Before working directly with Colombia’s National Disaster Risk Management System (SNGRD), I understood it the way most people do: an entity that “shows up” after an emergency. Working as Technical Advisor for Cali’s Secretaría de Gobierno, leading the city’s What Works Cities certification process from Bloomberg Philanthropies — which made Cali the fourth Colombian city to earn it, for data-driven decision-making — and earlier as a technical infrastructure advisor for the city’s risk-management secretariat, I learned that the SNGRD isn’t an entity. It’s a system, with a deliberate institutional architecture that starts long before a disaster and continues long after.

The SNGRD is grounded in Ley 1523 of 2012, which replaced the previous model — centered almost exclusively on emergency response, inherited from Decreto-Ley 919 of 1989 — with a comprehensive risk-management approach. That shift matters more than it sounds: moving from “responding to disaster” to “managing risk” means prevention, land-use planning, and vulnerability reduction become responsibilities as central to the system as the response itself. Colombia’s Unidad Nacional para la Gestión del Riesgo de Desastres (UNGRD) is the national coordinating entity, but the law distributes explicit responsibilities to departments and municipalities too — it’s not a centralized system, it’s a cascading one where every territorial level carries its own obligations.

The system’s three pillars

Ley 1523 organizes risk management into three processes that reinforce each other, not a linear “first this, then that” sequence:

  1. Risk knowledge: identifying, analyzing, and monitoring hazards and vulnerabilities — from seismic microzonation studies to landslide monitoring — to build a real technical basis, not an intuitive one, for decisions.
  2. Risk reduction: acting on that knowledge before the event occurs, through land-use planning, mitigation works, and building codes like NSR-10, which translates seismic risk knowledge into concrete structural design requirements.
  3. Disaster management: the operational response once an event has already occurred — including the EDAN damage and needs assessment — and the recovery that follows.

These three pillars only work if they’re connected: a municipality can have the best response plan in the country, but if it never invested in risk knowledge, it will respond blindly to an event that could have been anticipated.

How the municipal level fits the national one

One of the most concrete lessons of working directly inside a municipal risk-management secretariat is seeing firsthand how Ley 1523’s architecture plays out locally: every municipality must have its own Municipal Risk Management Council (CMGRD) and its own municipal risk-management plan, articulated with the departmental plan and, ultimately, with the National Risk Management Plan. In Cali, that articulation shows up in very concrete decisions: which mitigation works to prioritize on slopes with a history of landslides, which road corridors need additional studies before intervention, and how that information gets reported upward to UNGRD in a form comparable with other municipalities across the country.

The What Works Cities certification we led for Cali wasn’t a risk-management project per se, but it shared the same underlying logic: institutions that make decisions based on consistent, comparable data — rather than isolated intuition — end up managing any kind of risk better, seismic or otherwise.

Closing

Seen from the inside, the SNGRD is less an emergency-response entity and more an institutional infrastructure for managing information and decisions under uncertainty — strikingly similar, at its core logic, to any well-designed data system: consistent capture, clear aggregation levels, and a chain of responsibility connecting what happens in a Cali neighborhood to national public policy. Understanding that architecture, beyond the next emergency headline, is what actually gives citizen-level preparedness an institutional system behind it.