ACKNOWLEDGEMENTS

Special acknowledgement and appreciation to the Interagency Committee on Dam Safety

for their support and technical advice in the preparation of this document.

Department of Agriculture

Department of Defense

Department of Energy

Department of Interior

Department of Labor

Federal Emergency Management Agency

Federal Energy Regulatory Commission

Nuclear Regulatory Commission

Tennessee Valley Authority

United States Section of the International Boundary and Water Commission
On the cover.— Photograph of Glendo Dam, Wyoming, taken from right abutment showing 

main embankment and spillway.
i

ACRONYMS AND ABBREVIATIONS

ALARP as low as reasonably practicable

ANCOLD Australian National Committee on Large Dams

BCHydro British Columbia Hydro

DSC Dam Safety Committee

EMA Emergency Management Agency

f-N plot annualized failure probability vs. number of fatalities plot

F-N plot probability per year of potential life loss ≥N vs. number of fatalities (N) plot

IRRMs interim risk reduction measures

O&M operations and maintenance

SBA Standards Based Approach

iii

CONTENTS

Page

1.1 Background...........................................................................................................................5

1.1.1 Risk Analysis..........................................................................................................7

1.1.2 Risk Assessment .....................................................................................................8

1.1.3 Risk Management ...................................................................................................9

1.1.4 Risk Communication ..............................................................................................9

2.1 Objectives of the Guidelines.................................................................................................9

3.1 Risk Analysis......................................................................................................................11

3.1.1 Risk Analysis/Risk Estimation .............................................................................11

3.1.2 Types of Risk Analysis.........................................................................................12

3.1.2.1 Potential Failure Modes Analysis....................................................... 12

3.1.2.2 Screening Level Risk Analysis........................................................... 13

3.1.2.3 Periodic Risk Analysis........................................................................ 13

3.1.2.4 Issue Evaluation Risk Analysis........................................................... 13

3.1.2.5 Risk Reduction Analysis..................................................................... 14

3.1.3 Quantitative Versus Qualitative Risk Analyses....................................................14

3.1.4 Risk Analysis Results ...........................................................................................14

3.1.4.1 Preparing the Dam Safety Case .......................................................... 15

4.1 Risk Assessment .................................................................................................................23

4.1.1 Risk Assessment/Risk Evaluation Process ...........................................................23

4.1.2 The Dam Safety Case............................................................................................25

4.1.3 Approach to Making Risk-Informed Decisions....................................................25

4.1.4 Tolerable Risk.......................................................................................................26

5.1 Risk Management ...............................................................................................................29

6.1 Risk Communication/Public Awareness.............................................................................33

6.1.1 Internal Communication within a Dam Safety Organization ...............................33

6.1.1.1 Dam Site and Project Site Personnel .................................................. 34

6.1.1.2 Local Level of an Organization .......................................................... 34

6.1.1.3 Technical Elements of an Organization.............................................. 35

6.1.1.4 Decision Making Level of an Organization........................................ 35

6.1.2 Communications with Stakeholders .....................................................................35

6.1.3 Communications with the Organizations and the Public Impacted by the

 Dam....................................................................................................................36

7.1 References...........................................................................................................................39

Tables

Table Page

1 Joint Federal risk categories.......................................................................................... 30
iv

Figures

Figure Page

1 Relationship between risk analysis, risk assessment, and risk management. ................. 6

2 Recurring dam safety activities....................................................................................... 8

3 Bureau of Reclamation [4] f-N plot.............................................................................. 16

4 U.S. Army Corps of Engineers [7] F-N (societal risk) plot.......................................... 17

5 Australian National Committee on Large Dams [2] F-N (societal risk) plot. .............. 18

6 New South Wales Dam Safety Committee [8] F-N (societal risk) plot........................ 19

7 Qualitative risk matrix. ................................................................................................. 20

8 An f-N plot showing individual potential failure modes and total risk [4]................... 21

9 An F-N plot showing cumulative risk [7]..................................................................... 22

Appendices

Appendix

A Guidelines on Risk Terminology
Federal Guidelines for Dam Safety Risk Management

5

1.1 Background

Agencies, owners, and regulators have been using risk1for quite some time to 

inform decisions within various industries across the world. In particular, the 

United States, the United Kingdom, the Netherlands, and Hong Kong have 

integrated risk into safety decisions in various ways since the 1960s [1]. Those 

entities that analyze, evaluate, and manage risks have found that risk provides a 

rigorous, systematic, and thorough process that improves the quality of, and 

support for, safety decisions. In addition, several entities in the dam safety 

industry have been using risk to inform decisions since the late 1980s. Notably, 

the Australian National Committee on Large Dams (ANCOLD) [2], British 

Columbia Hydro (BCHydro) [3], and the Bureau of Reclamation [4] adopted risk 

management2strategies to assess and manage risks for their dams. For entities 

that own or regulate dams, various decisions are made regarding an individual 

structure or a portfolio of structures, including decisions about:

 The safety of a structure

 Necessary actions to reduce risks

 Prioritization of actions for a portfolio of structures

Using risk to inform decisions involves three distinct components. These 

components, each having their own purpose and function, are:

 Risk analysis

 Risk assessment

 Risk management

Figure 1 shows how risk analysis3, risk assessment4, and risk management relate 

to each other. Dam safety risk management includes routine and non-routine 

activities and is the umbrella under which risk is used to inform decisions by 

owners and regulators. Risk communication, although not specifically identified 

in figure 1, is a critical part of each component of risk management. While the 

main components of risk-informed decision making are risk analysis, risk 

assessment, and risk management, there are activities that dominate the 

 

 

1 Risk is the product of the likelihood of a structure being loaded, adverse structural 

performance, and the magnitude of the resulting consequences. In this document risk is in the 

context of dam safety and does not take into consideration physical security or cybersecurity risk.

 

2 Risk management is action implemented to communicate the risks and either accept, avoid, 

transfer, or control the risks to an acceptable level considering associated costs and benefits of any 

action taken.

 

3 Risk analysis and risk estimation are qualitative or quantitative procedures that identify 

potential modes of failure and the conditions and events that must take place for failure to occur.

 

4 The process of considering the quantitative or qualitative estimate of risk, along with all 

related social, environmental, cost, temporal, and other factors to determine a recommended 

course of action to mitigate or accept the risk.

Note: The above definitions were developed for use in this document.
6

Figure 1.—Relationship between risk analysis, risk assessment, and risk management.

completion of each component. For risk analysis, the key activity is risk 

estimation. For risk assessment, the key activity is risk evaluation5. For risk 

management, the key activity for dams with high risk is risk reduction. These 

concepts are illustrated in figure 1.

 

 

5 Risk evaluation is the qualitative or quantitative description of the nature, magnitude, and 

likelihood of the adverse effects associated with a hazard. A risk evaluation often includes one or 

more estimates of risk, a risk description, risk management options, economic and other 

evaluations, and estimates of changes in risk attributable to the management options.

Note: The above definition was developed for use in this document.
7

The term risk, when used in the context of dam safety, is comprised of three parts: 

(1) the likelihood of occurrence of a load (e.g., flood, earthquake, etc.), (2) the 

likelihood of an adverse structural response (e.g., dam failure6, damaging 

spillway discharge, etc.), and (3) the magnitude of the consequences resulting 

from that adverse event (e.g., life loss, economic damages, environmental 

damages, etc.). Typically, the direct consequences of dam failure are estimated. 

Indirect consequences could also result, in which failure of the dam results in loss 

or failure of key facilities, which can ultimately lead to additional economic 

consequences or loss of life. If indirect consequences can be identified and 

estimated, they can be incorporated into the risk estimates. In some cases, it may 

not be possible to capture all of the indirect consequences. Figure 2 depicts the 

flow of recurring dam safety activities and how risk information is used to inform 

decisions on dam safety actions and setting priorities.

Risk estimates typically reflect the risk at a given dam at the snapshot in time 

when the risk analysis is performed. It is recognized that the conditions at the 

dam will likely change in the future and the consequences of dam failure may also 

change as development occurs within potential dam failure inundation boundaries. 

This potential future increase in consequences can be taken into account as part of 

a long-term consideration of risk.

This document provides guidelines for implementing risk-informed decision

making in a dam safety program. The intended audience is Federal agencies that 

own or regulate dams. The guidelines could also be applied to non-federally 

owned or regulated dams that can impact federally owned or regulated facilities; 

however, this would require the cooperation and involvement of the non-Federal 

dam owner.

1.1.1 Risk Analysis

Risk analysis is the first component of risk management. It is the portion of the 

process in which the potential failure modes, structural performance, and adverse 

consequences are identified. It is also the process during which a quantitative 

or qualitative estimate of the likelihood of occurrence and magnitude of 

consequence of these potential events is made. A critical first step in a risk 

analysis is identifying the specific potential failure modes that are most likely at 

a given dam. The frequency of occurrence of the loadings (e.g., reservoir load 

levels, floods, earthquakes, ice loading, etc.) that could initiate potential failure

and then cause adverse consequences is estimated and considered as part of a risk 

analysis.

 

 

6 Failure characterized by the sudden rapid and uncontrolled release of impounded water or 

liquid-borne solids.
8

Figure 2.—Recurring dam safety activities.

1.1.2 Risk Assessment

Risk assessment is the process of examining the safety of a specific structure, 

making specific recommendations, and recommending decisions on a given dam 

or project using risk analysis, risk estimates, and other information that have the 

potential to influence the decision. The risks are assessed by the dam owner 

and, if applicable, the regulator, owner’s engineer, or other stakeholders. 

The assessment considers all factors (e.g., likelihood, consequences, cost, 
9

environmental impacts, etc.) and may also use evaluation criteria established 

by the owner or regulator. Decisions may include additional or enhanced 

monitoring; additional investigations, evaluations or analyses; remedial actions; 

abandonment of the dam; or no additional actions.

1.1.3 Risk Management

Risk management is the overarching activity when risk is used to inform dam 

safety decision making and builds on risk analysis and risk assessment phases. It

encompasses activities related to making risk-informed decisions, prioritizing 

evaluations of risk, prioritizing risk reduction activities, and making program 

decisions associated with managing a portfolio of facilities. Risk management 

includes evaluating the environmental, social, cultural, ethical, political, and legal 

considerations during all parts of the process. These activities include potential 

structural and nonstructural actions on a given dam or project, as well as 

activities such as routine and special inspections, instrumented monitoring and its 

evaluation, structural analyses, site investigations, development and testing of 

emergency action plans, and many other activities. All of the activities described 

above relate to risk control which involves dam safety actions to reduce risk and 

activities to identify issues early before potential failure modes can initiate.

1.1.4 Risk Communication

Risk communication is a critical component of an effective risk-informed decision 

process. It is not a separate component of the process; it must be integrated 

into all aspects of the process. Risk communication is essential within an 

owner/regulator organization and with other individuals/organizations that have 

a stake in the dam or would be impacted by its failure.

2.1 Objectives of the Guidelines

Federal agencies seek to ensure the structural integrity and operational safety of 

the dams in their charge and, in doing so, wisely allocate the use of monetary and 

human resources. In exercising their dam safety responsibilities, Federal agencies 

consider that:

 There are certain principles that should be held in common for consistency 

and correctness

 There should be a common understanding of risk management processes
10

 There are commonly recognized standards for safety and tolerable risk7

(while there is a general consistency in these standards within the dam 

safety community, Federal agencies may establish their own standards to 

best accomplish their unique missions)

 There are technical tools and approaches related to risk analysis that can 

be mutually shared and jointly developed

Risk analysis and risk assessment provide fundamental input to risk-informed 

decisions. To the extent that is reasonable and practicable, the tools, procedures, 

and guidelines should be consistent among the agencies.

These guidelines will enable Federal agencies to use the general principles of 

risk management and make risk-informed decisions. The agencies will work to 

develop and maintain consistent application of risk analysis, risk assessment, risk 

management, and risk communication using equivalent procedures and tools.

The guidance offered and specific procedures identified in these guidelines are 

not mandated. Individual agencies may vary in the way they apply these 

guidelines as necessary to accomplish their respective missions. To foster 

consistency in using and implementing these guidelines, refer to appendix A, 

which defines selected terms related to the risk-informed decision process.

A number of principles apply to the overall objectives of these guidelines. 

Therefore, each major section of this document identifies principles for 

implementing risk-informed decision making, discusses these principles, and 

then summarizes them in a box at the end of the section.

Although dam failure can result in many different types of consequences 

(e.g., economic, environmental or cultural), life safety is of paramount 

importance. While a complete range of consequences can be considered in dam 

safety decision making, loss of human life is the primary factor to consider.

Risk-informed decision making provides a framework in which relative risks at 

a given dam and within an inventory of dams can be compared. When making 

dam safety decisions, it must be acknowledged that all risk estimates include 

uncertainty8and subjectivity. A risk analysis can provide valuable insight into 

the vulnerabilities at a given dam. Risk should inform the decision process and 

improve the state of safety related to dams.

 

 

7 Tolerable risk is a risk within a range that society can live with so as to secure the benefits 

provided by the dam.

 

8 Uncertainty is the result of imperfect knowledge about the present or future state of a system, 

hazards, events, situations, or populations under consideration.
11

The primary purpose of a dam safety program is to identify the risk to life and 

property posed by dams. While dam safety risks cannot be eliminated, they 

should be reduced to a level that is as low as reasonably practicable. 

Each agency has a unique authority, mission, and management practice. While 

the guidance in this document is intended to develop consistency within Federal 

agencies, the use of risk to inform decisions may vary. 

Within a dam safety program, there will typically be limitations on the 

expediency of implementing dam safety recommendations. These limitations 

can be the result of funding or resource availability. The urgency of completing 

dam safety actions should be commensurate with the level of risk. 

3.1 Risk Analysis

3.1.1 Risk Analysis/Risk Estimation 

Risk analysis is typically a quantitative process (i.e., the outputs and inputs to a 

risk assessment are numeric). However, risk may also be expressed qualitatively. 

Risk analyses can provide valuable input to decisions made at various stages of a 

project and serve other important purposes. Risk analysis can include decisions 

made for a single dam or within a portfolio of dams. Thus, several types of risk 

analyses can be used as described below. The first step common to all types of 

risk analyses is identifying the site-specific potential failure modes. Risks are 

typically quantitatively evaluated by failure mode. The failure modes are then 

rolled up within a decision framework at a particular structure. For a given dam 

or project, all of the relevant types of loadings that may be experienced should be 

considered when identifying potential failure modes. 

The following principles apply to the overall objectives of these 

guidelines:

1. Life safety is paramount.

2. Risk should inform the decision process and improve the status of 

safety related to dams.

3. Identify and reduce the risk to life and property posed by dams and 

reduce those risks to as low as reasonably practicable.

4. Each agency has a unique authority, mission, and management 

practice. Their use of risk to inform decisions may vary.

5. The urgency of completing dam safety actions should be 

commensurate with the level of risk.
12

Methods to calculate and estimate risks are constantly evolving. This document 

does not try to describe in detail how to analyze risks. It only describes the 

general practices used by those who analyze risks. The current state-of-thepractice for analyzing risks is the Best Practices in Dam Safety Risk Analysis, 

a document and accompanying training course developed by the Bureau of 

Reclamation and the U.S. Army Corps of Engineers [5].

3.1.2 Types of Risk Analysis

There are various types of risk analysis. The level of information and the 

uncertainty reflected in the risk estimates will vary. Generally, more detailed risk 

analyses (those associated with issue evaluations and risk reduction) have more 

detailed analyses available, and studies have been performed to try to reduce the 

amount of uncertainty. More detailed risk analyses will generally be led by an 

experienced facilitator and be performed by a qualified multi-disciplinary team.

3.1.2.1 Potential Failure Modes Analysis

Potential failure modes are mechanisms that can result in an uncontrolled release 

of the reservoir. A potential failure modes analysis is a critical first step in 

conducting a risk analysis. It requires a detailed records review and a review of 

dam performance (e.g., instrumentation, visual and operational). Information is 

also needed on flood and earthquake frequencies in order to consider hydrologic 

and seismic potential failure modes. The perspective of local office personnel, 

including dam operators, inspectors, and dam tenders, is invaluable. The goal of 

a potential failure modes analysis is to: (1) identify the site-specific credible 

potential failure modes for a given dam; (2) provide complete descriptions of the 

potential failure modes, including the initiating event and the progression of steps 

leading to an uncontrolled release of the reservoir; and (3) provide a general 

description of the magnitude of the breach, including identifying and recording 

the factors that make the potential failure more likely and less likely and the 

consequences more severe or less severe.

It is recognized that large controlled flood releases may result in significant 

downstream consequences, including loss of life, but these events have typically 

not been included as potential failure modes because they result from intended 

operation of the dam. Large controlled releases that may result in serious 

downstream consequences are typically made to prevent even greater 

consequences that would occur from dam failure. Agencies may elect to 

consider the risk from large controlled releases, and risk communications should 

occur when large releases are made.
13

3.1.2.2 Screening Level Risk Analysis

A screening level risk analysis is typically performed for a portfolio of dams. 

The goal is to: (1) identify potential failure modes and (2) develop relative risk 

estimates for each dam in a way that enables the relative risk among the dams to 

be evaluated and priorities for further study or remediation to be established.

Information on loadings, consequences, and analyses that relate to potential 

failure modes may be very basic and limited, typically consisting of data already 

available or prepared just in advance of the screening effort. Screening level risk 

analyses have typically had very mixed results in identifying key dam safety 

issues. A screening level risk analysis can be a valuable tool for identifying 

uncertainties related to potential failure modes and significant dam safety issues. 

It can be used to prioritize additional studies and initiate modification studies at 

dams. Screening level risk analyses can either be made quantitatively or 

qualitatively.

3.1.2.3 Periodic Risk Analysis

A periodic inspection of all dams is required under the Federal Guidelines for 

Dam Safety [6]. A comprehensive, periodic dam safety review that documents

the condition of the dam at a point in time should incorporate a risk analysis to 

enhance the value of the effort. Additional analyses and studies are typically not 

performed specifically for a periodic risk analysis because the analysis relies on 

existing information. The risk analysis for a periodic dam safety review can be 

performed by an individual, but there are distinct advantages to engaging a small 

team. A periodic risk analysis focuses on all potential failure modes that are 

considered credible at the dam. Periodic dam safety reviews are performed on a 

recurring cycle, with the interval between assessments determined by the agency.

3.1.2.4 Issue Evaluation Risk Analysis

Issue evaluation risk analyses are focused on one specific (or more than one) 

potential failure mode that may require additional engineering analyses, studies, 

or investigations to support a quantitative risk analysis. These supporting 

activities are completed to reduce uncertainty and increase confidence in the 

resulting risk estimates. Typically, field explorations, material testing programs, 

detailed studies and analyses, or a combination of these will be performed to 

provide information for the risk analysis. Analyses and studies may focus on 

loadings, structural response, consequences, or a combination of these. Issue 

evaluation risk analyses are usually conducted with an experienced risk analysis 

facilitator and a team that have experience and backgrounds related to the 

potential failure mode or modes being evaluated.
14

3.1.2.5 Risk Reduction Analysis

A risk reduction analysis is used to estimate the anticipated risk for critical 

potential failure modes after potential dam modifications or non-structural 

measures are implemented. It typically involves reviewing risk estimates from an 

existing risk analysis, deciding which events will be impacted by the changes,

and re-estimating the likelihood of those events. During the risk reduction 

analysis, risk reduction measures for the various alternatives are evaluated and a 

preferred alternative is selected (also considering other factors such as the cost 

to implement actions, construction risks and environmental and other factors). 

In addition, it is necessary to analyze the proposed alternative remediation 

measures to verify that they will successfully reduce the risks to the desired

level.

3.1.3 Quantitative Versus Qualitative Risk Analyses

Each type of risk analysis can be accomplished using either a quantitative or 

qualitative approach. In either approach, a comprehensive identification, written 

description, discussion, and evaluation of factors that make events more or less 

likely to occur for each credible potential failure mode are documented. The 

magnitude of consequences related to a potential failure is also characterized 

(quantified), discussed, and documented.

3.1.4 Risk Analysis Results

Risk analysis results are typically portrayed with plots that graphically portray the 

risk estimates (i.e., likelihood of failure versus economic loss and potential life 

loss) and have an accompanying table that provides the input data used to 

generate the graphs. Two types of graphs are typically used: (1) the f-N plot 

and (2) the F-N plot.

An f-N plot shows individual failure modes that portray the potential for life loss 

as the estimated number of lives that would be lost (N) on the x axis and the 

annualized probability of the failure (f) associated with the life loss on the y axis. 

An f-N plot depicts both societal (impacting society as a whole) and individual 

risk (impacting the most exposed individual subjected to dam breach flows). In 

addition to displaying discrete risk estimates for individual potential failure 

modes (a way that dam failure can occur for a given loading condition), the total 

risk for the facility is plotted.

An F-N plot shows the cumulative risk posed by all failure modes and the 

associated potential life loss (discrete estimates for individual potential failure 
15

modes are not shown, but the plot does depict societal risk9in more detail). On 

the F-N plot, the end branch probabilities are accumulated by consequence level 

irrespective of failure mode. A cumulative curve is developed and plotted 

showing the probability of N or more lives lost. An F-N plot depicts societal risk. 

Both f-N and F-N plots require quantitative risk estimates. Figures 3–6 are 

examples of f-N and F-N plots. For qualitative risk estimates, the results can be 

plotted using a matrix. Figures 8 and 9 provide examples of an f-N and F-N plot 

with data added. Figure 9 depicts cumulative risk.

3.1.4.1 Preparing the Dam Safety Case

Numerical risk estimates are based on judgments, are typically subjective, and

include varying degrees of uncertainty. These estimates should not be the sole 

basis to inform decisions. Understanding the basis of the risk estimates is as 

important as the risk numbers themselves. The dam safety case is a logical and 

objective set of arguments used to advocate a position that either additional 

safety-related action is justified, or that no additional safety-related action is 

justified. The dam safety case should cite the most compelling information that 

supports the risk estimates and the overall findings and also discuss the 

uncertainties that were identified in the risk analysis.

The arguments combine together key evidence regarding the three basic risk 

components (load probability, response likelihood, and consequences) in order to 

support decisions related to a dam's existing condition or ability to withstand 

future loading. The dam safety case should initially be developed in the risk 

analysis phase and completed as part of the risk assessment for a given dam. The 

risk analysis team will be in the best position to provide the supporting arguments 

for the risk analysis estimates. The risk analysis team should also identify a suite 

of options for additional actions to better define or reduce risk, if there is 

justification for taking actions. An independent group should review the risk 

analysis report and the dam safety case and then provide additional input and 

possibly revisions to any proposed dam safety actions. This independent group 

may identify additional factors to consider in the risk assessment or additional 

options for refining or reducing risk. Individuals who have the authority in

the organization to make dam safety decisions will have the final input and 

determination on adopting recommended actions. The dam safety case is 

completed once the final actions (which may include a decision to take no action) 

have been determined within the organization. A number of principles apply to 

risk analysis. These principles are discussed below and summarized in the box at 

the end of this section.

 

 

9 Societal risk is the probability of adverse consequences from hazards that impact society as a 

whole and that create a social concern and potential political response because multiple fatalities 

occur in one event.
16

Figure 3.—Bureau of Reclamation [4] f-N plot.

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1 10 100 1,000 10,000

f, Estimated Annual Failure Probability

N, Estimated Life Loss

Decreasing justification 

to reduce or better 

understand risks

Evaluate Risks Thoroughly, 

Ensuring ALARP Considerations 

are Addressed

Increasing justification 

to reduce or better 

understand risks
17

Figure 4.—U.S. Army Corps of Engineers [7] F-N (societal risk) plot.

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1 10 100 1,000 10,000

F, probability per year of potential loss of life ≥ N

N, Number of Fatalities

Risks are unacceptable,

except in exceptional

circumstances

Risks are tolerable

only if they satisfy

ALARP requirements

Societal Tolerable Risk Limit

Risks may be 

unacceptable or 

tolerable,

but will be 

examined 

thoroughly and 

must at a 

minimum satisfy 

ALARP 

requirements
18

Figure 5.—Australian National Committee on Large Dams [2] F-N (societal risk) plot.

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

0 1 10 100 1,000 10,000

F, probability of failure per dam per year with expected loss of life >=N

N, number of fatalities due to dam failure

Revised ANCOLD Societal Risk Reference Guideline

Risks are Tolerable

only if they satisfy

the ALARP

requirements

Risks are unacceptable,

except in exceptional

circumstances

limit of tolerability

for existing dams

limit of tolerability

for new dams or 

major augmentations
19

Figure 6.—New South Wales Dam Safety Committee [8] F-N (societal risk) plot.

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

0 1 10 100 1,000 10,000

F,probability of failure per dam per year with an expected loss of life >=N

N, number of fatalities due to dam failure

Proposed Societal Risk Requirements: Existing Dams

Full SBA

Required

as a

minimum -

Full 

DSC decision

based

on critical

review of

benefits and

risks

Risks are Intolerable

Risks are Negligible

limit of tolerability

for existing dams
20

Figure 7.—Qualitative risk matrix.

Risk Matrix

Level 1 Level 2 Level 3 Level 4

Consequence Category

Likelihood of Failure

Moderate Low Very High High
21

Figure 8.—An f-N plot showing individual potential failure modes and total risk [4].

1.E-0 8

1.E-0 7

1.E-0 6

1.E-0 5

1.E-0 4

1.E-0 3

1.E-0 2

1.E-0 1

1 1 0 100 1000 10000

f, Annualized Failure Probability (AFP) 

N, Estimated Life Loss

Example Dam 4

Total Risk 

and 

uncertainty 

bounds

Static Failure 

Mode 

Hydro Failure 

Mode 

Seismic 

Failure Mode 

Notes:
22

Figure 9.—An F-N plot showing cumulative risk [7].

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1.E-02

1.E-01

1 10 100 1,000 10,000

F, probability per year of potential loss of life ≥ N

N, Number of Fatalities

Example Dam 4

Total RIsk

Risks are unacceptable,

except in exceptional

circumstances

Risks are tolerable

only if they satisfy

ALARP requirements

Societal Tolerable Risk Limit

Risks may be 

unacceptable or 

tolerable,

but will be 

examined 

thoroughly and 

must at a 

minimum satisfy 

ALARP 

requirements
23

A critical first step in a risk analysis is an evaluation of the design, construction, 

analysis, and performance of a dam and an identification of the specific potential 

failure modes that apply to that dam. If critical potential failure modes are 

overlooked, the risk analysis results will be incomplete and misleading. 

It should be recognized that each dam is unique in terms of purpose, geologic 

and demographic setting, design, structure, operations and consequences. While 

certain dams may be similar to other dams in type, design and size, there are 

unique factors that need to be considered when identifying potential failure modes 

and when estimating risk. 

Numerical risk estimates by themselves provide an incomplete basis for dam 

safety decision making. There are a number of factors that should also be 

considered, including the uncertainty and confidence in the risk estimates. The 

dam safety case provides supporting justification for the numerical risk estimates. 

A well-constructed dam safety case should include a discussion that supports and 

supplements the numerical risk estimates.

4.1 Risk Assessment

4.1.1 Risk Assessment/Risk Evaluation Process

Risk assessment is the process of considering the quantitative or qualitative 

estimated risk of the existing dam or project, along with all other factors related to 

a safety decision. These factors can include the dam safety case, social/economic 

impacts, environmental impacts, constructability, and potential to do harm. The 

risk assessment is conducted to determine a recommended course of action 

(which may involve considering a range of options) for mitigating or accepting 

the risks related to a specific dam or project or with regard to a specific dam 

safety issue or operational concern on that project. 

The following principles apply to risk analysis:

1. The basis for a coherent risk analysis should be a thorough 

examination and description of potential failure modes analysis.

2. It should be recognized that each dam is unique in terms of 

purpose, geologic and demographic setting, design, structure, 

operations, and consequences.

3. A well-constructed dam safety case should include a discussion 

that supports and supplements the numerical risk estimates.
24

Typically the risk assessment and proposed recommendations are initially 

developed by the risk analysis team and then reviewed, and possibly revised, by a 

technically qualified and experienced team, rather than a single individual. This 

specialized team can discern the relative criticality, the measure of concern, and 

the type and degree of remedial action needed to address the issue. When there is 

justification to take dam safety actions, a suite of options should be identified, and 

the costs and potential benefits of each option should be developed and presented. 

The final decision to adopt any recommended dam safety actions is made by the 

authorized decision makers within the organization. The most obvious and direct 

factors that enter into the assessment are the results of a risk analysis. These 

results may come in the form of quantitative/numeric results or qualitative 

statements that indicate the measure of concern relative to public safety. 

Quantitative results provide three measures related to risk. They are:

 Likelihood of occurrence of a failure or adverse consequence in terms of 

annual probability

 Estimated population at risk and/or life loss given failure or adverse 

consequence presented as the total estimated loss for a given annual 

probability of failure (often plotted or graphed), or the product of those 

two values which is called the “annualized life loss”

 The economic damages (e.g., downstream damages, cost to rebuild 

facilities, loss of operational revenue, regional social/economic damages, 

environmental damages, etc.). Again, these can be given or plotted as the 

lost economic value versus the annual probability of occurrence or as an 

annualized cost

However, there are many factors that may be included in a dam safety case and 

can be considered in the decision recommendation. They include:

 The risk analysis input for the dam safety case

 The design and construction of the dam, including defensive design 

features

 The past and future performance monitoring of the dam

 Environmental considerations

 Public perception and public input

 Regional, social, and economic considerations

 Ease, difficulty, and practicality of remediation

 Potential to do harm as a result of carrying out remediation
25

 Uncertainty about the results and the success of the remediation

This document focuses on a risk-informed approach to make decisions. This 

method has the advantage of providing a more consistent basis for decision

making. Also, since it is risk-informed, rather than risk-based, it allows for other 

important factors (such as those listed above) to be considered in the decision, 

beyond a sole reliance on numerical risk estimates. The factors that are 

considered in making dam safety decisions will be at the discretion of each 

Federal agency.

4.1.2 The Dam Safety Case

The risk estimates and the recommended actions need to be coherent. Since 

uncertainty is inherent in each assertion, the arguments should also address 

whether confidence is high enough for the assertions to stand on the basis of 

existing evidence.

The dam safety case and the identification of risk management options are 

recognized as essential elements to ensure public protection. They represent the 

understanding of existing conditions and predicted future behavior stated as 

objectively as possible.

4.1.3 Approach to Making Risk-Informed Decisions

The concept and practice of the use of risk to inform dam safety risk assessment 

decisions evolved primarily from the recognition of, and the desire to address, the 

great deviation in the magnitude of potential life loss and, to a lesser degree, great 

variation in economic impact of potential failure of dams classified as high 

hazard. When dam safety became prominent in the late 1970s, decisions were 

primarily based on the standard hazard classification of the dam (e.g., high, 

significant, or low). Thus, a dam with an estimated potential life loss of more 

than one person in the event of dam failure was classified and treated in the same 

way as a dam with a potential life loss of several thousand people. This lack of 

discrimination between the levels of consequences among high hazard dams led 

to proposals of criteria that would take the magnitude of loss into consideration. 

Among others, ANCOLD [2], BCHydro [3], the Netherlands [9], and the Bureau 

of Reclamation [4] proposed or developed evaluation criteria or guidelines.

The above discussion presumes that a quantitative risk analysis will be carried 

out. However, evaluation criteria could also be readily established, converted, or 

mapped for a qualitative risk analysis.
26

4.1.4 Tolerable Risk

Inherent in the use of risk analysis and risk-informed criteria or guidelines and, 

specifically, in risk assessment is the recognition and understanding of tolerable 

risk.

Risk assessment teams, which include the organization’s decision makers, can 

make a variety of decisions such as:

 Remediation for a project or dam will not be required, but monitoring of 

the concern will continue.

 A nonstructural alternative will be implemented.

 An alternative that addresses the major portion of the concern, but does 

not deal with all aspects, will be the course of action.

The risk remaining after decisions are implemented, related to a specific dam 

safety issue, is considered a tolerable risk. It can also be thought of, considered,

or called the residual risk. It is the risk that remains after prudent actions to 

address the risk have been taken, or the remote risk associated with a condition 

that was judged to not be a credible dam safety issue.

Threshold values are typically established to help guide decisions on tolerable 

risk. While the threshold guideline values are generally consistent within the dam 

safety community (see figures 3, 4, 5, and 6), agencies may elect to use different 

values to address their unique mission.

Another way of describing or thinking about tolerable risk is that, after hearing all 

the facts and information related to an issue or issues on a dam or project, an 

organization decides that further action is not reasonably practicable. When a 

judgment is made that risks are as low as reasonably practicable, this is often 

determined by comparing the effectiveness of reducing risk further (evaluated by 

considering the cost to further reduce risk and the amount of risk reduction 

achieved, and then comparing it to other risk reduction actions implemented by 

the agency). If the costs to achieve an additional level of risk reduction are 

disproportional to achieving the same magnitude of risk reduction at other dams, 

the current risk may be as low as reasonably practicable. There are many factors 

besides the numerical estimate of risk that can contribute to the decision that no 

further action is justified, including:

 The cost to reduce risks further

 The level of certainty or uncertainty on various aspects of the problem

 A precedent of comparable decisions on other projects
27

 The possibility that the concern is not reasonable to address in a practical 

manner 

 The chance of success of an action 

 Time to perform the remediation 

 Other considerations 

It should also be recognized that regardless of what actions are taken or not taken,

there will always be a certain level of residual risk. Therefore, rather than 

ignoring or supposing that the risk is zero, it is appropriate that tolerable risk 

levels for various aspects of the dam be discussed and identified. 

A number of principles apply to risk assessments. These principles are discussed 

below and summarized in the box at the end of this section. 

Remedial actions should do no harm. The goal of remedial dam safety actions is 

to reduce risk. Some remedial actions may have unintended consequences, 

however. In order to implement some remedial actions, construction risks may be 

excessive during certain phases of the work. A remedial action to address a 

specific potential failure mode can increase the probability of another potential 

failure mode. Decisions should be risk-informed10, not risk-based11. Decisions 

should be based on consideration of the results of a risk analysis as a key input, 

but other factors, such as the uncertainty and confidence in the risk estimates,

should also be considered. Decisions should not be based solely on where risk 

estimates plot on an f-N or F-N chart. The decisions made should consider the 

risk estimates, including the uncertainty and confidence in the risk estimates, the 

 

10 Risk-informed dam safety decision making implies that decisions are made considering risk 

estimates and many other contributing factors that might include confidence in the risk estimates, 

risk uncertainty, deterministic analyses, and the overall dam safety case in addition to other local 

or regional considerations. 

11 Risk-based dam safety decision making implies that a comparison of a risk estimate to risk 

criteria is the basis for decision-making. 

The following principles apply to risk assessment:

1. Remedial actions should do no harm.

2. Decisions should be risk-informed, not risk-based.

3. Interim risk reduction measures (IRRMs) should be considered 

and implemented where needed.
28

likely outcomes if dam safety actions are completed, and other factors important 

to an agency’s mission.

Interim risk reduction measures should be considered and implemented where 

needed. While the ultimate goal may be to reduce risks to certain levels at a given 

dam, IRRMs can achieve timely incremental risk reduction, often at a reasonable 

cost. 
29

5.1 Risk Management

Risk management encompasses activities related to making risk-informed 

decisions, prioritizing evaluations of risk, prioritizing risk reduction activities, 

and making program decisions associated with managing a portfolio of facilities. 

Risk management processes vary with respect to an organization’s dam safety 

governance. Risk management is greatly facilitated and enhanced by having the 

knowledge base supplied by the risk analyses and risk assessment inputs for the 

dams as described above. Such knowledge allows a logical and consistent basis 

for substantiating and prioritizing risk reduction activities and/or making program 

decisions associated with managing a portfolio of facilities. Risk management, 

because it uses the findings from a risk assessment/risk evaluation process, 

includes considering the environmental, social, cultural, ethical, political, and 

legal factors. Risk management should be regarded as an ongoing and iterative 

process that needs to adapt to new information.

The primary goal of risk management is to implement actions to either: accept, 

further monitor or evaluate, control, or reduce risk, while considering the cost and 

benefits of any actions taken. When reducing risk either at a single dam or within 

a portfolio of dams, actions should be taken as quickly and as efficiently as 

possible, recognizing that there will likely be limits on available funding. 

Consideration should be given to how much risks are reduced compared with 

the costs necessary to achieve risk reduction. Generally, the priorities will be 

to address the dams with the highest perceived risk first, assuming there is 

confidence in the risk estimates; however, if the cost of reducing risk at the 

highest risk dam is disproportional to the risk reduction achieved, it may be 

appropriate to consider risk reduction activities at other dams first.

The agencies recognize that the methods used to calculate risk do not provide

precise numerical results. Therefore, it would not be appropriate to rely solely on 

the numeric estimates in comparison to definite established criteria (i.e., riskbased evaluation criteria). Decisions are usually more complex than can be 

portrayed using only the numerical results of a risk analysis. The strength of the

dam safety case should also be considered in the risk management phase.

In order to effectively prioritize dam safety actions, information on the cost and

duration of the actions and the risk reduction potential is needed. This type of 

information is necessary to evaluate the efficiency of risk reduction actions and 

can be used to fine-tune dam safety actions. A record of the baseline risks, the 

dam safety case and rating, and updates that resulted from risk reduction activities 

should be maintained for each dam in an agency’s inventory.

For Federal dam owners with large dam inventories, or for private dam owners 

with large dam inventories, it will be important to prioritize dam safety actions 

because funding will limit how quickly actions can be completed. If an owner is 

dealing with a large dam inventory, a risk categorization scheme may be helpful 
30

in making an initial cut at prioritizing dam safety actions. Table 1 shows a 

method of categorizing dams by risk that will provide an initial sorting of dam 

safety actions.

Table 1.—Joint Federal risk categories

Urgency of 

action Characteristics and considerations Potential actions

I – VERY 

HIGH 

URGENCY

CRITICALLY NEAR FAILURE: 

There is direct evidence that failure is 

in progress, and the dam is almost 

certain to fail during normal 

operations if action is not taken 

quickly.

OR

EXTREMELY HIGH RISK: 

Combination of life or economic 

consequences and likelihood of 

failure is very high with high 

confidence.

 Take immediate action to avoid failure. 

Communicate findings to potentially 

affected parties.

 Implement IRRMs.

 Ensure that the emergency action plan is 

current and functionally tested.

 Conduct heightened monitoring and 

evaluation. Expedite investigations and 

actions to support long-term risk reduction.

 Initiate intensive management and 

situation reports.

II - HIGH 

URGENCY

 RISK IS HIGH WITH HIGH 

CONFIDENCE, OR IT IS VERY 

HIGH WITH LOW TO MODERATE 

CONFIDENCE: The likelihood of 

failure from one of these 

occurrences, prior to taking some 

action, is too high to delay action.

 Implement IRRMs.

 Ensure that the emergency action plan is 

current and functionally tested.

 Give high priority to heightened monitoring 

and evaluation. Expedite investigations 

and actions to support long-term risk 

reduction.

 Expedite confirmation of classification.

III -

MODERATE 

URGENCY

MODERATE TO HIGH RISK: 

Confidence in the risk estimates is 

generally at least moderate, but can 

include facilities with low confidence if 

there is a reasonable chance that risk 

estimates will be confirmed or 

potentially increase with further study.

 Implement IRRMs.

 Ensure that the emergency action plan is 

current and functionally tested.

 Conduct heightened monitoring and 

evaluation. Prioritize investigations and 

actions to support long-term risk reduction.

 Prioritize confirmation of classification as 

appropriate.

IV – LOW TO 

MODERATE 

URGENCY

LOW TO MODERATE RISK: The 

risks are low to moderate with at least 

moderate confidence, or the risks are 

low with low confidence, and there is 

a potential for the risks to increase

with further study.

 Ensure that routine risk management 

measures are in place.

 Determine whether action can wait until 

after the next periodic review.

 Before the next periodic review, take 

appropriate interim measures and 

schedule other actions as appropriate.

 Give normal priority to investigations to 

validate classification, but do not plan for 

risk reduction measures at this time.

V – NO 

URGENCY

LOW RISK: The risks are low and 

are unlikely to change with additional 

investigations or studies.

 Continue routine dam safety risk 

management activities and normal 

operations and maintenance.
31

To prioritize actions within a category, consider each of the following factors, 

which will contribute to increasing the priority of actions at a given dam:

 Both the failure probability and the annualized life loss exceed the 

threshold guideline values

 The failure probability or the annualized life loss is driven by a single 

potential failure mode

 The failure probability or the annualized life loss is driven by a potential 

failure mode manifesting itself during normal operating conditions

 The range of risk estimates is tightly clustered and the mean and median 

are similar (for detailed uncertainty analyses only) and/or sensitivity 

studies instill confidence

 Risk reduction or confirmation is relatively easy and inexpensive

The above factors can also be considered if a dam appears to border two 

categories. If a dam owner has a small inventory of dams, the above factors alone 

can be used as the basis for establishing priorities. The initial effort to place the 

actions in one of the five risk categories would have limited value for small dam 

inventories.

Prioritization of dam safety actions can be done on a facility basis (where total 

risk is the focal point, and the goal is to reduce total risk to tolerable levels) or on 

an individual potential failure mode basis (where single potential failure modes 

are addressed).

A number of principles apply to risk management. These principles are discussed 

below and summarized in the box at the end of this section.

Reducing risk at a given dam or within a portfolio of dams will typically require 

setting priorities. Factors to consider will be the magnitude of risk at a given dam 

and the confidence in the risk estimates, the costs of implementing risk reduction 

actions, and the timeframe required to achieve the risk reduction. All of these 

factors should be considered when establishing priorities. The objective of an 

organization should be to reduce dam safety risk as effectively and as efficiently 

as possible.

Each organization should have a transparent process for establishing priorities and 

the urgency of completing dam safety actions. Within an organization, the 

responsibility for the inventory of dams will often be divided among a number 

of offices. Having a transparent process will develop confidence within the 

organization that decisions are made objectively and fairly.
32

Prioritizing work within a portfolio of dams will typically be a dynamic process. 

While priorities can be established annually, new dam safety issues that have a 

high priority may develop in between annual prioritization activities. This 

requires flexibility in prioritizing work within a portfolio, allowing for 

adjustments in planned work as new, high priority issues are identified. 

Use a dedicated, established group to review and prioritize proposed dam safety 

actions within a portfolio of dams or when establishing urgency for action at a 

specific dam. This will help ensure consistency in establishing priorities and will 

improve efficiency because a consistent group will maintain knowledge of the 

overall inventory. 

Independent review is critical to the credibility of risk management. This will 

help ensure that biases and individual preferences do not dominate the decision 

making process. 

The urgency of completing dam safety actions should be commensurate with risk. 

In general, dams with the highest estimated risk should receive the highest 

priority because they are the dams most likely to fail in the inventory. 

The following principles apply to risk management:

1. The objective of an organization should be to reduce dam

safety risk as effectively and as efficiently as possible.

2. Each organization should have a transparent process for

establishing priorities and the urgency of completing dam

safety actions.

3. Incorporate flexibility in prioritizing work within a portfolio,

allowing for adjustments in planned work as new, high

priority issues are identified.

4. Use a dedicated, established group to review and prioritize

proposed dam safety actions within a portfolio or when

establishing urgency for action at a specific dam.

5. Independent review is critical to the credibility of this

process.

6. The urgency of completing dam safety actions should be

commensurate with risk.
33

6.1 Risk Communication/Public Awareness

Communication is important in all aspects of dam safety within an organization, 

with the public, and with the specific owners or stakeholders of a project. 

However, communication about the work associated with risk is particularly 

important because of the fears, sentiments, perceptions, and emotions surrounding 

the word risk and the use of risk analysis in engineering. Thus, it is important to 

understand and have a good plan for communicating risk, including:

 What information is available at a given dam related to potential failure 

modes and how the information is considered in a risk analysis

 How risk will be considered by an organization

 What the results of the risk analyses are

 What decisions were reached and what risk remains

This communication can help create an awareness of potential dam safety issues 

and help all parties gain a greater understanding. Creating an understanding of 

risk and dam safety issues is important for those who have varying degrees of 

connections to the dam and the associated potential impacts. These diverse

groups have a variety of backgrounds, experience, and sophistication. 

Communication plans and strategies should be developed for the following:

 Internal to a dam safety organization

 Owners and stakeholders

 Dam site and project personnel

 Local organizations

 Technical organizations or consultants

 Decision makers

 The public

6.1.1 Internal Communication within a Dam Safety 

Organization

There are at least four levels at which communication garnered from risk studies 

and resulting decisions needs to take place within an organization. These include:

 Communication with employees at the dam or project site

 Communication at the local level of the organization, where the 

responsibility for managing the operation and maintenance, as well as the 

routine visual surveillance and instrumental monitoring for the suite of 

dams associated with one or more projects typically resides
34

 Communication at the technical level, where traditional engineering and 

geologic studies and investigations are performed, where risk analyses and 

risk assessments are carried out, and where independent staff check and 

review studies, analyses, and risk analysis results

 Communication at the decision making level, where funding is secured 

and decisions are made regarding dam safety actions and risk management 

decisions on program priorities

6.1.1.1 Dam Site and Project Site Personnel

The dam tenders, inspectors, staff performing visual inspections and taking 

readings of seepage and instruments, and plant operators responsible for gate 

operations provide a valuable source of information relative to risk analyses 

and need to be included. Dam operators often have detailed information and 

understanding of the dam history, past performance issues, and a good perspective 

on perceived changes at the dam. It is important to include them in risk analysis 

activities to benefit from their knowledge of the dam. In addition, it is very 

important for them to gain an understanding of potential failure modes at the dam, 

specific locations at the dam where potential failure modes might develop, and the 

initiating mechanisms for the potential failure modes. This will allow them to 

more effectively monitor the dam. Likewise, the results of risk analyses and the 

decisions and rationale used in risk assessment and risk management need to be 

provided to these personnel so that they have a full understanding of the outcome 

of the risk process.

6.1.1.2 Local Level of an Organization

Supervision and management of the operation of a number of projects and dams 

are usually the responsibility of a local office within a dam safety organization. 

These offices have the responsibility to staff for routine operation and 

maintenance of the projects and dams under their purview, as well as for 

inspection and monitoring of the dams. In addition, they are often responsible 

for implementing structural and nonstructural actions which may be specified as 

the outcome of the risk-informed decision analyses. Often, these local offices 

cover a number of facilities and manage a staff that must distribute its time 

between several sites. Local office personnel, as appropriate, also need to be 

consulted and included in risk analyses relative to failure modes and dam 

performance, either because they have previously been assigned to dams under 

their purview and have an intimate historic knowledge and/or they have a broader 

perspective by virtue of being associated with all the projects and dams under

their responsibility. With respect to communicating the findings from the risk 

analyses, and the decisions from risk assessment and risk management, the local 
35

office is typically the key intermediary between the desired objectives of the 

organization’s dam safety office and the field site that will be affected by the 

outcomes.

6.1.1.3 Technical Elements of an Organization

Detailed communications are required among the technical staff (including

consultants and contractors) performing the basic analytical studies and 

evaluations, the persons performing the risk analyses, and the staff performing 

the risk studies who will be reviewing studies, analysis reports, and risk analysis 

reports and making their assessments on specific dams and dam safety issue 

evaluations. The reports prepared by each previous study level will need to 

include sufficient detail so that the primary reviewers (as well as analysts in future 

years) can understand assumptions made, detailed results of studies, analyses and 

risk analyses, and the technical basis for overall findings. Further, these results 

may be called for at any future stage in the process (e.g., risk management, 

stakeholder review, etc.); thus, good documentation is essential. Briefings are 

typically performed for technical staff on the results of studies, risk analyses, the 

overall findings, and the dam safety case for proposed actions. Briefings may 

also be performed for consultant review boards, which provide an independent 

review of studies and findings. At this level, the communication will be the most

technically demanding.

6.1.1.4 Decision Making Level of an Organization

Decision makers need to have a general understanding of the potential failure 

modes at a dam, the results of studies and analyses performed, the risk analysis 

results, and the dam safety case. Decision makers have the responsibility for 

formally accepting dam safety actions and must be convinced that the proposed 

actions are warranted and appropriate. Summary technical information is 

typically presented in briefings for decision makers, and the detail needs to be 

sufficient to support the key findings and dam safety case. Individuals who have 

the responsibility for setting priorities within an organization will also need to 

understand the basis and urgency of dam safety actions at a given dam. This is 

needed to prioritize actions across an entire inventory.

6.1.2 Communications with Stakeholders

Risk communication with stakeholders and owners is important in order to be 

successful. Risk communication and stakeholder participation should ensure that

(1) responsible and affected stakeholders will be partners and be afforded the 
36

opportunity to participate in decisions that affect them and (2) communications 

regarding potential inundation hazard, consequences, and shared solutions will be 

open, transparent, and understandable.

It may be helpful to include individuals from stakeholder organizations as 

observers in the risk analysis, especially in the risk assessment meetings. This 

will allow those individuals to gain a better understanding of the basis of the risk 

analysis estimates, the subsequent findings, and the rationale on which a decision 

is made. They will typically be interested in the rationale behind proposed dam 

safety and will want to ensure that the chosen actions are appropriate and 

efficient. It will also be helpful to explain the overall dam safety process used and 

explain the risk guidelines that were used in the risk assessment. Funding 

partners may enlist consultants to review reports, attend briefings, and interact 

with technical staff. Detailed technical reports and briefings may need to be 

provided for consultants.

There may be multiple levels of stakeholders that will be impacted by risks at a 

given dam or that could be impacted by the risk at another dam upstream or 

downstream of the given dam. Impacts may be related to new or updated risk 

estimates at a given dam or may be related to a change in operations (or expected 

releases for a given magnitude flood). These potential impacts may need to be 

shared with dam or facility operators, owners, or the regulators who oversee the 

facilities.

Local emergency management authorities are key stakeholders in dam risk 

management. Effective communication of dam risks with emergency 

management authorities responsible for responses and evacuation actions is 

essential. Effective risk communication should provide timely and best available 

information to facilitate the development of response plans and risk mitigation 

strategies.

6.1.3 Communications with the Organizations and 

the Public Impacted by the Dam

Communications should also be provided proactively for organizations and the 

public that will be, could be, or consider themselves impacted by a dam failure or 

by dam safety actions that will restrict or modify the operations at the dam. These 

communications should be initiated at the planning or investigation stage to 

prevent erroneous information and rumors from developing. Such presentations 

need to be appropriately technical, conveying the technical information in a 

manner that conveys the key issues and concerns at the dam, the potential impacts 

of a dam failure, the proposed actions to address the issues/concerns, and the 

impacts of these actions on organizations and the public. In addition, the 

presentation needs to convey the costs and schedule for the dam safety actions.
37

The diverse audience that attends the public and stakeholder meetings may 

include persons who can fully comprehend the technical content being presented. 

Therefore, a definite way to alienate the audience is to presume they are incapable 

of understanding the work that is planned or has been done. Information should 

be presented in a manner that is easy to understand but not condescending to the 

audience. While recognizing this, the presentation should avoid the use of 

technical jargon and unnecessary detail. Technical staff should be available to 

answer detailed technical questions from individuals with technical backgrounds 

that may attend the briefing.

Organizations may have security concerns related to information that is presented 

in these general briefings or public meetings, and the presentations may have to 

be adjusted to take this into account. Security concerns will vary with individual 

dams, and security protocols will vary within each agency. Each agency will 

need to establish their own guidelines on the type of information and the level 

of detail that are appropriate for public briefings. Decisions on the level of 

information to share should balance legitimate security concerns with the benefits 

of creating a public awareness of potential dam safety issues.

A number of principles apply to risk communication. These principles are 

discussed below and summarized in the box at the end of this section.

Enhance communication with the public, internally within dam owning and 

regulating organizations, and Emergency Management Agencies (EMAs). Risk 

communication provides many benefits, including improving the chances that 

dam safety decisions will be supported within and outside of the organization, 

better preparing the organization and the public for taking action in the event 

of an emergency, and instilling confidence in the dam safety office of an 

organization.

Emergency Action Plans identify emergency situations that may develop at a 

given dam and establish protocols for reacting to the emergency. The advance 

planning inherent in these plans, and the familiarity of local officials and the 

public with the plans, will save valuable time during an emergency. Emergency 

Action Plans and communication with the public are important and integral 

aspects of reducing risk to life.

Communications should be open and transparent. This will help instill confidence 

in the organization and better prepare the organization and the public for 

responding to an emergency.

Dams present both a benefit and a risk to the public. When dam safety risks are 

presented, the public may focus on the negative aspects of the dam and not realize 

the offsetting benefits that the dam provides. When describing dam safety issues 

at a given dam, the presenter should focus on the benefits as well as the risks 

posed by the infrastructure.
38

Integrate risk communications early in the process of responding to dam safety 

issues. This is beneficial because by including individuals in the process and 

giving them the opportunity to provide input and, possibly, influence decisions, 

they are more likely to accept the decisions being made. Provide context for risk 

communications (i.e., compare with other risks). This is especially important for 

the public who may have trouble identifying the significance of dam safety risks. 

Focus communications on actions that individuals/organizations need to take. 

This is important because an effective dam safety program and effective risk 

reduction actions involve a number of organizations and individuals: those that 

monitor and maintain dams, those that evaluate and make decisions regarding the 

safety of dams, and those that react and respond to emergencies at dams. Risk 

estimates are inherently uncertain, with the nature and the amount of uncertainty 

varying from dam to dam. It is important to acknowledge the uncertainty and put 

it into the proper context. The following aspects of uncertainty in risk estimates 

and the dam safety case should be discussed: 

 What is certain 

 What is likely, but not certain 

 What is possible, but not likely 

The following principles apply to risk communication:

1. Enhance communication with the public, internally within dam 

owning and regulating organizations, and Emergency 

Management Agencies.

2. Emergency Action Plans and communication with the public are 

important and integral aspects of reducing risk to life.

3. Communications should be open and transparent.

4. When presenting dam safety issues at a given dam, focus on the 

benefits and the risks posed by the infrastructure.

5. Integrate risk communications early in the process of responding 

to dam safety issues.

6. Provide context for risk communications (compare with other 

risks).

7. Focus communications on actions that individuals/organizations 

need to take.

8. Discuss uncertainty in risk estimates and the dam safety case:

 What is certain

 What is likely, but not certain

 What is possible, but not likely
39

7.1 References

[1] Ball, D.J. and Floyd, P.J. 1998. Societal Risks, Report prepared for UK 

Health and Safety Executive. 

[2] Australian National Committee on Large Dams. 2003. Guidelines on Risk 

Assessment. Sydney, New South Wales, Australia. 

[3] B.C. Hydro. 1995. Seminar and Workshop on Risk-Based Dam Safety 

Evaluation, sponsored by BC Hydro. 

[4] Bureau of Reclamation. 2011. Dam Safety Public Protection Guidelines. 

Dam Safety Office, Denver, Colorado. August. Web site: 

(http://www.usbr.gov/ssle/damsafety/documents/PPG201108.pdf) 

[5] Bureau of Reclamation and U.S. Army Corps of Engineers. 2012. Best 

Practices in Dam Safety and Levee Safety Risk Analysis, Denver, Colorado. 

[6] Federal Emergency Management Agency. 2005. Federal Guidelines for 

Dam Safety.

[7] U.S. Army Corps of Engineers. 2011. Safety of Dams – Policy and 

Procedures. ER-1110-2-1156. October 28, 2011. Web site: 

(http://140.194.76.129/publications/eng-regs/ER_1110-2-1156/ER_1110-2-

1156.pdf) 

[8] New South Wales Government Dams Safety Committee. 2006. Risk 

Management Policy Framework for Dam Safety. New South Wales, 

Australia, August. 

[9] Ale, B.J.M. 1992. The Use of Risk Information in the Netherlands, paper 

presented at the 7th Annual European Summer School on Major Hazards, 

July 6–10, 1992, Cambridge. 

APPENDIX A

Guidelines on Risk Terminology

A-1

Appendix A – Guidelines on Risk Terminology

To facilitate the cooperative agreement for all elements of risk-based decision analysis, it is 

extremely valuable to use common terminology and have a common understanding of that 

terminology. It is recognized that this is not a simple task because words related to dam safety 

risk have been used in different ways by the member agencies over the years since their initial 

application over 35 years ago. However, to establish consistency in terminology, this guideline 

provides definitions for the terms given below that are used in risk management, risk assessment, 

risk analysis, and risk evaluation. These definitions have been developed for use in this 

document.

Dam failure: Failure characterized by the sudden rapid and uncontrolled release of impounded 

water or liquid-borne solids. It is recognized that there are lesser degrees of failure and that any 

malfunction or abnormality outside the design assumptions and parameters that adversely affect 

a dam’s primary function of impounding water could be considered a failure.

Credible potential failure mode: A potential failure mode that is considered to affect the total 

risk at a given dam and for which action could potentially be taken to reduce risk. A noncredible potential failure mode is a potential failure mode which is judged to have very low risks 

and for which a strong case can be made to that affect. Non-credible potential failure modes are 

often judged to represent a risk that is well below tolerable risk guidelines and orders of 

magnitude less than that of the more dominant potential failure modes at a given dam.

Individual risk: This term is associated with the most exposed individual who is placed in a 

fixed relation to a hazard, such as a dam. Individual risk is the sum of the risks from all potential 

failure modes associated with the hazards that affect that person. The similarity to annualized 

failure probability is apparent when life loss of that individual is virtually certain (because the 

failure probability multiplied by a life loss of one person is equal to the failure probability).

Potential failure mode: A way that dam failure can occur (i.e., the full sequence of events from 

initiation to failure) for a given loading condition. A condition of a potential failure mode is that 

it results in an uncontrolled release of the reservoir.

Risk: The product of the likelihood of a structure being loaded, adverse structural performance,

(e.g., dam failure), and the magnitude of the resulting consequences.

Risk analysis/risk estimation: A qualitative or quantitative procedure that identifies potential 

modes of failure and the conditions and events that must take place for failure to occur. A 

quantitative risk analysis yields a numerical estimate of the risk of adverse consequence,

multiplying the probability of load times the probability of dam failure given the load times the 

magnitude of adverse consequence given dam failure.

Risk assessment: The process of considering the quantitative or qualitative estimate of risk,

along with all related social, environmental, cost, temporal, and other factors to determine a 

recommended course of action to mitigate or accept the risk.
Federal Guidelines for Dam Safety Risk Management

A-2

Risk based: This term implies that a comparison of a risk estimate to risk criteria is the basis for 

decision-making.

Risk evaluation: The qualitative or quantitative description of the nature, magnitude, and 

likelihood of the adverse effects associated with a hazard. A risk evaluation often includes one 

or more estimates of risk, a risk description, risk management options, economic and other 

evaluations, and estimates of changes in risk attributable to the management options.

Risk governance: The process of risk-informed decision making and the process by which riskinformed decisions are implemented.

Risk informed: This term implies that decisions are made considering risk estimates and many 

other contributing factors that might include confidence in the risk estimates, risk uncertainty, 

deterministic analyses, and the overall dam safety case in addition to other local or regional 

considerations.

Risk management: Actions implemented to communicate the risks and either accept, avoid, 

transfer, or control the risks to an acceptable level considering associated costs and benefits of 

any action taken.

Residual risk: Risk remaining at any time.

Tolerable risk: A risk within a range that society can live with so as to secure the benefits 

provided by the dam. It is a risk that is not to be regarded as negligible or ignored, but needs to 

be kept under review and reduced further if possible.

Societal risk: The probability of adverse consequences from hazards that impact society as a 

whole and that create a social concern and potential political response because multiple fatalities 

occur in one event. Society is increasingly adverse to hazards as the magnitude of the 

consequences increases.

Uncertainty: The result of imperfect knowledge about the present or future state of a system, 

event, situation, or population under consideration.
 FEMA P-1025

Catalog No. 14353-1