According to the National Inventory of Dams, as of January 2016 there are approximately 90,500 dams in the United States and about 2.5 percent of these (approximately 2,100 dams) are associated with hydropower projects. Hydropower projects are owned and operated by both non-federal entities—such as private utility companies, municipalities, and state government agencies—or federal government agencies—primarily the U.S. Army Corps of Engineers (the Corps) and the Bureau of Reclamation. Collectively, these dams associated with hydropower projects account for about 8 percent of the total electric generating capacity in the United States. Hydropower projects generally consist of one or more dams and other key components associated with hydroelectric power generation and water storage, and are uniquely designed to accommodate watersheds, geology, and other natural conditions present at the time of construction. These components include both those that allow operators to adjust reservoir water levels, such as spillways and gates, as well as those that produce and distribute electricity, such as transmission lines and powerhouses, among others. (See fig. 1.) The Federal Power Act provides for FERC’s regulatory jurisdiction over a portfolio of about 1,000 non-federal hydropower projects comprising over 2,500 dams. While FERC does not construct, own, or operate dams, it licenses and provides oversight of non-federal hydropower projects to promote their safe operation. Licensees are responsible for the safety and liability of dams, pursuant to the Federal Power Act, and for their continuous upkeep and repair using sound and prudent engineering practices. FERC officials in each of the agency’s five regional offices work directly with licensees to help ensure these projects comply with licenses and meet federal guidelines for dam safety. In addition, stakeholder groups such as the Association of State Dam Safety Officials can assist licensees in staying current on federal and state dam laws and regulations, dam operations and maintenance practices, and emergency action planning, among other things. FERC’s regulations, supplemented by its Operating Manual and Engineering Guidelines, establish a framework for its dam safety oversight approach. FERC’s Operating Manual provides guidelines for the FERC staff performing inspections that are aimed at ensuring that structures are safe, are being properly maintained, and are being operated safely. FERC’s Engineering Guidelines provides FERC staff and licensees with procedures and criteria for the review and analysis of license applications, project modification proposals, technical studies, and dam designs. For example, one chapter presents guidelines for FERC staff to use to determine the appropriateness and level of geotechnical investigations and studies for dams. The Engineering Guidelines states that every dam is unique and that safety analysis of each dam require that engineers apply technical judgement based on their professional experience. As part of FERC’s safety oversight approach, it assigns a hazard classification to each dam in accordance with federal guidelines that consider the potential human or economic consequences of the dam’s failure. The hazard classification does not indicate the structural integrity of the dam itself, but rather the probable effects if a failure should occur. Depending on the hazard classification, the extent of and the frequency of safety oversight activities can vary. Low hazard dams are those where failure —an uncontrolled release of water from a water-retaining structure—would result in no probable loss of human life but could cause low economic and/or environmental losses. Significant hazard dams are those dams where failure would result in no probable loss of human life, but could cause economic loss, environmental damage, or other losses. High hazard dams are those dams where failure would probably cause loss of human life. FERC has designed a multi-layered oversight approach that involves both independent and coordinated actions with dam owners and independent consultants. Key elements of this approach include ensuring licensees have a safety program in place, conducting regular safety inspections, reviewing technical analyses, and analyzing safety as a part of project relicensing. (See fig. 2.) Licensee’s dam safety program. According to FERC guidance, licensees have the most important role in ensuring dam safety through continuous visual surveillance and ongoing monitoring to evaluate the health of the structure. Beyond this expectation for continuous oversight, FERC requires licensees of high and significant hazard dams to have an Owner’s Dam Safety Program. FERC dam safety inspection. The dam safety inspection, also called operation inspection, is a regularly-scheduled inspection conducted by a FERC regional office project engineer primarily addressing dam and public safety. FERC’s Operating Manual establishes the frequency that a FERC engineer conducts dam safety inspections. Independent consultant inspection and potential failure mode analysis. FERC requires licensees to hire a FERC-approved independent consulting engineer to inspect and evaluate high hazard dams and certain types of dams above a certain height or size and submit a report detailing the findings. Additionally, FERC requires the licensee of a high or significant hazard dam to conduct a potential failure mode analysis. A potential failure mode analysis is an exercise to identify and assess all potential failure modes under normal operating water levels and under extreme conditions caused by floods, earthquakes, and other events. FERC relicensing of projects. FERC issues hydropower licenses for the construction of new hydropower projects, and reissues licenses for existing projects when licenses expire. Licensees may submit applications for a new license for the continued operation of existing projects as part of a process known as relicensing. During relicensing, in addition to the power and development purposes for which FERC issues licenses, FERC must evaluate safety, environmental, recreational, cultural, and resource development among other factors when evaluating projects, according to its guidance. In addition, FERC requires licensees to conduct various engineering studies related to dam performance in accordance with FERC safety requirements. Required engineering studies focus on dam performance as affected by hydrology, seismicity, and dam stability. Licensees may also produce engineering studies, such as a focused spillway assessment, for their own operations or at the request of FERC. We found, based on our analysis of the 42 dam safety inspections we reviewed, that FERC staff generally conducted and collected information from these inspections consistent with guidance in its Operating Manual. According to FERC’s Operating Manual, staff’s approach to conducting these inspections and collecting information is to include preparing for the inspection by reviewing documents, conducting a field inspection of the dam and associated project components, and discussing inspection findings with licensees and with FERC supervisors. Preparation for inspection: We found that FERC staff generally met document review requirements in preparation for safety inspections of the 42 dams we reviewed. (See table 1.) According to the Operating Manual, FERC staff are to review safety-related information contained in documents such as potential failure mode analyses and hazard potential classifications. For example, we found that staff documented their review of the most recent independent consultant inspection report and potential failure mode analysis for each of the 16 high hazard dams we reviewed. FERC staff told us that they generally used checklists when preparing for these inspections. For example, some of the staff told us they tailor the checklist included in the Operating Manual, based on the dam’s type, characteristics, and hazard classification. Additionally, for each of the dams in our sample, staff stated that they prepared for the inspection by reviewing prior inspection reports and recommendations. Field inspection: We found that FERC staff generally met requirements for reviewing project components and documenting their findings from field inspections of the 42 dams we reviewed. (See table 2.) According to the Operating Manual, FERC staff are to conduct visual inspections of the dam, typically alongside the licensee, to assess the dam and project components by observing their condition and identifying any safety deficiency or maintenance requirement. Also during the inspection, FERC staff are to compare current conditions of the dam and project components to those described in prior inspection reports, and as applicable, collect information on the licensee’s progress towards resolving deficiencies and maintenance issues that can affect safety. To assess safety, FERC staff we interviewed stated that they primarily rely on their engineering judgment. Inspection findings: According to our interviews with FERC staff from selected projects, we found that staff generally followed FERC guidance in discussing inspection findings with licensees and supervisors prior to preparing inspection reports to document their findings. According to the Operating Manual, following the dam safety inspection, FERC staff are to discuss the inspection with the licensee, giving direction on how to address any findings. Additionally, upon returning to the office, staff are to discuss inspection findings with their supervisors who may suggest additional actions. FERC staff are then to develop a dam safety inspection report that documents observations and conclusions from their pre-inspection preparation and their field inspection and identifies follow-up actions for the licensee. We found that FERC staff prepared inspection reports to document findings from the 42 dam safety inspections we reviewed. In response to inspection findings, FERC requires licensees to submit a plan and schedule to remediate any deficiency, actions that FERC staff then reviews, approves, and monitors until the licensees have addressed the deficiency. While we found that FERC staff conducted inspections and collected inspection findings consistently in the files we reviewed, FERC’s approach to recording information varies across its regions, thus limiting the usefulness of the information. FERC’s approach to recording inspection information relies on multiple systems to record inspection information and affords broad discretion to its staff on how to characterize findings, such as whether to track inspection findings as maintenance issues or as safety deficiencies. As related to systems for recording inspection information, FERC staff use the Data and Management System (DAMS), the Office of Energy Projects-IT (OEP-IT) system, as well as spreadsheets. In particular, according to FERC staff: Four out of FERC’s five regional offices use DAMS—which is primarily a workload tracking tool—to track plans and schedules associated with safety investigations and modifications as well as inspection follow-up items. FERC staff stated that since the inspection information in DAMS is recorded as narrative text in a data field instead of as discrete categories, sorting or analysis of the information is difficult. One regional office uses OEP-IT to track safety deficiencies while the system is more widely used across FERC to track licensees’ compliance with the terms and conditions of their licenses. Three out of FERC’s five regional offices also use spreadsheets and other tools that are not integrated with DAMS or OEP-IT to track inspection information and licensee progress toward resolving safety deficiencies. FERC staff said that use of these different systems to record deficiencies identified during inspections limits their ability to analyze safety information. For example, according to FERC officials, OEP-IT was not designed to track safety deficiency information and is not compatible with DAMS for use in tracking information on a national level. Furthermore, because spreadsheets and other tools are specific to the regional office in which they are used, FERC staff does not use the information they contain for agency-wide analysis. Concerning decisions on how to characterize inspection findings, FERC staff relies on professional judgment, informed by their experience and the Engineering Guidelines, to determine whether to track inspection findings as a safety deficiency or as a maintenance item, according to FERC officials. With input from their supervisors, FERC staff also determines what information to record and how to track the status of the inspection finding. For example, staff assigned to a dam at a FERC- licensed project in New Hampshire observed concrete deterioration on several parts of the dam and its spillway and asked the licensee to monitor all concrete surfaces, making repairs as necessary. According to staff we interviewed, regional staff and supervisors decided not to identify this as a deficiency to be tracked in DAMS because concrete deterioration is normal and to be expected in consideration of the area’s harsh winter weather. In contrast, staff assigned to a dam at a FERC- licensed project in Minnesota observed concrete deterioration on several parts of the project, including the piers and the powerhouse walls, and entered the safety item in DAMS as requiring repair by the licensee. FERC officials stated they are comfortable with the use of professional judgement to classify and address inspection findings because it is important to allow for consideration of the characteristics unique to each situation and how they affect safety. FERC’s approach to recording inspection information is inconsistent because FERC has not provided standard language and procedures about how staff should record and track deficiencies including which system to use. Federal standards for internal control state that agencies should design an entity’s information system and related control activities to achieve objectives and control risks. In practice, this means that an agency would design control activities—such as policies and procedures—over the information technology infrastructure to support the completeness, accuracy, and validity of information processing by information technology. FERC officials acknowledged that there are inconsistent approaches in where and how staff record safety deficiency information, approaches that limit the information’s usefulness as an input to its oversight. While the agency has not developed guidance, officials stated that FERC plans to take steps to improve the consistency of recorded information by replacing the OEP-IT system with a new system, tentatively scheduled for September 2018, that will have a specific function to track dam safety requirements. However, this new system will not replace the functions of DAMS, which FERC will continue to use to store inspection information. The two will exist as parallel systems with the eventual goal of the two systems’ sharing information. By developing standard language and procedures to standardize the recording of information collected during inspections, FERC officials could help ensure that the information shared across these systems is comparable, steps that would allow FERC to identify the extent of and characteristics associated with common safety deficiencies across its entire portfolio of regulated dams. Moreover, with a consistent approach to recording information from individual dam safety inspections, FERC will be positioned to proactively identify comparable safety deficiencies across its portfolio and to tailor its inspections towards evaluating them. While FERC uses inspection information to monitor a licensee’s efforts to address a safety deficiency for an individual dam, FERC has not analyzed information collected from its dam safety inspections to evaluate safety risks across the entire regulated portfolio of dams. For example, FERC has not reviewed inspection information to identify common deficiencies among certain types of dams. Federal standards for internal control state that agencies should identify, analyze, and respond to risks related to their objectives. These standards note that one method for management to identify risks is the consideration of deficiencies identified through audits and other assessments. Dam safety inspections are an example of such an assessment. As part of such an approach, the agency analyzes risks to estimate their significance, which provides a basis for responding to the risk through specific actions. Furthermore, in our previous work on federal facilities, we have identified that an advanced use of risk management involving the ability to gauge risk across a portfolio of facilities could allow stakeholders to comprehensively identify and prioritize risks at a national level and direct resources toward alleviating them. FERC officials stated that they have not conducted a portfolio-wide analysis in part due to the inconsistency of recorded inspection data and because such an evaluation has not been a priority compared to inspecting individual dams. According to officials, the FERC headquarters office collects and reviews information semi-annually from each of its five regional offices on the progress of outstanding dam investigations and modifications in those regions. FERC’s review is designed to monitor the status of investigations on each individual dam but does not analyze risks across the portfolio of dams at the regional or national level. For example, officials from the New York Regional Office stated they do not perform trend analysis across the regional portfolio of dams under their authority, but they compile year-to-year data for each separate dam to show any progression or changes from previous data collected from individual dams. A portfolio-wide analysis could help FERC proactively identify safety risks and prioritize them at a national level. FERC officials stated that a proactive analysis of its portfolio could be useful to determining how to focus its inspections to alleviate safety risks, but it was not an action that FERC had taken to date. The benefits of a proactive analysis, for example, could be similar to those FERC derived from the analysis it conducted in reaction to the Oroville Dam incident. To conduct this analysis, FERC required 184 project licensees, identified by FERC regional offices as having spillways similar to the failed spillway at the Oroville Dam, to assess the spillways’ safety and capacity. According to FERC officials, these assessments identified 27 dam spillways with varying degrees of safety concerns. They stated that FERC’s spillway assessment initiative was a success because they were able to target a specific subgroup of dams within the portfolio and identify these safety concerns at 27 dam spillways. FERC officials stated that they are working with the dam licensees to address these safety concerns. A similar and proactive approach based on analysis of common deficiencies across the portfolio of dams under FERC’s authority could also help to identify any safety risks that may not have been targeted during the inspections of individual dams and prior to a safety incident. As directed by FERC, licensees and their consultants develop and review, or update, various engineering studies related to dam performance to help ensure their dams meet FERC requirements and remain safe. FERC regulations and guidelines describe the types and frequency of studies and analyses required based on dams’ hazard classifications. For all high hazard and some significant hazard dams, existing studies are to be reviewed by each licensee’s consultants every 5 years, as part of the independent consultant inspection and accompanying potential failure mode analysis. According to FERC officials, for those significant hazard dams that do not require an independent consultant inspection and for low hazard dams, FERC’s regulations and guidelines do not require any studies, but in practice FERC directs many licensees to conduct them. FERC also may request engineering studies in response to dam safety incidents at other projects, or engage a board of consultants to oversee the completion of a study. For example, as previously noted, following the Oroville Dam incident in 2017, FERC requested a special assessment of all dams with spillways similar to the failed spillway at the Oroville Dam. To develop these studies, all six of the consultants we interviewed stated that they follow guidelines provided by FERC and other dam safety agencies. Specifically, they stated that they use FERC’s Engineering Guidelines, which provide engineering principles to guide the development and review of engineering studies. In recognition of the unique characteristics of each dam, including its construction, geography, and applicable loading conditions, the Guidelines provides consultants with flexibility to apply engineering judgment, and as a result, the approach that licensees and their consultants use and the focus of their reviews of engineering studies may vary across regions or projects. For example, one independent consultant we interviewed noted that seismicity studies are not highlighted during the independent consultant inspections for projects in the Upper Midwest in comparison to projects in other areas of the country because the region is not seismically active, but that inspections do look closely at ice loads during the winter months. To create these studies, we found that licensees and their consultants generally use data from other federal agencies and rely on available modeling tools developed by federal agencies and the private sector to evaluate dam performance. For example, many of the engineering studies we reviewed rely on data from the National Weather Service and the National Oceanic and Atmospheric Administration to estimate precipitation patterns and the U.S. Geological Survey to estimate seismic activity. In addition, licensees and their consultants use modeling tools and simulations, such as those developed by the Corps to estimate hydrology, to develop engineering studies. FERC staff noted that the engineering studies developed by licensees and their consultants generally focus on the analysis of extreme events, such as earthquakes and floods. In reference to extreme events, FERC staff said that both actual past events and likely future events are considered in determining their magnitude. FERC staff noted the probable maximum flood—the flood that would be expected to result from the most extreme combination of reasonably possible meteorological and hydrological conditions—as an example of a dam design criterion that is based on application of analysis of extreme events. In describing the efficacy of probable maximum flood calculations, FERC officials stated that they had not observed a flood that exceeded the probable maximum flood calculated for any dam and noted that their Engineering Guidelines provides a conservative approach to estimating the probable maximum flood and other extreme events. FERC officials stated that requiring a conservative approach to estimating extreme events helps to mitigate the substantial uncertainty associated with these events, including in consideration of emerging data estimating the effects of climate change on extreme weather events. Once developed, engineering studies we reviewed often remained in effect for a number of years, until FERC or the licensee and its consultant determined an update was required. For example, we found that the hydrology studies were 20 years or older for 17 of the 42 dams in our review, including for 9 of the 16 high hazard dams in our sample. FERC’s Engineering Guidelines states that studies should be updated as appropriate. For example, FERC’s Engineering Guidelines on hydrology studies state that previously accepted flood studies are not required to be reevaluated unless it is determined that a re-analysis is warranted. The Guidelines notes that FERC or the consultant may consider reanalyzing the study for several reasons, including if they identify (1) significant errors in the original study; (2) new data that may significantly alter previous study results; or (3) significant changes in the conditions of the drainage basin. FERC staff and consultants we interviewed stated that age alone is not a primary criterion to update or replace studies and that studies should be updated as needed depending on several factors including age, new or additional data, and professional judgment. Consultants we interviewed identified some limitations that can affect their ability to develop engineering studies for a dam. For example, they noted that some dams may lack original design information, used prior to construction of the dam, which includes the assumptions and calculations used to determine the type and size of dam, the amount of water storage capacity, and information on the pre-construction site geology and earthquake potential. FERC officials estimated that for a large percentage of the dams they relicense, the original information is no longer available. For example, according to the report from the independent forensic team investigating the Oroville Dam incident and as previously noted, some design drawings and construction records for the dam’s spillway could not be located and some other documents that were available were not included in the most recent independent consultant inspection report submitted to FERC. To overcome the lack of original design information, FERC told us that licensees and their consultants may use teams of experts, advanced data collection techniques, and other modern methods, where feasible, to assess the dam’s ability to perform given current environmental conditions. In cases where design or other engineering information is incomplete, consultants stated that they generally recommend the licensee conduct additional studies based on the risk presented by the missing information but also noted that the financial resources of a licensee may affect its willingness and ability to conduct additional studies. However, FERC officials stated that FERC staff are ultimately responsible for making decisions on whether additional engineering studies are needed to evaluate a dam’s performance. FERC has established policies and procedures that use formal guidance, and permit the use of professional judgment, to evaluate and review engineering studies of dam performance submitted by licensees and their consultants. FERC officials in both the headquarters and regional offices emphasized that their role as the regulator is to review and validate engineering studies developed by the licensee and their consultants. FERC generally does not develop engineering studies as officials noted that dam safety, including the development of engineering studies, is primarily the licensee’s responsibility. To carry out their responsibility to ensure public safety, FERC staff stated they use procedures and criteria in the FERC Engineering Guidelines to review engineering studies and apply professional judgment to leverage their specialized knowledge, skills, and abilities to support their determinations of dam safety. FERC’s Engineering Guidelines provides a framework for the review of engineering studies, though the Guidelines recognizes that each dam is unique and allows for flexibility and exemptions in their use. Moreover, the Guidelines notes that analysis of data is useful when evaluating a dam’s performance, but should not be used as a substitute for judgment based on experience and common sense. Because FERC’s Engineering Guidelines allows for the application of professional judgment, the methods used to review these studies vary depending on the staff, the region, and individual dam characteristics. For example, FERC staff said that when they review consultants’ assumptions, methods, calculations and conclusions, in some cases they may decide to conduct a sensitivity analysis if—based on the staff’s judgment—they need to take additional steps to validate or confirm factors of safety for the project. FERC officials also stated that staff may conduct their own independent analyses, as appropriate, such as evaluating a major structural change to the dam or validating submitted studies. For example, as part of its 2016 review of the Union Valley Dam in California, FERC staff validated the submitted hydrology study by independently calculating key inputs, such as precipitation rates and peak floods, to evaluate the dam’s performance and verify the spillway’s reported capacity. In addition, FERC has established various controls to help ensure the quality of its review, including using a risk-based review process, assigning multiple staff to review the studies, and rotating staff responsibilities over time. We have previously found in our reporting on other regulatory agencies that practices such as rotating staff in key decision-making roles, and including at least two supervisory staff when conducting oversight reviews help reduce threats to independence and regulatory capture. Risk-based review process. FERC’s review approach is risk-based, as the frequency of staff’s review of these studies is based on the hazard classification of the dam as well as professional judgment. FERC relies on three primary engineering studies (hydrology, seismicity, and stability), and others as appropriate, which form the basis for determining if a dam is safe. In addition, FERC requires licensees to hire a FERC-approved independent consulting engineer at least every 5 years to inspect and evaluate high hazard and other applicable dams and submit a report detailing the findings as part of the independent consultant inspection process. In general, for the dams we reviewed, we found that FERC staff reviewed engineering studies for dams subject to independent consultant inspections (which are typically high or significant hazard dams) more frequently than those engineering studies associated with dams for which FERC does not require an independent consultant inspection (typically low hazard dams). For example, we found FERC staff had reviewed the most recent hydrology studies for all 22 high and significant hazard dams in our sample subject to independent consultant inspections within the last 6 years and documented their analysis. According to FERC officials, for dams not subject to an independent consultant inspection, FERC staff review engineering studies on an as needed basis, depending on whether the underlying assumptions and information from the previous studies are still relevant. For example, for the 20 dams in our study not subject to an independent consultant inspection, we found that most (15) of these studies were reviewed by FERC within the past 10 years, usually during the project’s relicensing. Multiple levels of supervisory review. As part of FERC’s quality control and internal oversight process, multiple FERC staff are to review the studies produced by the licensee and its consultant, with the number of successive reviews proportional to the complexity or importance of the study, according to FERC officials. FERC’s Operating Manual establishes the general procedure for the review of engineering studies. To begin the review process, the staff assigned to a dam is to review the engineering study and prepares an internal memo on its findings; that memo is then to be reviewed for accuracy and completeness by both a regional office Branch Chief, and the Regional Engineer. If necessary, Washington, D.C., headquarters office staff are to review and approve the final memo. Upon completion of review, FERC staff are to provide a letter to the licensee indicating any particular areas where additional information is needed or where more studies are needed to evaluate the dam’s performance. According to FERC officials, each level of review adds successive quality control steps performed by experienced staff. We have previously found in reporting on other regulatory agencies that additional levels of review increases transparency and accountability and diminishes the risk of regulatory capture. Rotation of FERC staff responsibilities. As part of an internal quality control program to help minimize the risk of missing important safety- related items, FERC officials told us they rotate staff assignments and responsibilities approximately every 3 to 4 years. According to FERC officials, this practice decreases the chance that a deficiency would be missed over time due to differences in areas of engineering expertise between or among staff. We have previously found in our reporting on other regulatory agencies that strategies such as more frequently rotating staff in key roles can help reduce the risk to supervisory independence and regulatory capture. Some FERC regional offices have developed practices to further enhance their review of these studies. For example, the New York Regional Office established a subject matter expert team that helps review dams with unusually complex hydrology issues. This team was created, in part, because FERC staff noted that some of the hydrology studies conducted in the 1990s and 2000s were not as thorough as they would have wanted, and warranted a re-examination. Currently, the New York Regional Office is reviewing the hydrology analysis associated with 12 dam break studies to determine if the hydrology data used in developing these studies were as rigorously developed and validated. According to the FERC staff in this office, utilizing a team of subject matter experts has reduced Regional Office review time and improved the hydrology studies’ accuracy. FERC staff in the New York Regional Office also told us that they are working with other regional offices on setting up similar technical teams. For example, FERC staff in the New York Regional Office have been working with the Portland Regional Office to set up a similar team. FERC procedures require the use of engineering studies at key points over the dam’s licensing period to inform components of its safety oversight approach, including during the potential failure mode analyses of individual dams as well as during relicensing. Potential failure mode analysis. The potential failure mode analysis is to occur during the recurring independent consultant inspection and is conducted by the licensee’s independent consultant along with other key dam safety stakeholders. As previously explained, the analysis incorporates the engineering studies and identifies events that could cause a dam to potentially fail. During the potential failure mode analysis, FERC, the licensee, the consultant, and other key dam safety stakeholders are to refer to the engineering studies to establish environmental conditions that inform dam failure scenarios, the risks associated with these failures, and their consequences for an individual dam. Further, according to a FERC white paper on risk analysis, FERC is beginning to use information related to potential failure modes as inputs to an analysis tool that quantifies risks at each dam. With this information, FERC expects to make relative risk estimates of dams within its inventory and establish priorities for further study or remediation of risks at individual dams, according to the white paper. Relicensing. During relicensing, FERC staff are to review the engineering studies as well as information such as historical hydrological data and extreme weather events, which also inform their safety evaluation of the licensee’s application. FERC officials also stated that as a result of their relicensing review, they might alter the articles of the new license before it is issued should their reviews indicate that environmental conditions affecting the dam’s safety have changed. We found that FERC generally met its requirement to evaluate dam safety during the relicensing process for the 42 dams we reviewed. During the relicensing process, we found that for the dams we reviewed, FERC staff review safety information such as the past reports, inspections, and studies conducted by FERC, the licensee, and independent consultants and determine whether or not a dam owner operated and maintained its dam safely. According to FERC staff, the safety review for relicensing is generally a summary of prior safety and inspection information, rather than an analysis of new safety information, unless the licensee proposes a change to the operation or structure. FERC’s review during relicensing for the high hazard and significant hazard dams we reviewed was generally consistent with its guidance and safety memo template, though the extent of its review of low hazard dams varied. (See fig. 3.) For example, for the 22 high and significant hazard dams we reviewed, the safety relicensing memos followed the template and nearly all included summaries of hydrology studies, stability analyses, prior FERC inspections, and applicable independent consultant reports. For the 20 low hazard dams, FERC staff noted that some requirements in the template are not applicable or have been exempted and therefore were not reviewed during relicensing. While low hazard dams were more inconsistently reviewed during relicensing, FERC staff also noted that there has been a recent emphasis to more closely review, replace, or conduct engineering studies, such as the stability study, for low hazard dams during relicensing. Moreover, FERC staff told us that the safety risks associated with these dams are minimal, as the failure of a low hazard dam, by definition, does not pose a threat to human life or economic activity. According to FERC staff, if a licensee proposed altering the dam or its operations in any way as part of its application for a new license, FERC staff would review the proposed change and may recommend adding articles to the new license prior to its issuance to ensure dam safety. FERC officials noted that, as part of their review, any structural or operational changes proposed by the licensee during relicensing are reviewed by FERC. These officials also noted that FERC generally recommends modifications to the licensees’ proposed changes prior to their approval and inclusion in the new license. However, FERC officials noted that, in some cases, additional information is needed prior to approving the structural or operational change to ensure there are no risks posed by the changes. In those instances, FERC may recommend that articles be added to the new license, that require the licensee to conduct additional engineering studies of the issue and submit them to FERC for review and approval. For example, during the relicensing of the Otter Creek project in Vermont in 2014, the licensee proposed changes to the project’s operation resulting from construction. As a result, FERC’s staff recommended adding a number of articles to the license, including that the licensee conduct studies to evaluate the effect of the change on safety and to ensure safety during construction. During relicensing, third parties—such as environmental organizations, nearby residents and communities, and other federal agencies, such as the U.S. Fish and Wildlife Service—may provide input on various topics related to the project, including safety. However, FERC officials said that very few third parties file studies or comments related to dam safety during relicensing. FERC’s template and guidance do not specifically require the consideration of such analyses as part of its safety review, and we did not identify any safety studies submitted by third parties for dams or reviewed by FERC in our sample. According to FERC officials, when stakeholders submit comments during relicensing, the comments tend to focus on environmental aspects of the project, such as adding passages for fish migration. Further, FERC is not required under the Federal Power Act to respond to any comments, including those related to dam safety, from third parties, according to FERC officials. However, according to FERC officials, courts have held that the Administrative Procedure Act precludes an agency from arbitrarily and capriciously ignoring issues raised in comments. Furthermore, these officials stated that if a court determines that FERC did not sufficiently address issues raised during the relicensing process, its orders are subject to being reversed and remanded by applicable United States courts of appeals. Moreover, FERC officials noted that the information needed to develop third party safety studies, such as the dam design drawings and engineering studies, are property of the licensee, rather than FERC. In addition, this information may not be readily available to third parties or the public if FERC designates it as critical energy infrastructure information, which would preclude its release to the general public. FERC staff we interviewed stated that there have been no instances where the Commission denied a new license to a licensee as a result of its safety review during relicensing. FERC staff stated that given the frequency of other inspections, including the FERC staff inspections, and independent consultant inspections, it is unlikely staff would find a previously unknown major safety issue during relicensing. FERC staff told us that rather than deny a license for safety deficiencies, FERC will keep a dam owner under the terms of a FERC license to better ensure the licensee remedies existing safety deficiencies. Specifically, FERC staff noted that under a license, FERC can ensure dam safety by (1) closely monitoring the deficiency’s remediation progress through its inspection program, (2) adding license terms in the new license tailored to the specific safety deficiency, and (3), as necessary, pursuing compliance and enforcement actions, such as civil penalties or stop work orders, to enforce the terms and conditions of the license. For example, prior to and during the relicensing of a FERC-licensed project in Wisconsin in 2014, FERC’s review identified that the spillway capacity was inadequate. While the project was relicensed in 2017 without changes to the spillway, FERC officials stated that they have been overseeing the plans and studies of the remediation of the spillway through their ongoing inspection program. However, if an imminent safety threat is identified during the relicensing review, FERC officials stated that they will order that the licensee take actions to remedy the issue immediately. Moreover, FERC officials noted that, if necessary, a license can be revoked for failure to comply with the terms of its license. FERC designed a multi-layered safety approach—which uses inspections, studies, and other assessments of individual dams—to reduce exposure to safety risks. However, as the spillway failure at the Oroville Dam project in 2017 demonstrated, it is not possible to eliminate all uncertainties and risks. As part of a continuing effort to ensure dam safety at licensed projects, FERC could complement its approach to evaluating the safety of individual dams by enhancing its capability to assess and identify the risks across its portfolio of licensed dams. Specifically, while FERC has collected and stored a substantial amount of information from its individual dam safety inspections, FERC’s approach to recording this information is inconsistent due to a lack of standard language and procedures. By clarifying its approach to the recording of information collected during inspections, FERC officials could help ensure that the information recorded is comparable when shared across its regions. Moreover, the absence of standard language and procedures to consistently record inspection information impedes a broader, portfolio- wide analysis of the extent of and characteristics associated with common safety deficiencies identified during FERC inspections. While FERC has not yet conducted such an analysis, a proactive assessment of common safety inspection deficiencies across FERC’s portfolio of licensed dams— similar to its identification of dam spillways with safety concerns following the Oroville Dam incident—could help FERC and its licensees identify safety risks prior to a safety incident and to develop approaches to mitigate those risks. We are making the following two recommendations to FERC: FERC should provide standard language and procedures to its staff on how to record information collected during inspections, including how and where to record information about safety deficiencies, in order to facilitate analysis of safety deficiencies across FERC’s portfolio of regulated dams. (Recommendation 1) FERC should use information from its inspections to assess safety risks across its portfolio of regulated dams to identify and prioritize safety risks at a national level. (Recommendation 2) We provided a draft of this report to FERC for review and comment. In its comments on the draft report, FERC said it generally agreed with the draft report’s findings and found the recommendations to be constructive. FERC said that it would direct staff to develop appropriate next steps to implement GAO’s recommendations. These comments are reproduced in appendix IV. In addition, FERC provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Chairman of FERC and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at 202-512-2834 or vonaha@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. FERC seeks to ensure licensees’ compliance with FERC regulations and license requirements, including remediating safety deficiencies, by using a mix of preventative strategies to help identify situations before they become problems and reactive strategies such as issuing penalties. As part of its efforts, FERC published a compliance handbook in 2015 that provides an overall guide to compliance and enforcement of a variety of license requirements, including dam safety. The handbook includes instructions for implementing FERC rules, regulations, policies, and programs designed to ensure effective compliance with license conditions, which include dam safety, to protect and enhance beneficial public uses of waterways. FERC developed a range of enforcement actions, that include holding workshops to encourage compliance and issuing guidance, that increase in severity depending on the non- compliance issue. (See fig. 4.) More broadly, FERC’s guidance directs officials to determine enforcement actions and time frames for those actions on a case-by-case basis, depending on the characteristics of the specific compliance issue. According to FERC officials, many of these safety compliance discussions are handled informally. In addition, their compliance approach emphasizes activities that assist, rather than force, licensees to achieve compliance, according to its guidance. These activities include facilitating open lines of communication with licensees, participating in technical workshops, and publishing brochures and guidance documents, among other efforts. Also, according to these officials, FERC works with licensees to provide guidance and warnings of possible non-compliance matters, in order to avoid usage of any enforcement tools, if possible. According to FERC officials, any safety issues that endanger the public will result in immediate penalty or removal of the dam from power generation, but this action is not lightly taken. Additionally, the length of time between when a safety deficiency is identified and is resolved varies substantially depending on the specific project. As stated earlier in this report, FERC works with licensees to determine a plan and schedule for investigating safety issues and making any needed modifications. However, FERC officials stated that the majority of safety compliance issues are resolved within a month. However, FERC officials stated that if a licensee repeatedly does not take steps to address a compliance issue, FERC will explore enforcement actions through a formal process. According to officials, FERC’s enforcement options are based on authorities provided under the Federal Power Act and such options are flexible because of the variation in hazards, consequences, and dams. According to FERC officials, to ensure compliance with safety regulations, if a settlement cannot be reached, FERC may, among other things, issue an order to show cause, issue civil penalties in the form of fines to licensees, impose stop work or cease power generation orders, revoke licenses, and seek injunctions in federal court. Nevertheless, FERC officials stated that there is no specific requirement for how quickly the compliance issues or deficiencies should be resolved and that some issues can take years to resolve. For example, in 2004, the current licensee of a hydroelectric project operating in Edenville, Michigan, acquired the project, which was found by FERC to be in a state of non-compliance at that time. FERC staff made numerous attempts to work with the licensee to resolve the compliance issues. However, they were unable to resolve these issues and as a result issued a cease generation order in 2017, followed in 2018 by a license revocation order. In practice, FERC’s use of these enforcement tools to resolve safety issues has been fairly limited, particularly in comparison to other license compliance issues, according to FERC officials. Since 2013, FERC has issued one civil penalty for a safety-related hydropower violation and has issued compliance orders on eight other projects for safety-related reasons, including orders to cease generation on three projects. For the 14 projects and 42 dams we reviewed, FERC licensees and their consultants used a variety of tools to develop engineering studies of dam performance (see table 3). These tools included programs and modeling tools developed by government agencies, such as the U.S. Army Corps of Engineers (the Corps), as well as commercially available modeling tools. FERC officials stated that they also used a number of the same tools used by its licensees and consultants. Similarly, for the 14 projects and 42 dams we reviewed, FERC licensees and their consultants used a variety of datasets to develop engineering studies of dam performance (see table 4). These datasets included data maintained and updated by various government agencies, including the United States Geological Survey and National Oceanic and Atmospheric Administration. FERC officials stated that they also used a number of the same datasets used by its licensees and consultants. This report assesses: (1) how FERC collects information from its dam safety inspections and the extent to which FERC analyzes it; (2) how FERC evaluates engineering studies of dam performance to analyze safety, and (3) the extent to which FERC reviews dam safety information during relicensing and the information FERC considers. This report also includes information on FERC actions to ensure licensee compliance with license requirements related to dam safety (app. I) and selected models and data sets used to develop and evaluate engineering studies of dam performance (app. II). For each of the objectives, we reviewed laws, regulations, FERC guidance, templates, and other documentation pertaining to FERC’s evaluation of dam safety. In addition, we reviewed an independent forensic team’s assessment of the causes of the Oroville Dam incident, including the report’s analysis of FERC’s approach to ensuring safety at the project, to understand any limitations of FERC’s approach identified by the report. We also reviewed dam safety documentation, including dam performance studies, FERC memorandums, the most recent completed inspection report, and other information, from a non-probability sample of 14 projects encompassing 42 dams relicensed from fiscal years 2014 through 2017. (See table 5.) We selected these projects and dams to include ones that were geographically dispersed, had varying potential risks associated with their potential failure, and had differences in the length of their relicensing process. We developed a data collection instrument to collect information from the dam safety documentation and analyzed data from the sample to evaluate the extent to which FERC followed its dam safety guidance across the selected projects. To develop the data collection instrument, we reviewed and incorporated FERC oversight requirements from its regulations, guidance, and templates. We conducted three pre-tests of the instrument, and revised the instrument after each pre-test. To ensure consistency and accuracy in the collection of this information, for each dam in the sample, one analyst conducted an initial review of the dam safety documentation; a second analyst reviewed the information independently; and the two analysts reconciled any differences. Following our review of the information from the dam safety documentation, we conducted semi-structured interviews with FERC engineering staff associated with each of the 14 projects and 42 dams to obtain information about FERC’s inspections, review of dam performance studies, and analysis of safety during the relicensing of these projects. Our interviews with these FERC staff provided insight into FERC’s dam safety oversight approach and are not generalizable to all projects. We also interviewed FERC officials responsible for dam safety about dam safety practices. In addition, to review how FERC collects information from its dam safety inspections and the extent to which FERC analyzes it, we also reviewed inspection data from FERC’s information management systems from fiscal years 2014 through 2017. To assess the reliability of these data, we reviewed guidance and interviewed FERC officials. We determined that the data were sufficiently reliable for our purposes. We compared FERC’s approach to collecting, recording and using safety information to federal internal control standards for the design of information systems and related control activities. We also reviewed our prior work on portfolio- level risk management. To evaluate how FERC evaluates engineering studies of dam performance to analyze dam safety, we reviewed FERC policies and guidance. We interviewed six independent consultants having experience inspecting and analyzing FERC-regulated dams to understand how engineering studies of dam performance are developed. We selected consultants who had submitted an inspection report to FERC recently (between December 2017 and February 2018) based on the geographic location of the project they reviewed and experience conducting these inspections, and the number of reports submitted to FERC over this time period. (See table 6.) Our interviews with these consultants provided insight into FERC’s approach to conducting and reviewing studies and are not generalizable to all projects or consultants. To evaluate the extent to which FERC reviews dam safety information during relicensing and the information it considers, we reviewed templates developed by FERC to assess safety during the relicensing and analyzed the extent to which staff followed guidance in these templates for the 14 projects and 42 dams in our sample. We also interviewed stakeholders, including the National Hydropower Association and Friends of the River to obtain general perspectives on FERC’s relicensing approach. Our interviews with these stakeholders provided insight into FERC’s approach to relicensing, and these views are not generalizable across all stakeholders. To review actions to ensure licensee compliance with license requirements related to dam safety, we reviewed FERC’s guidance related to compliance and enforcement and interviewed FERC officials responsible for implementation of the guidance. To review information on models and datasets used to develop and evaluate engineering studies of dam performance, we reviewed dam safety documentation associated with the projects in our sample (described previously), reviewed FERC documentation, and interviewed FERC officials. We conducted this performance audit from July 2017 to October 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Andrew Von Ah, (202) 512-2834 or vonaha@gao.gov. In addition to the contact named above, Mike Armes (Assistant Director); Matt Voit (Analyst-in-Charge); David Blanding; Brian Chung; Geoff Hamilton; Vondalee Hunt; Rich Johnson; Jon Melhus; Monique Nasrallah; Madhav Panwar; Malika Rice; Sandra Sokol; and Michelle Weathers made key contributions to this report.

Summary: In February 2017, components of California's Oroville Dam failed, leading to the evacuation of nearly 200,000 nearby residents. FERC is the federal regulator of the Oroville Dam and over 2,500 other dams associated with nonfederal hydropower projects nationwide. FERC issues and renews licenses—which can last up to 50 years—to dam operators and promotes safe dam operation by conducting safety inspections and reviewing technical engineering studies, among other actions. GAO was asked to review FERC's approach to overseeing dam safety. This report examines: (1) how FERC collects information from its dam safety inspections and the extent of its analysis, and (2) how FERC evaluates engineering studies of dam performance to analyze safety, among other objectives. GAO analyzed documentation on a non-generalizable sample of 42 dams associated with projects relicensed from fiscal years 2014 through 2017, selected based on geography and hazard classifications, among other factors. GAO also reviewed FERC regulations and documents; and interviewed FERC staff associated with the selected projects and technical consultants, selected based on the frequency and timing of their reviews. The Federal Energy Regulatory Commission's (FERC) staff generally followed established guidance in collecting safety information from dam inspections for the dams GAO reviewed, but FERC has not used this information to analyze dam safety portfolio-wide. For these 42 dams, GAO found that FERC staff generally followed guidance in collecting safety information during inspections of individual dams and key structures associated with those dams. (See figure.) However, FERC lacks standard procedures that specify how and where staff should record safety deficiencies identified. As a result, FERC staff use multiple systems to record inspection findings, thereby creating information that cannot be easily analyzed. Further, while FERC officials said inspections help oversee individual dam's safety, FERC has not analyzed this information to identify any safety risks across its portfolio. GAO's prior work has highlighted the importance of evaluating risks across a portfolio. FERC officials stated that they have not conducted portfolio-wide analyses because officials prioritize the individual dam inspections and response to urgent dam safety incidents. However, following the Oroville incident, a FERC-led initiative to examine dam structures comparable to those at Oroville identified 27 dam spillways with varying degrees of safety concerns, on which FERC officials stated they are working with dam licensees to address. A similar and proactive portfolio-wide approach, based on analysis of common inspection deficiencies across the portfolio of dams under FERC's authority, could help FERC identify safety risks prior to a safety incident. Guidelines recognize that each dam is unique and allow for flexibility and exemptions in its use. FERC staff use the studies to inform other components of their safety approach, including the analysis of dam failure scenarios and their review of safety to determine whether to renew a license. GAO recommends that FERC: (1) develop standard procedures for recording information collected as part of its inspections, and (2) use inspection information to assess safety risks across FERC's portfolio of dams. FERC agreed with GAO's recommendations.