Experience has shown that multiple, unrelated and sometimes benign perturbations have challenged our systems in complex ways we would have never expected. High-consequence scenarios can emerge as a result of the occurrence of multiple unrelated events. Traditional system safety evaluations (e.g., Failure Modes and Effects Analysis) often model the response of the system to a single perturbation (failure or process deviation). Accident scenarios predicted by these models tend to be incomplete. From a risk management point of view, relying solely on such analyses, may cause relatively unimportant issues to receive excessive attention, while other important issues may go unidentified.