Commission Staff Working Paper - Risk Assessment and Mapping Guidelines for Disaster Management - Hoofdinhoud

COUNCIL OF Brussels, 5 January 2011

THE EUROPEAN UNION

17833/10

PROCIV 184 JAI 1070 ENV 862 FORETS 154 AGRI 549 RECH 417

COVER NOTE

from: Secretary-General of the European Commission,

signed by Mr Jordi AYET PUIGARNAU, Director date of receipt: 22 December 2010

to: Mr Pierre de BOISSIEU, Secretary-General of the Council of the European

Union

Subject: Commission Staff Working Paper - Risk Assessment and Mapping Guidelines for Disaster Management

Delegations will find attached Commission document SEC(2010) 1626 final.

________________________

Encl.: SEC(2010) 1626 final

EUROPEAN COMMISSION

Brussels, 21.12.2010 SEC(2010) 1626 final

COMMISSION STAFF WORKING PAPER

Risk Assessment and Mapping Guidelines for Disaster Management

EN EN

• 1. 

  Introduction .................................................................................................................. 4

• 2. 

  Scope and Objectives of EU Guidelines ...................................................................... 5

2.1. Scope ............................................................................................................................ 5

2.2. Objectives of EU Guidelines ........................................................................................ 6

2.3. Role of Risk Assessment and Mapping within Disaster Risk Management ................ 8

• 3. 

  Definition of Terms ...................................................................................................... 9

• 4. 

  The Risk Assessment Process .................................................................................... 12

4.1. Actors ......................................................................................................................... 12

4.2. Public Consultation and Communication................................................................... 13

4.3. Data............................................................................................................................. 13

• 5. 

  Risk Assessment Methods.......................................................................................... 15

5.1. Conceptual Framework and Basic Methodology ....................................................... 15

5.1.1. Risks: combining the consequences of a hazard with the likelihood of its occurrence .................................................................................................................................... 15

5.1.2. Impact (human, economic, environmental, political/social) ...................................... 17

5.1.3. Risk matrix ................................................................................................................. 18

5.2. Stage 1: Risk Identification ........................................................................................ 20

5.2.1. Risk scenarios............................................................................................................. 21

5.2.2. Single-risk and multi-risk assessments....................................................................... 22

5.2.3. Risk identification in national risk assessments ......................................................... 23

5.3. Stage 2: Risk Analysis................................................................................................ 25

5.3.1. Single-risk analysis of natural and man-made hazards .............................................. 25

5.3.2. Multi-risk assessments................................................................................................ 28

5.3.3. Risk analysis in national risk assessments.................................................................. 29

5.4. Stage 3: Risk Evaluation ............................................................................................ 30

5.5. Dealing with Uncertainty ........................................................................................... 32

5.5.1. Sensitivity analysis ..................................................................................................... 32

5.5.2. The precautionary principle........................................................................................ 32

5.6. Cross-border Dimension of Risk Assessment ............................................................ 32

• 6. 

  Risk Mapping to Support Risk Assessment ............................................................... 34

6.1. Flood Mapping ........................................................................................................... 35 6.2. Recommendations on the risk mapping approach...................................................... 35

6.3. Way forward ............................................................................................................... 36

• 7. 

  Annex 1: Reference Material...................................................................................... 37

• 8. 

  Annex 2: Relevant Information on Risks for the Development of an Overview of the Major Risks the EU May Face in the Future.............................................................. 40

  • 9. 

    Annex 3: List of Risk Identification Methods............................................................ 41 1. I NTRODUCTION

    On 23 February 2009, the European Commission adopted a Communication on a

    Community approach on the prevention of natural and man-made disasters 1 setting

    out an overall disaster prevention framework and proposing measures to minimize the impacts of disasters. The Communication advocated the development of EU and national policies supporting the disaster management cycle: prevention - preparedness - response - recovery.

    The Council Conclusions on a Community framework on disaster prevention within the EU, adopted on 30 November 2009 emphasised that hazard and risk identification and analysis, impact analysis, risk assessments and matrices, scenario development, risk management measures, and regular reviews are major components of the EU disaster prevention framework and of prevention policies at all levels of government, and stressed the potential for an added value of EU work in these areas.

    The Council Conclusions called on the Commission, before the end of 2010, together with Member States to develop EU guidelines, taking into account work at national level on methods of hazard and risk mapping, assessments and analyses in order to facilitate such actions in Member States and to ensure a better comparability between Member States.

    The Council Conclusions also invited the Member States, before the end of 2011 to further develop national approaches and procedures to risk management including risk analyses, covering the potential major natural and man-made disasters, taking into account the future impact of climate change. Member States are invited to make use of the guidelines on methods of risk assessments and mapping to be developed by the Commission.

    Member States are also invited, before the end of 2011, to make available to the Commission information on risks of relevance for the development of an overview of the major risks the European Union may face in the future.

    The Commission is called on, before the end of 2012, on the basis of national risk analysis, to prepare this cross-sectoral overview of the major natural and man-made risks that the European Union may face in the future and taking into account, where possible and relevant, the future impact of climate change and the need for climate adaptation; and to identify on the basis of the overview risks or types of risks that are shared by Member States or regions in different Member States.

    Finally, the recently adopted Commission Communication on the Internal Security

    Strategy 2 , in particular Action 2 of Objective 5 on "an all-hazards approach to threat

    and risk assessment", states that by the end of 2010 the Commission will develop, together with Member States, EU risk assessment and mapping guidelines for disaster management, based on a multi-hazard and multi-risk approach, covering in principle all natural and man-made disasters. This process will contribute to

1 COM(2009)82 final i of 23.2.2009; The Communication on the Internal security strategy addressed the

need for an integrated approach between security and other policies..

EN 4 EN

establishing by 2014 a coherent risk management policy linking threat and risk

assessments to decision making. 3

• 2. 

  S COPE AND O BJECTIVES OF EU G UIDELINES

Europe has generated a wealth of efficient disaster management practices which effectively limit the negative consequences of hazards. Some regions have developed valuable specialised expertise for particular types of risks. Sharing this experience will help to further reduce the impacts of hazards in the most efficient and acceptable ways and allows the joining of forces for the challenges ahead. As recognised by the Council Conclusions on a Community framework on disaster prevention, developing a European perspective may create significant opportunities of successfully combining resources for the common objective of preventing and mitigating shared

risks.

2.1. Scope

National risk assessments include risks which are of sufficient severity to entail involvement by national governments in the response, in particular via civil protection services. Several countries have already produced national risk assessments or carried out substantive work in the area, in particular, UK, NL, DE,

SE, FR, USA, Australia, Canada.

These guidelines build on experience in the practical implementations of national risk assessments and mapping, in particular existing good practice risk assessments of major natural and man-made disasters available in Member States. The guidelines

take full account of existing EU legislation including the directives on flood risks 4 , protection of European Critical Infrastructures 5 , and on the control of major accident hazards (Seveso) 6 7 , the Water Framework Directive (drought management) .

Moreover, the guidelines consider a number of Eurocodes, such as Eurocode 8 on

building design standards for seismic risks 8 , and also the Council conclusions on prevention of forest fires within the European Union 9 . The guidelines also gather

results from most recent research in the area of risk assessment and mapping.

3 COM (2010) 673 i: Objective 5: Increase Europe's resilience to crises and disasters - Action 2: An allhazards

 approach to threat and risk assessment: Action 2: An all-hazards approach to threat and risk assessment:

4 Directive 2007/60/EC i of the European Parliament and of the Council of 23 October 2007 on the

assessment and management of flood risks, OJ L288, 6.11.2007, p.28.

5 Council Directive 2008/114/EC i on the identification and designation of European critical

infrastructures and the assessment of the need to improve their protection, OJ L345, 23.12.2008, p.75.

6 Council Directive 96/82/EC i on the control of major accident hazards involving dangerous substances,

OJ L010, 14.01.1997, p. 13.

7 Directive 2000/60/EC i of the European Parliament and of the Council of 23 October 2000 establishing a

framework for Community action in the field of water policy, OJ L327, 22.12.2000, p.1.

8 http://eurocodes.jrc.ec.europa.eu/home.php.

9 Council conclusions of 26 April 2010, Council document 7788/10, inviting the Commission to include

forest fires in the priorities to be addressed in the ongoing work on exchange of good practice and development of guidelines on risk assessment and mapping, and to continue and enhance the European Forest Fire Information System (EFFIS) on the basis of data supplied by the Member States. The MS are invited to classification of forest areas according to the risk of forest fire, including the designation

The guidelines are mainly addressed to national authorities and other actors interested in the elaboration of national risk assessments, including regional and local

authorities involved in cross border cooperation 10 .

The focus of these guidelines is on the processes and methods of national risk assessments and mapping in the prevention, preparedness and planning stages, as carried out within the broader framework of disaster risk management. The guidelines are based on a multi-hazard and multi-risk approach. They cover in

principle all natural and man-made disasters both within and outside the EU 11 , but

excluding armed conflicts and threat assessments on terrorism and other malicious

threats. Risk classification does not fall within the scope of these guidelines.

Disaster risk policies at the European level deal with a variety of topics, including

natural and man-made disasters, health threats 12 , pandemics, industrial risks, nuclear

risks, agricultural risks, and others. To the extent that the response to actual disasters within Europe involves operations by civil protection services, there is a clear civil protection interest in minimising such risks and in establishing appropriate feed-back mechanisms to prevent as much as possible their occurrence and impacts. Risk assessment and mapping are the first step in these preventive efforts. Comprehensive risk assessments will necessarily have to include the input from all competent services. These guidelines are intended to create an open platform for national risk assessments which can encompass most or all of these risks, even though in this first

version the focus will be on natural and industrial disasters and their interactions.

This first version of guidelines will need to be updated in light of new research and practical implementation experience in Member States and internationally, as well as

possible further integration with other policy fields.

While further developing these guidelines, synergies at EU level with the new

Commission Health Security Initiative 13 , due for the end of 2011, will be established

and close collaboration at national level with the health authorities will have to be

fostered.

2.2. Objectives of EU Guidelines

The main purpose of these guidelines is to improve coherence and consistency among the risk assessments undertaken in the Member States at national level in the prevention, preparedness and planning stages and to make these risk assessments more comparable between Member States. Coherent methods for national risk assessments will support a common understanding in the EU of the risks faced by Member States and the EU, and will facilitate co-operation in efforts to prevent and mitigate shared risks, such as cross-border risks. Comparability of risk assessment

of high-risk area taking into account work conducted within the European Forest Fire Information System (EFFIS).

10 These guidelines will refer only to the national level notwithstanding the fact that for certain hazards,

such as floods, the best geographic scope of the analysis may be different, such as the river basin (district). Furthermore, certain border regions may face identical hazards or threats and therefore a

regional scope of analysis may be more appropriate than the national scale.

11 Effects outside the EU may be considered where they affect EU citizens or their property.

12 Including CBRN disasters.

13 Council conclusion of 13 September 2010.

methods would add value to the individual efforts of Member States and would allow risk assessments to be pooled (shared risk assessments) among regions or Member

States facing shared risks 14 . Comparable methodologies would also enable a wider

and better appreciation of the impacts of disasters experienced in some but not all Member States. A number of challenges currently impair comparability between

countries. These include country-specific assessment and impact criteria, specificterminology and linguistic diversity. There are also variations in the assumptions about the nature of harm and differences in appreciation on the scale of events for which investments into planning, prevention and preparedness are justified.

Greater transparency on the impact categories applied can improve comparability, taking account of the fact that some assessments are sensitive and may limit the

sharing of certain data.

Common terminology and a shared understanding of concepts will greatly facilitate consistency and comparability. The guidelines will therefore propose definitions of

the certain terms.

The EU guidelines for national risk assessment and mapping have the following

objectives:

(1) improve the use of good practices and international standards across the EU and help to gradually develop coherent and consistent risk assessment methodology and terminology;

(2) provide a risk management instrument for disaster management authorities, and also other policy-makers, public interest groups, civil society organisations and other public or private stakeholders involved or interested in the management and reduction of disaster risks;

(3) inform the debate in international fora such as UNISDR 15 and UN-OCHA 16 ;

(4) contribute to the development of knowledge-based disaster prevention policies at different levels of government and among different policy competencies, as national risk assessments involve the integration of risk information from multiple sources;

(5) inform decisions on how to prioritise and allocate investments in prevention, preparedness and reconstruction measures;

(6) contribute to the raising of public awareness on disaster prevention measures;

(7) contribute to a risk assessment and mapping process across the EU which can serve as a basis for the 2012 overview of the major risks the EU may face in the future.

14 The principle is addressed in the Inspire Directive 2007/2/EC i establishing an infrastructure for spatial

information in the European Community.

15 UNISDR = UN-International Strategy for Disaster Risk Reduction.

16 UN-OCHA = UN-Office for the Coordination of Humanitarian Affairs.

(8) contribute to the information required to establish an assets database for emergency assistance.

(9) Contribute to establish, by 2014, a coherent risk management policy linking threat and risk assessments to decision making, as stated in the recently adopted Communication from the Commission on the "EU Internal Security Strategy In Action: five steps towards a more secure Europe"

Commission services can assist Member State efforts and in particular help organise the sharing and dissemination of good practice. As announced in the Communication on "a Community approach on the prevention of natural and man-made disasters" referred to in the introduction, the Commission will use the upcoming calls for cooperation projects under the Civil Protection Financial Instrument to include the

possibility to support projects on public awareness. 17 .

2.3. Role of Risk Assessment and Mapping within Disaster Risk Management

Risk assessment and mapping are carried out within the broader context of disaster risk management. Risk assessment and mapping are the central components of a more general process which furthermore identifies the capacities and resources available to reduce the identified levels of risk, or the possible effects of a disaster (capacity analysis), and considers the planning of appropriate risk mitigation measures (capability planning), the monitoring and review of hazards, risks, and

vulnerabilities, as well as consultation and communication of findings and results.

Capacity analysis, capability planning, monitoring and review, consultation and communication of findings and results are not the subject of these guidelines. However, national risk assessments and mapping deliver the essential input for informed capacity building and the enhancement of both disaster prevention and

preparedness activities.

When carried out at national level, disaster risk assessments and risk management can become essential inputs for planning and policies in a number of areas of public and private activity. By improving the awareness and understanding of the risks a Member State faces, decision makers, stakeholders and interested parties are in a better position to agree on the preventative measures to take and to prepare in ways to avoid the most severe consequences of natural and man-made hazards and of other

adverse events.

Furthermore, the process of producing a risk assessment will enable both public authorities and businesses, NGOs, and the general public to reach a common understanding of the risks faced as a community and help fostering an inclusive debate about the relative priority of possible prevention and mitigation measures. Wide dissemination and awareness-raising are important steps to further develop and fully integrate a risk prevention culture into sectoral policies, which are often

complex and involve many stakeholders, e.g. large railway stations.

17 COM(2009)82 final i of 23.2.2009.

Once risks are analysed in some detail it will become possible to plot risk maps as one of the outputs of risk assessments. Risk maps generate a level of transparency

which can help engage all interested actors in society.

Risk assessments and risk mapping contribute to ensuring that policy decisions are prioritised in ways to address the most severe risks with the most appropriate prevention and preparedness measures, and can in the process also become an

instrument of solidarity.

Risk assessments deal with uncertainty and probabilities. These are the necessary subjects of a rational debate about the level of risk a Member State, or even the entire EU, may find acceptable when considering the costs of associated prevention and

mitigation measures.

• 3. 

  D EFINITION OF T ERMS

Achieving a common terminology remains a challenge 18 . Scientists and practitioners

have developed specific terminology for the assessment of particular hazards and impacts. This terminology differs significantly between the various disciplines. It is not the intention of these guidelines to harmonise terminology of specialised disciplines. However, it is necessary to make different terminology comparable when drawing them together in national risk assessments. Thus a more universal approach is required for the purpose of EU guidelines encompassing a number of different fields of risks. For the purpose of these guidelines, international standards developed by the International Organisation for Standardisation, in particular ISO 31000, ISO

19

31010, and the corresponding ISO Guide 73 terminology will be used , in combination with the more targeted UNISDR terminology on disaster risk reduction,

and a number of new proposals specifically adapted to these guidelines.

For the purpose of these guidelines for national risk assessments definition of terms

will be used as follows:

Hazard is a dangerous phenomenon, substance, human activity or condition that may cause loss of life, injury or other health impacts, property damage, loss of livelihoods and services, social and economic disruption, or environmental damage. Comment: […] In technical settings, hazards are described quantitatively by the likely frequency of occurrence of different intensities for different areas, as

determined from historical data or scientific analysis. (UNISDR, 2009)

Natural hazard: Natural process or phenomenon that may cause loss of life, injury or other health impacts, property damage, loss of livelihoods and services, social and economic disruption, or environmental damage. Comment: Natural hazards are a

18 See: Armonia: Assessing and Mapping Multiple Risks for Spatial Planning - approaches,

methodologies, and tools in Europe.

19 ISO 31000: Risk management - Principles and guidelines; was released in 2009 and provides principles

and generic guidelines on risk management. It can be used by any public, private or community enterprise, association, group or individual. It is not specific to any industry or sector. ISO 31010: Risk management - Risk assessment techniques; is a supporting standard for ISO 31000 and provides guidance on selection and application of systematic techniques for risk assessment. ISO Guide 73: Risk

management – Vocabulary; provides the definitions of generic terms related to risk management.

sub-set of all hazards. The term is used to describe actual hazard events as well as the latent hazard conditions that may give rise to future events. Natural hazard events can be characterized by their magnitude or intensity, speed of onset, duration, and area of extent. (UNISDR, 2009)

Technological hazard: A hazard originating from technological or industrial conditions, including accidents, dangerous procedures, infrastructure failures or specific human activities, that may cause loss of life, injury, illness or other health impacts, property damage, loss of livelihoods and services, social and economic disruption, or environmental damage. (UNISDR, 2009)

Exposure: People, property, systems, or other elements present in hazard zones that are thereby subject to potential losses. (UNISDR, 2009)

Vulnerability: The characteristics and circumstances of a community, system or asset that make it susceptible to the damaging effects of a hazard. (UNISDR, 2009)

In probabilistic/quantitative risk assessments the term vulnerability expresses the part or percentage of Exposure that is likely to be lost due to a certain hazard.

Resilience: The ability of a system, community or society exposed to hazards to resist, absorb, accommodate to and recover from the effects of a hazard in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions. (UNISDR, 2009)

Risk is a combination of the consequences of an event (hazard) and the associated likelihood/probability of its occurrence. (ISO 31010)

Risk assessment is the overall process of risk identification, risk analysis, and risk evaluation. (ISO 31010)

Risk identification is the process of finding, recognizing and describing risks. (ISO 31010)

Risk analysis is the process to comprehend the nature of risk and to determine the level of risk. (ISO 31010)

Risk evaluation is the process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable. (ISO 31010)

Risk criteria are the terms of reference against which the significance of a risk is evaluated. (ISO 31010)

Consequences are the negative effects of a disaster expressed in terms of human impacts, economic and environmental impacts, and political/social impacts. (ISO 31010)

Human impacts are defined as the quantitative measurement of the following factors: number of deaths, number of severely injured or ill people, and number of permanently displaced people.

Economic and environmental 20 impacts are the sum of the costs of cure or

healthcare, cost of immediate or longer-term emergency measures, costs of restoration of buildings, public transport systems and infrastructure, property, cultural heritage, etc., costs of environmental restoration and other environmental costs (or environmental damage), costs of disruption of economic activity, value of insurance pay-outs, indirect costs on the economy, indirect social costs, and other

direct and indirect costs, as relevant.

Political/social impacts are usually rated on a semi-quantitative scale and may

21

include categories such as public outrage and anxiety , encroachment of the territory, infringement of the international position, violation of the democratic

system, and social psychological impact 22 , impact on public order and safety, political implications, psychological implications, and damage to cultural assets 23 ,

and other factors considered important which cannot be measured in single units,

such as certain environmental damage.

Threat is a potentially damaging physical event, phenomenon or activity of an

intentional/ malicious character.

Single-risk assessments determine the singular risk (i.e. likelihood and consequences) of one particular hazard (e.g. flood) or one particular type of hazard (e.g. flooding) occurring in a particular geographic area during a given period of

time.

Multi-risk assessments determine the total risk from several hazards either occurring at the same time or shortly following each other, because they are dependent from one another or because they are caused by the same triggering event or hazard; or merely threatening the same elements at risk (vulnerable/ exposed

elements) without chronological coincidence.

Multi-hazard assessments determine the likelihood of occurrence of different hazards either occurring at the same time or shortly following each other, because they are dependent from one another or because they are caused by the same triggering event or hazard, or merely threatening the same elements at risk

(vulnerable/ exposed elements) without chronological coincidence.

Hazard assessments determine the probability of occurrence of a certain hazard of

certain intensity.

Hazard map is a map that portrays levels of probability of a hazard occurring across a geographical area. Such maps can focus on one hazard only or include several

types of hazards (multi-hazard map).

20 Environmental impacts should wherever possible be quantified in economic terms, but may also be

included in non-quantified terms under political/social impacts.

21 UK assessment criteria in Annex to: Non-paper by France, Germany, the Netherlands, Portugal,

Slovenia, Spain, and the United Kingdom on National Risk Assessment.

22 NL assessment criteria in Annex to: Non-paper by France, Germany, the Netherlands, Portugal,

Slovenia, Spain, and the United Kingdom on National Risk Assessment.

23 D assessment criteria in Annex to: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia,

Spain, and the United Kingdom on National Risk Assessment.

Multi-hazard map is a map that portrays levels of probability of several hazards

occurring across a geographical area.

Risk map is a map that portrays levels of risk across a geographical area. Such maps

can focus on one risk only or include different types of risks.

Risk scenario is a representation of one single-risk or multi-risk situation leading to significant impacts, selected for the purpose of assessing in more detail a particular type of risk for which it is representative, or constitutes an informative example or

illustration.

• 4. 

  T HE R ISK A SSESSMENT P ROCESS

4.1. Actors

At the beginning of the national risk assessment process one authority must be designated for the task of coordinating the work. The process will normally require

the setting up of a number of working groups for different types of natural and manmade hazards and representatives of different interested groups (such as first responders, transport operators), and in some instances also different levels of authorities (federal, regional, etc.).

Successful planning will require coordination between the varied government departments or agencies responsible for managing the consequences of different types of emergencies. A national risk assessment provides an agreed basis for priorities in emergency planning which will facilitate this coordination. It can also be used to ensure an appropriate balance of investment in measures to prevent and

mitigate risks.

The process of producing a national risk assessment involves public authorities, research and businesses, non-governmental organisations and the wider general public. National risk assessments should aim at making these actors reach a common understanding of the risks faced and of their relative priority. This shared understanding should cover both the range of risks considered relevant and the levels of severity for which preparedness planning would be judged appropriate. An approach which is objective, comprehensive and based on the most robust available evidence helps to avoid planning under pressure from recent events including public

and media perceptions of the greatest risks 24 .

All parties involved in the risk assessment process should: (a) agree on the scoring criteria at the start of the assessment process, (b) record the methods used and their level of uncertainty, (c) note the justification for including or excluding specific risks, (d) record the scores allocated to each risk and their justification, (e) devise a

protocol for the use of expert opinion 25 .

24 Quoted from: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain, and the

United Kingdom on National Risk Assessment, paragraph 7.

25 Quoted from: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain, and the

United Kingdom on National Risk Assessment, paragraph 22.

4.2. Public Consultation and Communication

Draft risk assessments should be widely consulted with stakeholders and interested parties, including central and regional levels of government and specialised departments. Risk assessments which are seen to be objective and impartial can help to build and sustain public trust and credibility. As a result, it may also help to ensure that policy-makers accept and use the assessment even where they are not directly

involved in producing it 26 .

Moreover, extensive public information on the process and outcomes of risk assessments will be necessary to lead to a better understanding of the risks and to enable all stakeholders and the general public to become more engaged in emergency

planning, preparedness and response.

The EU Floods Directive and the Water Framework Directive require consultation of interested parties on flood risk management plans at the catchment scale. The Floods Directive also requires Member States to make flood maps and plans publicly

available.

The following actions should accompany national risk assessments:

• Publication of potential risk scenarios to inform the population about the

government’s preparatory measures for emergencies and to provide advice on

how the general public could be better prepared;

• Information to stakeholders and the general public on the particular risks they

face, through for instance the dissemination of hazard maps;

• Cooperation with the private sector where their risk assessments complement the

efforts of public authorities.

4.3. Data

National risk assessments will have to draw on data from many different sources posing challenges in terms of data traceability, reliability, proper documentation, interoperability and other. It is therefore important that data sources are made

explicit, including as concerns the use of expert know-how.

Agreed models for the measurement of likelihood and impacts are still rather scarce for many types of hazards and risks. This means that a number of assumptions and estimations will need to be used in national risk assessments. It is important that the types of assumptions, proxies and estimates be made explicit and that the merit of the

applied models is clearly stated.

Commission services together with other EU bodies such as the European Environment Agency is developing actions assessing data and information gaps, as well as comparability issues. A European Environment Agency technical report that provides an overview on the impact of natural hazards and technological accidents in

26 See: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain, and the United

Kingdom on National Risk Assessment, paragraph 23.

Europe 1998-2009 is due at the end of the year 2010 27 . This report additionally

points out the data gaps and information needs related to several hazard types. The

main challenges for the future include:

• Further geographical information (vector data, spatial resolution, GIS-data);

• Inclusion of more events and impacts (e.g. including impacts on ecosystems or smaller events, i.e. events which are below the currently used threshold levels of

global disaster databases);

• Improved and standardized definitions and terminology for economic losses

and/or damage costs (e.g. including reconstruction costs), affected people, etc.;

• Making more data publicly accessible;

• Validation of country specific data by Member States and Quality

Assessment/Quality Control in general

• Harmonization of methodologies, data and data models.

This work will build in particular on the international efforts to develop comparable

information systems being developed at international level by CRED 28 and reinsurance companies (Munich Re, Swiss Re) 29 .

National risk assessments should consider the requirements of EU legislation on

comparability and interoperability of data. In line with the INSPIRE Directive 30 , the

common Implementing Rules adopted in a number of specific areas (Metadata, Data Specifications, Network Services, Data and Service Sharing and Monitoring and Reporting) will help to ensure that spatial data infrastructures being developed in Member States will contribute to enhancing the usability of national data necessary for risk assessment. In particular, the INSPIRE data specifications will constitute the foundation for the INSPIRE Implementing Rules laying down the technical arrangements for the interoperability and harmonization of spatial data sets related to the themes listed in the Annex II and III of the INSPIRE Directive. The theme “Natural Risk Zones” listed in Annex III is particularly relevant to this document, as

it will provide common specifications (GML 31 application schemas, UML 32 models

and registries) for the creation and publication of spatial datasets related to natural hazards and risk mapping. The draft data specification document for this theme is currently being developed by a group of selected national experts and the first

version will be available for review by the end of 2010.

Consideration must also be made of the different services developed under GMES (Global Monitoring for Environment and Security) which are encouraging the interoperability of data and will help provide better data for example through the

27 EEA, 2010: Mapping the impacts of natural hazards and technological accidents in Europe, not yet

published.

28 CRED = Centre for Research on the Epidemiology of Disasters

29 See e.g.: Below R., Wirtz A., Guha-Sapir D: Disaster category classification and peril terminology for

operational purposes : Common accord CRED and MunichRe, October 2009.

30 Directive 2007/2/EC i of the European Parliament and of the Council of 14 March 2007 establishing an

Infrastructure for Spatial Information in the European Community (INSPIRE).

31 GML = Geography Markup Language.

32 UML = Unified Modelling Language, an object modelling and specification language used in software

engineering.

Land and Emergency response service. 33 The principles included in the Shared

Environmental Information System (SEIS) 34 should be considered where relevant.

Finally, whenever personal data are collected or processed, such an activity may only be carried out under compliance with Directive 95/46/EC i on the protection of individuals with regard to the processing of personal data and on the free movement

of such data.

Expert opinions are important throughout the risk assessment process to identify new risks, develop scenarios, analyse and score impacts and likelihoods, and in assessing the effects of prevention and mitigation measures, including regulatory and policy measures. The selection of experts, their roles and mandates should therefore be

carefully considered.

Risk assessments need to be kept up-to-date as risks emerge and evolve, including changes in elements at risk (exposure) and vulnerability. It is therefore important to regularly review and reassess risks and methods. The review should consider relevant advances in best-practice and discussions at European level. Adequate risk monitoring arrangements, feedback and lessons learnt from a disaster response, exercises and training, as well as the regular evaluation of prevention, preparedness and mitigation measures will facilitate any future risk assessment and the

(re-)evaluation of the effectiveness of prevention and mitigation measures 35 .

Actions to improve data availability will need to receive sufficient funding so as to not lose (reaction) time in having to locate funds necessary for such activities

(example: 2010 volcanic ash cloud).

• 5. 

  R ISK A SSESSMENT M ETHODS

5.1. Conceptual Framework and Basic Methodology

5.1.1. Risks: combining the consequences of a hazard with the likelihood of its occurrence

According to ISO 31010, risks are the combination of the consequences of an event or hazard and the associated likelihood of its occurrence. Consequences are the negative effects of a disaster expressed in terms of human impacts, economic and environmental impacts, and political/social impacts. More detail on the measurement

of impacts will be provided separately in the next chapter below.

33 GMES can provide a range or information from space EO data over risk areas or images of reference

from past events, or more elaborated information such as reference maps over risk areas, land cover and land cover change maps at various scales (produced by the land service), or more specific products like

risk maps (provided by the Emergency Response service).

34 Communication from the Commission to the Council, the European Parliament, the European

Economic and Social Committee and the Committee of the Regions - Towards a Shared Environmental Information System (SEIS), SEC(2008) 112, COM/2008/0046 final.

35 Organisation for Economic Cooperation and Development (2009): Innovation in Country risk

management.

In situations where the likelihood of occurrence of a hazard of a certain intensity can

be quantified we refer to the term probability of occurrence 36 . When the extent of the

impacts is independent of the probability of occurrence of the hazard, which is often the case for purely natural hazards, such as earthquakes or storms, risk can be

expressed algebraically as:

Risk = hazard impact * probability of occurrence.

Simple example: The risk of a storm causing damage (impact) of 10 million Euro and which is likely to occur on average once every year may be considered presenting the same risk as a storm causing damage of 350 million Euro but where

we know from past experience that it is likely to occur only once every 35 years.

Where the size of the impact influences the likelihood of occurrence, i.e. where the two terms are not independent of each other, the risk cannot be expressed simply as a product of two terms but must be expressed as a functional relationship. Likewise, where the impacts are dependent on preparedness or preventive behaviour, e.g. timely evacuation, there are advantages in expressing the impact indicator in a more differentiated manner. In particular in the analysis of natural hazards, impacts are often expressed in terms of vulnerability and exposure. Vulnerability V is defined as the characteristics and circumstances of a community, system or asset that make it

susceptible to the damaging effects of a hazard. 37 Exposure E is the totality of

people, property, systems, or other elements present in hazard zones that are thereby

subject to potential losses 38 .

Risk =ƒ(p*E*V) 39

Using the concept of vulnerability makes it more explicit that the impacts of a hazard are also a function of the preventive and preparatory measures that are employed to reduce the risk. For example, for a heat wave hazard it may be the case that behavioural preparedness measures, such as information and advice, can critically reduce the vulnerability of a population to the risk of excess death. Effective prevention and preparedness measures thus decrease the vulnerability and therefore

the risk 40 .

Depending on the particular risk analysed, the measurement of risk can be carried out with a greater number of different variables and factors, depending inter alia on the complexity of the chain of impacts, the number of impact factors considered, and the requisite level of precision. Generally, the complexity of the modelling and the

36 In English, in contrast to the more general term "likelihood", the term "probability" is often narrowly

interpreted as a mathematical term. Cf.: Note in ISO 31000 on "likelihood".

37 UNISDR, 2009.

38 UNISDR, 2009. The term "exposure" is frequently used in the field of insurance where the total value at

risk (exposure) is determined, e.g. the value of buildings, and next the vulnerability of the considered value at risk under a certain stress (e.g. a defined type of flooding) is analysed.

39 Risk is a function of the probability of occurrence of a hazard, the exposure (total value of all elements

at risk), and the vulnerability (specific impact on exposure).

40 Vulnerability reduction is closely related to the concept of resilience, which is the ability of a system,

community or society exposed to hazards to resist, absorb, accommodate to and recover from the effects of a hazard in a timely and efficient manner, including through the preservation and restoration of its

essential basic structures and functions. UNISDR, 2009.

quantification of factors can be increased as long as this also improves certainty. Hence, when quantitative models and additional variables and factors increase complexity without at the same time improving certainty (in terms of reliability, prediction and robustness) the use of more qualitative assessments and expert opinions will in principle be the better choice, also from the point of view of resource

efficiency and level of transparency.

5.1.2. Impact (human, economic, environmental, political/social)

For the purpose of these guidelines three types of impacts are defined:

• Human impacts (number of affected people) are the number of deaths, the number

of severely injured or ill people, and the number of permanently displaced people.

• Economic and environmental 41 impacts are the sum of the costs of cure or

healthcare, cost of immediate or longer-term emergency measures, costs of restoration of buildings, public transport systems and infrastructure, property, cultural heritage, etc., costs of environmental restoration and other environmental costs (or environmental damage), costs of disruption of economic activity, value of insurance pay-outs, indirect costs on the economy, indirect social costs, and

other direct and indirect costs, as relevant.

• Political/social impacts are usually rated on a semi-quantitative scale and may include categories such as public outrage and anxiety 42 , encroachment of the

territory, infringement of the international position, violation of the democratic

system, and social psychological impact 43 , impact on public order and safety, political implications, psychological implications, and damage to cultural assets 44 ,

and other factors considered important which cannot be measured in single units, such as certain environmental damage.

Human impacts can be estimated in terms of number of affected people,

economic/environmental impacts in terms of costs/damage in Euro. 45 The

political/social impacts will generally refer to a semi-quantitative scale comprising a number of classes, e.g. (1) limited/ insignificant, (2) minor/ substantial, (3) moderate/ serious, (4) significant/ very serious, (5) catastrophic/ disastrous. To make the classification of such latter impacts measurable the classes must be based on

objective sets of criteria.

In risk identification and risk analysis, always all three categories of impacts should be considered when assessing the impact of any analysed event, hazard, or risk,

including for risk scenarios and multi-risk assessments (see below).

41 Environmental impacts should wherever possible be quantified in economic terms, but may also be

included in non-quantified terms under political/social impacts.

42 UK assessment criteria in: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain,

and the United Kingdom on National Risk Assessment.

43 NL assessment criteria in: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain,

and the United Kingdom on National Risk Assessment.

44 D assessment criteria in: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain,

and the United Kingdom on National Risk Assessment.

45 This assessment should include the number of people affected by a crisis outside the EU.

Impact assessments need to define a reference space-time window.

Impacts should be presented (or at least should be available) separately for the different impact categories, even though they may be combined or aggregated for certain purposes. Risk matrices (see below) should also be available in disaggregated format, i.e. separate matrices for each category of impact. The availability of such a disaggregated format will be important for making comparisons between the risk assessments of different Member States and to make it possible for the Commission to produce an overview of risk for the EU. When impact categories are aggregated, special attention must be paid to avoid double counting of impacts, as there are

frequent overlaps.

Impact analysis should rely as much as possible on empirical evidence and experience from past disaster data or established quantitative models of impact. It is clear that for quantification purposes a number of assumptions and estimates will have to be used, some of which may be rather uncertain. These assumptions and

estimates should always be clearly identified and substantiated.

There are a number of available techniques, standards, and models that can be used for impact quantification, many of which are hazard specific, such as e.g. the resilience of buildings to earthquakes, storms, or floods, the death rate from heat waves etc. This first version of the guidelines recommends the use of good-practice risk assessment methods unless impossible. A catalogue of recommended methods and standards for risk assessments will be developed for a future version of these

guidelines.

The three categories of impacts can often be assessed one by one but there may be circumstances with strong interdependencies, such as the number of dead and injured people from collapsed buildings due to earthquakes. In particular the assessment of economic impacts will need to assess interdependencies, such as the effect of supply

disruptions of essential inputs, such as energy, transport, networking, water etc.

Ideally, the assessment of economic impacts can make extensive use of asset registers or databases of exposed elements (elements at risk), which should exist at least for all critical infrastructures, networks and transport, hazardous installations, transport of dangerous substances on roads and waterways, essential ecosystems, and

others.

Impacts should be considered in the short term and the medium term. When they are

quantified, impacts can be expressed in today's value (such as net present value).

5.1.3. Risk matrix

A risk matrix relating the two dimension likelihood and impact is a graphical representation of different risks in a comparative way. The matrix is used as a visualisation tool when multiple risks have been identified to facilitate comparing the

different risks 46 .

46 Risk matrices are also used to help to define which risks need further or more detailed analysis or which

given risk is considered broadly acceptable or not acceptable, according to the zone where it is located on the matrix.

Figure 2: Example of risk matrix

The scale used may have 5 or more points. The matrix may be set up to give extra

weight to the impact or to the likelihood, or it may be symmetrical 47 .

Within each category of impact (human, economic/environmental, political/social) the relative importance should be graded using a single set of criteria to score the relative likelihood and the relative impact applicable to the different hazards or risk scenarios. In particular, the human impact should be measured in number of affected

people and the economic and environmental 48 impact should be measured in Euro.

The political/social impact can be measured in a qualitative scale comprising five classes, e.g. (1) limited/ insignificant, (2) minor/ substantial, (3) moderate/ serious,

(4) significant/ very serious, (5) catastrophic/ disastrous 49 .

It should be considered to produce distinct risk matrices for human impact, economic and environmental impact and political/social impact, as these categories are

measured with distinct scales and would be otherwise very difficult to compare 50 .

Figure 3: Example of risk matrix with disaggregated presentation of impacts

          Human impacts Economic impacts Political/social impacts [#] [€] [1-5]

Risk matrices can be used in all stages of risk assessment (see below).

47 Comparison of risk assessment techniques, ISO 31010.

48 Environmental impacts should wherever possible be quantified in economic terms, but may also be

included in non-quantified terms under political/social impacts.

49 See: Annex to: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain, and the

United Kingdom on National Risk Assessment.

50 See also: Comparison of risk assessment techniques, ISO 31010.

For the purposes of these guidelines, the mere comparison of several risks in one

risk-matrix is not called multi-risk analysis.

5.2. Stage 1: Risk Identification

While there are various ways of dividing up the risk assessment process into a number of logical steps depending mainly on the roles of different actors involved, for the purpose of these guidelines, and taking into account work at national level on

methods of hazard and risk mapping 51 , the overall risk assessment process of national

risk assessments should be composed of at least the following three stages: (1) risk

identification, (2) risk analysis, (3) risk evaluation.

Figure 4: Stages of risk assessment in the overall risk management process 52

At the beginning of the risk assessment process there are three main preliminary steps to be made: 1) selecting the same target area (national); 2) selecting the same time window (short-term); 3) defining the same metric for the risk (impact measures). Once these steps have been made, we can start with the risk

identification.

Risk identification is the process of finding, recognizing and describing risks. It is a screening exercise and serves as a preliminary step for the subsequent risk analysis stage. Risk analysis is the process to comprehend the nature of risk and to determine the level of risk. Risk evaluation is the process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is

acceptable or tolerable.

Risk identification should be based as much as possible on quantitative (historical,

statistical) data. 53 However, as the purpose of the risk identification stage is to find

and recognize all likely hazards and significant consequences, it is appropriate to extensively use also qualitative methods, such as expert opinions, intelligence

51 Including the examples of Germany, the Netherlands and the UK. See: Non-paper by France, Germany,

the Netherlands, Portugal, Slovenia, Spain, and the United Kingdom on National Risk Assessment.

52 ISO 31000.

53 Solutions must be found for addressing risks which are difficult to measure or where the information

linked to the risk may be classified such as threat of a terrorist attack on a transport system.

information, check-lists, systematic team approaches, inductive reasoning

techniques 54 , or other. Techniques to improve the completeness of the risk

identification process may also include brainstorming and Delphi methodology (interactive forecasting method relying on a panel of experts). More details about the

range of possible risk identification methods are provided in Annex 3.

The outcome of the risk identification stage is a listing of the different identified risks and risk scenarios that will be analysed in more detail in the subsequent stage 2: the risk analysis. This listing will include a brief description for each identified risk

and risk scenario.

5.2.1. Risk scenarios

Ideally, risk identification would consider all possible hazards, their probabilities of occurrence and their possible impacts. Such a comprehensive quantitative empirical approach is often referred to as probabilistic assessment. For national risk assessments a probabilistic assessment will not be possible due to the multitude of

possible risks.

Hazards can occur in different intensities and also the quantum of impacts may be uncertain, i.e. not clearly related to the intensity of the hazard, but merely linked by a

certain probability.

For example, the level of impacts of hurricane Katrina was critically dependent on the likelihood that certain dykes would resist the water pressure. This likelihood was a priori unknown or at least uncertain and in any case varied with different possible water levels and other factors. It is thus obvious that the system of possible events and their likelihood can quickly become very complex and would require very

substantial efforts to correctly estimate the overall system in all its dimensions.

Moreover, as will be discussed below, there are also multi-hazard or multi-risk situations where one hazard triggers another hazard. Again, the range of possible hazards to consider and their impacts and their follow-on hazards and impacts may

seem unlimited.

Because of this complexity, risk identification usually involves the elaboration of scenarios of potential risk situations, which condense the realm of possibilities to a

limited number of identified situations 55 . A risk scenario is a representation of one

single-risk or multi-risk situation leading to significant impacts, selected for the purpose of assessing in more detail a particular type of risk for which it is

representative, or constitutes an informative example or illustration.

Risk scenarios are a plausible description of how the future may develop. Scenario building is mainly based on experiences from the past, but also events and impacts which have so far not occurred should be considered. Scenarios should be based on a coherent and internally consistent set of assumptions about key relationships and driving forces. Like any other simplification of reality, the definition of a scenario entails subjective assumptions. It is therefore essential that all information leading to

54 See e.g. the HAZOP - Hazard and Operability Study method mentioned in ISO 31010.

55 See e.g.: CRN: Focal report 2: Risk Analysis.

the definition of a scenario is made explicit so that they can be reviewed and

updated 56 .

For risk assessments on a high level of aggregation, such as national risk assessments, it is a fundamental issue which scenarios are chosen, as this will determine how useful the risk assessment will be to depict reality. Compared to the vast universe of situations (of risks and their varying degrees of intensities) that are indeed possible in reality, only a limited number of scenarios can be selected. National risk assessments have attempted to deal with the selection issue by making reference to some standard, such as a "reasonable worst case", or another benchmark. However, the remaining uncertainties in this approach are immense. The usefulness of comparing national risk assessments will vitally depend on some common

understanding on how scenarios are built.

In practice, risk scenarios are often built having in mind certain levels of impacts. These levels are also referred to as protection levels and can be defined e.g. in terms of (prevented) casualties. Other terms of reference may include the probability of a certain hazard exceeding a certain threshold level and this suddenly boosting the impacts, e.g. the breaking of a dyke, or wind stress exceeding certain design

standards, etc.

ISO 31010 states the following: “Many risk events may have a range of outcomes with different associated probability. Usually, minor problems are more common than catastrophes. There is therefore a choice as to whether to rank the most common outcome or the most serious or some other combination. In many cases, it is appropriate to focus on the most serious credible outcomes as these pose the largest threat and are often of most concern. In some cases, it may be appropriate to rank both common problems and unlikely catastrophes as separate risks. It is important that the probability relevant to the selected consequences is used and not the

probability of the event as a whole.”

These guidelines will propose to define a minimum common understanding for the selection of scenarios. The choice should be guided by specified levels of impacts and certain hazard probabilities (see below) in order to obtain a minimum degree of

coherence among the different national risk assessments.

Generally, risk scenarios will be used both in the risk identification phase as well as at the risk analysis stage, with the latter aiming to establish quantitative estimates for impacts and probabilities. At the stage of risk identification, scenario building must be devised in the most inclusive way and may refer to rough estimates or qualitative analysis. At the stage of risk analysis, if possible, quantitative probabilities should be estimated for each scenario, e.g. using Bayesian methods, i.e. a statistical procedure

which utilizes prior distribution data to assess the probability of a result.

5.2.2. Single-risk and multi-risk assessments

For the purpose of risk identification and risk analysis, a number of distinctions are

introduced:

56 IRASMOS project.

Single-risk assessments determine the singular risk (i.e. likelihood and consequences) from one particular hazard (e.g. flood) or one particular type of hazard (e.g. flooding) occurring in a particular geographic area during a given period of

time.

Details about the appropriate single-risk methods will be provided in the chapter on

risk analysis below.

Multi-risk assessments determine the total risk from several hazards, taking into

account possible hazards and vulnerability interactions:

(1) occurring at the same time or shortly following each other, because they are dependent of one another or because they are caused by the same triggering event or hazard;

(2) or threatening the same elements at risk (vulnerable/ exposed elements) without chronological coincidence.

Coinciding hazards (number 1 above) are also referred to as follow-on events, knockon effects, domino effects or cascading events. Examples are e.g. a landslide triggered by a flood, triggered by a rain storm, or an industrial accident triggering environmental pollution, triggering health concerns etc. Any event or hazard may trigger a greater number of subsequent hazards, all of which could be individually considered. The likelihood of each of the events occurring is of course correlated to the likelihood of occurrence of the other event or the prior triggering event. The assessment of consequences then needs to consider the cumulative impact of all of the various impacts occurring at the same time or shortly following each other.

Where the different risk would not occur simultaneously but still affect the same elements at risk (also: vulnerable elements, exposed elements, stock), i.e. humans, economic activity, the environment and cultural, political or social goods, the assessment helps to understand e.g. that a building must be resilient against both

earthquakes and floods etc., and may be at risk from both of these hazards.

Such multi-risk approaches are important in all geographic areas susceptible to several types of hazards, as is the case in many regions in the EU. In this situation, exclusively focussing on the impact of only one specific hazard could even result in raising the vulnerability in respect of another type of hazard. For example, if a building development on a flood plain is approved because its structure includes an elevated and stilted ground floor, this could result in the structure being particularly

vulnerable to the effects of an earthquake’s seismic waves 57 .

Multi-risk analysis will be further discussed in a separate chapter below.

5.2.3. Risk identification in national risk assessments

According to the Council conclusions on a Community framework on disaster prevention within the EU, Member States are invited, before the end of 2011, to

57 Example given in Armonia: Assessing and Mapping Multiple Risks for Spatial Planning - approaches,

methodologies, and tools in Europe, p. 14.

make available to the Commission information on risks of relevance for the development of an overview of the major risks the EU may face in the future. For the purpose of producing this overview the Commission will need to receive national risk assessments which consider all major natural and man-made hazards, as well as

at least some significant interaction scenarios, as further discussed below 58 .

Considering that Member States are at different levels of advancement in their risk assessment efforts, these guidelines suggest a step-wise approach in four components: (1) scenario building, (2) extent of quantitative analysis, (3) number of

risks and risk scenarios considered, (4) temporal horizon.

Scenario building: As a matter of necessity, scenarios building must be undertaken according to a minimum degree of common understanding. It will otherwise be impossible to compare the information presented by different Member States and may even lead to a distorted overall view. For this purpose, national risk identifications would need to consider at least all significant hazards of a intensity that would on average occur once or more often in 100 years (i.e. all hazards with a annual probability of 1% or more) and for which the consequences represent significant potential impacts, i.e.: number of affected people greater than 50, economic and environmental costs above € 100 million, and political/social impact

considered significant or very serious (level 4).

Where the likely impacts exceed a threshold of 0.6 % of gross national income (GNI) also less likely hazards or risk scenarios should be considered (e.g. volcanic eruptions, tsunamis). Where the likelihood of a hazard leading to impacts exceeding the above threshold is more than one in ten years, at least three scenarios with at least

three different intensities should be included in the assessment.

The number of necessary scenarios will depend on the size of the Member State, the number and extent of existing hazards and risks, and the level of advancement of the national risk assessment efforts. Experience from Member States indicates that a

number of 50 to 100 scenarios may be possible for a first risk identification exercise.

Requirements for quantification and the number of risks and risk scenarios

considered will be further detailed in the section below on risk analysis.

As concerns the temporal horizon, generally, the risk identification process should

consider risks that may appear in the immediate future, i.e. one to five years ahead. 59

For the purpose of the overview, it will also be useful if the more advanced Member State communicate their forward-looking assessments, as indeed longer-term periods of 25 to 35 years are considered in some national risk assessments in order to identify broad trends or emerging risks. Such foresight can also take a global perspective and

identify international interdependencies 60 . To adequately capture the potential

58 Interaction scenarios will normally include risks 1) among natural risk, 2) among industrial risk and 3)

between natural and industrial risks and 4) vice versa.

59 A period of five years is considered consistent with the time typically needed to plan investments to

mitigate a risk. See: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain, and the United Kingdom on National Risk Assessment, point 29.

60 See: Non-paper by France, Germany, the Netherlands, Portugal, Slovenia, Spain, and the United

Kingdom on National Risk Assessment, points 30 and 31.

impacts of climate change on certain types of disasters such as floods and droughts, a longer time perspective would be adequate and should be used when broad trends

and emerging risks are identified.

5.3. Stage 2: Risk Analysis

Risk analysis is the process to comprehend the nature of risk and to determine the

level of risk. 61 For every risk and risk scenario identified in the previous risk

identification stage, the risk analysis process carries out a detailed (and if possible quantitative) estimation of the probability of its occurrence and the severity of the

potential impacts.

It is important during risk analysis to establish the geographic scope of the risk scenario and of the impacts, even though the precise location may be left unspecified. In more advanced national risk assessments a greater number of risks in localised areas on the national territory, such as a river basin or a city, depending on the hazard and the level of analysis, should be considered, if possible. Keeping track of the local dimension of risks is important to avoid possible double-counting of impacts; and

may help avoiding possible omissions.

Whenever possible, risk analysis must be based on quantitative data:

• The assessment of the probability of an event or hazard should be based, where

possible, on the historical frequency of events of similar scale and available statistical data relevant for an analysis of the main drivers, which can help to pick

up on accelerating trends, e.g. due to climate change.

• The assessment of the level of impact should be in quantitative terms.

The assessment should be as objective as possible and should recognise the uncertainty in the underlying evidence. The issue of uncertainty will be further addressed below with reference to sensitivity analysis and the precautionary principle. It is in any case important to explicitly address and reveal uncertainty in

the analysis.

5.3.1. Single-risk analysis of natural and man-made hazards

Single-risk analysis estimates the risk of a singular hazard in isolation from other hazards or risk scenarios. Once all relevant single risks are determined, an overall evaluation can be carried out and risk maps can be produced for different risk

intensities (see below).

Different natural hazards require very different analyses of their risk, i.e. in establishing the probability of their occurrence and the level of possible impacts. These guidelines will not advocate particular methods of risk analysis but merely provide a minimum level of coherence between different national risk assessments.

61 ISO 31000.

Good-practice risk quantification methods should be used in national risk analysis

whenever possible 62 .

EU legislation has introduced a number of "single-hazard" risk assessment requirements, such as in the area of flood risks, droughts, risks of accidents with dangerous substances, and risks to European Critical Infrastructures. The present guidelines are intended to complement these and ongoing efforts in other policy fields and in any case shall not touch on the legal priority of these works or modify any of the ongoing developments of specifications or standards, in particular not in

the field of flood risk management.

Examples of risk assessment and mapping in EU legislation

Floods: The Floods Directive requires Member States to identify areas of potential significant flood risk, based on a preliminary flood risk assessment which looks at, among

other things, past floods, effectiveness of man-mad flood defence infrastructure and longterm developments such as in land use and climate change where relevant. For these areas, flood hazard and flood risk maps have to be prepared, identifying the potential adverse consequences to human health, economic activity, cultural heritage and the environment under a set of scenarios. The final step is to prepare flood risk management plans, which shall include flood risk management objectives and prioritise measures for achieving these objectives.

Droughts: Droughts are natural disasters, which can occur due to long absence of rainfall and heat waves. The Water Framework Directive deals with the management of scarce water resources and drought management, in particular the regards the mitigation of the effects of floods. Member States authorities are required to monitor the quantitative status of groundwater and the quality and quantity aspects of surface water (such as flow, levels). Areas at risk of not reaching the target of good quantitative and ecological status have to be identified. This risk assessment and mapping will have to be followed-up by water

management measures to be included in the River Basin Management Plans.

Industrial accidents: The Seveso II Directive deals with the presence of dangerous substances in establishments. It covers industrial "activities" as well as the storage of dangerous chemicals. All operators of establishments coming under the scope of the directive need to send a notification to the competent authority and to establish a major accident prevention policy. In addition, operators of upper tier establishments need to establish a safety report, a safety management system and an emergency plan. Member States are obliged to pursue the aim of the directive through controls on the sitting of new establishments, modifications to existing establishments and new developments such as transport links, locations frequented by the public and residential areas in the vicinity of existing establishments. In the long term, Land-use Planning Policies shall ensure that appropriate distances between hazardous establishments and residential areas are maintained. Operators as well as public authorities have certain obligations to inform the

public.

European Critical Infrastructures: Directive 2008/114/EC i on the identification and designation of European Critical Infrastructures (ECIs) and assessment of the need to improve their protection focuses in a first step on the sectors energy (electricity, oil, gas) and

transport infrastructures. 63 Each designated ECI shall have an Operator Security Plan (OSP)

62 A catalogue of recommended methods and standards for risk assessments will be developed for a future

version of these guidelines.

63 "European Critical Infrastructure" are defined as those assets, systems or parts thereof located in EU

Member States which are essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people (e.g. electricity, gas and oil production, transport and covering inter alia an identification of important assets, a risk analysis based on major threat scenarios and vulnerability of each asset, and the identification, selection and prioritisation of countermeasures and procedures. A Security Liaison officer will function as the point of contact for security issues between ECI owner/operator and the relevant Member State

authority.

Every two years, each Member State shall forward to the Commission information on threats and risks encountered per ECI sector. On the basis of those reports the Commission and the Member States shall examine whether further protection measures at the EU level should be

considered.

The identification of European Critical Infrastructures has to be carried out taking account of

the following impact criteria:

• 1) 

  casualties criterion (assessed in terms of potential number of fatalities or injuries),

  • 2) 

    economic effects criterion (assessed in terms of the significance of economic loss and/or

  degradation of products or services; including potential environmental effects),

  • 3) 

    public effects criterion (assessed in terms of the impact of public confidence, public health

  and disruption of daily life; including the loss of essential services).

Notwithstanding the recommended use of good-practice, including those included in Annex 3 and regularly updated, national risk analysis should address the following

subjects 64 :

(1) Hazard analysis

(a) Geographical analysis (location, extent)

(b) Temporal analysis (frequency, duration, etc.)

(c) Dimensional analysis (scale, intensity)

(d) Probability of occurrence

(2) Vulnerability analysis

(a) Identification of elements and people potentially at risk (exposure)

(b) Identification of vulnerability factors/ impacts (physical, economic, environmental, social/political)

(c) Assessment of likely impacts

(d) Analysis of self-protection capabilities reducing exposure or vulnerability

As noted, if the stage of risk identification has been carried out in an adequate way it has identified the major natural and man-made hazards leading to significant risks to be considered in national risk assessments. It is the listing from the risk identification

distribution, telecommunication, agriculture, financial and security services, etc.), and the disruption or destruction of which would have a significant impact on at least two EU Member States.

64 See e.g.: Deutsche Gesellschaft für Technische Zusammenarbeit (GTZ), 2004: Risk Analysis – a Basis

for Disaster Risk Management.

which determines which risks and risk scenarios will be further analysed. However, risk identification is merely a tool to find and recognise all significant risks.

Whenever further significant risks and risk scenarios are discovered during the riskanalysis stage they should also be considered and analysed.

5.3.2. Multi-risk assessments

The challenge of multi-risk assessments is to adequately take account of possible follow-on effects (also: knock-on effects, domino effects or cascading effects) among hazards, i.e. the situation where one hazard causes one or more sequential hazards. For example, an earthquake may cause the explosion of a gas pipeline, or an industrial accident may cause a forest fire. Multi-risk assessments thus consider the

interdependency of several hazards and risks.

A multi-risk approach entails a multi-hazard and a multi-vulnerability perspective 65 .

Each risk assessment must incorporate possible amplifications due to the interaction with other hazards; in other words, one risk may increase as a consequence of the occurrence of another hazard, or because another kind of event has altered significantly the vulnerability of the system. The multi-vulnerability perspective refers to the variety of exposed sensitive targets, for example, population, transport systems and infrastructure, buildings, cultural heritage, etc. that show different types of vulnerability against the various hazards and that require different types of

capacities to prevent and cope with them.

Arguably, many so-called single-risk analyses already consider to varying degrees the complexity of different origins of a particular hazard. But they may often stop short of bringing together dissimilar hazards, such as different natural hazards, different man-mad hazards, or combinations of the natural and man-made hazards. There are a number of difficulties combining single-risk analyses into more integrated multi-risk analyses, among which the fact that available data for different single risks may refer to different time windows, different typologies of impacts are

used, etc., which makes comparisons and rankings difficult if not impossible.

In practice another challenge of multi-risk assessments lies in the co-ordination and interfacing between different specialised authorities and agencies, which each deal

with specific hazards or risks without developing a complete overview of the knockon,

domino and cascading effects. 66 Indeed, the manager of a gas pipeline may not be

aware of the probability of a volcanic eruption causing a 10 cm ash layer leading to

the structural failure of a bridge used for the gas pipeline. 67 Likewise, the forest fire

department may not be sufficiently knowledgeable about the probability of an industrial accident leading to a forest fire.

65 Carpignano, A., et.al: A methodological approach for the definition of multi-risk maps at regional level:

first application, and, European Commission DG JRC, Institute for the Protection and Security of the Citizen. 21020, Ispra, Italy.

66 Crisis and Risk Network (CRN), Center for Security Studies (CSS), ETH Zürich:

Gefährdungsszenarien auf Stufe Bund, Eine Umfragestudie über laufende Arbeiten im Bereich Risikoanalyse, 2008.

67 See the instructive example in: European Commission: Principles of multi risk assessment– Interaction

amongst natural and man induced risks, p 61.

The European funded ESPON project 68 has provided a comprehensive, if somewhat

superficial, analysis of such hazard interactions for all European NUTS3 areas and present corresponding maps which is instructive on the question of how to build up a quantitative risk analysis for the whole of the EU. In particular, the ESPON report

discusses the identification of so-called "hazard clusters".

Commission services will analyse the scope and methodology for multi-risk

assessment for risks affecting the EU.

These guidelines will not advocate a particular method of dealing with multi-risk scenarios. Some good practice has been described in literature, for example NaTech

accidents involving earthquakes, lightning, and floods 69 .

National risk assessments should attempt to also consider multi-risk scenarios, especially in countries that are already more advanced in this work. The following

work steps are recommended: 70

(1) Identification of possible multi hazard scenarios, starting by a given top event and evaluating the possible triggering of other hazards or events leading to hazards;

(2) Exposure and Vulnerability analysis for each individual hazard and risk within the different branches of the scenarios;

(3) Risk estimate for each hazard and adverse event and for the multi-risk scenarios.

Software tools such as decision support system for mapping multiple risk scenarios can be used and facilitate the visualisation and information and the running of

scenarios.

5.3.3. Risk analysis in national risk assessments

For the purpose of the overview of the major risks the EU may face in the future it will be necessary that national risk analysis be carried out according to a minimum common understanding of scenario building, as discussed in the above chapter on risk identification. Depending on the different levels of experience of Member States,

the following should be considered:

Quantification: Member States with a greater experience should strive to carry out the various underlying risk analyses with progressively more use of quantitative analysis. As mentioned, at least for the impacts empirical quantitative modelling

should be employed.

Number of risks and risk scenarios analysed: While risk assessments based on more experience may analyse in depth a greater number of risk and risk scenarios, it may be appropriate to limit the number of analysed scenarios for Member States who

68 ESPON, p.100 ff.

69 Renni, E., Basco A., Busini, V., Cozzani, V., Krausmann, E., Rota, R. and Salzano, E., 2010:

Awareness and mitigation of Natech accidents: Toward a methodology for risk assessment.

70 See: European Commission: Principles of Multi-Risk Assessment.

carry our the national risk assessment process for the first time to the 10-20 most

important risk scenarios.

National risk analyses should strive to consider both single-risk and some multi-risk scenarios and should appropriately aggregate the risks from multiple hazards, but keeping available the results of the three impact categories, the analysis must be

carried out separately per category of impact.

It will important for the overview of risks the EU may face in the future that the

methods of calculation are available and properly documented.

5.4. Stage 3: Risk Evaluation

Risk evaluation is the process of comparing the results of risk analysis with risk criteria to determine whether the risk and/or its magnitude is acceptable or tolerable. Risk criteria are the terms of reference against which the significance of a risk is evaluated. The risk criteria may include associated costs and benefits, legal requirements, socioeconomic and environmental factors, concerns of stakeholders, etc. Risk evaluation is used to make decisions about the significance of risks whether each specific risk should be accepted or treated. The International Risk Governance Council (2006) describes the objectives of risk evaluation as a judgement on the reliability and acceptability based on balancing pros and cons, testing potential impacts on quality of life, discussing different development options for the economy and society and weighing the competing arguments and evidence claims in a

71

balanced way .

As an example, the Floods Directive, requires MS to set own flood risk management objectives, given that the situation differs from catchment to catchment or even

location to location.

EU legislation has addressed a number of risks. In addition to the Water Framework Directive and the directives on floods, industrial accidents and critical infrastructure mentioned above, the EU has issued a number of legal acts in the area of industrial

hazards:

(1) EC Regulation 1726/2002 i banning single-hull tankers from European ports;

(2) EC Regulation 1406/2002 i and 2038/2006 entrusting the European Maritime Safety Agency with the task of response to ship-caused pollution;

(3) Directive 2005/35/EC i of 7/9/2005 on ship-source pollution and on the introduction of penalties for pollution offences;

(4) Directive on Environmental Impact Assessments 85/337/EEC;

(5) Directive on Strategic Environmental Assessment 2001/42/EC.

Specific prevention standards have also been defined in Eurocodes, as listed in Table

1 below.

71 IRGC (2006).

Table 1: Eurocodes relevant for different types of natural and industrial disasters.

Type of disaster Technical / normative framework

Forest fires Eurocode 1 (actions on structures) defines protective design measures against fire for buildings made of various materials (steel, concrete, wood, masonry)

Ground movements Eurocode 7 defines calculation and design rules for stability of buildings according to Geotechnical conditions of construction site (XP ENV 1997, PR EN 1997-2, ENV 1997-3)

Earthquakes Eurocode 8: EN 1998-1 (general rules, seismic actions), EN 1998-3 (assessment and strengthening of buildings), ENV 1998-4 (reservoir, pipes), EN 1998-5 (foundations, structures), EN 1998-6 (masts, towers…)

Storms, Hurricanes Wind resistant design of buildings is covered by Eurocode 1 - EN 1991-1-4

Cold waves Eurocodes cover protection against cold and snow

Heat waves and drought Eurocode EN 1991-1-5 includes design to resist heat waves

Partly covered by Eurocode EN 1997-1-1 (Geotechnics)

Industrial and Eurocode 1 (EN 1991-2-7) also defines building design

technological hazards rules against explosions

Marine pollution and oil Technical norms for vessels spills

The present EU guidelines on national risk assessments and mapping will not advocate any particular risk criteria, benchmarks or standards, but would encourage transparency in this area including for the purpose of the overview of risk to be prepared by the EU in 2012.

Following the development of the national risk assessment and maps, the involved authorities should seek to interface in an appropriate way with the ensuing processes of risk management, including capacity analysis and capability planning, monitoring and review, and consultation and communication of findings and results, as well as with the appropriate policy levels involved in developing building design criteria, chemical process and facility safety measures, land use planning, community disaster mitigation and response plan, and the design of sustainable industrial processes.

5.5. Dealing with Uncertainty

Risk analysis shall take into account the uncertainties associated with the analysis of risks. Uncertainties need to be understood in order to communicate risk analysis results effectively. Uncertainty analysis involves the determination of the variation of

imprecision in the results 72 , resulting from the collective variation in the parameters

and assumptions used to define the results. Sources of uncertainty should be identified where possible and should address both data and model uncertainties.

Parameters to which the analysis is sensitive should be stated.

5.5.1. Sensitivity analysis

Sensitivity analysis involves the determination of the size and significance of the magnitude of risks to changes in individual input parameters. It can help determine whether the assumptions underlying a prediction are robust or whether further

information needs to be gathered. For more information see http://sensitivityanalysis.jrc.ec.europa.eu/.

5.5.2. The precautionary principle

Where the scientific evidence is weak the precautionary principle can justify inclusion of relevant risks assessed on a qualitative basis especially when risks to the environment, human, animal and plant health are involved and where the consequences are likely to be substantial and irreversible and the likelihood of the occurrence of a negative consequence cannot be assessed. The precautionary principle may be applied as a first step towards risk management. Temporary decisions may need to be taken on the basis of the qualitative or inconclusive

evidence 73 . At the same time any precautionary action must be based on objective

assessments of the costs and benefits of action and requires transparency in decision

making. 74 Where the precautionary principle is applied, additional efforts should be

made to improve the evidentiary base.

5.6. Cross-border Dimension of Risk Assessment

Many large scale disasters have significant cross border impacts. For example the Danube crosses or forms the border of ten European countries, or in Belgium where in September 2009 an accident of a commuter train closed international rail links to

France and the United Kingdom for several weeks.

Risk management in cross border areas depends on efficient exchange of information across borders and therefore the data should be easily accessible and usable by those in the neighbouring cross border areas. However efficient exchange of information across borders faces a number of challenges. These concern the way end users use

the system, the way in which data providers supply their data.

There are also tools being developed that can help to overcome some of these

challenges, in particular:

72 International Standard IEC/ISO 31010.

73 European Commission: Impact Assessment guidelines.

74 See also COM(2000)1 i.

(1) multiple languages: tools are being developed to enable databases to be queried in different languages and to translate the results into the language of choice

(2) different terminology: the Lexicon of terminology attached to this document can help

The different information systems need also to address constraints such as different data structures, or different legal and institutional contexts. As concerns data security issues, decisions on the use of information need to be reached by partnership with the potential affected parties. The main challenge is to get these systems to work

together and share information to allow proper data analysis 75 .

There are numerous examples of cross border risk assessments in practice being developed by European regions often with support of the EU Structural and

Cohesion Funds Territorial Cooperation (INTERREG) programmes 76 . For example,

the INTERREG IV Programme provides funding for all regions of Europe plus Switzerland and Norway (regional and local public authorities) to exchange and transfer knowledge and good practice. Two main priorities are targeted: ‘Innovation and Knowledge economy’ and ‘Environment and Risk prevention’. Among the

projects approved is MiSRaR 77 – Mitigation Spatial Relevant Risks in European

Regions and Towns involving regions and cities from six countries – NL, EE, EL, IT, PT and BG. It addresses the exchange of knowledge and experience in the field of spatially relevant risk mitigation including risk assessment – forest fires, floods,

landslides and industrial hazards.

Another is the Elbe-Labe project 1 on the adaptation to flood risk in the Elbe basin with 20 partners from 4 countries that aims to standardise methods and instruments

for flood risk assessment and management 78 . EU trans-boundary flood related projects 79 (Comrisk, Safecoast, Ella, Flapp, FLOODsite, Danube Floodrisk) have

also addressed trans-boundary flood risk assessment and mapping.

Moreover, the EU's two macro-regional strategies for the Baltic and the Danube Regions both include a strong focus on risk management and accident response capacity. In the case of the EU Strategy for the Baltic Sea Region, the aim is to improve regional cooperation on disaster response through the integration of maritime surveillance systems, the development of more coherent sea navigation, effective pollution responses and the facilitation of joint search and rescue activities. Examples of concrete projects within this Strategy include the mapping of existing response capacities in the region, the development of regional plans for cross-border response cooperation, and the establishment of volunteer troops for maritime pollution response. As far as the Danube Region is concerned, the focus is placed principally on flood prevention and management via the Danube River Basin

75 ORCHESTRA, An Open Service Architecture for Risk Management.

76 e.g. cross-border cooperation programmes such as the "Two Seas" between France, the UK, Belgium

and the Netherlands – or transnational cooperation programmes such as the Baltic Sea Region Interreg IVB Programme the Central Europe Programme or the South-East Europe Programme.

77 http://www.misrar.nl/

78 http://www.label-eu.eu/

79 EXCIMAP: Handbook on good practice for flood mapping in Europe.

Management Plan on the one hand, and on industrial accidents and pollution on the other hand. Examples of actions foreseen in the Strategy include the extension of the coverage of the European Floods Alert System (EFAS) or to strengthen the

interoperability of emergency response assets across the region.

The present EU guidelines on national risk assessments and mapping encourages the development of cross-border risk assessments and mapping, building on the requirements of current EU legislation, in particular on floods, and using where

relevant the processes and methods stipulate in these guidelines.

• 6. 

  R ISK M APPING TO S UPPORT R ISK A SSESSMENT

Maps can be important tools to show information about hazards, vulnerabilities and risks in a particular area and thereby support the risk assessment process and overall risk management strategy. They can help set priorities for risk reduction strategies. Maps also have important roles to play to ensure that all actors in risk assessment have the same information about hazards and in the dissemination of the risk assessment results to stakeholders. Finally, risk mapping could also be useful in the

broader context of land use planning.

Preparing risk maps is a complex process. They are normally part of the results of a risk analysis and follow on from steps to map the hazards and vulnerabilities over a

territory.

There are numerous examples of hazard, vulnerability and risk mapping methodologies being used by public authorities and private organisations in Europe

and the wider world. Carpignano et al 80 have reviewed risk mapping practices in

Europe and identified weaknesses and challenges. Firstly most approaches address only natural hazards and less systematically technological and industrial risks. The study argues that research on the comparability of man-made and natural risks is still a challenge. Furthermore qualitative aspects of vulnerability (e.g. values attributed to environmental or cultural assets) and risks perceptions are not taken on board. 'Debate on the definition of accurate parameters and indicators to express

vulnerability and coping capacities are still ongoing'.

The above mentioned Armonia project undertook a review of the state of art of existing single and multi risk methodologies for mapping. The project studied hazard and risk mapping techniques for six natural hazards: floods, earthquakes, landslides, forest fires, volcanoes plus meteorological extreme events and climate change. Based on the analysis 'minimum standards' are suggested for hazard maps and risk maps aimed at spatial planning. Overall this review shows a range of different practices in hazard, vulnerability and risk mapping across the hazards. No one approach dominates the field. The review of multi-hazard and multi risk mapping in the Armonia report at several systems including the US FEMA Hazus-MH and the French Délégation aux Risques Majeures (DDRM). However Armonia argues that

none of the systems produce a rigorous multi-hazard scenario.

80 Carpignano, A. et al.: A methodological approach for the definition of multi-risk maps at regional level.

Generally, the diverse scales at which different social and economic dimensions of vulnerability operate make the spatial representation through GIS mapping

techniques very difficult.

6.1. Flood Mapping

Floods are the most common disaster in Europe and also the most costly. Flood risk mapping is therefore the area of disaster management where mapping methodologies have advanced the most. The EU directive on the 'Assessment and management of flood risks' requires Member States to conduct an initial assessment of water bodies at risk of flooding by 2011 and to produce flood hazard maps and flood risk maps by 2013. The hazard maps should cover geographical areas which could be flooded

according to different scenarios 81 , while the risk maps should show the potential adverse consequences associated with floods under those scenarios 82 . The

Commission is cooperating with flood experts from Member States in the preparation

of these assessments and maps.

EXCIMAP a European informal exchange circle on flood mapping bringing together representatives from 24 European countries or organisations has produced a

handbook of good practice in flood mapping as well as an Atlas of Flood Maps 83 .

6.2. Recommendations on the risk mapping approach

The research projects and academic literature on the subject of risk mapping confirm its complexity and the fact that gaps remain in the methodologies. While hazard mapping has been improved by the wider use of GIS techniques, the inclusion of social, economic and environmental variables into GIS models remains a challenge. The Commission recommends that a step by step approach be taken in the Member

States to develop risk maps. As the first step, the following maps could be prepared:

(1) Maps showing the expected spatial distribution of major hazards. The different hazards and intensities should be presented in separate maps.

(2) The hazard maps should be accompanied by maps showing the spatial distribution of all relevant elements that need to be protected - such as population, infrastructures, naturally protected areas etc. Again separate maps for different subjects of protection can be prepared. However using Geographical Information Systems such information can be brought together.

81 The Floods Directive requires preparation of hazard maps showing the extent of floods at high

(optional), medium (at least a 100-year return period) and finally of low probability floods or alternatively extreme events.

82 According to Article 6(5) Floods Directive, flood risk maps indicate the potential adverse consequences

associated to flood scenarios (three probabilities), expressed in terms of the indicative number of inhabitants potentially affected; the type of economic activity of the area potentially affected; the installations as referred to in Annex I to Council Directive 96/61/EC i of 24 September 1996 concerning integrated pollution prevention and control which might cause accidental pollution in case of flooding and potentially affected protected areas identified in Annex IV(1)(i), (iii) and (v) to Directive 2000/60/EC i; other information which the Member State considers useful such as the indication of areas where floods with a high content of transported sediments and debris floods can occur and information

on other significant sources of pollution.

83 EXCIMAP: Handbook on Good Practice for Flood Mapping in Europe.

(3) A third series of maps should show the spatial distribution of vulnerability in terms of susceptibility to damage for all relevant subjects of protection (in separate maps for different subjects of protection).

(4) In a second step, these maps can then provide the basis for the preparation of risk maps in terms of showing the combination of likelihood and impact of a certain event as well as for aggregated hazard maps. For example the GIS project developed by the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe (BBK) in Germany enables the spatial distribution of critical infrastructures in combination with information on flood risk areas and population density in a region can be linked and illustrated.

6.3. Way forward

More advanced risk mapping approaches will enable authorities in Member States to produce maps for different types of hazards, at different scales, and for different

purposes, such as risk levels and intervention routes.

ANNEXES

• 7. 

  A NNEX 1: R EFERENCE M ATERIAL

  ARMONIA: Applied multi risk mapping of natural hazards for impact assessment, FP6-2003-Global-2-511208.

  Australian Emergency Management Committee, 2009: National Emergency Risk Assessment Guidelines, Tasmanian State Emergency Service, Hobart.

  Below R., Wirtz A., Guha-Sapir D: Disaster category classification and peril terminology for operational purposes: Common accord CRED and MunichRe, October 2009.

  Bundesamt für Bevölkerungsschutz und Katastrophenhilfe BBK, 2010: Methode für eine Risikoanalyse im Bevölkerungsschutz, (http://www.bbk.bund.de/cln_027/nn_398010/SharedDocs/Publikationen/Broschuere n__Flyer/Methode__Risikoanalyse BS,templateId=raw,property=publicationFile.pdf/Methode_Risikoanalyse-BS.pdf).

  Carpignano, A. et.al: A methodological approach for the definition of multi-risk maps at regional level: first application, Dipartimento di Energetica, Politecnico di Torino, 10129, Torino, Italy, European Commission DG JRC, Institute for the Protection and Security of the Citizen, FP 6 NARAS project.

  Center for Security Studies (CSS), ETH Zürich: Gefährdungsszenarien auf Stufe Bund, Eine Umfragestudie über laufende Arbeiten im Bereich Risikoanalyse, 2008, http://www.bevoelkerungsschutz.admin.ch/internet/bs/en/home/dokumente/Unterlag en_Risiken.parsys.0001170.downloadList.65038.DownloadFile.tmp/gefaehrdungssz enairenstufebundd.pdf

  Crisis and Risk Network (CRN): Focal report 2: Risk analysis – Integrated risk management and societal security, Center for Security Studies (CSS), ETH Zürich, http://www.bevoelkerungsschutz.admin.ch/internet/bs/en/home/dokumente/Unterlag en_Risiken.parsys.0001110.downloadList.77378.DownloadFile.tmp/crnreportfocalre port2riskanalysis.pdf

  Deutsche Gesellschaft für Technische Zusammenarbeit (GTZ), 2004: Risk analysis: a basis for disaster risk management, Eschborn, http://www.proventionconsortium.org/themes/default/pdfs/CRA/GTZ2004_meth.pdf

  ENSURE: Enhancing Resilience of Communities and Territories facing natural and Na-tech hazards, www.ensureproject.eu (ongoing project, coordinator: Bureau de Recherches Geologiques et Minieres, France), FP 7 project.

  ESPON 1.3.1: The Spatial Effects and Management of Natural and Technological Hazards in Europe, Geological Survey of Finland.

  European Commission: Critical Analysis if the current practices and methodologies in Risk Assessment including Hazard Identification and Risk Mapping used in a representative sample of Member States, ENV.A.3/ETU/2009/007r.

European Commission: Principles of multi risk assessment– Interaction amongst natural and man induced risks, FP6 SSA project, Contract 511264.

EXCIMAP (European Exchange Circle on Flood Mapping): Handbook on good practices for Flood Mapping in Europe, http://ec.europa.eu/environment/water/flood_risk/flood_atlas/pdf/handbook_goodpra ctice.pdf.

FEMA: Risk mapping, assessment and planning, http://www.fema.gov/plan/prevent/fhm/rm_main.shtm.

Habegger, B., Horizon Scanning in Government - Concept, Country Experiences, and Models for Switzerland, Center for Security Studies, ETH Zurich, 2009. http://www.bevoelkerungsschutz.admin.ch/internet/bs/en/home/dokumente/Unterlag en_Risiken.parsys.0001150.downloadList.69578.DownloadFile.tmp/horizonscanning ingovernment.pdf

IRASMOS: Integral Risk management of rapid of extremely rapid mass movements, D52, Technical report, FP 7 project.

ISO 31010: Risk management - Risk assessment techniques.

ISO Guide 73: Risk management – Vocabulary.

JRC IPSC: Risk Mapping in the New Member States – A summary of general practices for mapping hazards, Vulnerability and Risk.

MiSRaR (Mitigating Spatial Relevant Risks in European Regions and Towns) 2009: Working with scenarios, risk assessment and capabilities in the National Safety and Security Strategy of the Netherlands,

(http://www.misrar.nl/UserFiles/File/BP_1_ZHZ_annex%202%20National_Riskasse sment__English(1).pdf).

Non-Paper by France, Germany, Netherlands, Portugal, Slovenia, Spain and the

United Kingdom: National Risk Assessment.

OECD report: Emerging risks in the 21st century. http://www.oecd.org/dataoecd/23/56/19134071.pdf

OECD reviews of risk management policies: Review of the Italian national civil protection system, http://oberon.sourceoecd.org/vl=1225609/cl=13/nw=1/rpsv/ij/oecdthemes/99980061/ v2010n5/s1/p1l

OECD risk management case studies: Norway: Information Security, Sweden: the safety of older people, Japan, large scale floods and earthquakes, http://www.oecd.org/document/23/0,3343,en_2649_33707_36171832_1_1_1_1,00.h tml.

OECD study: Etude de l’OCDE sur la gestion des risques d’inondation, bassin de la Loire, France: www.sourceoecd.org/governance/9789264017740.

ORCHESTRA: An open service architecture for risk management, FP6 project,

2008.

PLANAT (Nationale Plattform Naturgefahren): Protection against natural hazards in Switzerland: Vision and strategy, 2005, http://www.planat.ch/ressources/planat_product_en_501.pdf.

Renni, E., Basco A., Busini, V., Cozzani, V., Krausmann, E., Rota, R. and Salzano, E., 2010: Awareness and mitigation of Natech accidents: Toward a methodology for risk assessment, Chemical Engineering Transactions, Vol. 19, pp. 383-389.

SCENARIO: Inside Risk: A Strategy For Sustainable Risk Mitigation, Editors:

Claudio Margottini and Scira Menoni, September 2010, FP 6 project.

Steinberg, J.L., Sengul, H. and Cruz, A.M., 2008: Natech risk and management: an assessment of the state of the art, Natural Hazards, Vol. 46, pp. 143-152.

UK Cabinet Office: National Risk Register, 2008, http://www.cabinetoffice.gov.uk/media/cabinetoffice/corp/assets/publications/reports /national_risk_register/national_risk_register.pdf.

UNISDR: Living with Risk - A global review of disaster reduction initiatives, 2004 version, see also: http://www.unisdr.org/eng/library/lib-terminologyeng%20home.htm.

UNISDR: UN International Strategy for Disaster Reduction Sec, 15 January 2009, http://www.unisdr.org/eng/library/lib-terminology-eng.htm.

UNISDR: GRIP (Global Risk Identification Programme), http://www.gripweb.org/grip.php?ido=1000.

US National research Council: Review of the department of Homeland Security's

Approach to Risk Analysis, 2010, http://www.nap.edu/catalog/12972.html.

• 8. 

  A NNEX 2: R ELEVANT I NFORMATION ON R ISKS FOR THE D EVELOPMENT OF AN O VERVIEW OF THE M AJOR R ISKS THE EU M AY F ACE IN THE F UTURE

The overview of the major risks the EU may face in the future is intended to capture the range of disasters and emergencies that might have a major impact on all or significant parts of the EU. It will provide a picture of the risks the EU faces and will

complement national risk assessments.

The overview will build on the information on risks identified in the national risk assessments communicated by Member States to the European Commission. The precise format of the overview is yet to be determined and depends importantly on

the quality of the information received from Member States.

The overview should ideally go beyond a mere "horizon scanning", i.e. foresight information about emerging issues and trends in the EU's political, economic, social, technological, and ecological environment (as carried out e.g. in the UK and The

Netherlands 84 ). On the other side, a fully quantitative analysis will not be possible, to

the extent that national risk assessments will also not be based on fully probabilistic

methods.

Information on risks provided by national governments for the development of the

overview of EU risk should include:

(1) Description of process and methodology used for national risk assessments;

(2) Listing or catalogue of risks and risk scenarios identified in the risk identification for the purpose of the national risk assessments

(3) Reporting on national risk assessments to the extent that information is not classified;

(4) Information on any other risks considered to be important for an overview of risks the EU may face in the future.

84 Habegger, B.: Horizon Scanning in Government - Concept, Country Experiences, and Models for

Switzerland, Center for Security Studies, ETH Zurich, 2009.

• 9. 

  A NNEX 3: L IST OF R ISK I DENTIFICATION M ETHODS

  Table 2: Outline of risk assessment tools (ISO 31010, Annex A, p. 23-27)

  Risk assessment Resources Nature and Quantitechniques

  Description and degree of

  Complexit

  capabilities uncertainty y

  tative output? Check-lists Listing of typical uncertainties low low low no

  Preliminary Hazards and hazardous

hazard analysis situations and events low high medium no identification

Structured

interview and Collection and evaluation of low low low no brainstorming ideas

Combination of different expert opinions on identification,

Delphi technique probability and consequence medium medium medium no estimation and risk evaluation

(+ voting by experts) SWIFT

Structured "what Risk identification by a team medium any no if" (workshop)

medium

Human reliability Human impact on system

analysis (HRA) performance (evaluation of medium medium medium yes human error influences)

Analysis of a single loss and its Root cause contributory causes as well as analysis (single identification of future medium low medium no loss analysis) improvements of the system or

process Qualitative or quantitative

Scenario analysis identification of possible future scenarios based on present or medium high medium no

different risks Identification and analysis of hazards and exposure.

Toxicological risk Combination of the level of

assessment exposure and the nature of harm high high medium yes

to measure probability of the harm occurrence Analysis of the effect of key disruption risks on an

Business impact organization's operation and the

analysis way to manage them medium medium medium no

(identification and quantification of capabilities) A graphical determination of all the ways an undesired event

Fault tree analysis could occur (a logical tree diagram) and consideration of high high medium yes

reducing/eliminating potential causes Inductive reasoning for the

Event tree translation of probabilities of

analysis initiating events to possible medium medium medium yes

outcomes Cause/ A combination of fault and consequence event tree analysis to include high medium high yes analysis time delays (causes and

consequences are considered) Identification of contributory

Cause-and-effect factors of an effect through

analysis brainstorming (tree structure or low low medium no

fishbone diagram)

FMEA (FMECA) Failure Mode and Effect Analysis (+ criticality analysis) medium medium medium yes

Reliability Identification of policies to be centred implemented to manage failures medium medium medium yes

maintenance in a more efficient and effective manner

Sneak analysis

(sneak circuit Identification of design errors medium medium medium no analysis)

HAZOP Hazard Definition and assessment of and operability possible deviations from the medium high high no

studies expected or intended performance

HACCP Hazard

analysis and Measurement and monitoring of critical control specific characteristics required medium medium medium no points to be within defined limits

LOPA (Layers of

protection Evaluation of controls and their medium medium medium yes analysis) effectiveness (barrier analysis)

Description and analysis of risk

Bow tie analysis pathways from hazards to outcomes and review of medium high medium yes

controls

Markov analysis Analysis of repairable complex systems high low high yes

Establishment of the aggregate

Monte Carlo variation in a system resulting

analysis from variations in the system high low high yes for a number of inputs

(triangular or beta distributions) Assessment of the probability of

Bayesian analysis a result by utilizing prior high low high yes distribution data

Met de EU Monitor volgt u alle Europese dossiers die voor u van belang zijn en bent u op de hoogte van alles wat er speelt in die dossiers. Helaas kunnen wij geen nieuwe gebruikers aansluiten, deze dienst zal over enige tijd de werkzaamheden staken.

De EU Monitor is ook beschikbaar in het Engels.