Risk, Calamity and Apology

Risk decisions often appear unsatisfactory after a calamity has taken place. This holds even when they are products of systematic risk analysis. Yet, if relevant considerations available to be known pre-accident were adequately taken into account and safety measures implemented accordingly, nobody seems morally blameworthy. In this paper, I advance a two-way argument. Firstly, I show how analysis of post-accident apologizing sheds new light on vexed tensions in ethical assessment of risk impositions. This amounts to exposing conflicting moral intuitions in risk decisions, discussing problematic tenets in risk analysis as well as outlining three lines of arguments that destabilize the very notion of correct risk analysis. The analysis indicates that bringing different discussions of moral blameworthiness together facilitates resolving the tensions. It also calls for further and early-on collaboration between risk theorists and ethicists in order to carry these insights to risk analysis. Secondly, I argue that analysis of risk decisions, in part, reveals a discrepancy between the definitional work done on apology and what is required by ethics. Virtually every suggestion for the gold standard for apology involves moral blameworthiness as a necessary condition. I highlight different kinds of cases in which nobody is culpable, but an apology can be morally fitting or required. It would be nonsensical to say that, in these cases, one ought to apologize, but in a disingenuous manner.


Introduction
When a calamity takes place, measures to contain damage needs to be taken whenever possible. Afterwards, a post-accident investigation may be undertaken, liabilities will be assigned, and the affected parties should be compensated to the extent just and possible. Sometimes a relevant party states a public apology. This is true of some companies and their chief executive officers. 1 A public apology is also occasionally stated by government officials, spokeswomen of regulatory authorities, and members of expert organizations. 2 Post-accident apologizing is intuitive. It feels appropriate, many times required. Nevertheless, in one sense stating an apology appears puzzling. An apology is at odds with the fact that many activities (such as production of nuclear power and implementation of a vaccination scheme) are preceded by risk analysis enforced by laws and administrative practices. In risk analysis, dangers are identified, assessed, and weighed against each other and against socioeconomic, ethical and political considerations. The aim is then to take effective and proportional safety measures in order to prevent calamities from happening and reduce the risks to an acceptable level. Let us call correct risk analysis a situation in which relevant considerations available to be known pre-accident are adequately taken into account and safety measures implemented accordingly. In correct risk analysis, the relevant parties (i.e. an operator and a regulatory authority including the related expert organizations) have done their duty. Now, if a risk nevertheless materializes, neither the operator nor the regulatory agencies appear to be morally blameworthy. An apology seems not required-at least not in a strict sense.
In this paper, I will first briefly consider different accounts for a post-accident apology. Most, if not all, real-life cases of post-accident apologies can be explained by incorrect risk analysis and/or apology without fault-admitting. 3 Besides the empirical question of what is being apologized for, there is a philosophical issue: does a post-accident apology conflict with correct risk analysis? I will sketch five ways the mismatch between an authentic apology and correct risk analysis might be resolved. They include mistaken apology, apologizing for contribution, unavoidable regret, flawed principles of risk analysis, and impossible correct risk analysis. The analysis draws on several discussions which are interrelated but-at least to my awareness-have not been considered together in the context of risk analysis. They include ethics of apology, philosophy of risk, moral luck, decision theoretic principles and distinctions, agent regret, culpable ignorance, and ethics of emerging technologies. 1 As an example, on their webpage Masataka Shimizu, the president of Tokyo Electric Power Company (TEPCO), spoke on behalf of his company: BOur deepest sorrows go to those people and their families who are suffering from the Tohoku-Chihou-Taiheiyo-Oki Earthquake and tsunami that struck our nation on March 11th [2011]. Furthermore, I deeply apologize for the distress and inconvenience to those residing in the surrounding areas of the power station, Fukushima Prefecture as well as broader society due to the extensive damage our facilities sustained at Fukushima Daiichi Nuclear Power Station and the rolling blackouts.^(TEPCO 2011.) 2 As an example, after an outbreak of narcolepsy linked with the Pandemrix vaccination against pandemic influenza A/H1N1 (colloquially known as swine flu), Terhi Kilpi, the head of the Department of Vaccination and Immune Protection of the Finnish National Institute for Health and Welfare (THL), apologized to the affected parties (MTV3 2011a). Pekka Puska, the director general of the THL, also expressed his condolences, but emphasized that the decision to vaccinate was made under the best available information (MTV3 2011b). The association between the vaccine and narcolepsy was found out and confirmed later. Interestingly, Kilpi has later indicated that she would not decide differently now as the vaccinations prevented many unnecessary deaths. At another instance, she stated that the vaccination should maybe not have been given to young people, aged 5 to 20. 3 To avoid misunderstandings, I want to emphasize the following. First, I do not claim to know the real reasons behind the TEPCO's or the THL's apology. The reasons should fall into the three accounts suggested in the section two. Second, I do not imply that the members of the TEPCO or the THL should not have apologized. Furthermore, the socio-cultural norms and practices concerning apologizing and asking for forgiveness differ in Europe and Japan. For an account of the Fukushima Daiichi accident and ethical questions related to the use of nuclear power more generally, see the editorial and two special issues by Benjamin Hale (2011) in Ethics, Policy and Environment.
The tension between an authentic apology and (correct) risk analysis reveals discrepancies in moral intuitions and precepts, but also more generally vexed issues in theories and practices of decision-making under outcome uncertainty. 4 In particular, risk decisions often appear unsatisfactory, or they seem much less satisfactory, after a calamity has taken place. This holds true even when they followed from a systematic risk analysis. My guess is that the philosophical questions related to apology and risk analysis have gone under the radar because, at first thought, it seems that there cannot be any reasonable issue here: stating a post-accident apology in case of correct risk analysis simply does not make sense as nobody is morally blameworthy. Apologizing presupposes moral blameworthiness. If someone is morally blameworthy, then the risk analysis cannot be a correct one and an apology may be in order.
Some simplifications had to be made. I will mainly consider the perspective of an individual, whereas oftentimes it is collectives who might be held morally responsible. It may be asked what it means that a collective (such as a company, an agency, or even a state) apologizes. An authentic apology might not be correctly ascribed to collectives, but only to the members of those collectives. Only the latter are capable of remorse. In what follows, I have sidestepped questions related to a collective stating a(n authentic) apology, for example, issues arising from the fact that although representing the same collective, the persons stating an apology may often be different from the wrongdoers. These issues are certainly important, but they remain beyond the present analysis and could not have been satisfactorily dealt with here.
Another related limitation concerns moral blameworthiness. Either it is a representative individual who apologizes on behalf of a collective for previous (in)actions in which she did or did not participate, or it is an individual who apologizes for her own failure to fulfill duties assigned to her within the collective. A reductionist strategy would be to say that in incorrect risk analysis, there must be at least one individual who is morally blameworthy for her (in)actions. However, it remains a matter of debate whether or not collective responsibility is reducible to individual responsibility. Two sets of reasons cast doubt on the possibility of a simple reduction, at least in some situations. Firstly, social interaction gives at times rise to outcomes that no one directly caused or intended. Tragedy of the commons, causal overdetermination and decision-making paradoxes (such as voting paradoxes) undermine the straightforward ascription of responsibility to individuals. Secondly, it may be difficult or impossible to track an individual's exact causal role in complex social endeavors. about risks is learned as a result of an accident need to be distinguished. New information gained can be such that it should have been considered in correct risk analysis. Alternatively, new information may require changes in risk analysis in the future (for a discussion on learning from accidents, see e.g. Lindberg et al. 2010). It is reasonable to assume that sometimes this information cannot be achieved in principle or without an unreasonable cost pre-accident. In the latter case, stating an apology seems not required.
The second explanation of post-accident apologizing amounts to an apology without faultadmitting. 5 In practice, it is not seldom that stating an apology and admitting moral blameworthiness come apart. A post-accident apology may be an instance of expression of sympathy (i.e. Bwe are sorry that X happened^), not of a fault-admitting apology (Bwe are sorry that our [in]actions contributed to harming you in an unacceptable and morally blameworthy way^). I will call the latter an authentic apology. An (inauthentic) apology can be stated for reasons other than fault-admitting both when incorrect risk analysis was made and when correct risk analysis was made, however rare the latter case.
Stating a public apology can serve several purposes. It may be good public relations for a collective because it gives an impression to stakeholders and the general public that the collective is a morally-conscious actor who shows respect to the affected parties, that it tries to normalize the situation or relationship, and that it is committed to acting differently in the future. A strategic apology may nevertheless come with a price. Whatever the real reasons behind it, stating an apology easily gives an impression that something wrong was done. It might be taken as an indication of fault-admitting and taking responsibility. 6 So there can also be reasons not to apologize even in cases where one knows that one's actions were faulty. This is the case when uncertainties about legal liabilities and compensations exist. After the Gulf of Mexico oil spill in 2010, BP admitted responsibility only after a while.
The picture is further complicated by a dynamic between admitting blameworthiness and explaining what happened that works towards the opposite direction. Providing a full account of one's actions may blur the moral responsibility. As explicated by Bovens (2008, p. 229): [w]e expect the offender to provide an account of the wrongdoing-what is it that brought her to act in the way she did? Now this account may contain mitigating excuses and should be as complete as possible. But there is a fine line between telling the story extremely well and making exculpatory excuses. The mitigating excuses in a well-told story may add up and come to sound like an exculpatory excuse. This is no doubt sometimes intentionally exploited in practice, but it also raises a more fundamental question as to the extent to which an agent can be morally blameworthy. A full account of any action normally refers to causes that remain outside one's direct control. I will return to this later (esp. in terms of foreseeability in sections 4.2 and 4.3).
The third account is a (hypothetical) situation in which an authentic apology is stated in case of correct risk analysis. It fires up a host of philosophical questions related to ethics of risk-imposition. Again, two cases should be distinguished. In the first one, all actions required by laws, regulations and guidelines are fulfilled by relevant parties. When so, nobody is legally liable (for the risk decisions). In the second one, risk analysis is undertaken in such a way that nobody is to blame, morally speaking. Abiding by the current laws and regulations does not ensure correct risk analysis. They may require insufficient risk assessment, management and/or communication.

Does a Post-Accident Apology Conflict with Correct Risk Analysis?
The question whether or not a post-accident apology conflicts with correct risk analysis hinges on two incompatible intuitions. On the one hand, an apology by a causally responsible party feels appropriate after a calamity has taken place. On the other hand, there seems to be no reason to apologize, if there was no fault or failure in risk analysis. Both intuitions carry prima facie plausibility. There are at least five ways the mismatch might be resolved. Let us next consider each of them in turn.

Mistaken Apology
The apology may be mistaken. There is, consequently, no inconsistency between correct risk analysis and stating a post-accident apology. An authentic apology is typically taken to presuppose at least two things: that an agent has contributed to (the occurrence of) something and that she takes herself to be morally blameworthy for doing that. She should have known better and she feels it. What is important to note here is that virtually every analysis of apology takes moral blameworthiness to be a necessary condition for an authentic apology. Here are three examples: Bit is intrinsic to a genuine apology that one takes oneself to be in the wrong^ (Davis 2002, p. 169) BFor a genuine apology, it is not sufficient that the offender admit[s] that her action turned out badly-she must also recognize her culpability^ (Bovens 2008, p. 221) A categorical apology requires acceptance of blame, admitting both causation and wrongdoing (Smith 2008, esp. Ch. 2). 7 The first suggestion proceeds from this to claim that what is required is that she considers herself to be morally blameworthy, not that she is morally blameworthy. So a mistake about one's blameworthiness might dispel the mismatch between an authentic apology and correct risk analysis.
The trick here, however, is that whether or not an authentic apology presupposes actual moral blameworthiness is unclear and calls for an argument. It seems intuitive that an apologizer need not only think that she is morally blameworthy, but should also have an idea of what exactly makes her actions transgressive. This may make making the mistake harder and rarer, but admittedly one can also be mistaken about the reasons that make an action morally blameworthy. Furthermore, it might not be reasonable to accept an apology if the apologizer is not morally blameworthy, but only thinks so. Instead of accepting the apology, reconciliation could require explaining to the apologizer why there was no transgression in the first place.
This said, in practice it may be relatively common that one is uncertain about whether or not she is morally blameworthy. In some cases this uncertainty may be irreducible by careful reflection, communication and finding out the facts of the situation. Under such uncertainty, one might want to err on the side of caution and apologize. Balancing is required, however, as an excessive precautionary apologizing could prove counterproductive by inflating the moral gravity of the practice itself.

Contributory Apology, Moral Remainder, and Pragmatic Moral Reasons
The oddity of apologizing for correct risk analysis might be avoided by invoking a looser concept of apology. One suggestion consists of dropping off the second condition. In particular, it is not necessary that one is and takes herself to be morally blameworthy. Contributing to an unfortunate course of actions and events is sufficient for an apology. In a sense, Brooke Natalie Barnum-Roberts (2011) goes even further when arguing that there are cases in which apologizing without regret makes good sense. (Here I assume that one might regret choices for which she is not morally blameworthy as in case of outcome regret explained below.) In her view, someone can be genuinely sorry for her (in)actions without wishing that she had done differently.
This looser understanding of an apology as a mere contributory apology may be common in practice. However, the question is not what is being apologized for, but what should be apologized for. If a mere contribution were sufficient for genuinely apologizing, then it would be fitting to apologize for being part of an unfortunate course of events even when not contributing to those events was impossible for an agent or otherwise morally excusable for her.
Yet the issue is not that simple. Bernard Williams explains cases-specifically, a careful lorry driver who runs over a child-in which one is causally responsible for harm to others but not morally blameworthy as follows: Bthere is something special about his relation to this happening, something which cannot merely be eliminated by the consideration that it is not his fault^(Williams 1981, p. 28). The driver might well entertain thoughts like BI could have prevented this from happening^and he could wish he acted differently despite the fact that he knows not to be morally blameworthy for what happened. It seems that an apology, for example, to the parents whose child was killed in the accident could be in order here. Not apologizing when he later by-no-plan meets them would surely be bad taste. A virtuous person apologized in this kind of situation. There might be a (prima facie) duty to apologize.
Interestingly, this apology encompasses many of the common characteristics of the gold standard for apology. The driver should, for example, show respect and sympathy for the loss and suffering caused by the accident. The apology also needs to be accompanied by an attitude of humility. As virtually every suggestion for the standard involves moral blameworthiness as a necessary condition, the lorry driver example reveals a tension between the definitional work done and what is required by ethics. It would be nonsensical to say that the driver should apologize, but in an insincere, inauthentic or disingenuous manner.
One way to put the conclusion from the lorry driver case is that an apology may be fitting when one is not morally blameworthy, but that there is a moral remainder (or a residual obligation, to use a term coined by Williams). Sometimes there are competing valid moral reasons to choose mutually exclusive options, but a right course of action nonetheless. Bovens (2008) provides an example in which one misses an appointment with a friend because his child suddenly gets ill. Besides breaking a promise by not doing what was agreed, there is also some inconvenience-although only minor-caused to the friend. Despite these two moral Bcosts^, staying at home with the child is what one should do, all things considered. One may still owe the friend a notice, which amounts to a moral remainder. 8 Bovens considers it to be somewhat plausible that one should apologize in his example, but suggests that, alternatively, it might be that what one owes to the friend Bis an expression of regret for having been placed in this choice situation and for the harmful consequences of (…) [one's] actions^ (Bovens 2008, p. 224). Regret here is concerned with the situation in which one is involved and to which one has contributed: causing harm to another person. One does not wish she had chosen differently, nor is there moral blameworthiness.
An apology may relate to moral remainder in two ways. Firstly, it could be considered that an apology in itself fulfills the remainder. According to Sven Ove Hansson and Martin Peterson (2001, p. 159), one has B(at least) a residual obligation to sincerely apologise^in cases corresponding to the Boven's example above. Secondly, an apology could be required if one failed to do what is required by a moral remainder. If one informs the friend that one cannot make it to the appointment and explains the situation, then there seems to be no room for an authentic apology besides. The moral remainder has been fulfilled. If it was not fulfilled, an apology might be required. It is noteworthy that in this case an apology is only indirectly concerned with the original decision.
Similar considerations may be invoked in case of tragic choices. They comprise situations in which there appears not to be a morally right course of action at all as all the available choices are catastrophic, morally speaking, and/or the compelling moral claims are not meaningfully comparable with each other (for a discussion of tragic choices when probabilities are involved, see Rivera-López 2008; for analysis of hard and tragic choices, see Tessman 2017). 9 Whenever a (risk) decision presents a tragic choice, apologizing, explaining the situation to the ones harmed (when possible) and expressing respect and sympathy for their suffering can be fitting. But again, this does not amount to an authentic apology-strictly speaking.
Lastly, it could be argued that pragmatic moral reasons warrant apologizing in case of correct risk analysis. It is plausible, for example, that (the general practice of) apologizing raises moral Bclimate^in society, i.e. fostering and resulting in more responsible behavior by oneself and others in the future. In consequentialist ethics or reasoning, the valuable 8 To consider this in the context of risk decisions: at times, one needs to choose a lesser evil, meaning inducing the possibility of significant harm to some in order to prevent a greater harm to many. This is the case, for example, in vaccination schemes. While some people will suffer side effects, everybody receives the benefit of population immunity. The moral remainder might imply attempting to identify the individuals and subpopulations prone to the side effects and excluding them from the program as well as alleviating the side effects when they occur. 9 Hard choices refer to cases in which there are competing valid moral reasons to choose mutually exclusive options, but a right course of action all things considered nonetheless (the missing-an-appointment case discussed above presents an example of a hard choice). The most commonly presented example of a tragic choice is the one with which Sophie is confronted at a Nazi concentration camp in the novel Sophie's Choice. One of her two kids can be spared, but only if she chooses which one to save. consequences arising from apologizing could make stating an apology a moral duty. Taken to its extreme this obligation is not dependent on (although it might in practice be associated with) whether or not one has contributed to a moral wrong or even whether there is a moral wrong in the first place. In any case, as far as there is no moral blameworthiness involved, this morally motivated apology cannot qualify as an authentic one.

Regret and Apology
Regret often seems an unavoidable possibility in decision-making under outcome uncertainty. This is because feelings and emotions are only partially reason-responsive. So it is possible to regret a decision one made even if she believes that the decision was the best possible or a morally right one. Sometimes all the options are calamitous (as is the situation in tragic choices). At other times, a highly improbable bad thing happens. Regret may also arise in response to information that was not at hand at the time of a decision. One might often feel that she should have found out more information before making a decision, but regret (when not reason-responsive) may also ensue in cases where the relevant information became available only after the risk decision.
Even if feelings and emotions were fully responsive to (rational) reasons, one might regret her undertakings because her preferences and values change over time. Noteworthy is that some principles in decision theory are actually based on the notion of regret. The principle of minimax regret says that a decision-maker should choose an option that is associated with the lowest level of maximal regret. This presupposes that some amount of regret may follow even in the case of a rational decision. In sum, regret may follow in case of correct risk analysis depending on how things turn out. As regret accounts for an authentic apology, the oddity of post-accident apologizing disappears.
This third suggestion also faces a number of problems. Firstly, the denial of regret-free alternatives can be questioned. Some philosophers have insisted that one should act in a way that avoids self-blame and remorse. John Rawls (1972, p. 422), for instance, suggests that Ba rational individual is always to act so that he need never blame himself no matter how things finally transpire^. 10 Needless to say, the absence of self-blame does not mean that the individual could not be sad about the suffering of others caused by her actions and express genuine pity and sorrow.
Secondly, the straightforward connection drawn between regret and an apology is problematic. Paul Davis (2002) argues that an authentic apology involves substantially more than regret about an offence caused by one's behavior. Furthermore, while regret is necessary for being genuinely sorry seems to be the received wisdom, merely a specific kind of regret is relevant. Only when an individual has contributed to something harmful or unacceptable, she wishes that she had not contributed to that and does so for moral reasons as in cases of remorse and repentance, an apology is in order. 11 Other forms of regret are irrelevant to an authentic apology.
If regret is irrational in a sense that an individual knows that a right decision was made but still feels it, she has no reason to apologize despite, or besides, the (not-morally-relevant) fact that apologizing might make her feel better (on rationality of regret, see e.g. Bittner 1992). 12 A relevant distinction is that an agent may feel outcome regret driven by a comparison of the realized outcome with some reference point (for example, with an imagined, expected or known outcome of an unchosen alternative), even if she does not feel process regret. The latter refers to the evaluation of whether or not the decision procedure was justified. If it was so, then she thinks the decision was a right one and would decide in the same way again, if the opportunity appeared, irrespective of the actual consequences in particular cases.

Flawed Principles of Risk Analysis
A fourth suggestion is that a post-accident apology does not conflict with correct risk analysis because the theoretical basis of risk analysis is unsatisfactory from an ethical point of view. In particular, its underlying principles are not stable against the occurrence of calamities. Risk analysis resembles the application of the principle of maximizing expected utility. The latter proves unsatisfactory after-the-fact, that is, when a calamity-the possibility of which was included in the calculation-has taken place. Hansson (2007) points to typical lines of postaccident argumentation. Accidents are not defended as being the necessary bad of a strategy that is the best option in the (very or infinitely) long run. When did a collective causally responsible for a calamity assert that it was acceptable and only to be counted as part of utility maximization? A related point is that accident investigation boards are instructed to answer the questions BWhat happened? Why did it happen? How can a similar event be avoided?^, not the question BWas the accident defensible in an expected utility calculation?^ (Ibid., It is true that the principle of maximizing expected utility seems not satisfactory as a sole ethical precept. A major defect is that its prescriptions occasionally go against basic moral intuitions, for example, by infringing basic rights, conflicting with people's sense of fairness, and paying insufficient attention to catastrophic small probability events (for problems in maximizing expected utility, see e.g. Hansson 2013, esp. pp. 26-8). One possible solution here would be to combine the principle with other ethical precepts (such as basic rights, justice and precaution).
It is often stated that common forms of risk analysis are based on consequentialist reasoning and, specifically, maximizing expected utility (e.g. Hansson 2013, p. 26). This means that the same problems would color risk analysis as well (as the above-version of the suggestion presumes). However, it seems mainly to be the two-dimensional conception of risk as consisting of a quantified damage (disutility) and its probability that is shared. The balancing of different risks against each other and against political, socio-economic and ethical considerations in risk management does not (necessarily) coincide with choosing an option with the highest expected utility. Here other ethical precepts can well be taken into account.
Moreover, risk analysis can reflect what is required by ethics better or worse. There is no necessary link between ethical norms of harm (and risk) avoidance, basic rights, autonomy, justice, etc. on the one hand, and the chosen level of acceptable risk and risk mitigation measures taken in risk management on the other. A corollary is that risk analysis may be undertaken in accordance with its set aims and procedures, but that the risk decisions made still give rise to moral blameworthiness.
The fact that risk decisions often seem unsatisfactory-or much less satisfactory-after-thefact does not imply that these decisions would be ethically faulty as well. What might be called blame mania is the idea that there must be somebody responsible and blameworthy for basically any calamity that takes place. Even if it is a natural catastrophe, somebody must have underestimated the risk and carried out insufficient alarms and preventative measures. 13 This may at times be the case, but generally speaking blame mania presents an unreasonable position and attitude. Some calamities take place however good the risk analysis. Related to this is the observation that expectations towards institutions' capability of handling risks are typically higher than those of individuals. At times, these expectations are simply too high to be reasonable.
A quick response to the suggestion that risk analysis is based on flawed principles is that the actual practices with their problematic underlying principles amount to incorrect risk analysis. Is it not just that these practices do not yield to correct risk analysis, not that correct risk analysis is impossible in a way that it is also satisfactory after the fact?

Is Correct Risk Analysis a Chimera?
If correct risk analysis was impossible, then there would be no weirdness in a post-accident apologizing. This suggestion may take at least three forms.

Apples and Oranges
Weighing between different kinds of risks (e.g. those of species loss versus economic recession) and between risks and benefits (e.g. probable increase in mortality versus faster transportation) in a justified manner is not only extremely challenging, but in some cases it may be impossible (see e.g. Rescher 1983, esp. pp. 20-6). If so, correct risk analysis proves to be a chimera.
In a sense apologizing may still remain odd even if correct risk analysis was impossible. This is the case when everything that could have reasonably been taken into consideration and done was, in fact, taken into consideration and done. Furthermore, in the most common cases incomparability (or incommensurability) is not about risks in itself, but about different values and disvalues. There is no straightforward and commonly agreed-on way to weigh and balance between the disvalue of species loss and economic recession, nor between increase in mortality and faster transportation.
A proponent of this line of argumentation is thus faced with a choice. She may admit that finding an ethically right or acceptable choice is impossible even when outcomes of different actions are known for a fact (and continue arguing that this also holds under outcome uncertainty, which in turn would make correct risk analysis impossible at least in some cases). Alternatively, she could try to show a special nature of the context of outcome uncertainty (i.e. how incomparability is especially problematic in this context). Accepting the former is painful as the problems are shared with any evaluative analysis of consequences. The latter remains to be done. 14

The Act-Outcome Link Argument and Intrinsic Failure
Another line of argument draws on the act-outcome link. Thomas Nagel explains that [i]n many cases of difficult choice the outcome cannot be foreseen with certainty. One kind of assessment of the choice is possible in advance, but another kind must await the outcome, because the outcome determines what has been done. The same degree of culpability or estimability in intention, motive, or concern is compatible with a wide range of judgments, positive or negative, depending on what happened beyond the point of decision. The mens rea which could have existed in the absence of any consequences does not exhaust the grounds of moral judgment. Actual results influence culpability or esteem in a large class of unquestionably ethical cases ranging from negligence through political choice. (Nagel 1993, p. 452.) 15 The act-outcome link argument may take two forms. The first one says that the outcome of an action, at least, partly determines its ethical verdict. The second one says that the outcome of an act, not only the intention or motive of an agent performing it, determines partly what has been done, and that ethical appraisal of choices is dependent on what actually has been done. In both cases, knowledge about the probabilities of different possible outcomes is not enough. Pre-accident risk analysis is necessarily incomplete from an ethical point of view (and, perhaps, it is also morally indeterminate). It makes good sense to apologize when after-thefact ethical appraisal uncovers a fault.
Notwithstanding, it is tempting to think that in light of what can be known pre-accident some decision that would make moral reproach unsuitable no matter how things turn out must be possible (ibid., esp. p. 452). Hansson (2007Hansson ( , 2013 suggests a strategy called hypothetical retrospection in which a decision is evaluated under the assumption that one of the branches of possible future developments has materialized. Decision alternatives obviously need to be evaluated under each of the identified possible developments. By Italics, I want to point that there may well be unexpected outcomes and they might trigger regret. This is not a problem for Hansson, however, as he emphasizes the difference between regret and moral acceptability (or defensibility). BRegret is a psychological reaction, not an argued moral standpoint^ (Hansson 2013, p. 64). Instead of trying simply to avoid regret, one should ensure that however things turn out, the post-fact evaluation would not conclude that a decision was morally wrong.
As the previous suggestions, the act-outcome link arguments also come with a Bcost^. In an extreme form the arguments would expel the action-guiding function of ethics when the outcome of an (in)action is not known for a fact. Moreover, if the outcome of an action alone determined (a great part of) a full ethical appraisal, after-the-fact analysis of past risky choices would reveal unbearable consequences. Under this view, taking a 99,99% chance of causing a calamity may well be the right choice when the outcome is not obtained (even if there were other options with lesser risks available).
It has been suggested that the way in which a particular outcome comes about as a result of a choice is relevant to its justifiability. Williams (1981, pp. 23-7) distinguishes between extrinsic and intrinsic luck and argues that it matters for the retrospective (un)justifiability of an action how intrinsic the cause of a failure is to the action's intended outcome. To use Williams' famous example in a slightly modified form: if Gauguin's feasible project to become a famous painter was foiled by his being accidentally killed, this would not unjustify his decision to dedicate his life to art. On the other hand, B[w]ith an intrinsic failure, the project which generated the decision is revealed as an empty thing, incapable of grounding the agent's life ( ibid., p. 36). This would be the case if Gauguin, after pursuing a life as an artist, found out that he was not an exceptionally talented painter who could produce valuable artwork.
While in Williams' view both intrinsic and extrinsic luck are necessary for success and retrospective justification, it is only an intrinsic failure that could prove a decision unjustified. He admits that even if Gauguin would find his choice to pursue his art and leave his family justified in case of success, this Bneed not provide him with any way of justifying himself to others, or at least to all others^(ibid., p. 23). This brings out the question as to the extent to which this particular kind of justifiability has to do with moral defensibility and ethics (this is also where Williams and Nagel disagree). One may pursue disastrous projects, ethically speaking, and have both intrinsic and extrinsic luck in them. Furthermore, while Gauguin could not know for sure whether he would have it in himself what is required to become a great artist, it matters a great deal to the justification-both ethical and rational-what kind of evidence he possessed at the time of the decision. If he did not pursue art at all before making the decision and merely had a hunch that he then followed, many would be inclined to think that despite success, his decision to pursue art was unjustified.
What would count as an intrinsic failure in the context of risk analysis? It might amount to founding the risk assessment on wrong background assumptions, missing possible harmful consequences, choosing wrongly the level of acceptable risk, undertaking insufficient risk management actions or failures in responsible risk communication. In their report on risk governance deficits, the International Risk Governance Council (2009) states that Bno matter how good an early warning system is, or how thoroughly risk assessments are conducted, it is important to acknowledge that risk assessment relies on what, conceivably, could go wrong^.
Whether or not there is an intrinsic failure in risk assessment may be found out only afterwards. If it turns out that there was such a failure, it would not be a case of correct risk analysis. This illustrates how the first explanation discussed in the section two (i.e. incorrect risk analysis) proves too simplified. In case of an intrinsic failure, risk analysis-as it was conducted-could not have fulfilled its very aims. It would certainly be a case for revising risk analysis (or its objectives); yet, it remains debatable whether the analysts would be morally blameworthy. 16

Luck-Component of Risk, Uncontrollability, and Apology
A closely related line of argument draws on the luck-component of a risk. In the case of a decision-theoretic risk, there is something that is known (i.e. the magnitude and scope of damage as well as its probability) and something that remains not known (whether or not the damage actualizes in a particular case) (see Luce and Raiffa 1957). 17 Owing to the latter, any risk entails a luck-component that refers to the part of a danger for which there is neither controllability nor foreseeability. A conventional wisdom says that to the extent there are things beyond one's control one cannot be morally blameworthy. As Nagel puts it, [p]rior to reflection it is intuitively plausible that people cannot be morally assessed for what is not their fault, or for what is due to factors beyond their control. Such judgment is different from the evaluation of something as a good or bad thing, or state of affairs. (…) So a clear absence of control, produced by involuntary movement, physical force, or ignorance of the circumstances, excuses what is done from moral judgment. (Nagel 1993, p. 450.) Against this, it is known from the classical examples of moral luck that people are often treated as (if they were) responsible for character traits, situations and outcomes over which they lack control. Nagel continues, [w]here a significant aspect of what someone does depends on factors beyond his control, yet we continue to treat him in that respect as an object of moral judgment, it can be called moral luck (ibid.; for another seminal discussion on moral luck, see Williams 1981, Ch. 2; see also Dickenson 2003;Levy 2011).
According to a common classification, this luck-which may be good or bad-can be concerned with one's inclinations, capacities and temperament (constitutive luck), the kinds of problems and situations one faces (circumstantial luck), how one is determined by antecedent circumstances (causal luck), and how one's actions and projects turn out (resultant luck). Risk decisions pertain mainly, but not solely, to resultant luck (here I sidestep differences in the appetite for risk-taking or risk-avoidance which could be interpreted as constitutive luck). Now, to sum up, the luck-component of risk argument says that when correct risk analysis has been made, but things end up badly (by bad resultant luck), apologizing is fitting.
This argument suffers from the following ailments. Firstly, it does not make sense to apologize, ethically speaking, or state an authentic apology for the luck-component of a risk given that reducing it by more extensive risk assessment was not morally required. Secondly, even if the debate on moral luck shows that people are often being held responsible for things that are beyond their control, this does not make it reasonable, nor an authentic apology required, provided that we are not willing to give up the conventional wisdom. This holds even when admitting that to some extent the conventional wisdom is naïve as under closer scrutiny, Bwhether we succeed or fail in what we try to do nearly always depends to some extent on factors beyond our control^ (Nagel 1993, p. 450). There is admittedly a Bcost^related to this position (that I continue to hold) in a sense that some uncontrollable things are exempted from moral evaluation and others not, while it is difficult to spell out justification for their difference. 17 The luck-component argument can be made under decision-theoretic risk, uncertainty and ignorance.

Discussion
It has been argued here that an apology may be morally fitting or required in case of correct risk analysis, but it cannot be an authentic one. This holds when uncertainties about one's blameworthiness remain, when one has induced a moral wrong which is justified all things considered, when one has faced a tragic choice, and/or possibly also when there are pragmatic moral reasons that warrant apologizing. If a moral remainder has not been fulfilled, an authentic apology may be required, but it is not concerned directly with the original (risk) decision. Furthermore, three lines of arguments which threaten to undermine the possibility of correct risk analysis have been highlighted. Even if these arguments went through and if correct risk analysis (as defined at the outset) was impossible, stating a post-accident apology remains weird when everything that could have reasonably been done was in fact done preaccident.
On the one hand, I hope I have showed how analysis of post-accident apologizing can shed new light on vexed tensions in ethical assessment of risk impositions. The preceding analysis indicates that bringing different discussions of moral blameworthiness together facilitates resolving the tensions. It also calls for further and early-on collaboration between risk theorists and ethicists in order to carry these insights to risk analysis. On the other hand, I have argued here that analysis of risk decisions, in part, reveals a discrepancy between the definitional work done on apology and what is required by ethics. The analysis highlighted different kinds of cases in which nobody is culpable, but an apology can yet be morally fitting or even required. While authentic apology presupposes moral blameworthiness, it would be nonsensical to say that in these cases one ought to apologize, but in a disingenuous manner.