1776 Advances in Safety, Reliability and Risk Management – Bérenguer, Grall & Guedes Soares (eds) © 2012 Taylor & Francis Group, London, ISBN 978-0-415-68379-1 Security risk management in Norwegian aviation meets nordic traditions of risk management O.A. Engen University of Stavanger, Norway ABSTRACT: The risk management systems in the Norwegian aviation sector in the aftermath of 9/11 have been a top down process characterised by rapidity and secrecy and there has been little local and national risk assessment involved during the process. Both the aviation sector and the petroleum sector are technologically based organisational systems and both aspire to be associated with best practises of high reliability. A well known statement is that safety regulations in the petroleum sector are founded on traditional democratic ideals in working life. An important aspect of the Nordic regulation practise of safety has been to take care of the interests of groups and thereby increase personal responsibility concerning the workplace and security. The idea is that involvement and participation increase mission valences, legitimacy and trust and therefore the quality of the regulating regime as such. The paper will highlight differences and similarities between the two systems and discuss whether local participation and stakeholder involvement are necessary prerequisites for successful safety/security management. regulation 2320/2002 which evolved into a detailed, deterministic system aimed at securing civil avia- tion through a detailed and uniform system for all of the European countries. From the more goal- based way of regulating, the new security regime essentially followed a ‘prescriptive’ regulatory approach which is based upon mandated compli- ance (Penny, et al., 2001). This paper discusse show the security regime in aviation deviates from traditional “Nordic” practises of technological risk management in the petroleum sector. The paper highlights differences and similarities between the two systems and ques- tion whether local participation and stakeholder involvements are necessary prerequisites for suc- cessful safety/security management. 1.1 Safety vs. security In Norway it is only one common word that covers “safety” and “security”, namely “sikkerhet” (in ger- man: sicherheit) whereas in English the two terms refer to different types of actions and contexts. In order to conceptually distinguish between the terms “safety” and “security”, Cambacedes & Chaudet (2010) have developed a fruitful framework that may serve the purposes of this article. The frame- work starts with distinguishing between “system” vs. “environment” and “malicious” vs. “accident”. The system vs. environment (S-E) distinction refers to where “security is concerned with the risks originating from the environment and potentially 1 INTRODUCTION Both the aviation sector and the petroleum sector are technologically based organisational systems and both aspire to be associated with best practises of high reliability. Traditionally the safety regime on the Norwegian Continental Shelf has been developed and governed by a sophisticated body of laws and regulations coined as the “Nordic model” of Occupational Health and Safety and based on a three-part pillar with the regulator, the employer and the employees/unions as legitimate partners (Karlsen & Lindøe, 2006). It is reasonable to claim that the Nordic Model and the safety sys- tem that has developed in the Norwegian oil indus- try is closely connected. One important result of the Nordic Model was the working environmental act which established that technology has to adjust to human behavior and not the other way around. The traditional Norwegian safety system is thus found in the system-oriented approach where socio-technical design and organizational factors adjusted to how humans act are seen as the domi- nant factors (Leveson, 2004; Reason, 1997). The terrorist attacks that took place September 9/11, 2001, demonstrated that the security system, comprising legislation, regulation, and implemen- tation were not adequate to handle an intentional event of this magnitude.The 9/11 attacks caused a major reshuffling in the regulatory system and made it mandatory for all member countries. The convention formed the basis for EU’s new frame