Risk in transit: a case study of the introduction of a new risk definition for risk management in the Norwegian petroleum industry

Abstract In 2015, a new risk definition was presented by the Norwegian Petroleum Safety Authority (PSA-N) as a petroleum regulation update and ‘rolled out’ in the PSA-N organisation and the oil and gas industry as a regulatory guideline, changing the definition of risk from ‘the combination of probabilities and consequences’ to ‘the consequences of an activity, with associated uncertainties’. This article reports on research that explores the industrial effects of this change. We have conducted qualitative interviews with both operator employees and consultants, and we have undertaken a qualitative cross-sectional analysis, where we explored how the implementation of the new risk definition is experienced by different actors in the industry. The analysis draws on translation perspectives from institutional theory and focuses on the developments of theory and practice influenced by the interaction between the industry and consultancies, academia and the regulator. We find that the new risk definition has had some practical influence on risk management, particularly exemplified through a generally raised awareness about uncertainty, in addition to some direct effects on risk analysis tools. The study also demonstrates pros et cons with a functional regulatory regime. On one hand it gives the companies significant leeway for them to tailor their treatment and evaluation of uncertainty to the context. On the other hand, with different understandings of uncertainty among the companies, it is more challenging for the regulator to perform audits in a structured manner. Furthermore, the study sheds light on different power aspects that are at play, influencing the interplay between standardised definitions, legislative instruments, practice, experience, and expertise.


Introduction
The traditional way of considering risk solely as a function of probabilities and consequences has for some time been criticized for not considering uncertainty sufficiently, and not addressing all relevant issues relating to uncertainty, including highlighting surprise and the unforeseen.(Aven and Renn 2009;Flage et al. 2014).It has been argued that when different risks are calculated, there could be considerable variations in the strength of the knowledge base, access to data, the credibility of the assumptions and how well the analysts understand the situation in question (e.g. through modelling).Information about such uncertainties could be vital in decision-making processes (e.g.Aven 2015), and should thus be addressed and taken into account in risk management.calls have also been made for more focus on the limitations of the tools used to characterize the uncertainties, and for improving the way the characterizations are conducted (Aven 2012).In line with this, it has been called for a 'new way of thinking about risk' (Aven and Krohn (2014:8), emphasizing uncertainty and the strength of knowledge.
Although the arguments have gained much interest and support, and also have been reflected in ISO standards (International Organization for Standardization 2018) and glossaries (Society for Risk Analysis 2015), little is known about how industry is relating to uncertainty in practice, and how regulators could stimulate to actual industry inclusion of uncertainty in risk management.In this qualitative case study, we will address this knowledge gap.
The study addresses a specific setting, namely the Norwegian oil and gas industry.Thus, reservations should be taken with respect to generalization beyond the oil and gas industry in this context.Still, the study should be valuable input to those interested in themes of circulation and translation of scientific definitions in any field, although the particular travel in another field must be analysed and understood within the particular context.
We approach the study from a perspective of organisational sociology and institutional theory.This means that we do not front any investments in the risk definition.In our study and our analysis we approach the case with scientific rigour and let the perspectives and experiences from the applied risk practitioners -our informants -form the basis of all our analyses.Having said that, the researchers have substantial experience from safety research, which is valuable for pursuing informants' reflections further and still being able to capture the meaning, which is one of the trademarks of a trustworthy social study of science and technology.

The case
In 2015, a new risk definition was presented by the Norwegian Petroleum Safety Authority (PSA-N) as a petroleum regulation update, and 'rolled out' in the PSA-N organisation and the oil and gas industry as a regulation guideline.Where risk was previously seen as 'the combination of probabilities and consequences' , it was now defined as 'the consequences of an activity, with associated uncertainties' (Petroleum Safety Authority Norway 2015).Importantly, this new definition implied putting into regulation what had been the view of the regulators for considerable time already; both the PSA-N and the risk science community had discussed the issue of properly addressing risk for many years, as seen from their perspective, the industry's addressing of risk was not satisfactory and therefore improvements were needed.
As any effects of updated guidelines on regulations naturally take time to develop and to be traceable in organisational practices, there is so far little documentation on the effects of the new definition of risk.However, in a recent study, Røyksund and engen (2020) researched the implications of the new risk definition in the PSA-N, and the investigations and the practices of the investigators.This study suggests that so far, the impact of the new risk definition is modest.There has, however, been an increased focus on the uncertainty aspects of risk in the PSA-N inspections, although the use of the uncertainty-based risk concept varies substantially, from few traces to conclusions of 'non-conformity' due to a 'lack of systematic assessments and treatments of uncertainty' (Røyksund and engen 2020, 7)  1 .
While there is some knowledge about the reception among regulators, less is known about the reception and impact of the new uncertainty-based risk concept in the oil and gas industry.Joint industry projects such as 'enhanced Risk Assessment and Management' (NOROG 2015) and 'Black Swans -an enhanced perspective on risk' (NOROG 2017) can be traced back to the PSA-N's initiative and are mentioned by Røyksund and engen (2020), but the impact tracing stops there.
This paper reports from a study where the impacts have been sought traced further out in the organisational practices of the oil and gas industry.The objective is to shed light on how the new risk definition has affected the risk management practices in the Norwegian petroleum industry.In the extension of this, we will discuss how regulators can stimulate to good risk management practices in the industry.
The 2015 change in definition in the PSA-N did not represent a break with risk research traditions.Aven and Krohn (2014, 8) presentation of 'a new way of thinking about risk' connected to both understanding, assessing, and managing unforeseen potential surprises.compatible with the (later) new risk definition (PSA-N, 2015), they argue for the importance of moving from probabilities towards a broader risk perspective that emphasizes the principles of uncertainty and the strength of knowledge and associated developments in theory, principles and methods for risk assessment and management (Aven and Krohn 2014: 2), see also Aven (2013Aven ( , 2012)).However, although a well-known concept in risk research, the uncertainty-based risk approach has not existed for long as an operationalised approach in risk management in the industry and among regulators.
even if uncertainty was established as an integrated part of the scientific risk concept, the practical risk analyses in the oil and gas industry have been characterized by traditional approaches, where the risk matrix has been an important and appealing tool across disciplines and organizational contexts (Jordan, Mitterhofer, and Jørgensen 2018).By introducing the new definition in 2015, the ambition of the PSA-N was to stimulate more elaborate discussions of risk and the understanding of the limitations of traditional risk analyses in operative environments.
The PSA-N has especially linked uncertainty to the strength of knowledge and generally requires that uncertainty must be assessed in decisions regarding solutions and measures (Petroleum Safety Authority Norway 2018).Beyond that, the interpretation of uncertainty and how to practically address uncertainty in risk management has been left to the petroleum companies to operationalise (Petroleum Safety Authority, 2016).This falls into the functional regulatory regime that characterizes the Norwegian petroleum industry (Nilsen and Størkersen 2018).

Travel, flow, and translations of the risk definition
The fact that the operationalization of an uncertainty-based risk perspective is delegated to the companies makes the definition open to different interpretations.In light of institutional theory, the concepts of travel, flow, and translation of ideas can be useful for analysing how the new risk definition has manifested itself in different parts of the petroleum industry.The words 'Travel' , 'flow' , and 'translations' in this context are applied as metaphors for describing what takes place when ideas (e.g. the new risk definition introduced to improve and elaborate risk management processes) meet organizations (e.g.petroleum companies) (czarniawska and Joerges 1996).
Implicit in the travel metaphor is the notion that ideas follow certain well-established routes (Sahlin and Wedlin 2008).In relation to the new risk definition, one route might include academic institutions, regulators, and consultancies before involving the petroleum companies.In other words, ideas might flow in established networks of actors that enable and provide 'energy' towards their adoption.Armbrüster and Kipping (2002) distinguish between different archetypes of knowledge associated with academics, consultants, and practitioners, and how these types of knowledge flow and circulate in the network.Academics' risk management knowledge is of a generic kind, as it should apply for a variety of students and businesses.consultants' knowledge, on the other hand, is change-oriented as they prepare customers for some sort of change.Further, practitioners' knowledge is situated and based on long-time learning in specific domains.The flow and circulation of knowledge can be illustrated as in Figure 1.
For consultants, generic risk management knowledge is important for legitimizing their work to customers, but also for conveying changes in the environment, including regulatory changes.consultants also interact with a range of different customers and can obtain a repertoire of different experiences that can be used in new contexts.Academics develop their generic risk management knowledge on studies of practice, and transmit their knowledge through publications and teaching, both to consultants and to practitioners, who translate this to change-oriented and change-situated risk management knowledge.
The translation metaphor opens up the notion that ideas can be transformed and adapted to specific purposes and contexts.Ideas are not only copied, but also modified, sometimes in radical ways (Røvik 2016).In our context, petroleum companies (and other actors, such as consultancies) might thus be seen as active translators, rather than passive receivers of the new risk definition.This is particularly of relevance when the new risk definition is flexible for interpretation and operationalization.Røvik (2016:299) has coined the term translation competence, referring to 'the ability of translators to translate practices and ideas between organizational contexts in ways that increase the probability of achieving organizational ends' .In other words, we might speak of 'good' and 'bad' translations and translators, depending on how well different translations fit various conditions.Armbrüster and Kipping (2002) did not include regulators in their model, although it is clear that the PSA-N have a central role in our case.This will be further explored in our analysis.
The translation perspective is highly suitable for the particular context of the case, where there are strong links between the industry, academia and the regulator; many if not most of the risk scientists have worked in the industry, and also, a majority of the risk analysts working in the industry have a history studying safety and risk in academia -not seldom under those risk scientists.Further, the regulator is largely populated with employees that have either a past or a future in academia or the industry.Hence, ideas have good conditions for circulation across entities.

Methods and data
The paper derives from a case-based study.Borrowing the words of Yin (2014), we define a case study to be 'an empirical inquiry that investigates a contemporary phenomenon (the "case") in depth and within its real-world context.Representing a case of functional regulation, it illuminates challenges and opportunities associated not only associated with risk regulation; findings may have generic value also for other subjects of regulation, such as HSe culture regulation (Kongsvik, Gjøsund, and Vikland 2016).To explore how the new risk definition has impacted the risk analysis and decision-making practices in the Norwegian oil and gas industry, we have conducted qualitative interviews which include both operators and consultants in the field of risk.One limitation in this study is that it reports only from industry experience, which of course does not cover the whole picture.However, in the research project we also approach representatives from regulator and academia, and thus the subject matter will be illuminated from these perspectives in forthcoming publications.
Our approach is based on a traditional qualitative cross-sectional analysis, where we are interested in how the implementation of a new risk definition is experienced by different actors in the industry.Through interviews, we seek insights in three main themes that together contribute to meeting the article's objective: (1) how the informants were introduced to the new risk definition, (2) how the definition was translated and made operational, and (3) what changes this may have led to in the risk analysis and decision-making practices among oil and gas companies.Below, we will present our methodological approach; the selection of informants; how the interviews were conducted, transcribed, and analysed; and the possible strengths and weaknesses of our study.

The selection of informants: oil and gas companies and consultants
To capture the variability of practices, we interviewed employees in oil and gas companies with different characteristics: one large company, one small company, and one new company.Our study of functional regulation is as such an example of an embedded, single-case design, using a variation of subunits in the analysis (Yin 2014).All of the informants have been involved in practical risk considerations and decisions related to projects and ongoing operations, but possibly with different experiences based on organizational affiliation.Because the selection of informants followed certain criteria regarding characteristics of the companies, it can be defined as an information-oriented (Flyvbjerg 2006) and purposive sampling (Silverman (2015).We interviewed 10 employees from the large company, 5 employees from the small company and 3 employees from the new company.In addition, we interviewed 10 consultants from three different consultancy firms.In total, 28 employees were interviewed in the study (see Table 1).The informants presented in our results represent different roles in the oil and gas industry, including consultants, risk managers, engineers within technical safety, specialists in human factors, and asset managers.All of the informants had practical experience and responsibilities in risk analyses, but their academic background in risk varied considerably.Participants were recruited through contacting so-called 'door openers' in the companies, and these contact persons then passed on our request for participation in the RISKY project to relevant colleagues.
Based on the nature of their work, where, for example, operators and consultants are in different positions in the risk field, the interview guide was adapted in accordance with the category the interviewee represented.

Considering quality: strengths and weaknesses
In qualitative research, the researchers' own position and experience are likely to affect the interpretations and understanding of the phenomenon of interest.Acknowledging our own roles in the research process is therefore important for the reflexivity of our analysis, and for ensuring transparency and reliability in our work (Roulston 2010).We worked together, in an interdisciplinary research group, during all phases of the project: designing the interview guide, selecting the interviewees, and analysing the resulting data.Hence, we found different experiences, both theoretical and practical, from the oil and gas industry, all relevant for discussing the impact of the new risk definition.This kind of cooperation, based on a shared research community of practice, can arguably improve the validity and relevance of the study (Strauss 1987;Widerberg 2001).Also, for the concrete interview situations there are some aspects that should be discussed regarding the quality of the study.All the interviews were conducted by two interviewers: one with main responsibility of asking questions and discussing with the informant, and the other taking notes while making sure the core questions from the interview guide are included.An advantage of this method is that the two interviewers can discuss thoughts and empirical aspects afterwards, also in the analysis and writing phase, filtering the output from the interview in addition to the recorded material.even though we thought such digital conversations risk losing important body language and physical 'face-to-face' interactions, the digital interviews might lower the threshold for participating in the study and, therefore, make it easier to recruit relevant interviewees.
The empirical material was treated so as to maintain the anonymity of the informants and companies throughout the study from planning to publication.All in all, the study relates to established privacy rules and has been approved by the Norwegian center for Research Data (NSD).

Results
In this section we will present the results from the analysis of the interview study.We start by describing how the new risk concept has travelled from the scientific community to the sharp end of the O&G industry, before we report the informants' understanding of the new risk concept and of the uncertainty dimension.Thereafter, we review how the new risk concept has influenced practices in O&G companies.

The industry is mainly a receiver of the risk concept
Based on the interviews, we can describe the process of changing the approach to risk management as a three-phase process.
The first phase involves translating new scientific knowledge into an adjusted risk definition that is relevant and useful both for the regulator and for the regulated.The second phase involves translating the definition into a communicable message for an industrial risk management context, so that the risk definition can be 'rolled out' throughout the petroleum industry.In the third phase, the risk definition was subjected to translation -or operationalisation -by the O&G industry in order to adapt and implement the risk definition in the organisational processes and tools.Below, we will refer to these phases as the first, second, and third translation (Figure 2).The first translation involves a collaboration process between the regulator and academia, and industry representatives.The central output from this phase was the new risk definition in the Framework Regulation Guideline (Petroleum Safety Authority Norway 2015).The details of processes and events in this phase lie outside the scope of this paper but will be treated in forthcoming papers from the same research project.
Among the outputs from the second translation was the PSA-N report 'Risikobegrepet i petroleumsvirksomheten (The concept of risk in the petroleum industry)' (Petroleum Safety Authority Norway 2016).The PSA-N's stance or perspective was thus 'handed over' to the industry.We use the term 'handover' consciously, as the process was characterised by our informants handing over a concept rather than co-developing it: I got to know the new [risk definition] via PSA-N.I think they published some notes about the risk definition, and there was some information on their website.I am not sure, but I believe that they also arranged some information meetings.(engineer, technical safety) This description is a variant of many similar statements we got from our informants.Another informant recalled: 'I got to know [the risk definition] when I read their note.'(risk manager) consultants also had the impression that the written material from the PSA-N was important in the 'handover' to the industry, in addition to the information provided in seminars and conferences.The information was considered to be on a general level, and to be open for interpretation.This was considered to be in line with the general goal based or functional regulatory framework from the PSA-N: Well, no, they published some such articles on their website, and they made some notes, which should try to illustrate what was meant by it.And they talked about it at seminars.[…] It was a bit much text and a bit fluffy, and not so concrete what it meant in practice.But at the same time, the PSA-N's role as an authority… they are not supposed to tell the industry what the industry should do, so I think it is a conscious choice, it is up to the actors themselves, and the industry itself, to interpret and lay down frameworks and management in accordance with the regulations, but the regulations should not dictate to the operators in detail what to do.(consultant) The note the informants are referring to, is 'Risikobegrepet i petroleumsvirksomheten (The concept of risk in the petroleum industry)' (Petroleum Safety Authority Norway 2016), an 18 page note explaining the 2015 update of the Framework Regulation Guideline § 11, with a 'clarification' of the definition of risk.The note was written and distributed to explain the reason for the guideline update of the Framework Regulation Guideline § 11 (Petroleum Safety Authority Norway 2015), how the risk concept should be understood and used, and what difference it makes for practical risk management (Petroleum Safety Authority Norway 2016).
These two sources, the update of the Framework Regulation Guideline and 'The concept of risk in the petroleum industry' , in addition to some accompanying website information, newsletters and information meetings, were the main references to the 'ready-made' risk concept that was communicated by the PSA-N to the industry.Interestingly, the note did not contain any references to academic sources, so in addition to being ready-made, it was also somewhat black-boxed.
In the receiver's end, follow-up translation efforts were also made by the employers' association for oil and supplier companies (NOROG).In addition to conferences between industry and academia, talks, videos and more, two reports were produced by NOROG: 'enhanced risk assessment and management' (NOROG 2015) and 'Black Swans: An enhanced perspective on understanding, assessing and managing risk' (NOROG 2017).In both these reports, the central contributions from the same academic risk environment that contributed to the PSA-N report was acknowledged.
Thus, while the oil and gas companies were formally included in the NOROG projects producing explanatory material, the new risk definition was in practice handed over to the industry from the regulator -who, in turn, had all the theoretical considerations produced by their close academic partner.
The work with the new risk definition also produced other types of changes than merely the definition itself.One on the resulting outputs was a revision of the Job Safety Analysis specifically addressing uncertainty and knowledge strength in the sharp end (Norsk Olje og Gass 2017).
With respect to the third translation, some of the interviewees working in 'sharp end' operations -three out of seven -had not heard about the new risk definition.They considered to be attending to risk in the same way as they always had done: When we work with risk, we attend to it as we have done before, involving probabilities and consequences […].So I do not know how we should include uncertainty in relation to this.That would be one more thing to guess so to speak.(Risk manager) even if several informants (but still a minority) had not heard about the new definition, they still claimed to consider uncertainty in their decision-making, although not always in a systematic manner or by means of specific tools.considerations about what was unknown or where they lacked knowledge was on the agenda, as it always had been, according to the informants.It was also claimed that the new definition was difficult to apply for those at the sharpest end: 'You cannot say to your team -have we remembered and assessed the consequences of what we are going to do now and the associated uncertainty?It is a slightly heavy formulation that does not work in practice.'(Risk manager) Other informants also hint that the new definition is not intuitive and might be difficult apply in sharp end-work decisions.
The fact that the industry was largely a receiver of the new risk concept can explain the challenge associated with translating the concept into something compelling; among many of the informants there is, at the same time, a low degree of ownership and a feeling that this does not represent something new in practice.

Uncertainty as lack of knowledge
Among the informants, the dominant understanding of uncertainty is as 'lack of knowledge' .According to some, the new definition has led to more awareness of situations where more knowledge is needed to reduce the uncertainty: We try to address uncertainty to a greater extent by considering the strength of knowledge.What knowledge do we have as an organization?Is the knowledge sufficient among managers and professionals to go through with this?Do we need some more expertise and knowledge from elsewhere to reduce the uncertainty that lies in the somewhat limited knowledge we have as an organization or as individuals?(Risk manager) The increased awareness of lack of knowledge as a source for uncertainty has led to the involvement of expert personnel in the decision-making process: When we agree that we should have a closer look at a particular risk, then there will be a separate issue in the meeting where those who know the risk best are present.Is it addressed correctly?Is it the right consequence and probability?Do we have the right focus?Do we have control?(Risk manager) Another informant considered it to be important to have 'the right competence in the room' , that could inform the rest of the group about the strength of knowledge and possible uncertainty.

The new concept is by and large conceived as putting into words what We are already doing
Interestingly, although most of the informants are not overly enthusiastic about the new risk definition, they nevertheless hold that they have always addressed uncertainty in their risk analysis work.However, according to our informants, one may differentiate between operational risk and business risk.The lack of enthusiasm is much related to how the new definition works for operational risk; many informants see the definition as complicating an existing risk definition that already sufficiently includes aspects of uncertainty, and consider that they have always acknowledged and taken into account uncertainty associated with both the probability and the consequences of events 2 : When you look at the consequences of the activity with associated uncertainty, well, that is exactly what we are working with, the consequences of the activities.Potentials for leakage, potentials for someone getting stuck in our equipment, potentials for destroying our tools, that we must spend time and resources to replace it.So, [uncertainty] is not a foreign term, but if you choose to use those definitions or not, is to me… well, not very important.Because we are working with this anyway (…) To me it's just another way of describing the same.Yes, it is a product of probability and consequence, but it is also… of course risk is the consequence of our activity, that is completely obvious.(Risk manager) This position is shared with another informant, but only in the context of operations: 'Probability/consequence is very well suited for a QRA or something else where you have a lot of facts, and where you can account for a mathematical foundation for why it is like it is' .(Risk manager) The same informant, however, suggests that, when you address risk from a business perspective and have less experience data, the new definition resonates better: 'But when you take the business perspective, where you really, you have to look into the future, and the past provides very limited support, or information, then you have to find another way of defining risk' (Risk manager).Although from a scientific stance the definition of risk cannot change as you move from one context to another, but the informant might have a point in that different formulations of a scientific message may communicate differently in different contexts amongst which the magnitude of both knowledge strength and uncertainty may vary significantly.
Another informant is of the opinion that the new risk definition was developed to be more aligned with the ISO definition, and also, 'to be more aligned with how the industry interprets the risk term' (engineer, technical safety).
One of the informants, working with corporate safety and human factors, reflects on the intentions the PSA-N might have had for changing the risk definition: What were their intentions behind this, and what was the context this came out of?It′s quite understandable for me to see the context from which the definition came out of, but I have one foot in the academic world, and one foot in a world consisting of scaffolders with face tattoos, right, and I definitely see which of the two worlds this was aimed at.(Specialist in human factors and organisational safety, corporate safety) The informant further argues on how the conceptual basis for the new risk definition is closely linked to research on risk analysis and quantitative methods for risk assessment.At the same time, he states how the PSA-N's dissemination of the concept involves 'an expectation that the new risk definition will be applied broadly, and that it will be used in all possible operational risk assessments' .The informant further describes how the situation is experienced in reality: Only a couple of months ago, when I renewed my offshore safety course, we were sitting there, me and the scaffolders I told about, and other people who are at the sharpest end of our business.listening to some semi-interested instructor talking about the concept of uncertainty in the risk definition.You can imagine the distance then, from the context in which the definition arose, to these people here, and the expectation that they will use this in their everyday work.It is quite long.(Specialist in human factors and organisational safety, corporate safety) This situation draws up an interesting gap between intensions, theoretical concepts, and those who operate them in their everyday working life.
Several of the consultants interviewed had an academic background from studies at Master or PhD level from the university environment working with uncertainty in the risk concept.For these informants, the new definition was in line with how they already conceived risk: For us it wasn't a very big change, because most of the people in [the consultancy] who work with risk management come from [university].So this way to interpret risk is also the way we have practiced and guided our customers, so it has not changed after the change that PSA-N made.It became more in line with how we practiced it in oil and gas.(consultant) even if the consultants in general were familiar with the theoretical underpinnings for including uncertainty in the risk concept, there were also challenges in conveying this to customers.uncertainty involves more than strength of knowledge according to several of the consultants; but to get understood by the customers, it was considered necessary to 'translate' uncertainty as 'lack of knowledge' in order to be understood: When academics say that 'there can be uncertainty beyond the strength of knowledge' , of course there can be.But then I prefer to speak in a way that people understand, rather than being completely precise.So in recent years I have been talking more and more about the strength of knowledge.every time something is said about uncertainty then, I actually start talking about the strength of knowledge.(consultant)

Raised consciousness
Although the inclusion of uncertainty in the new risk definition is not perceived as a new idea, statements regarding a raised consciousness towards uncertainty following the change in definition run like a red thread through the interviews: 'I may have gotten a stronger consciousness toward uncertainty; you cannot simply lean on a risk analysis with a low frequency (…) Things may happen anyway' .(engineer, technical safety) Another informant formulates a similar statement and further elaborates: even though PSA-N has left the risk definition of risk as probability and consequence, we're still using the risk matrix with a probability axis and a consequence axis (…) What has changed, perhaps, with the new definition, is that we are more conscious about what we should have been conscious about all the time, that risk is not an exact science (…) Before it was a bit like, as us engineers like it, the more numbers you get after the comma the more correct the answer is (…) I think the greatest effect of PSA-N's change of the [risk] definition is that we have become more conscious that it builds on a number of preconditions with associated uncertainties, both in tools, methods and knowledge levels, yes, historical data, everything you build on is associated with uncertainty… There is a higher consciousness regarding that, but apart from that -how we work -is it business as usual.(engineer, technical safety) This consciousness, particularly towards how the risk analyses are used in decisions, is more evident than are any changes in methods or tools used for risk analysis: Before, we considered the statistics and when we got a very small number [on probability], we were happy, because the probability was so small.I think we are much better in considering the uncertainty today, and we see that it is not right to assign a probability that is so low that it disappears from the screen.(Asset manager) Still, uncertainty exists for all parameters, with one informant expressing that it is not straightforward to take the acknowledged uncertainty into account: I think there are still many analysis-and simulation tools that are very frequency based, where you are to enter a frequency for leakages for example, and simulate how that (…) leakage evolve, but there is of course uncertainty (…) of what may happen as well.All the parameters have uncertainty associated to them, so how are you going to account for that?(engineer, technical safety) All in all, there are many statements indicating that the new risk definition does not necessarily imply or require new ways of doing risk analysis, such as this: There is no change in how risk analyses are being done after the new definition came.(engineer, technical safety) The methods we use may not have changed sufficiently in light of the new definition.We somehow do not really take the new definition to a sufficient extent.We do things the same way.(consultant) The new risk concept is also considered to have a very limited influence on how risk is considered for 'sharp-end' considerations, for example in offshore contexts: It has not reached offshore.There are simpler discussions, it is more practical, it is more 'hands on' .They're doing a tool box talk and doesn't start talking about uncertainty.It may well be a checkpoint if there is something you are wondering about, so it can be integrated, but in a much simpler way.(consultant) What the risk definition has affected, however, is the wider risk management practices: What has changed, is the way we manage [the risk analyses].There is an acknowledgement that two lines under the result still means that [the result] is an estimate.We do sensitivity analyses, and they receive more attention.It is easier to argue for how to work with uncertainty (…) To do sensitivity analyses is to look for uncertainties (…) To bring in assumptions, sensitivities, to include changes underway, builds robustness.In that way we have become better.(engineer, technical safety) Therefore, there clearly is a raised consciousness towards uncertainty, but the strengthened focus does not necessarily lead to significant practical changes.We end this empirical section by showing that the tools that are used for risk analyses are sometimes, but not always, adapted to have a real effect on the risk analyses.

Risk assessment tools
In one risk analysis tool described by the informants, measures have been taken to include uncertainty as a third dimension in addition to probability and consequence.In the risk matrix, hazards may be marked by a solid line, dotted line, or no line at all to signal levels of uncertainty.Some claim that this has led to more discussions and also actions to reduce the level of uncertainty, for example by bringing in experts with special knowledge on the topic at hand: One step on the way has been to include knowledge strength as a third dimension [in the risk matrix], using for example a different colour for those who have low knowledge strength.Or a ring, or in bold, but a third dimension into the matrix.And then I know that some people talk about strength of knowledge as one thing, and the importance of results or actually sensitivity as another.(consultant)

Others still find it difficult to know what uncertainty really means and find it difficult to pinpoint what changes the new definition has brough about:
I don't feel much has changed, apart from, we're trying to include that term, I see for example in tools used for project management and where you have a matrix where you are to describe a risk with causes and consequences (…) then there is, in a way, a drop-down menu with uncertainty, high -medium -low, but what does that mean?One had sought to implement uncertainty without, maybe (pause) it's perhaps not much help for the user of such a tool.(engineer, technical safety) Sometimes the tools may actually also effectively counter ambitions to integrate considerations on uncertainty tighter into the analyses.This was the case in one informant's company, where they had renewed the software license and actually lost some functionality related to uncertainty management: In the previous version of the software we're using, we had a company adapted version of [software name], and we could quite easily see, by the size of these dots in the risk matrix… the dots had different sizes based on whether we judged the uncertainty as low, medium, or high.Some years have passed since we used that version.We got a new software when we started this project, I think it was three or four years ago, and there we have not (had access to) that functionality (…) Now there is a little text field where you can choose the same, but you don't get a graphic representation (…) I don't use that field.(Risk manager)

Discussion
The results of the study point towards a main theme that we will address in this discussion, organised as three sub-themes.The main theme is the relation between actors and epistemic cultures, and the sub-themes address the networks and circulation of people in the petroleum sector, the co-development of practice and science with respect to risk, and the relation between generic and applied risk analysis.

Lost and found in translation
There is a close collaboration between the PSA-N and the petroleum companies in different arenas; there are also strong, well-established networks between the regulator and industry representatives and consultants.There has also been a mobility of personnel in the networks, as some of the consultants and practitioners have done their formal education at the institution that has a strong engagement in the new risk concept.A necessary condition for the 'travel' and 'flow' of the new definition has thus been present (Sahlin and Wedlin 2008), at least for parts of the industry.
Still, there are some of the informants who report that they are not familiar with the new definition and that they perform the risk analysis as they have always done; they also consider the inclusion of uncertainty in the definition as difficult, unnecessary, and potentially counterproductive.Informants in this category work mainly for companies that are relatively small and new on the NcS.Therefore, they may not be involved in the same networks or partake in the circulation of risk management knowledge (Armbrüster and Kipping 2002) to the same extent as other company representatives.They still claim to address uncertainty in their informal discussions, but they insist that this is nothing new and that it is not a consequence of the new definition.
This might also be considered expressions of resistance to change, which is extensively researched in organizational studies, sometimes linked to affective responses (Oreg et al. 2018) such as fear of marginalization of one's competence, loss of positions, etc. (Scott and Jaffe 1995).Such affective responses could also be based on the history of previous changes.If previous changes are considered unnecessary, and the organization is considered not to have the necessary capacity to implement the change, the readiness for new changes is low (Miake-lye et al. 2020).A state of change cynicism might develop (Amundsen and Kongsvik 2016), especially if there are limited possibilities to influence or adapt the proposed change to existing work processes.To the degree that it might me challenging both for academia and the regulator to reach out to operative personnel, explanations might have to look into this phenomenon as well.
It is also possible that those who have not heard about the new definition are still influenced by it, although they are not aware that this is the case.Sahlin and Wedlin (2008) distinguish between three different modes describing how ideas flow in networks.The 'broadcasting mode' signals one strong sender of an idea that is adopted by several actors more or less simultaneously.This might be the regulators' ideal, i.e. their prescriptions being adopted instantly and in the same way by those regulated.The 'chain mode' is a picture of a stepwise flow of ideas involving several actors in a sequence.Those adopting and translating an idea might not be aware of its origin or that it is a part of a trend: ' …we can sometimes discern only after the fact that the imitation is a part of a larger trend or development ' (bid: 228).Mediation by other organizations and actors' might be considered a special case of the chain mode, where the mediating actors are not directly affected by the ideas but only report them to others.The inclusion of uncertainty in risk analyses is clearly a part of a larger trend, and is evident in different standards and regulatory documents (e.g.International Organization for Standardization 2018).The chain and the mediation modes can thus explain why uncertainty is addressed, even if the new definition is not heard of.
There are also other informants stating that the new definition and uncertainty as a concept are less intuitive and more difficult to comprehend than the traditional probability-consequence approach.They have still applied the definition in their risk considerations and decision-making.uncertainty has been understood as 'lack of knowledge' , which is translated and applied in the context of the much-used risk matrix (Jordan, Mitterhofer, and Jørgensen 2018).Hazards are marked according to the strength of the knowledge associated with them by using different symbols, introducing a third dimension to the matrix.As a consequence of introducing uncertainty in tools, several of our informants perceive that there are more elaborate discussions and involvement of expertise in the decision-making processes so as to reduce the uncertainty.The inclusion of qualitative considerations in an otherwise strong quantitative approach to risk seems to be an implication of the new definition, which has expanded risk management practices.

Two parallel movements -practice informed by science and science informed by practice
The PSA-N's introduction of a new risk definition represents a statement in the continuous dialogue between practice and science, which has been a characteristic of the petroleum HSe field since the early days of the Norwegian petroleum industry (lindøe, Baram, and Renn 2013).The Norwegian tradition of risk and safety science research is strong 3 , and the petroleum industry has been an important empirical field for informing and developing risk and safety science research; this is the case to such a degree that one may say that the petroleum industry has been an important contributor to the development of safety as a scientific field (see e.g.NOu 2000).At the same time, the safety record of the Norwegian oil and gas sector (see e.g.Petroleum Safety Authority Norway 2022, and similar reports for earlier years) as well as the ambition of the PSA-N to be world-leading in HSe reflect a highly reliable industrial field -engaging in high-risk activities but experiencing few serious accidents -a record and ambition that can be traced back not only to the industrial practices alone, but also to the collaboration with academia (The Ministry of labour and Administration 2001; Kongsvik, Gjøsund, and Vikland 2016;Okstad, Jersin, and Tinmannsvik 2012;Antonsen, Nilsen, and Almklov 2017).
Risk science in this context (e.g.Aven 2018; Aven and Thekdi 2021) refers to both generic and applied science, where the generic risk science deals with theoretical concepts, principles, theories and more, generally valid regardless of field, and applied risk science relates to the generation of knowledge resulting from specific risk analyses in particular organisations, industries or fields.Practise, on the other hand, we reserve for the practical application of risk analysis in the processes within the organisations, industries or fields.While the translation between generic risk science and applied risk science requires scientific rigour combined with contextual insight, the relation between applied risk science and risk practise is significantly impacted by practical experiences, situational adaptations and efficiency-thoroughness trade-offs.Hence, although the practices of applied risk analysis are always expected to be scientifically sound, we know from organisational research on safety and resilience that they are inherently flavoured by the practical circumstances under which they take place.In the context of this study, such circumstances may include risk experiences from e.g. the same oil well, the same oil field, similar projects etc.By virtue of such conditions, the correspondence between risk science and risk analysis follows trails of both explicit and tacit knowledge and organisational practices where what to consider and how to manage the trade-off between efficiency and thoroughness can sometimes make those trails hard to follow for outsiders (Hollnagel 2009;latour 1987).That does not mean that the trails do not exist.
A majority of our informants describe themselves as well familiar with the uncertainty aspect of risk, even if some are at odds with the theoretically underpinnings of uncertainty.The reception of the new risk definition by some as 'exactly what we are [already] working with' reflects a community of practise that has historically engaged in the same discourses and shared many of the same perspectives as the community of science (lindøe, Baram, and Renn 2013), but the two communities differ with respect to language cultures and pragmatism; while there is a lot of practical experience residing in the insights and principles of applied risk science, and indeed practical risk analysis is largely informed by applied risk science, there is still a gap between risk science and risk practise that the new risk definition might to some degree have bridged, but not closed.
Importantly, the regulator -the PSA-N -has been 'a driving force for knowledge development' (Røyksund and engen 2020,: 1) and has played an important role in the development of risk practices and risk research through its role in the translation process from science to practice using the instruments of paragraphs and audits.In this triangle of actors and reciprocity, practice and science have informed each other also thanks to the circulation of people between the realms of research.There are not many working with risk analysis in the petroleum industry that are not acquainted with the leading academic risk environments, and the same is the case for the PSA-N; many of them were students under the same professors, enjoyed the same lessons, internalised the same ideas in university.
This does not imply, however, that the perceptions of risk are identical across these domains.Although they are all risk practices, practising risk processes and technology is different from practising risk theory, and practising risk paragraphs is also something different.One may think of these as different epistemic cultures (cetina 1999).Inspired by the field of Resilience engineering and the concepts of 'work as imagined' and 'work as done' (Hollnagel 2015), we suggest that risk practise also has a Janus face of 'risk as imagined' and 'risk as done' , implying the possibility of a loose coupling between the science of risk and the practice (application) of risk and safety in the sharp end.This is of course not unique for the field of risk, and it is not surprising either, considering the different framing conditions within which scientists and practitioners work.

Development of risk research & practise -risk as imagined and risk as done
The relationship between the fields of science and practice is mediated through the state's regulation of the petroleum activity on the Norwegian continental Shelf.As a provider of rules and regulations for the industry, the regulator -The Petroleum Safety Authority (PSA-N) -is also a concept provider for the industry, as they demonstrate with the new risk definition that is presented to the industry.As we have seen, the PSA-N leans heavily on the collaboration with academia on the development of concepts (at least in our case) and presents the scientific concept of risk in the practice field.Following the philosophy and principles of functional or goal-based regulation, the PSA-N leaves it largely to the industry to decide how they want to achieve the intention of the regulation and which methods and tools they adopt in order to comply.Through an institutionalised, dialogue-based audit regime, the PSA-N reviews the companies' risk management systems, processes, and practices.As our informants elaborate, the audits do not offer many specific or practical hints from the PSA-N on the operationalisation of the risk definition, apart from 'uncertainty' being more frequently mentioned.In Figure 1 below, both the triangle of academia, industry, and regulator and the axis of science and practice are presented.
Another dimension of the relation between theory and practice in the context of risk management, is to describe it as 'risk as imagined' and 'risk as done' .This offers connotations to the theories of safety and resilience; moreover, reminds us of the practical commitment to and ancestry of risk science.
Both empirically-informed risk research and scientific-based risk management require the co-development of theory and practice.This corresponds well to the description of the emergence of both risk research and risk management in the context of the development of the Norwegian petroleum industry through the decades.However, one might ask: does the way the new risk concept is introduced -in parallel with academia's claim to risk science as a generic science field of its own, existing only as a premise provider for the practical world of risk management (Aven 2016;logan et al. 2022, invite to such a reading) 4 -imply a breach with this co-development of science and practice?If the scientific fundament that the PSA-N leans on in the introduction of the new definition is a science for practice, how strongly is it grounded in practice?Furthermore, how would a science of risk practice differ from this, and how could it support the operational environment better?
In safety research and practice in general, there is a continuous strive to close the gap between 'work as imagined' and 'work as done' .A working hypothesis is that the same ambition should apply when the specific themes are risk research and risk practices.This is also explicitly expressed by the PSA-N: the main reason for adjusting the definition of risk was to contribute to an improved understanding of risk in the oil and gas industry (Petroleum Safety Authority Norway 2016; Røyksund and engen 2020; Aven and Krohn 2014).A practical test for the adequacy of the new risk definition could be the following: 'Does it reduce or increase the gap between 'risk as imagined' and 'risk as done'?'

Conclusion
At the outset of this paper, we asked how the new risk definition has affected risk analysis and decision-making practices in operating companies.An additional question that grows out of this analysis is: 'What can we learn about risk science and practice from the process of implementing a new risk definition in the industry by the regulator?' With respect to the first question, the new risk definition has had some practical influence on the risk management.Awareness about uncertainty has generally increased, and some direct effects on risk analysis tools are reported; also, there might be other direct or indirect effects not traced by this study.The future will show if and how the definition will have a more profound long-term effect, either direct or indirect, following the increased consciousness about uncertainty that is reported to have already developed.It seems clear that discussions between the regulator and the industry regarding how to practically address and 'translate' uncertainty should continue, as some of our informants have not been strongly involved in the discourse so far.The long tradition of industry collaboration on important risk and safety issues is an important foundation for further strengthening of risk analysis practices, and there are established arenas that could be utilized further for this purpose.
The other question invites to reflecting upon the characteristics of a functional regulatory regime, and the pros et cons coming with such a regime.A general challenge with functional regulatory regimes is that the regulator cannot decide on new practices; it is up to the companies themselves to interpret the regulation and to find a suitable approach for compliance.This can be advantageous in the sense that it gives the companies significant leeway to tailor their treatment and evaluation of uncertainty to the context.On the other hand, with different understandings of uncertainty among the companies, it is more challenging for the regulator to perform audits in a structured manner.This underscores the significance of good relationships and collaboration climate between the regulator and the industry; what is not required through unyielding paragraphs can still be fostered through communication and development of a shared understanding.As such, the tripartite cooperation model -the dominating collaboration model in the petroleum domain where unions, employers and the government collaborate constructively to seek improvements for safety and the working environment -provides favourable framework conditions for a discourse on new risk regulation.Hence, and as we acknowledge that relatively short time has passed since the new risk definition was introduced, there is reason to believe that a more unified understanding and operationalisation of risk could appear in the years to come.That also implies a need for future research in this field.
If we look beyond the case study to draw more generic learning about the uncertainty dimension of risk, safety practise and safety science, we find that advances in safety research and the understanding of the uncertainty dimension of risk would benefit from more empirical studiesboth in numbers and in depth -of risk practices and the addressing of uncertainty.And that is not only a question of incorporating more real-world observations into the scientific works on uncertainty and decision making; it is also about understanding existing power relations among the risk actors (Figure 3): the power of definition, including the guidance provided by standards such as ISO, NS and NORSOK, the SRA glossary and other authoritative sources; the power of legislation, including the legal guidance of Framework HSe Regulation §11 (PSA 2015); and the power of practice with the guidance of expert knowledge, practical experience, and common sense.All these power sources are at play in this case and gives us an opportunity to study science in action as theories of risk develop in parallel with and, to some degree, in frictional relation with the experienced risks in the world, all facilitated and regulated by society's legal institutions.
uncertainty can be categorised into epistemic uncertainty (related to knowledge), aleatoric uncertainty (related to variation or randomness) and ontologic uncertainty (related to e.g.belief systems, or incompleteness or irrelevance of models) (Gansch and Adee 2020).In turn, these broad categories of uncertainty can be broken down into sub-types of uncertainty such as parameter uncertainty and model uncertainty (epistemic), measurement uncertainty and sampling uncertainty (aleatoric), and semantic uncertainty and interpretational uncertainty (ontological).Note, however, that different categorisation practices exist; e.g.Aven (2011) refers only to epistemic uncertainty and aleatoric uncertainty.These distinctions between different types of uncertainty are not scrutinized in this paper, but will be in forthcoming works from the same research project.2.

3.
There are many ways of measuring this; one way is to count the number of articles by Norwegian authors in safety journals.4. logan et al. (2022) write: 'An integrated approach also enables the use of risk science-with its significant body of literature, tools and methods-to inform and support resilience efforts' .

Figure 1 .
Figure 1.The circulation of risk management knowledge (adapted from armbrüster and kipping 2002).

Figure 2 .
Figure 2. Three translations of risk concept.

Table 1 .
number of informants from the different types of companies.