction industry.
Branlat and Woods [90] Discuss resilient behaviours exhibited by expert practitioners in high-risk situations, and how complex adaptive systems can be developed to improve system resilience.
Han, et al. [58] Investigated how organisations perceived change in safety culture and restored it to an acceptable state using a RE perspective, proposed a model of safety management based on interactions between workers, managers and organisation in construction Furniss, et al. [102] Presented a framework for decomposing RE at multiple levels and used these to examine resilient episodic behaviours in a nuclear power plant.
Kitamura [91] Reviewed why the lessons previously learnt from nuclear disasters such as Three Mile Island and Chernobyl were not sufficient for preventing the Fukushima nuclear disaster in Japan, and how RE could supplement existing strategies to improve nuclear safety.
Macchi, et al. [91] Developed a Dimensions of Integrated Safety Culture (DISC) by integrating key attributes of OR espoused by Hollnagel [49] and used these to assess RE in the healthcare and nuclear domains.
Dinh, et al. [103] Explored principles and factors which could be used to improve resilience of chemical plant.
Shirali, et al. [60] Assessed the challenges of developing RE and adaptive capacity in a Chemical process plant.

Tamvakis and
Xenidis [104] Discussed basic parameters of RE; decomposed road, rail, maritime and air transportation systems and presented a framework through which RE could be explored in this system.
Tveiten, et al. [105] Investigated how resilience could be engineered in emergency management by making it part of continuous risk and hazard management in the Norwegian oil and gas industry.
Wachs, et al. [106] Investigated how non-technical skills could be re-interpreted from a RE perspective in electricity distribution.

Dimensions of RE
An analysis of the literature suggests RE has been published from a number of dimensions. The most common of these include cultural, behavioural and cognition [19].

Cultural Dimensions
The first theoretical connections between RE and culture was proposed by Carthey, et al. [66], who suggested commitment, competence and cognisance were among the main cultural drivers and proactive measures of OR.
Flin [76] associated managerial resilience with safety culture, arguing this could be demonstrated through management commitments where "a belief that when safety and production goals conflict, managers will ensure that safety will predominate" (p. 229). Wreathall [41],

6) Preparedness
The author argued for a "need to tie this approach to the concepts of resilience" [41] (p. 280). Three of the indicators suggested by the author; learning, just and flexible, are also integral to safety culture [80]; while some are also associated with managerial resilience [76].
Woods [17] argued that RE essentially refocussed organisations that already had a culture of safety to become more proactive and adaptive, by challenging how data such as incidents were analysed and interpreted. Researchers such as Akselsson, et al. [71], Han, et al. [58] and Macchi, et al. [91] have also demonstrated how key principles of safety culture can be examined through RE in contexts such as construction and healthcare. Pillay, et al. [11] have also proposed how these factors can be used to inform the reality gradient of safety as a quantitative indicator of RE.
The central tenet of these papers is that safety culture and RE are linked. In essence, they posit that a culture of safety is necessary for developing RE [11] [66] [71], so they provide some support to the process view of RE. If this premise is to be accepted, it lends some support to Höpfl's assertion that safety culture is an interpretive device [107]; in this case one that could be used for interpreting

RE.
Many of the papers discussed above, however, are conceptual and have not been empirically tested, and very few studies have sought to make a connection between the two. It could be therefore suggested that the link between safety culture and RE is still an area of further attention, both in terms of research and practice. More empirical studies are necessary to develop, understand and/or validate any association between safety culture and RE. As discussed above, safety culture is an "interpretive device" [107], so can be used to interpret RE, and therefore acts as a tool for examining, exploring and/or measuring RE. And because safety culture itself includes artefacts, basic assumptions, attitudes, beliefs, espoused values, practices and perceptions [108] [109], these needed to be taken into account when examining the links between safety culture and RE.

Cognitive Dimensions
Author such as Vogus and Sutcliffe [43] appear to be among the first to link resilience and cognition, suggesting that this was one of the resources organisations deployed when responding to current and emerging threats.
Back, et al. [74] also opined that cognitive strategies people used to support resilient performance could be used to explain their behavioural abilities to rec- Patterson, et al. [42] also made a similar observation, in that cognitive resilience enhanced sense-making during collaborative cross-checking, and this was useful in reducing human errors.
Back, et al. [88] posited that cognitive resilience could be decomposed at five levels of granularity, including i) individual, ii) small team, iii) operational, iv) plant and v) industry. Other researchers such as Bracco, et al. [44], suggested a three-level decomposition at skill (S), rules (R) and knowledge (K). The authors argued cognitive resilience assisted in balancing mindfulness and encouraging adaptation that was necessary to maintain equilibrium in a system.
Malakis and Kontogiannis [50] concluded that cognitive resilience in air traffic control operations could be investigated by understanding failure sensitive strategies used by operators during safety critical events.
Most of the studies above imply that cognition is intrinsically linked to way people behaved and/or acted in specific contexts or simulated scenarios. Behavioural dimensions of RE are discussed in the next section.

Behavioral Dimensions
The idea that resilience is a behavioural characteristic arises from authors such as Vogus and Sutcliffe [43] who linked this with positive adjustments. As discussed previously, have been suggested to be decomposed at individual, small team, operational, plant and industry levels [88]. The authors used a case study to illustrate these ideas in the nuclear power plant, and concluded their framework was useful in identifying, in exploring and describing resilient behaviours in a range of small work contexts. In essence, the levels investigated in some of the behavioural dimensions represent the multiple levels of socio-technical arrangement of organisational systems that one needs to consider when addressing organisational risks [111]. Previous studies have also suggested that rehearsal (reflection-on-action) and creation of personalised cues (reflection-in-action) were some examples of cognitive strategies that could be used to support resilient behaviour [74]. These studies suggest that an examination of micro-levels of operations and activities can be used to explore and/or examine behavioural dimensions of RE in normal, everyday work.
Outside of the RE literature, Mallak [36] was among one of the first to develop and test an instrument to assess behavioural resilience in the healthcare industry.

Granularity of RE
This aspect of RE is concerned with the way it either impacts or is expressed at different levels of system. Flin [76] suggested that resilience could be explored at managerial level, while McDonald [38] decomposed these at three layers; operational, organisational and industrial. Woods [40] referred to cross-scale interactions of upwards and downward resilience; suggesting that downward resilience included clear goals, structures and procedures; while upward resilience included decisions made at the micro-level and which were influenced by local adaptations. Woods conceptualisation alludes to ways in which workers at the sharp end of risk maintain a balance between the two conflicting goals of safety and production. Back, et al. [88] examined resilient behaviours at the "small team level" through an experimental case study in the nuclear power plant.

Work-as-Imagined and Work-as-Performed
One important argument that has been proposed in the RE literature is that work-as-imagined (WAI) and work-as-performed (WAP) will always be different [14]. This is because the assumptions about how works are to be accomplished are generally different from the actual conduct of work. One reason for Open Journal of Safety Science and Technology this was due to the fact that there will always be holes in the design of work systems and processes because formal descriptions of work embodied in policies, regulations, procedures, and automation were incomplete as models of expertise and success; and because workers adapted these to suit the context of their actual work, either for achieving safety or efficiency [81], it was inevitable that organisational practices changed as part of daily work. Over time these led to some gaps being created between WAI and WAP, which was an important marker of RE [10] [11]. Analyses of such gaps revealed how workers created and sustained failure-sensitive strategies, balanced their work to achieve incompatible goals (production and safety), and how organisation learning could be used to drive adaptations to create safety [52].
This review revealed that seven empirical studies investigated aspects of gap between WAI and WAP, including by Abech, et al. [93]; Da Mata, et al. [97]; Borys [112] [113]; Costella, et al. [54] and Huber, et al. [73]. Abech, et al. [93] investigated how operators in an oil distribution company adapted when events challenged its model of how it should operate, by focusing on how closely operators depended on written plans and procedures to deal with regular, irregular and unexampled threats. The research revealed gaps in communication between key stakeholders in the system which contributed to inadequate risk control measures (such as risky tank-filling work practices and insufficient engineering controls for overflows). One of the shortfalls in this study was limiting the interviews to the operators, so the data collected was at the level of WAP. Extending the interviews to managers and supervisors would provide richer data on WAI for the system as well, and a comparative analysis between the two would reveal rich data about gaps in the system and/or how these are actually narrowed in practice.
Antonsen, et al. [98] explored conditions that facilitated workers to balance WAI and WAP in the Norwegian offshore supply base. Using self-administered questionnaire and semi-structured interviews, the researchers focused on the implementation and compliance to procedures, and found that simple and accessible procedures had better chances of being used, and ensuring a broad and direct participation of workers in implementing the procedure were important in gaining more commitment and compliance, and also acted as a catalyst for organisational learning. The authors acknowledged, however, that eliminating the gap completely was impossible because there were indefinite number of local, situational variations in the work context they had investigated.
Da Mata, et al. [97] examined constraints in a Brazilian helicopter transportation system, the mental mode of pilots, and factors that played a role in their decision-making when coping with unexampled threats, multiple pressures and goal conflicts. The researchers interviewed co-pilots, operators, captains, a psychologist and a human resource analyst over six months. One shortfall in this study was the use collection and analysis of interview data only, which includes "indirect information filtered through the views of interviewees" [114]. This Open Journal of Safety Science and Technology could be addressed through data triangulation, by extending data collection to documents and/or including observations of selected activities [115].
Borys [112] investigated the impacts of risk awareness programs on workers' awareness of risks, risk control practices, and the impact it had on safety culture.
The researcher used an ethnographic approach, and collected a triangulation of data, including documents, key participant observations and semi-structured interviews. The research revealed that there were gaps between the paperwork and practice which created an illusion of safety. In a later study he investigated how managers and workers interpreted and used safe work method statements (SWMS) to explore if there was a gap between WAI and WAP [113]. The study revealed that SWMS were important for safety but informants felt it should be reserved for tasks that were out of the ordinary, and that a combination of formal and informal social interactions as well as SWMS was important for safety.
The ethnographic approach used in the above studies is useful as a research strategy that has been used for investigating culture. However, a drawback with ethnography is that it can be very time consuming [80]. Another shortfall of this study was that it was limited to one organisation, and concentrated on actors internal to the organisation. No contractors or subcontractors were interviewed.
Many works in construction are done by subcontractors [116] and they are also those who bear the burden of responsibility for safety [117]. Extending data collection to this group will have provided a greater insight into aspects of both WAI and WAP from these stakeholders.
Costella, et al. [54] conducted a Huber, et al. [73] also audited a European chemical manufacturing company to investigate organisational learning. The researchers found daily trade-offs between production and safety made it difficult to achieve safety goals ahead of production, and normalization of small accidents and incidents which were not reported or investigated. In addition, there were in excess of forty (40)  The series of studies on WAI and WAP reviewed above points towards a number of practical strategies that can be useful in researching RE in the general industry. The most important of these is that investigations into RE do not require the use of sophisticated methods, instruments or tools. This is in tandem with Hollnagel [111], who posited that making use of existing methods and techniques, but from another perspective, was a useful way of operationalizing RE. The series of studies reviewed above studies focused on 1) work procedures, plans, safe work method statements, and risk control practices; many of which are part of an organisation's safe systems of work; 2) safety management systems, which are used in many medium-sized and large organisations, irrespective of the industry they are in; and 3) normal, day-to-day operations and activities.

Limitations
A number of limitations can be identified in this review.
The first is the choice of databases that were used. The predominant databases that were searched included those which capture studies from the social sciences.
This will have excluded articles captured in Engineering databases (such as Compedex or Inspec), Web of Science, Scopus or MEDLINE, including those published from a systems engineering perspective. This needs to be considered by future reviewers.
The second is the choice of keywords used in the search criteria. A deliberate choice was made not to use safety management in the keywords as this will have generated thousands of articles. Future reviews should take into account a combination of keywords which tie in the key ideas from OR, RE and safety management.
The third is that most of articles generated included those which had been presented or published in conference proceedings, and later published as book chapters, or as journals between 1998 and 2012. This was due to the fact this research was conducted during a time when RE ideas were early in the inception stages. In this regard the author acknowledges that since this work was completed two recent reviews have been published on the topic [118] [119]. This also needs to be taken into account in future reviews.
The fourth limitation is that the articles selected for final review were not appraised for quality as required by PRISMA. Again, this needs to be considered in future reviews. While no specific safety management tools exist, the guidelines suggested for critical skills appraisals [120] and used in recent reviews on organisational learning for safety [121] can provide a way forward.
The fifth limitation is with the way in which the author chose to unpack the themes according to dimensions (Section 4.4). In the traditional sense, the notion of engineering is explicitly linked to something technical. However, this re-Open Journal of Safety Science and Technology view did not investigate this dimension of RE. This needs to be considered in future reviews.

Summary of Findings
Despite these limitations this review has generated a number of important findings. there is a sparsity of empirical studies from contemporary high risk domains such as construction or mining, although propositions for such research have been made [11] [57] [123]. Second, while some factors associated with safety culture have also been suggested to be important for RE, the mechanisms and linkages between these are not clear. More empirical studies are necessary to develop, understand and/or validate any association between safety culture and RE [41].
Third, while behavior and cognition have been as important dimensions of RE, the mechanisms and linkages between these, or with safety culture, are not clear. More empirical studies are also necessary to develop, understand and/or validate any association between behaviour, cognition and RE.
Fourth, while learning from success has been suggested to be important in RE, very few empirical studies have been published on this aspect. Futures empirical RE studies need to take into account what has actually worked, i.e. successes, in order to get a deeper understanding of how things actually happen. Conceptualising and operationalising of success in RE needs to take into account the four main principles that have been suggested for RE; including anticipation, response, learning and monitoring [49] [111].
Fifth, most research appears to have been limited to examining single units or levels of an organisation. The achievement of safety, at least on the level where work is done at the sharp end of risk is likely to be influenced by other levels, such as managers, supervisors, associations and government [110], so it is imperative that RE research takes into account the multiple levels of a system, the key interactions that occur across these levels, and how safety emerges out of such interactions.
Sixth, most of the empirical works reviewed in this article include qualitative studies, consistent with [56]. Missing from the literature are empirical quantitative studies investigating the utility of RE as a safety management strategy [20].
Again, it is imperative that future studies do take into account how the indicators factors can be translated into useful variables and measures.
Seventh, while the published papers provide a rich source of information on concepts, ideas and notions associated with RE, many of the papers published have failed to build on each other's work so there is very little shared analytical framework [102]. Ensuring such a conceptual and theoretical framework will be useful in setting a boundary around research or investigation into RE [19].
However, before such conceptual and theoretical framework can be developed and used, it is imperative to identify indicator(s) that can be useful in advancing research and application in RE. Although the gap between WAI and WAP has been suggested to be an important, a framework which integrates the key principles, concepts and ideas of RE with WAI/WAP is missing. This represents the eighth gap in this review.

Opportunities for Further Research in RE
The research gaps identified above provide avenues for furthering research on RE for safety management. However, advancing such research framing a working definition in order to set some boundary and focus for RE. Based on the key concepts and ideas illustrated in this review, the following is proposed: "Resilience engineering is a sophisticated approach for managing organisational safety through the development of cognitive, behavioural, and cultural abilities to enable organisational members at all levels to actively anticipate, respond, monitor and learn to operate close to the boundary of safe operations as part of normal work, by narrowing the gap between work as imagined and work as performed" [19].
In proposing the above definition, it is not being suggested that the above is anyway superior to what authors have suggested, consistent with Westrum [39].
Framing RE in this way makes a number of things clear.
One, resilience engineering is about organisational safety, not individual safety. Two, it incorporates cognition, behavioural and cultural aspects of an organisation, so research on RE can be directed at any or all of these aspects.
Three, although an individual can have all these attributes, it is only when they are collectively distributed across all levels of the organisation that these play a role in RE. Four, the above collective aspects enable the organisation collectively to anticipate, respond, monitor and learn. Five, resilience engineering is about operating as close as possible to the boundaries of failure as part of normal work.
This means research on RE should entail normal, everyday work; not simulations. And six, the gap between WAI and WAP is an important facet of RE.
Many industries utilise safe systems of work such as safety procedures, safety rules, permits [124]- [129]. Construction organisations also use safe work method statements and work health and safety management plans [113] [123] [130]. In this regard any of these can be used to investigate the gap between WAI and WAP. Practical research questions in this area can centre on whether, or the extent to which, any of the above enhances or hinders RE as a safety management strategy. Safety culture is a common topic in safety management, and a practical research question can investigate, for example; the influence of safety culture factors (management commitment, awareness, learning, being just, flexibility and preparedness) on the four key principles of RE.
Behavioural approaches are also commonly used for managing safety in the industry, and a practical research question which could be asked here is whether emergent approaches such as psychological contracts of safety [131] [132] enhance or hinder behavioural aspects of RE.
In terms of learning from success, many organisations capture, analyse and manage data on near-misses and dangerous occurrences. Practical research in this area can focus on for example; how, or the extent to which, these are managed, and the role that anticipation, awareness, learning and monitoring play in their effective management.
Advancing research in this area also requires the use of a suitable conceptual framework. The findings of this review suggest it is important that such framework would be aimed at understanding: 1) multiple levels of the system being investigated, 2) the key interactions that occur across these levels, and 3) how safety emerges out of such interactions.
To address gaps in methodology, future research in RE also needs to include quantitative studies. A practical starting point can be through the behavioural, cultural and cognitive dimensions of RE; and which can be investigated at team, organisational of industry levels. Data collected from such research can be analysed at the above levels of granularity, or examine their influence on the key principles of anticipation, awareness, learning and monitoring. Such research also needs to enable an exploration and/or measurement of the gap between WAI and WAP, and ideally integrate the multidimensional nature and construct of RE. Such a framework can be based on either the functionalist or interpretive perspectives of safety management.