Organising for Resilience to Climate Change in Critical Infrastructures: The Application of Viable System Model in an Oil Refinery

Oil refineries are among industrial installations that are vulnerable to climate extreme events, whose frequency and intensity have been increasing over the last decades. Building resilience in resources to withstand climate-related hazards and to recover fast at low human and material cost, for changing climate conditions, is required. In this paper, we present an action research effort for the design of a viable decentralized climate-resilience-providing virtual organization in an oil refinery in Greece using the Viable System Model. The VIPLAN method was employed for the methodological design of a distributed Climate Resilience Providing Organisation for the case of a refinery facility in Greece. The paper presents the process and the results of this effort.


Introduction
Although it is one of the major sources of carbon emissions, undeniably oil and its derivatives still constitute a major energy source (Pollin 2015) whose supply must be secured and cannot be interrupted, at least, as long as the lengthy transition period towards more 1 3 sustainable energy sources is underway. Apart from carbon emissions that the use of oil and its subsequent contribution to climate change entails, the operation of oil's supply chain per se is vulnerable to extreme climate conditions, which may cause accidents with significant consequences for the natural and built environments, as well for important societal functions (Katopodis and Sfetsos 2019). Climate-related events have already created challenges for organizations, while their impacts are likely to increase in the future, as the vast majority of natural scientists warn (Wilbanks et al. 2007;Forzieri et al. 2018). On the other hand, climate change is causing faster ageing and degradation of the oil infrastructure along its entire supply chain, from oil extraction upstream to storage, refining and distribution processes, limiting its lifecycle and service level, and increasing the risk for major incidents (Katopodis and Sfetsos 2019). As extreme events of very high, or very low, temperatures, high winds, extreme precipitation, wildfires, etc. are expected to occur more frequently in the near future (Forzieri et al. 2018) with potentially combined Natech accidents happening (Ricci et al 2021), actions have to be undertaken to secure the resilience of oil infrastructure, the safety of people and the environment and the business continuity of the industry. In fact, the societal disruption caused by infrastructure failures of this sort can frequently be disproportionately higher in relation to the actual physical damage made (Chang 2014).
Climate-related events may also influence other sectors related to oil and their critical infrastructures, such diverse as electricity, natural gas, transportation, water, telecommunications and IT, as well as healthcare provision. The opposite can also happen, i.e. the oil sector may be affected by damages initially caused in the sectors mentioned above (Katopodis and Sfetsos 2019). All these imply that during the long and uncertain period of transition to more sustainable forms of energy, and as long as oil is still in need for energy security and supply, its production and distribution chain should be resilient, i.e. need to be able to cope and bounce back from shocks caused by threats, including those stemming from the extreme climate phenomena.
Refineries form a core component of the oil supply chain. Their infrastructure and operational assets are vulnerable to climate conditions, especially when they are close to sea or river coastal areas and constitute potential sources of severe hazards (fires, explosions, etc.), due to the storage and processing of highly inflammable materials. Beyond an organisation's assets and operations, such events may damage the economic and social wellbeing of the surrounding communities. As public awareness of such hazards increases, and concerns towards fossil fuels' infrastructures escalate (European Commission 2021), refineries and other related industrial installations must exhibit resilience to extreme weather conditions due to climate crisis (Katopodis and Sfetsos 2019).
At the organizational level, climate-related resilience implies that an organization has an inherent ability to survive drastically changing external conditions of different nature, including extreme weather events (heatwaves, storms, etc.), by adapting its structure and operation appropriately (Hamel and Välikangas 2003;Katopodis and Sfetsos 2019). As climate conditions are changing unexpectedly, when building resilience to climate-induced events, both present and (possible) future conditions must be taken into account, and resilience must be built across all the assets/resources of an organisation (both human and non-human). Resilience is perceived, defined, implemented and valued in relation to an organization's environmental characteristics at a specific time period taking into account experienced and anticipated disturbing events. This means that as environmental/climate conditions change, and events which were thought impossible to happen in a specific geographic area can actually happen, the definition and implementation of an organisation's resilience should be updated and adjusted in line with 1 3 the requirements that the new environmental conditions (natural, climate, social, etc.) dictate. Such a task requires the existence of a healthy organisational mechanism, or organisational unit, which will always be in a position, i.e. viable to serve its purpose, to arrive at the resilience requirements at the specific time, and take the appropriate measures towards implementing them. As refineries are complex organisations comprising of diverse elements, and climate change affects different elements differently, their autonomy in adaptation to new resilience requirements and responses contributes to faster and more effective overall organisational adaptation and viability. In this paper, we show how this mechanism can be developed as a decentralized organization (organization-within-organization) using the Viable System Model (VSM) (Beer 1989) that aims the same organisational design objectives.
We present the process and the results of an action research study to design the structure and operational processes of a viable resilience-providing organisation for a major oil refinery in Greece. The Climate Resilience Providing Organisation (CRPO) provides services, i.e. technical knowledge and organisational processes, which are implemented in the organisational units of the company. As it was already mentioned, the Viable Systems Model (VSM) (Beer 1985;1989) approach was employed to carry out this organisational development endeavour. The VSM comprises of five systems necessary for viability assigned to the management and operations functions. VSM was chosen because it facilitates the systematic design and (self-) transformation of organisations (Tavella and Papadopoulos 2017) that can exist, through adaptation, in changing environments, in harmony with their environment -socio-economic, or natural, assisted by the coordinated autonomy of their operational units. The VIPLAN method (Espejo and Reyes 2011), which is a method to diagnose and design organisational structures, tailored to the specifics of the particular situation (Lowe et al. 2020), was used to guide the activities of the research team in arriving at an organisational structure, i.e. definition and distribution of functions and activities of the resilience-providing organisation to the formal organisational units, which provides uninterrupted resilience to the infrastructure, processes and human resources of the overarching organisation.
Based on the above, the specific research questions that the effort reported in this paper aimed at answering, in the context of the specific case, were: i) Of which activities and functions the management and operations of the viable Climate Resilience Providing Organisation (CRPO) will be comprised of? ii) To which formal/organogram units of the refinery these activities will be assigned to?
Following, in "Organisational Resilience to Climate Change Hazards" section, we briefly present the current discussion over climate-related organisational resilience. In "Organisational Viability, Climate-Change Resilience and theVSM" section we look at the relationship between resilience and organisational viability. We surface the need for a systems approach and introduce the Viable System Model. In "Methodological Design of a Viable Organization" section we discuss the methodological design of a viable organization, while in "A Viable Climate-Resilience-Providing Organisation for the Oil Industry: Context of the Case Study" section we introduce the case study by considering the climateresilience requirements of the oil refining organisation. "Research Methodology for the Energy-GR Case" section briefly describes the action research methodology followed in the context of action research carried out for the specific facility, and "Design of a Resilience Providing Organisation in an Oil Refinery" section describes the methodological 1 3 development of the distributed viable resilience-providing organisational unit for the specific oil refinery organisation. Finally, in "Conclusions" section, we draw the conclusions of our research.

Organisational Resilience to Climate Change Hazards
In general, a resilient organisation must have the ability to anticipate, make sense and respond to signals/events in a changing environment (Hollnagel and Woods 2006;Dijkstra 2007;Jackson 2007;Ruiz-Martin et al. 2017). In addition to its continuity with respect to the complexities of the socioeconomic environment in which it is embedded, every (production) organisation must also have the ability to operate under diverse climate conditions. Business continuity and organizational resilience have attracted increased interest over the last years, not only in connection to the economic and competition environment (Adamides and Tsinopoulos 2015;Hamel and Välikangas 2003), but also in relation to the natural environment and climate dynamics, which have become major societal issues .
Interest in resilience to climate change has resulted in the production of ("laundry")-lists of requirements and performance measures, however without any significant proposals on how to develop/design climate-resilient organisations in practice, taking into account the systemic nature of organizations per se, and their embedment in their environment. As far as the oil industry is concerned, lately there has been a shift of interest from risk assessment and management (Quantitative Risk Assessment (QRA) has become mandatory for the oil industry (Katopodis and Sfetsos 2019)) to resilience development. However, organisational characteristics and organisational design processes for such organisations have not been considered in a systematic manner. Although there is literature on how organisations withstand disturbances and discontinuities (e.g. Korhonen and Seager 2008;Burnard and Bhamra 2011), in general, limited theoretical and practical insights on climate-resilient organisations have been published.  have developed an integrative framework of activities for organisational adaptation and resilience to extreme climate events organised in phases. The framework is based on two streams of research: a) research on "high-reliability organisations", i.e. processes of identifying, understanding, evaluating, monitoring and revising unexpected situations and intervening before effects escalate, whose results, however, provide partially sufficient response to systemic changes responsible for more frequent and intense climate events, and b), research on how to absorb impacts of extreme events and restore performance in the affected organisation. The foundational base of the framework is completed by insights from ecological resilience and the concept of persistence, which measures the amount of disturbance that an organisation can absorb before it has to make significant changes in its operation (McDaniels et al. 2008). These foundational sources resulted in a four-phase framework of anticipatory adaptation, exposure, recovery, and post-impact determination of resilience.
The phases of anticipatory adaptation and exposure to climate events concern resources of any kind (material and human) and are associated with impact resistance, or robustness, measured by the coping range between two threshold values. Recovery, on the other hand, is directly linked to rapidity (speed of response), i.e. how fast the organisation reaches its "optimal" performance after a climate event (in that context "optimal" is synonymous to best possible performance, even with reduced assets (Linnenluecke and Griffiths 2012)).

3
Along the first dimension, measures to increase resilience after a specific event include better specifications for material assets (lower and upper threshold values), decentralisation of operational resources, diversity and redundancy of resources, whereas as far as the second dimension is concerned, processes to identify and make sense of problems fast, processes to introduce and set up backup resources, establishment of priorities, etc. (Wreathall 2017;Katopodis and Sfetsos 2019).
The activities related to the coping range to, and the rapidity of recovery from, a climate event of the oil sector in general, and refineries in particular, aim at the development and maintenance of a a set of general enabling capacities/capabilities, which include (Katopodis and Sfetsos 2019; Linnenluecke et al 2012): • Anticipatory capacity, linked to understanding risks at different temporal and spatial scales, early warning systems, and making risk projections and emergency scenarios. In organisational terms, this is directly related to sense making of climate events and their impact on organisational survival (Tisch and Galbreath 2018). • Impact absorption capacity, linked to increased defences and reduced vulnerabilities related to structures, technology, processes and operational areas. • Coping capacity, linked to enhanced cooperation and mounting effective response within-and across-organizational boundaries during crises. • Restorative capacity linked to processes of faster business recovery.
• Adaptive capacity linked to augmenting the organisation's ability to adapt to emerging threats and challenges and to be able to invest in new capabilities (through research, pilot used of new processes and systems, etc.).
The actual development and deployment of these capabilities is a complex endeavour due to their interdependencies, on the one hand, and spatial and temporal distances that exist between them, on the other. Hence, organisational resilience by ad hoc design is not effective and a systems perspective is required, taking into account capabilities' interdependent dynamics. Given that the requirements for resilience are set dynamically due to the changing climate, measures for impact resistance and absorption (revised specifications and protective measures) and processes for rapid recovery should be defined, implemented and updated dynamically taking into account changing conditions. In parallel, guaranteeing the continuity of resilience may be the task of a viable formal organisational unit/scheme, or of a viable virtual governance scheme distributed to many (or to all) formal units of the entire organization. This resilience-providing organisation should stay viable by adjusting its structure and operation to changing climate conditions, guaranteeing climate resilience under any circumstances.

Organisational Viability, Climate-Change Resilience and the VSM
In general, a viable organisation must have the ability to maintain its (separate) existence, no matter how its changing environment influences (or threatens) it. On the other hand, a resilient organisation must have the ability to withstand/recover from challenges and disrupting events, including those stemming from the natural environment and are related to climate change. Resilient and viable organisations share a number of important characteristics, such as evolution, self-regulation and adaptability (Ruiz-Martin et al. 2017). In the context of this paper, but also for organisations in general, they differ in that resilience is a requirement defined having in mind a broad range of possible threats, whereas viability is more endogenous and diachronic property of an organisation. In addition, viability and resilience can be operationalised at two different levels: the viability of a specific part of an organisation (the Climate Resilience Providing Organisation-CRPO) (level of organisational unit) is necessary for guaranteeing the resilience of the entire organisation (oil refinery in our case), i.e. to promote the necessary capacities mentioned in the previous section (level of the entire organisation). As it was mentioned above, Beer's Viable System Model is a cybernetic approach that forms the basis for the corresponding diagnosis and design methodologies for organisations that have the ability to survive in complex dynamic environments (Cardoso-Castro 2019), i.e. they are viable. To guarantee resilience at all circumstances, a viable organisation must have the ability to self-regulate its operation, learn, adapt and evolve (Beer 1989). This is facilitated by the (coordinated) autonomy of its operational elements, which respond/adapt to their own environment and its challenges. The VSM has already been employed for the design of human communities and organisations that foster adaptation to criteria of environmental and social sustainability (e.g. Leonard 2008;Panagiotakopoulos et al. 2016). This is however different from designing an adaptable organisation that provides uninterrupted resilience to extreme events stemming from the environment, to a wider organisation or community.
In brief, the VSM describes the content and structure/interconnections of five systems, necessary for a viable organization. System 1 comprises the primary operational activities carried out for accomplishing the objective of the organisation (implementation), i.e., in our case, for providing resilience to specific parts (formal organisational units, sites, areas-within-sites, etc.). In order to be more manageable, these activities may be further divided into sub-activities, and so on. Usually decomposition takes place until the level of individuals' actions is reached. System 2 provides coordination to System 1 activities, as well as conflict resolution and stability. Coordination mechanisms include standards, protocols, common language, operational schedules, etc. (Hoverstadt 2008). System 3 is responsible for delivery management. It provides resources, maintains the organisation's infrastructure, measures its performance, and optimises the execution of System 1's activities. System 3* monitors the execution of activities of System 1. Monitoring takes place to ensure that the management's will is implemented, and for building trust between managers and the units they manage. System 3 and 3* provide cohesion in the operation of the organisation. System 4 scans the environment, plans and "strategizes" (intelligence). System 4 compensates the interests of System 3 that looks "inside and now" with the findings of "outside in the future" (Hoverstadt 2008). Finally, System 5 is responsible for overall policy making and for constructing and guaranteeing the identity of the organisation (policy). Systems 1 and 2 are the operational functions, whereas Systems 3, 4 and 5 provide administration/strategic management to operational activities. System 1 comprises of a number of specialised operational units interacting with parts of the external environment, while System 4 does the same with projections of the current environment into the future, which are used for planning the operation of the system. All systems, from System 5 to System 1, are interconnected in various ways (as will be shown in more detail in the case study model in Sect. 7).

Methodological Design of a Viable Organization
The Viable System Model constitutes a model (structure and behaviour) for a viable organisation that can adapt to the environmental changes to survive and maintain its separate existence, usually defined w.r.t. its purpose. It is structured in such a way that allows the systematic management of complexity in the auditing of an organization for viability and diagnosing the related issues of viability (Viable System Diagnosis), as well as for developing/designing a viable organisation (Viable System Design).
VIPLAN is an essentially participative methodology to diagnose and design a viable organization system (Espejo and Reyes 2011;Jackson 2019). It comprises five steps. In order to explore the organisational identity that the diagnosis or design concerns, the first step concentrates in "naming systems" as transformational entities using the TASCOI (Transformation, Actors, Suppliers, Customers, Owner, Interveners) framework. TASCOI resembles the CATWOE framework of Soft Systems Methodology (Checkland and Scholes 1990), which however does not refer to real transformations but to the actors' appreciation of a situation. In VSM the transformation is assumed to be carried out through production activities and regulatory functions, the latter regulating the execution, as well as supporting and/or servicing the former (Espejo and Reyes 2011). Actors are those stakeholders that carry out the work of the organisation, i.e. the transformation, customers are those receiving the (tangible or intangible) outcome of the transformation, the owners adapt and guide strategically the organization, and interveners are those that can define and/or influence the context in which the organisation operates. The recursive nature of the organisational model necessitates recursive systems naming too.
The second step in VIPLAN is to identify the (defined in step 1) systems' activities that are necessary for carrying out the transformation, and their interrelationships. A hierarchical structure of primary and supporting activities is assumed, i.e. activities consist of sub-activities, which again can be unfolded to sub-activities and so on. Technological and structural models facilitate the execution of this step. In order to manage most of complexity locally, the third step ("unfolding complexity") deals with uncovering the recursive structure of the organisation, whereas the fourth step is to discuss and design the distribution of resources and discretion (decision-making power) from the global level to the most basic level of primary activities. Primary activities are the activities responsible for the production of the services (or products) of an organisation, whereas regulatory/support functions are responsible for the production, regulation and support of primary activities (Espejo and Reyes 2011). In order to be autonomous, i.e. to have a separate identity and be viable, primary activities must control the necessary resources and have decision making power. This takes place through the distribution of discretion to specific roles, which indirectly determines the degree of centralisation/decentralisation of the organisation. Finally, in the last step (step 5), the design of the organisation structure as depicted in the VSM model template, is carried out, taking into account the results of the four previous steps, and by allocating primary activities and regulatory functions to the five systems of the model.
Rarely VIPLAN, and the alternative but related "methodology to support self-transformation" (Espinosa and Walker 2013), are used in a strict step-by-step teleological fashion. They are adjusted according to the specific cases dealt with (e.g. Arghand et al. 2022), lately emphasizing their problem structuring perspective as a processes that facilitate participative learning in collaborative organisational diagnosis and design (Jackson 2019;Harwood 2021;Vik et al 2022).
Beyond the specifics of the methodologies mentioned above, overall, it is generally agreed that the employment of VSM in organisational design entails three main phases (Jackson 2019): The first phase concerns the definition of the focal organisation's identity, its purpose and its internal and external stakeholders. Tools, such as CATOWE and TAS-COI, can be employed to facilitate the structuring task. The second phase concentrates on "unfolding" the complexity of the organization, i.e. the consideration and analysis of the organization as a recursive structure, followed by the identification of primary activities which are necessary for achieving the purpose at each (recursion) level. Finally the third phase concerns the testing of organisation's designed viability. This is accomplished by reconsidering the design of systems 1 to 5 of Beer's VSM model and by asking queries about the structure and function of each system (1 to 5) in real, or simulated, scenarios of business (service-providing) processes execution.

A Viable Climate-Resilience-Providing Organisation for the Oil Industry: Context of the Case Study
In this section, we present the context of the action research carried out for the design of a viable resilience-providing organization in an oil refinery. The case concerns one of the major refineries and energy companies in Greece. Founded in late nineties, Energy-GR (the name of the company is disguised for reasons of confidentiality), is one of the leading energy groups in South East Europe, with activities spanning across the energy value chain. It operates oil refineries with storage facilities, as well as subsidiary companies responsible for a network of filling stations, renewable energy generation and retailing of energy products and services. Over the last years there has been a shift towards renewable energy production and supply, however, the company's major assets remain its refinery installations and its storage facilities, distributed across different sites in Greece and abroad in the South East Europe. The case study presented in this paper concerns a specific refinery site which is located in wider Athens area.
Before the action research study was undertaken, the climate-related resilience strategy of the organisation was based on its Safety Plan. This means that resilience was considered as equivalent to safety. When an (extreme) weather event affected the infrastructure and operations of the organization, a formal recording was being made and communicated to all the stakeholders of the unit that was directly associated with the damage. Pre-defined in the safety manual standard shutdown and recovery procedures were being triggered. The basis for these activities was the associated national regulations and broader legislation, and the industry and international professional community's standards (American Association of Chemical Engineers), which, however, were tailored for the specific organization.
In the shutdown and recovery procedures priority was always given to the human resources (personnel safety) over process safety, which was also a requirement. The whole process was coordinated by a formal "shutdown committee". In addition, while shutdown and recovery procedures were underway, investigation and recording of the causes of the failure were being made. After formal and informal sessions of reflection and analysis to enhance learning from the events were being organised, the results of the investigation were being disseminated to the organisation to be taken into account when similar situations arose. Furthermore, the results of the analysis were being discussed in the regular meetings of the Safety Committee. For every organization site, the role of safety engineer was assigned to engineers and other technical personnel. These employees were responsible for allocating and coordinating safety responsibility to finer grain (sub)units. Those assigned safety-related responsibilities and tasks were trained at regular time periods, and accident scenarios simulations were carried out to assess the effects of weather events on the facilities, human resources, and the surrounding natural and built environments. Overall, the approach to climate resilience was safety-centred and reactive, based on analysis of past events, assuming relatively similar climate conditions. Hence, there was always the danger of a fluctuating level of resilience as the firm was adapting to the experiences of a changing environment (ecological adversity) (Clément and Rivera 2017).
In view of repeated extreme climate events that revealed climate change and its impacts, it was decided to enforce resilience in a systematic way and to proceed with the design of an organisation-within-organisation that would be responsible for providing uninterrupted, not fluctuating, resilience to climate change, managing the complexities of its consequences. Inevitably, such an organisation ought to be an informal one, structured by roles, responsibilities and processes distributed across the formal organisational units of the company. This was the proposed option of Energy-GR in order to maintain the distributed organisational culture of its safety system. The degree of involvement of company employees in this organisation would be varying from marginal to full-time according to the design. The design effort was assigned to a team of managers and external academics and researchers that used the concepts of the Viable Systems Methodology and elements of the related VIPLAN method, in the context of an action research study. Before moving to the design of viable organisation, the project commenced by determining the effects and risks of climate change to the oil industry in general and to the specific company in particular (Katopodis and Sfetsos 2019; Katopodis et al. 2021).

Research Methodology for the Energy-GR case
The action research approach of Checkland and Holwell (1998), based on the FMA framework (Framework of ideas, Methodology, Area of concern), was used. In brief, the area of concern was to understand the organizational interventions required for implementing a distributed viable organisation that would provide resilience to (future) climate events in the specific site. The method used was VIPLAN in the context of the three phase process (Jackson 2019), modified for the specific case as far as depth of analysis was concerned, to guide the activities of the research team. The framework of ideas came from existing analyses of organisational resilience to climate change, assessments of the possible effects of climate change to the oil industry in general, and of course, the theory and practice of the organisational cybernetics as reified in the concept of viable systems (Beer 1989). The challenge was to yield knowledge about viable organisational resilience to the dynamics and complexity of climate change (F), as well as about the application of VSM (M) in the specific, or similar, application context(s) (A). Five researchers were involved in the effort: two senior refinery managers with engineering background, directly associated with sustainability and occupational safety and health activities; two climate scientists directly involved in the climate-related resilience and risk management assessment of critical infrastructures; and, one organisation systems management researcher. The whole effort was led by one of the climate scientists (a mechanical engineer by training), actively supported, as far as the method of inquiry was concerned, by the organisation systems management researcher. The rest of the team contributed according to the members' specialisations and experience, as the project unfolded. The research effort lasted almost three years due to the pandemic. In this period, twelve site visits were made by the external to the organisation researchers, and nine teleconference sessions were organised.
After a brief introduction to VSM by the organisation systems researcher, the research team commenced the design effort with carte blanch, i.e. no effort to carry out a formal Viable System Diagnosis was made, since no resilience providing organisation, of any form, existed before, and the drawbacks and limitations of the previous conceptualisation of resilience in the refinery were very obvious, i.e. direct association with safety, absence of autonomy of units in safety requirements modifications, non-existent mechanisms for climate-change scanning, etc.
In carrying out the design, taking into consideration the specifics of the case, each of the three generic phases (Jackson 2019) comprised the following tasks/activities carried out by the research team, almost in a sequential manner with the necessary back-and-forth's: Phase 1: The aim was to arrive at a structured basic definition of the system/organization at the specific site (refinery). The CRPO system definition for the case site (refinery referred as Site II) was developed according to the TASCOI framework. Phase 2.1: The climate parameters of interest were identified along with the primary activities of the CRPO (technological modelling) and the unfolding of complexity of the organisation. The climate parameters which were subject to change, and which impacted the assets of the refinery were identified and grouped. This was followed by the identification of potential hazards resulting from every climate parameter. The impacts of exceeding values of climate parameters were determined. In the same phase, the unfolding complexity for assets and hazards was accomplished though the following activities: Identification of operation units on the basis of the organogram and their spatial distribution in the site.
Identification/inventory of assets for each of the above units.

Identification of hazards for each asset and vice versa.
Grouping of assets and hazards for every operational unit of the site.
The relations of primary activities to regulatory functions were also determined along with the association of regulatory functions to formal organisational units.
The distribution of System 1 functions to operational units defined in 2.1 was carried out. Phase 2.3: System 2, 3, 4 and 5 structure, interdependencies and functionality were defined. Phase 3:Reflection on, and testing of, organisational design was accomplished by revisiting and reflecting on design questions, and by considering future climate scenarios and the (potential) response of the five systems model.
As depicted below in more detail, elements and tools of VIPLAN were spread in the three phases as the method proceeded. Phases 1 to 3 were repeated recursively for subsystems. Indicatively, in Sect. 7, we provide the naming/identity of lower level system.

Identification of the System
The first step in our action research was to define (name) the system/organisation (Climate Resilience Providing Organisation, CRPO) for the oil refinery as a whole, in terms of the transformation that it would carry out. For the specific case, this transformation was defined as.
" A system that transforms legislation, resource, operational, and climate related information based on climate scenarios, past events and responses to events, into efficient proactive and reactive interventions that enhance the continuity of operations of an oil refinery's organisational units through increased impact resistance to, and rapidity of recovery from, extreme weather events with the minimum possible human and material cost." In the same line, the rest of the items of the TASCOI framework were defined as follows: Actors:Managers and other employees of formal organisational units involved in the planning and operation of the climate resilience providing organisation (assigned as core, or part, of their job description). Suppliers: Suppliers of future meteorological scenario-based, or actual, data, technical data from monitoring machinery, medical information, recordings of past responses, legislation, etc. Customers:Managers, other employees, as well as external contractors responsible for carrying out the formal organisational, or spatially laid out, units' operational tasks in the refinery. Owner:The Climate Resilience Providing Organisation (CRPO) and its management. Interveners: The company's top management, technical and scientific personnel, as well as external authorities related to climate change, extreme weather events, and civil protection.
When one wants to provide/enhance resilience in an organisation, she has to evaluate the current internal situation, to identify current and future potential threats, to evaluate the associated risks, to set priorities and to develop and implement proactive and reactive responses. As a consequence, the entire transformational activity of the resilience-providing system/organisation was organized into four sub-activities/transformations at-large (activities and supporting functions) that ought to be carried out for the transformation: the collection, organization and transformation of the information related to the past and future occurrence and impact on the enterprise of extreme weather events into a usable form; risk assessment and priority settings for support in response to climate events; the development of operational specifications and thresholds for normal operation for all the assets of the organization in all units; and, the development and implementation of recovery/stabilization procedures that need to be employed once an extreme climate event occurs (Fig. 1). As it was already indicated, input information, in addition to the current state of resources, has to be retrospective, based on past events, and predictive based on climate scenarios.
The transformation concerned different levels of organisational units: from the entire company to the specific site (e.g. oil refinery), down to individual units (e.g. storage tank farms).

Structural Underpinning of CRPO
Climate-related hazards were identified and analysed for determining the specific information which should be collected and be available to CRPO at any time for estimating the resilience requirements of the individual units of the refinery. The climate hazards that were taken into account, in aggregated form, obtained from the literature, as well as by data reported by the related organizations and the specific refinery management, are presented in Table 1. These climate parameters indirectly provide an estimation of the likelihood of the climate-induced risks and contribute to the identification of the operational and structural thresholds. As such, they have been divided into two separate categories, referring the climate drivers, which are the direct outcome either from observational data and in situ measurements, or from Global or Regional simulation models (GCM/RCM) and seasonal forecasting models, and climate hazards, which are direct consequence of climate drivers. Climate change is anticipated to modify the distribution of the extreme values of climatic actions, therefore to impact the design values of climatic parameters of resources, leading to increases of the mean or maximum of their values (Athanasopoulou et al. 2020). According to the different impacts climate hazards have on different resources, taking also into account operational and topological differences, resilience-providing activities were grouped into four categories: those for operational units, buildings and personnel, logistics infrastructure-storage and logistics infrastructure-transportation.  For the specific facility, possible climate hazards need to be identified on the basis of local geography, as well on the impact of climate extreme events experienced in the broader region in the past. In prioritising resources, the resilience-providing organization ought to obtain information on, and be able to address, the following impacts of climate hazards: • direct impacts on the main processes of the refinery (loss of functionality, service, and operations), • loss of infrastructure (e.g., destruction failures), • cascading effects from other critical infrastructure sectors, such as electricity/transport/water that affect the integrity and operations of oil assets, as it was already mentioned, • changes in the provision of "services and products" to the society, such as those stemming from changes in demand and consumption patterns, • indirect impacts (including externalities such as societal costs). Figure 2 depicts the unfolding of complexity for the organisation and the specific refinery site, focusing on a particular organisational unit (the refining process), at the bottom of the diagram. The resilience providing primary activities were distributed in all formal organisational units in the same manner. In this figure, the unfolding of complexity is based on a variety of criteria: at the top, on technology, then, on customers, followed by geography and asset grouping, down to the technologies at the specific site. The dimension of time is not included in this chunking.
The specific case presented in this paper mainly concerned the Energy-GR's oil refinery referred to as Site II and its satellite storage facilities, as well as the company-owned private port. The FCC-type refinery was initially built in the late fifties, but today is one of the most modern refineries in Europe. Over the years it has undergone several upgrades installing novel technologies as well as increasing its capacity. Today, it has a refining capacity of 148,000 bbl/d and its technological infrastructure includes a fluid catalytic cracker (FCC), a vacuum distillation unit, a mild hydrocracker and a visbreaker for processing atmospheric residue. It has a significant gasoline production capacity through the isomerization and reforming units (CCR). The refinery fully complies with the new environmental regulations and safety requirements, and delivers petroleum products in accordance with the highest EU standards. Table 2 depicts, indicatively, the knowledge items required for implementing climate resilience activities in the refinery. It should be noted that the shutdown and restart processes are part of the recovery process, whose exact specification requires the definition of the exact shutdown activity sequence, the rigorous check for damages procedures, the repair standards used, and the exact switch-on procedure. As climate and internal refinery conditions change, this table needs to be reviewed and updated continuously, providing learning opportunities for the climate resilience-providing personnel.
Actions are specific to certain states of the facilities, assuming specific climate scenarios. The viability of resilience provision by updating the refinery's knowledgebase can be obtained by the establishment of a cybernetic mechanism that updates thresholds (coping range) and recovery processes in the table according to changing asset conditions, climate scenarios and related information. Assets change state as a result of normal (time) wear, as well as because of their exposure to past extreme weather events. In the operation of this mechanism, an important role is played by the regulatory functions, which participate in the production and regulation of primary activities. Figure 3 below shows the technological model of CRPO whose primary activities for each defined group of assets (operations, buildings and personnel, logistics (storage and transportation)), for each formal organisational unit, were the "maintenance and improvement of coping range" (bottom of diagram) and the "development and efficient execution of recovery processes" (top of diagram). The exact definition of these two activities was the result of analysis of the oil sector, incorporating specific information supplied by the technical personnel of the specific refinery. Figure 4 depicts the unfolding of complexity of the CRPO for a specific unit (in general, could be any unit in Site II) down to the level of primary activities. In effect, it shows the tasks that need to be accomplished with respect to climate resilience in any formal, or topologically defined, organisational unit. For proactive climate resilience,  any improvement and maintenance activities need to be based on knowledge of the current state of the assets (including human resources protective structures), as well as knowledge of the possible, current and future, climate induced hazards. The latter is also needed for the development and efficient management of recovery processes. The regulatory/supporting functions required by the primary activities of the CRPO were identified and linked to primary activities in the corresponding tables, as Table 3 below indicatively depicts. The formal Energy-GR units, in which these functions needed to be distributed, were also determined ( Table 4). The regulatory/supporting functions for the primary activities were: knowledge of internal (refinery) resource assessment w.r.t. climate-induced hazards development (auditing process); development of future climate scenarios to identify potential hazards; development of Climate Risk Assessment Matrices (CRAM) (Katopodis et al. 2021) in order to prioritise hazards and responses; training of the "dedicated" CRPO representatives and managers and also the rest of the employees in the units; determination of the thresholds for the human and non-human assets (again w.r.t. climate-related hazards); development of recovery procedures comprising the elements depicted above; coordination of the recovery processes that extend to more than one formal units and areas; maintenance of the facilities at the state assumed in resilience provision decisions; and, determination, at the strategic level, of the resilience requirements for the entire facility, i.e. which level of resilience to climate events is required for the entire facility, what are the corresponding technical specifications, the level of acceptable losses, the recovery times, etc.
As it was already indicated, the primary activities and certain supporting functions/ activities will be carried out by CRPO representatives in formal units. As depicted in Fig. 3, the direct association of regulatory or supporting functions with primary activities determines distribution of discretion and the degree of centralisation/ decentralisation of CRPO. In developing the CRPO for the specific refinery, the aim was to decentralise resilience-provision as much as possible by distributing regulatory capacity and embedding support functions in all formal organisational units. In this way, the units of the refinery would be able to respond to climate-induced hazards autonomously, improving the efficiency and viability of the organisation. For instance, dedicated training will take place for every primary activity. Moreover, as redundancy of support functions would be inevitable in such endeavour, it would increase the resilience of the CRPO per se, which is also desirable.
As Table 3, indicates, overall, resilience requirements are defined at the site level and can be updated exceptionally at specific situations through direct links with primary activities (algedonic link in VSM). The "Audit of state of asset" activity requires knowledge about what and how to audit, appropriately trained personnel to be carried out, as well as knowledge to assess assets and determine their maintenance requirements. Similarly, the "Acquisition of hazard knowledge" primary activity requires knowledge and information about hazards stemming from anticipated climate conditions ("Future climate scenarios development" support function), about risks associated with them and appropriate training to make sense of them. Following, the execution of "Implementation of required resilience state" activity is regulated by the assessment of the associated risks (depending on the assessment of risk associated with an asset, the appropriate emphasis is given) and training for implementing the appropriate level of resilience (coping range) as it is dictated by the technical specifications provided by the corresponding regulatory function.
In the same manner, for the activities involved in the management of the recovery process, in order to organise assets, roles, and priorities, the "Analysis of hazard information" activity needs to be supported with information about hazards stemming   from anticipated climate conditions ("Future climate scenarios development"), knowledge of the associated risks, and appropriate training to take advantage of them. For the "Definition of recovery process" activity, which, in effect, instantiates a generic process for a specific situation, knowledge of the generic process is required ("Recovery process development" support function), as well as risk information to prioritise actions, knowledge to assess the state of the assets involved ("Assessment and maintenance of facilities") and appropriate training to carry out the task efficiently. Finally, the "Management of execution of recovery process" primary activity is regulated by the coordination mechanisms developed in the "Coordination of recovery processes" and supported by information from the "Risk management" (to define priorities) and "Training" functions. For the distribution of regulatory and support functions to the formal organisational units of the refinery, it was decided that resilience policy and requirements development would be the responsibility of the management of the refinery (SMGT). The Health, Safety and Environment (HSE) department would undertake most of the remaining functions with exceptions of the highly technical ones ("Internal resource assessment" and "Assessment and maintenance of facilities". "Risk management", "Training", "Coping range specifications development" and "Recovery processes development" would (also) be responsibility of Engineering (ENG). The last three functions, with the addition of "Coordination of recovery processes" were assigned to the Logistics (LOG) unit. It was decided that the Maintenance (MNT) department, among other tasks, would carry out the "Internal resources assessment", "Assessment and maintenance" and "Training" functions. In addition to these, the Reliability/Support (RLS) unit will take responsibility for "Risk management", as well as for "Coping range specifications development". Finally, the three actual oil process units (CRC, UTL and REF) will be all also responsible for the "Recovery processes development", "Coordination of recovery processes" and "Assessment and maintenance" regulatory functions (Table 4).

Development of a viable Climate Resilience Providing Organisation using the VSM
The VSM model depicts implicitly, in a more structure way, the relationships between primary activities and regulatory functions. Primary activities are associated with System 1, whereas regulatory functions are the object of Systems 2 to 5. Table 5 below lists a series of questions that guided the design of the systems of the CRPO in the context of VSM. Providing direct and indirect and indirect answers to these questions provided leads for specifying the functions of the five VSM systems and for distributing regulatory functions to the five systems of VSM.
Based on Table 5, and on the distribution of regulatory functions, together with the formal units in which they are implemented, to the VSM (sub)systems (policy (S5), intelligence (S4), cohesion (S3), coordination (S2) and implementation (S1)), as determined by the research team and depicted in Table 6, the overall organisational model described in Sect. 7.4 was developed. As Table 6 indicates, the "Health, Safety and Sustainability" (HSE) department will play the most crucial role in the management of the CRPO, while coordination and cohesion will concern most of the units of the organisation. On the other hand, policy will concern the site management (SMGT) and "Health, Safety and Sustainability" (HSE) units. Scanning for information about (future) climate change, protecting and mitigating technologies, methods, best practices, legislation changes, etc. by answering the following questions: Which climate models to choose for building future climate scenarios? How can we associate future climate scenarios to hazards and impacts for the companies' assets? Which technologies can increase the coping range associated with our assets? Are there technologies that can increase the speed and effectiveness of recovery processes after climate events? Which innovative organizational schemes can increase the speed and effectiveness of recovery processes? What is the current state of our assets? What is the current state of the resources used in resilience providing primary activities? What is the current state of the resources used in resilience providing monitoring functions? How is sense-making accomplished? Is the personnel appropriately trained to make sense of past events, internal and external conditions?

The CRPO Viable System Model
Based on the above analysis, observations and discussions within the action research team, but also with other stakeholders of climate resilience, the systems of the Viable System Model as response to the questions in Table 5, which correspond to the structure of the CRPO, as proposed to the management of Energy-GR, can be outlined as below.
In addition, Table 6 depicts the organisational units involved in the actual implementation of the systems.

System 1
System 1' main task is implementation and comprises the actual primary activities of the resilience-providing organisation. The Climate Resilience Providing Organization will be parallel to the formal organization and using (internal and external) customers (the formal organisational units) as a complexity driver will be distributed across the refinery operations/activities and formal organisational units, i.e. the refining process, crackers, turbines, as well as the Engineering, Maintenance, Distribution departments and other support units. The management activities concern both pre-active and re-active measures. The complexity of the management of the resilience of each of these activities is facilitated by further chunking complexity into managing operations, logistics infrastructures, and buildings and personnel (occupational safety and health) (technology complexity driver). Not all management objects are given the same importance in every operation/activity. For example, resilience of human resources working outdoors in FCC units to extreme temperatures is more important in this domain. The task of managing resilience-providing primary activities to climate events is distributed to specific employees within each formal unit/operation, given the role of CRPO representative. Tasks and responsibilities need to be appended to the job descriptions of the employees assigned this role.  Table 6 Distribution of regulatory functions to VSM systems The implementation system (S1) concerns the primary activities of resilience provision (Fig. 3), which are distributed to all formal units of the refinery Implementation (S1)

System 2
System 2 provides coordination among the operations/primary activities of System 1. This is primarily through the development and dissemination of a "Climate Resilience Manual" with responsibilities, actions and communication protocols among different operations/ activities that need to be carried out in each unit when building resilience (coping capacity), e.g. through resource redundancy, as well as for withstanding and recovering from specific disturbances in an efficient way (recovery processes). In the latter, coordination is carried out by defining responsibilities and communication protocols in shutdown and recovery processes that extend to different operating units, especially for Natech events. Also, coordination is achieved by enforcing generic rules, such as "Most affected unit/ operation leads the recovery process". Responsibilities for recovery coordination are allocated to personnel that are at the interface of each operating unit, i.e. their job description includes formal and informal communications with members of other units.

System 3
System 3 is responsible for providing thresholds, recovery activity manuals, orders to implement better coping capacities, etc. In general, System 3 is responsible for resource allocation, performance target setting, and performance measurement, as well as for the assessment and management of risks. Its tasks include the allocation/assignment of employees responsible for resilience at each formal organizational unit (it is not their only task), their training for recovery procedures, the development and communication of time frames for response to, and recover from, climate-induced events, and the determination and communication of damage repair budget limits for each organisational unit. This system is also responsible for the performance measurement of each unit and its assessment with respect to the standards set. The Climate Change Risk Management committee operates at the level of System 3. The activities and functions of System 3 are accomplished by cooperating managerial personnel of the Heath Safety Environment (HSE), Finance, and Engineering units, as well as internal audit/control managers.

System 3*
System 3* comprises a set of rules and norms for sporadic and detailed checking of the performance of an operational (formal) unit with respect to a specific dimension of climate resilience only, e.g. climate-related occupational health and safety in the crackers unit. This task is undertaken by the CRPO representative with the help of System 3 managers.

System 4
System 4 is responsible for scanning the external and internal organizational environment with respect to climate-induced hazards, and for making sense of past climate events, as well as of future climate change scenarios and the degree of potential exposure to anticipated climate events and their effects. In this line, it is responsible for training those responsible for climate resilience to understand extreme weather events and assess their risks and impacts. It is also responsible for scanning the external environment for new rules, government legislation, etc., and for explaining their meaning and impact to the organization. Finally, it is responsible for identifying climate resilience technologies and for their adoption, as well as for developing threshold operational values to weather extremes for human and non-human resources. These tasks are accomplished by personnel from the Health Safety Environment (HSE) department, cooperating external climate scientists, personnel and managers from the Engineering and Maintenance departments, as well as by risk managers.

System 5
This system top level system is responsible for ensuring that all the distributed activities and resources of the other four systems adhere to the scope and identity of the Climate Resilience Providing Organisation (CRPO), at different levels of complexity. For this purpose, the higher level management of the refinery sponsors a dedicated communication channel to all climate resilience stakeholders though a dedicated web micro-site and e-mail list. System 5 is responsible for fitting the CRPO to the actual operation of the refinery, i.e. defining the interfacing of the RPO system with the other systems of the refinery. The Climate Resilience Committee with the manager responsible for CRPO and representative managers from all major organisational units (HSE, Operations, HR, finance, etc.) operates at this level, and is responsible for the development of strategic plans for CRPO, as well as for overseeing the balance between exploration (considering new initiatives) and exploitation (strengthening existing activities and structures) in resilience management through risk assessment and initiatives' prioritisation.

Testing of organisational design
At the last stage of the research method applied, after revisiting Table 5 and reflecting on the degree of response of the design to the corresponding questions, the response and viability of the CRPO to the effects of future climate scenarios was examined in a simulation study. Climate simulations with the Advanced Weather Research and Forecasting (WRF-ARW) (v3.6.1)model, forced by EC-EARTH, which was dynamically downscaled to the region of Greece at a scale of 5 × 5 km 2 ,were performed for the future period (2025-2049), for two RCPs (4.5 W/m2 and 8.5 W/m2) (Katopodis et al. 2021). External academic researchers were involved in this endeavour, supported by the management of the HSE department (System 4). Risk analysis indicated the necessity of changes in the coping range of the units exposed to the new climate conditions (System 3). As part of the operation of the same system, after consulting site budgets produced in System 5, the set of financial and technical resources required by the most exposed formal units, were determined and allocated, under the guidance of the CRPO representatives who had more complete knowledge of the associated primary activities (System1). In the specific simulation exercise, the assumed increase of the maximum temperature necessitated an increase in the coping range of (plastic) pipelines, distillation equipment, and valves by augmenting their specifications, as well as the need of taking additional protective measures for the personnel working outdoors. Since changes concerned mainly technical structures, the Engineering Department was assigned the task (by System 3 managers) of coordinating the changes in the formal units (System 2). Figure 5 below shows the VSM of the proposed organisation, highlighting the principal functions of each (sub)system. The model depicts the chunking of complexity in System 1 along two recursion levels: asset groups and formal (organisational) units 1 3 where the assets are located, as the same, or similar assets, were present in different typical (organogram) organisational units.
The VSM of Fig. 5 was instantiated at both higher and lower levels of recursion. For instance, based on the structure of Fig. 3, Table 7 below shows the corresponding TAS-COI definition for a lower level organization. The particular lower level CRPO concerns the oil tank storage farm, which is a unit of the Storage function in the Logistics department. Corresponding Viable System Models were developed.

Conclusions
Climate change does not follow a linear path. As a consequence, climate parameters exhibit unpredictable behaviours in time, and also differ from place to place. As a result, the effects of extreme weather events associated with climate cannot be predetermined with certainty for quite long periods, so that appropriate measures for people and the built environment are taken. Continuous monitoring of climate dynamics and its effects -even at the microclimate level -by an organisation that is viable and does not become obsolete after climate and other environmental changes take place, is necessary to adjust proactive and reactive response strategies to climate-induced hazards. This is of particular importance to industrial facilities, such as oil refineries, where the people and technical infrastructure of the facility and the surrounding communities are exposed to the effects of extreme weather on hazardous materials stored and being processed. The organisational resilience of the facility, as a whole, has to be continuously adjusted to account for novel weather-induced hazards produced by the changing climatological conditions, as well as for the ad hoc changes that take place in the organization.
In this paper, through an action research study in an oil refinery in Greece, we attempted to show how the Viable System Model and the VIPLAN method can be employed for reinforcing organisational resilience to the dynamics of climate change by designing an organisation that provides uninterrupted resilience through adaptation. The specific objective of the study was to design a Climate Resilience Providing Organisation (CRPO) in the refinery, a distributed organisation-within-organisation with the appropriate level of autonomy in its elements for easy adaptation, responsible for providing uninterrupted resilience to climate change.
Towards this end, we developed proposals for the structure and operation of a distributed CRPO organisation-within-organisation located in the cybernetic loop between the external environment (natural and built) and the refinery's operations. The VIPLAN method was used to structure the inquiry and guide the activities of an action research team in arriving at required organisational structure, i.e. definition and distribution of functions and activities of the resilience-providing organisation to the formal organisational units. The CRPO will provide resilience to (possible) climate induced hazards using different forms of information, by augmenting the coping range and response efficiency of Table 7 Climate resilience provision at the refinery's storage tank farm Climate resilience provision to refinery's oil storage tank farm (TASCOI) Upstream system (level 0) Logistics resilience providing organisation Recursion level 1 Storage resilience providing organisation Recursion level 2 Oil storage tank farm resilience providing organisation Transformation Oil storage facilities exposed to climate events to storage facilities with resilience to unpredictable climate events Actors CRPO representatives in oil storage farms Suppliers HSE employees, Engineering employees, Maintenance employees, etc Customers Those responsible for the management of the oil storage tank farm, employees, etc Owner The CRPO management Interveners Other departments/units' managers and employees, top management, etc