Safety Science 76 (2015) 90–100

Contents lists available at ScienceDirect

Safety Science
journal homepage: www.elsevier.com/locate/ssci

Review

ALARP and CBA all in the same game

B.J.M. Ale a,⇑, D.N.D. Hartford b, D. Slater c
a
Technical University Delft, PO Box 5015, 2600 GA Delft, The Netherlands
b
BC Hydro, Vancouver, Canada
c
University of Cardiff, United Kingdom

a r t i c l e i n f o a b s t r a c t

Article history: The concept of reducing risk As Low As Reasonably Practicable (ALARP) as presented by the UK Health
Received 7 October 2014 and Safety Executive for the purpose of discharging its decision-taking responsibilities and the principle
Received in revised form 1 February 2015 of balancing cost and benefits through monetary Cost Benefit Analysis (CBA) which is used more widely
Accepted 20 February 2015
in health and safety decision-making seem to occupy the extremes of the decision making spectrum.
ALARP seems on the qualitative, holistic, principles based side whereas CBA seems on the quantitative,
limited, precisely defined side. These characteristics expose both principles to criticism. Application of
Keywords:
the ALARP concept may to lead to different decisions in similar contexts resulting in uncertainty and
As Low As Reasonably Practicable
Quantified risk analysis
unpredictability in decision making. CBA leads to decisions in which only money counts and all that can-
Cost Benefit Analysis not be expressed in money or is perceived of no monetary value is neglected. In this paper this issue is
Decision making explored in more depth, and it is concluded that they are part of the general decision making process.
The nature of the relevant safety laws and how they are applied frame the application of these concepts.
If the level of acceptable risk is not explicitly set by law, the risk level resulting from compliance to the
regulations is just as accidental as the Value of a Statistical Life (VOSL) found from ex post evaluations of
decisions. ALARP, QRA and CBA are part of the grander scheme of making decisions. Throughout, the focus
is on the principle rather than the practices of ALARP and CBA in reducing risk.
Ó 2015 Elsevier Ltd. All rights reserved.

Contents

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
2. ALARP and SFAIRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
3. Reasonability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
4. Cost Benefit Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
4.1. The value of life. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
4.2. Cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
4.3. Safety budget. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
4.4. Distribution of cost and benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
4.5. Societal risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
4.6. Values used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
4.7. CBA in decision making . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
5. Multi criteria analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
6. Optimisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
7. Dams and the question ‘‘How safe is safe enough?’’ – A brief overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
8. Fusing the extremes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
9. The bottom line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
10. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

⇑ Corresponding author.
E-mail address: ben.ale@xs4all.nl (B.J.M. Ale).

http://dx.doi.org/10.1016/j.ssci.2015.02.012
0925-7535/Ó 2015 Elsevier Ltd. All rights reserved.
 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
1. Introduction
The principle of As Low As Reasonably Practicable (ALARP) and
the principle of balancing cost and benefits through monetary Cost
Benefit Analysis (CBA) have been increasingly used by a diverse
range of industries that cover the spectrum of industrial and public
safety applications ranging from dams and levees, hazardous pro-
cess industries, railways and even steep slopes in urban areas. In
this regard, while the principle of balancing costs and benefits has
a long history, the range of current applications of the ALARP princi-
ple, which may be used in conjunction with CBA, is considerably
more diverse than the application for which the ALARP principle
was originally formulated. These principles seem to occupy the
extremes of the safety decision making spectrum. ALARP being on
the qualitative, holistic, principles-based side does not necessarily
lead to uniformly predictable outcomes, whereas CBA is on the
quantitative, limited, precisely defined side. These characteristics
expose both principles to criticism. Application of the ALARP process
may to lead to different decisions in similar contexts resulting in
uncertainty and unpredictability in decision making. CBA leads to
decisions in which only money counts and all that cannot be
expressed in money or is perceived of no monetary value is neglected.
This paper explores this issue in more depth and concludes that
ALARP and CBA are part of the general decision making process, even
if they are identified as separate, individual, explicit steps.
2. ALARP and SFAIRP
ALAP stands for As Low As Practicable. ALAP originated in the
field of radiation protection in the US in the 1950s. In 1970 title
10 of the Code of Federal Regulation Parts 20 and 50 specified that
exposure to radiation should be kept as far below the limits as was
reasonably practicable. By 1970 the notion of limits, to be used also
as reference, was part of the protection construct. In 1979 ALAP
changed in to As Low AS Reasonably Achievable (ALARA)
(Loewen, 2011).
In radiation protection the ALARA principle is used as a ratchet
mechanism to update – i.e. lower – the radiation exposure limits as
a function of the developments in science and technology. When
the limit technically can be set lower it will. Interestingly the
terminology in the regulation does not require the limits to change
as technology improves. It only requires that one operates as far
below the limits as can be achieved. Apparently the updates of
the limits are necessary to make enforcement of the required
behaviour possible or easier.
The principle that measures should be reasonable and practica-
ble was already used earlier in the United Kingdom in the
Electricity Regulations 1908 (Evans, 2008), in the Spinning by
Self-acting Mules Regulations of 1905 reg 3 (Rothery, 2008) and
in Section 5 of the Salmon Fishery Act 1861. Another early use
was found in the Chaffing Machines Act 1897, the Threshing
Machines Act 1878 (Bagnall, 2008) and the Alkali Act
Amendment Act 1874, but before that appeared in the Leeds Act
of 1848 (NN, 2014a,b,c): ‘‘But no person shall be subject to the fore-
going penalties for any act done in the exercise of any right to which he
is by law entitled, if he prove to the satisfaction of the court, before
whom he is tried, that he has used the best practicable means,
within a reasonable cost, to render harmless the liquid or solid matter
so permitted to flow or to be put into waters’’.
91
The underpinnings of the term ALARP originates in the UK and
actually predates the term ALAP. The Health and Safety act in the
UK specifies as duty that the risk should be reduced As Far As Is
Reasonably Practicable (SFAIRP). The term ALARP appears to have
emerged between the late 1960s and the late 1980s in relation to
how the UK Health and Safety Executive dealt with how it controls
risk from nuclear power stations. The term ALARP in the context of
the way in which the UK Health and Safety Executive is a reg-
ulatory interpretation made by the UK Health and Safety
Executive with respect to how it considers industrial safety over
the spectrum of industries for which it has responsibility.
According to the HSE document ‘‘ALARP at a glance’’ (HSE,
2014a) these terms mean essentially the same thing. While this
may be the case with respect to how the HSE discharges its
responsibilities; that is ALARP describes the level to which we
(HSE) expect to see workplace risks controlled, it does not mean
that the Courts will consider ALARP to be equivalent to ‘‘In So Far
as is Reasonably Practicable’’ (SFAIRP) (HSE, 2014b). The term ‘‘So
Far as is Reasonably Practicable’’ (SFAIRP) is used widely in health
and safety legislation in the UK, whereas the term ALARP is not
used. However, much of the contemporary commentary on
ALARP suggests that the term has been enshrined in the UK case
law since the case of Edwards v. National Coal Board in 1949
(NN, 1949). In the case the court stated that
‘‘Reasonably practicable’’ is a narrower term than ‘‘physically pos-
sible’’ and seems to me to imply that a computation must be made
by the owner in which the quantum of risk is placed on one scale
and the sacrifice involved in the measures necessary for averting
the risk (whether in money, time or trouble) is placed in the other;
and if it be shown that there is a gross disproportion between them,
the risk being insignificant in relation to the sacrifice – the [person
on whom the duty is laid] discharges the onus on them [of proving
that compliance was not reasonably practicable].’’
The ruling implied that the risk must be insignificant in relation
to the sacrifice (in terms of money, time or trouble) required to
avert it: risks must be averted unless there is a gross disproportion
between the costs and benefits of doing so.
The term SFAIRP was used in the Health and Safety At Work Act
in 1974 and is used in the regulations. In 2001 Cullen and Uff con-
cluded that at that time this was still an accurate expression of the
law (Cullen, 2001).
Notwithstanding all of the above, duty holders cannot assume
that if the HSE concludes that a certain risk is ALARP that it means that
the statutory duty of the dutyholder to reduce the risks SFAIRP is ful-
filled. It only means that the HSE is satisfied, not that the Courts will be
satisfied that the SFAIRP condition has been achieved. The important
point here, that is generally not made, is that the two qualifications
are applied to quite different properties. ALARP is applied to the level
of ‘risk’ whereas SFAIRP is applied to being ‘safe’. The key question is
whether being ‘safe’ is determined solely by the level of ‘risk’. Safety is
relative and influenced by values whereas risk is quasi-objective and
held to be value-free. The numbers mean the same to everyone, which
of course is why risk became the parameter or property of choice. In
practice, the difference means that the requirement ‘safe SFAIRP’
focuses on reducing the hazard. This is what the law requires and
on which the courts pass judgement.
The discussion on the difference between ALARP and ALARA
hinges on the definitions of Achievable and Practicable. Munson
92 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
(1988) state that despite that there may be subtle differences
between the two terms, they are in practice interchangeable.
However it looks like the use of the term ALARP in the UK as
opposed to ALARA seems to imply that achievable includes that
it could be theoretically possible to go lower even if it has not been
demonstrated in any way to be feasible in practice. ALARA then
demands to do work, research, engineering to make it work.
Practicable seems to indicate that the technical feasibility needs
to have been demonstrated. Whether this also means that the tech-
nical implementation of the possibility should have been realised
in practice and that practicable means the same as available tech-
nology is unclear.
In this context the term BAT, Best Available Technology, plays a
role. BAT implies that the costs are not considered. Then BAT
means the same as ALAP, As Low As Practicable, the term used in
radiation protection before it became ALARA.
ALARP apparently means that the technology not only should
be available, but also that the costs should be reasonable. This is
confirmed in the verdict on the appeal in the case of Baker against
the Quantum Clothing Group (The Supreme Court, 2011a).
‘‘In considering what is practicable, account must be taken of the
state of knowledge at the time. A defendant cannot be held liable
for failing to use a method which, at the material time, had not
been invented: Adsett v K and L Steelfounders and Engineers Ltd
[1953] 2 All ER 320; nor for failing to take measures against a dan-
ger which was not known to exist: Richards v Highway
Ironfounders (West Bromwich) Ltd [1955] 3 All ER 205.’’
In the same verdict the demand of gross disproportionality was
confirmed: (The Supreme Court, 2011b)
I agree with Smith LJ in her conclusion (at para 84 of her judgment)
that for the defence to succeed, the employer must establish a gross
disproportion between the risk and the measures necessary to
eliminate it. In the words of Asquith LJ in Edwards v National
Coal Board [1949] 1 KB 704, 712, ‘‘the risk [must be] insignificant
in relation to the sacrifice’’. In the present case, the provision of
ear defenders at relatively modest cost was entirely practicable.
For that reason, and since I have concluded that the employers
ought to have been aware of the risk of noise induced hearing loss
to the respondent, I do not consider that the defence of reasonable
practicability was available to them.
Another acronym that seems to mean the same is BATNEEC.
This term was introduced with the 1984 Air Framework Directive
(AFD) and applies to air pollution emissions from large industrial
installations. BATNEEC stands for Best Available Technology Not
Entailing Excessive Costs. In any case the introduction of several
different acronyms over the years suggests that the authors were
not satisfied that the existing acronyms conveyed had the same
meaning of what they tried to express.
Central in the discussion is what is meant by reasonable. A fla-
vour for the extremes in these discussions are acronyms also used
in the debate: CATNIP (Cheapest Available Technology Not
Invoking Prosecution) or as David Slater put it (1994): ALARA: As
Large As Regulators Allow, bringing back the notion the only a limit
ultimately can prevent the risks from growing. This also is
expressed by the drift to danger model as presented by
Rasmussen (1997).
The verdict in the case of Baker against the clothing group states
as elements that the person or institution is aware of the risk or
could reasonably be expected to be aware of it, and that a
reasonable person or institution could not use cost or difficulty
as a valid reason for not having such a policy. A valid reason could
be that the costs are substantially disproportionate. Whether this
substantially differs from grossly disproportionate in Evens against
the Coal Board is difficult to assess.
3. Reasonability
The use of the term reasonable suggests that – in the UK risk
management context – it is not sufficient to just adhere to some
limit, if it exists, and that the reasonability of performing or
refraining from an action is not just a matter of money. The term
expresses that besides aspects that can be expressed in terms of
money or have a monetary or market value, there are aspects that
do not have such a monetary value, or such a value cannot be
established with reasonable accuracy. The aspects may comprise
such things as equity, sociality and even maybe beauty – even if
it is only in the eye of the beholder. An area of outstanding beauty
may appeal to one and not to another. And this is certainly true for
buildings, which are conserved for their beauty, the beauty of
which is an area of contention between architects. In either case
the monetary value of these areas and buildings in many if not in
most cases is considerably less that the costs associated with keep-
ing them that way. In addition areas usually are much more valu-
able in terms of economic production and sales value when they
can be used as building sites or agricultural areas than when they
are designated as nature conservation areas. Therefore reasonabil-
ity comprises much more than money and it is only loosely
defined. It is what those who happen to make a decision consider
reasonable.
In particular instances, once it is ruled that a certain measure is
reasonable, then it usually does not change, even if circumstances
change. If a city grows and encroaches on a listed building it has to
construct around this building. At the same time the economic fac-
tors change. It probably was a building to keep in a rural area, but
is it also a building to keep now that the area has become a city? It
seems that once listed means always listed.1 So it looks like reason-
ability depends on the circumstances until the decision has been
made, after which changing circumstances no longer change the rea-
sonability. Therefore in the UK in many cases the practical meaning
of ALARP can only be inferred and may only be defined definitely
after a trial in court, which may only take place after an incident.
In the Netherlands legislation follows the Napoleonic principle that
it is a citizens right to know in advance what the legislature
demands and that governmental decisions need to be predictable
(Ale, 2005).
The advantage of a qualitative somewhat vague concept, and
decision-making that depends on a to a large extent subjective
value judgement by a decision maker, lies in that it avoids ques-
tions that are difficult to answer. It also avoids questions that have
ethical connotations. The question of the value of land has already
been touched above. A much more stinging problem is the mone-
tary value of a human life. By demanding substantial dispropor-
tionality or gross disproportionality of costs before refraining
from a risk reducing measure, the problem of precisely setting a
value on a human need not be addressed. However many decisions
imply a value for a human life. Sometimes these values are
assessed by dividing the costs of the measure by the number of sta-
tistical lives saved (or at least not killed by the activity under con-
sideration), such as in Tengs et al. (1995). However it should be
borne in mind that these evaluations implicitly assume that saving
lives was the only purpose of the measure and the only not mone-
tised issue in the decision. In some of the decisions mentioned by
Tengs et al. it seems obvious that the continuation of the political
career of the decision makers was considered an important but not
explicitly monetised factor. So the apparent inconsistency in
1
The same applies in the Netherlands.
 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100 93

decision making could perhaps be attributed to other factors than at their total portfolio of risks and may compensate an increased
just inconsistency. Nevertheless the question was, is and will be level of risk by risk reducing measures somewhere else. For
raised whether decisions involving risks for human lives and instance, rather than sticking to a moderately healthy diet always
health should be more consistent on the aspect of the implied they may decide to compensate for a heavy meal by a day of
monetary value of a human. Before this issue is addressed first fasting.
the other extreme of the decision making spectrum is considered: If earning power is used (Morall, 1986) the question arises how
CBA. to deal with the unemployed. If the number of life years lost is
used, how can the question of putting the elderly or the young in
specific hazardous situations be dealt with. The notion of Quality
4. Cost Benefit Analysis
Adjusted Life Years (QALY) brings the question of the handicapped
or challenged against the healthy.
In Cost Benefit Analysis and the decision making based on CBA
In terms of expenditure per life-year the numbers range from 0
it is assumed that everything has a value that can be expressed in
to 99 ⁄ 109 US dollar (Tengs et al., 1995). The policy value of a
money. It also assumes that these values can be determined and
human life seemed to gravitate to approximately 7 million US$.
are determined in the market place that the world is considered
This is equivalent to US$200,000 per life-year.
to be.
In more recent literature, the value for a human life to be used
When all aspects to consider are money such as an investment
in cost benefit analyses is called the Value Of Saving a Statistical
decision in stocks or bonds the application is straightforward. But
Life rather than the Value Of a Statistical Life (VOSL). The argument
it gets complicated even for decisions such as constructing a road.
given is that the value of LIFE is unmeasurable. Nevertheless, in any
Is the road value for money? The quantum of what has to be spent
cost benefit decisions the bottom line is that the value used is the
in monetary terms for the design, construction and maintenance
value for letting that life continue in that decision. In decisions
can be calculated. But what is the worth of the time saved by not
where statistical lives are lost, even when that is called tolerable
having tail backs? The value of changing the living environment
(HSE, 2001), the activity and the risk are accepted and decision
for those who have to be rehoused is not only the current market
makers would do better in the public debate if they did not hide
value of their houses (which usually is the item in the CBA), but
this behind words. HSE (2001) uses a value of one million pounds
also the ‘‘imponderable’’ costs of children losing their friends, hav-
in their advice on risky activities. Also this value is based on the
ing to go to another school, which has a value for them and for
amounts spent on road safety (HSE, 2001). HSE remarks that they
which they do not get compensated, which is not considered but
consider a higher value appropriate for risks for which people have
still is a value loss.
a higher aversion, but they do not specify a value for risks such as
Cost Benefit Analysis is attractive because whatever the con-
disasters in a chemical factory or a nuclear power plant.
sideration leading to a decision to implement or refrain from a
In an evaluation that is more recent than the one performed by
measure, one aspect is always that a measure bears some costs.
Tengs et al. (1995) and Viscusi and Aldy (2003) derive a value of 4
The other ubiquitous aspect is that the activity under consideration
million US dollar.
is advantageous to somebody. And in most occasions that advan-
According to Button (1993), the official value of a human life
tage is earning money. There are occasions though where money
varies from €12,000 to €2.35 million (Euro) and the market value
is not the primary objective. Having a race track has ‘‘fun’’ as its
between €97 and €630,000. Blaeij et al. regarding road safety find
main advantage even when money is made by admission fees.
values ranging from US$0.15M to US$30M (Blaeij et al., 2000;
The main disadvantage is noise, which is also difficult to express
Blaeij, 2003). They conclude that the value found depends among
in money terms.
other things on the method used to determine it and on the back-
Using CBA reduces the question of acceptability to the question
ground risk. They also say that to assume that a single (average or
of profitability. Even when it is difficult to answer this question,
mean) VOSL can be attained, as is frequently suggested in the
whether it is ethically acceptable to bother people with noise for
literature as well as among policy-makers, is not sound from a
some people’s fun is a question that is even more difficult. If the
theoretical perspective and that the same conclusion can be drawn
racetrack example is not sufficient to explain the issue, consider
regarding the empirics of VOSL estimations.
fireworks. Does having the fun of fireworks outweigh the suffering
The valuation of injuries is even more difficult as are environ-
of those who are killed and maimed in the accidents associated
mental damages. A comprehensive description is given in the
with the production and the storage of these fireworks?
ExternE (NN, 1995) report, but even there the results remain
The latter raises an even deeper issue. Apparently the people
inconclusive or as Dolan et al. put it ‘‘elusive’’ (Dolan et al., 2008).
involved in the production accept the risk in return for their pay.
So from the point of view of CBA, the market has done its job.
4.2. Cost
There was an offer: money in exchange for a risky job and some-
body accepted it. The more ethical question is: should this offer
There are also great difficulties in assessing the actual value of
be on the table to begin with. This in turn raises the question
the risk reduction costs. A seemingly expensive measure such as
whether human lives can be evaluated in terms of money and if
the desulphurization of residual oil actually brought money.
that is possible whether that value is a universal constant and all
Many of the expenses made in safety result also in increased relia-
people are indeed created equal and finally if that is the case what
bility of the production and less costs of down time and accidents.
that value is.
In fact, in the study performed by Pikaar and Seaman (1995) for the
Dutch ministry of Housing, Physical Planning and Environment it
4.1. The value of life appeared that most industries did not consider it worth their while
to register the costs of these measures. This is consistent with
A continuous stream of efforts has been made to deduce a num- Tengs et al. (1995) finding of the low costs of measures related
ber for the value of a human life. Several attempts have been made to the prevention of accidents.
that all have their specific ethical drawback (NN, 1995). So the methodology for Cost Benefit Analysis itself is well estab-
Recent literature indicates that these estimates can be very mis- lished and works well when only material loss and gain is involved,
leading because people manage their risk much more intelligently such as in finance. Currently there is not yet a clear understanding
then by just looking at the one risk under consideration. They look of how to use Cost Benefit Analysis in an organised way in risk
94 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
management, when these risks go beyond financial risks. What to
put in monetary terms against what otherwise is called ‘‘impon-
derable’’ is still the subject of considerable debate.
As described several times previously, especially when human
life and health are at stake the discussion is more about values
than about costs. But real decisions are often much more cynical
than that (Evans, 1996).
Illustrative in this respect is the discussion about Automatic
Train Protection systems (ATP) in the United Kingdom. After Lord
Hidden (1989) in his report of the Clapham Junction accident
advised to introduce ATP on the British Rail network, British rail
issued a report in 1994 (HSC, 1999) in which it showed that, given
the Value Of a Statistical Life used in the UK, ATP was dispropor-
tionally expensive. This conclusion was endorsed by the
Department of Transportation (DoT, 1995). After the crash at
Ladbroke Grove Lord Cullen (Cullen, 2001) concludes that that
decision was not unreasonable, but that the introduction of ATP
was advisable regardless of these costs. This in turn leads Evans
(Evans, 2005) to the conclusion that that money could be better
spent on road safety, illustrating again that monetary cost benefit
evaluations seldom dominate the final decision. However, the reg-
ulatory/political decision on ATP has not been the subject of any
court case. The cost-benefit argument was conducted entirely in
the political domain, much along the lines indicated. To the knowl-
edge of the authors, the ALARP argument has never figured in a
court case where the defence would have been that the residual
risk was such as to ensure compliance with the law – in effect, that
the risk was acceptable. The authors are not aware of any such
defence and in any case, the hindsight bias available to the court
can be expected to guarantee conviction.
Given these experiences the weighting of human lives in an
economic framework perhaps has to be left to the decision-makers
and any analysis that quantifies human losses in terms of money
has to be explicit about the valuation.
4.3. Safety budget
The remark made by Evans is repeated by Helsloot who com-
pares various safety measures and states among other things that
the costs associated with the signs at emergency exits can better
be spent giving children fruits at school (Helsloot, 2012).
This reasoning is problematic as it suggests that money spent
on saving or extending human lives can best be spent on food
and medicines in the poorest regions of the world. Thus the ulti-
mate conclusion of this reasoning would be that it would be better
to redistribute the life expectancy over the all the people in the
world, making the life expectancy in the ‘‘developing’’ world longer
at the expense of the life expectancy in the ‘‘western’’ world.
Whether this is ethically better or economically better is unclear.
What is clear is that then there must be a mechanism to deter-
mine where the safety money should go. It is no surprise that
Helsloot et al. propose an independent commission (Helsloot
et al., 2010, p163), that would decide on purely scientific grounds
where the safety money should be spent. The problem that
Helsloot et al. ignore is that there is no such thing as a safety bud-
get. There is money to spend on safety in a project, but this money
is part of the project budget. It is difficult to imagine a mechanism
by which such a Commission could decide that that a specific pro-
ject can be made more risky, then take money from whoever is
doing the project and spend it somewhere else. It is easy to imag-
ine that should such a procedure exist, whoever has a project
would set the safety budget to zero, budget for more risk and wait
until and if the Commission would do something about it, prefer-
ably by supplying money taken from somebody else.
The current practice of determining reasonability takes the
spending power of the initiator of a project into account. If the
initiator has no more money left to invest, improving safety is
not considered reasonable. This makes some projects or technolo-
gies safer than others. To prevent ‘‘poor’’ projects from being exces-
sively unsafe, standards exist that define a maximum level of risk.
These standards can be and are different for different types of
activities. There is no law of nature that defines an (un-) acceptable
level of risk, nor is there a principle that all risks should be mea-
sured equally. All of the reasonability principles can only operate
within the implied or explicit assumption that an ultimate limit
exists.
4.4. Distribution of cost and benefits
Risk acceptability is also a distribution problem. Those who
‘‘take’’ the risk often are not the same people who ‘‘bear’’ the risks.
When the rewards of risk taking goes to the risk creators and the
costs are carried by the risk bearers a strong incentive is created
for a small group to take large risks at the expense of others. The
banking crisis is a prime example. The management of the banks
took excessive risks and most of them got away with it. The tax
payer had to bail them out. For the moment it looks as if society
is curtailing the market freedom of the banks to prevent this beha-
viour in the future.
The separation between risk takers and risk bearers is in part
counteracted by litigation. The victims seek compensation from
those who created the harm. However, as is illustrated by the case
of the fireworks explosion in the Netherlands in 2000, damages in
the case of an accident can easily be beyond the financial capabili-
ties of the industry that caused the accident. One could choose for
the principle that the damage rests where it falls (Helsloot et al.,
2010, p83), and leave the victims with the damage, but this invari-
ably results in public outcry, in which case the tax payer again has
to foot the bill.
Another persistent problem in societal Cost Benefit Analysis is
that even if all the attributes can be expressed in terms of money,
what is considered ‘‘good’’ for society is not necessarily ‘‘good’’ for
everybody. The increase in ‘‘wealth’’ as a total may be maximised,
but some have more profit than others. The sheer fact that econo-
mists cannot decide on what is best, making society more egalitar-
ian, with small difference in income and possessions or less
egalitarian, with large differences proves the point. Therefore
Cost Benefit Analysis which only considers economic optimisation
ignores as Tawney (1926), put it:
‘‘A reasonable estimate of economic organization must allow for
the fact that, unless industry is to be paralyzed by recurrent revolts
on the part of outraged human nature, it must satisfy criteria,
which are not purely economic’’.
4.5. Societal risk
Societal risk is the term used for risks that involve events with
multiple fatalities or victims. Using just the expectation value of a
loss implies that the decision maker will attach equal value to risks
for which the R is equal; that it does not matter whether there is a
1/100 chance of winning 100 Euros, or a 1/1000 chance of winning
1000 euros. In normal life betting games this is often the case.
However, if the consequences are very high, this might no longer
be the case. As an example, after 9/11, insurance companies were
no longer prepared to insure losses in excess of 1 billion Euros,
regardless of the probability. In such circumstances the conse-
quences and the probabilities or frequencies have to be presented
and considered separately.
The most widely known expression of these effects in mathe-
matical terms is the so-called risk-aversion index. Risk aversion
 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
means that more severe consequences (with the same frequency)
weigh heavier in the decision making process than more frequent
events (with the same in total consequence). Large consequence or
disaster aversion therefore would be a better term (Bedford, 2013).
There is considerable debate about whether it is ethical to treat
a single accident with say 10 people killed as worse than 10 acci-
dents with 1 person killed each. Evans and Verlander (1993) state
that having an FN curve as a linear relationship between F (the fre-
quency) and N (the value exceeded) with a slope steeper than 1,
which is the mathematical expression of considering a single mul-
tiple fatality accident as less acceptable than a series of one fatality
accidents with the same total number of victims, violates the eco-
nomic rule of constant utility, and that therefore decisions made on
any other criterion than the expectation value of the number of
victims is wrong. Recently however, Bedford (2013) has shown
that an FN curve with a slope steeper than 1, or valuing a multi-
ple fatality accident heavier than a series of single fatality acci-
dents is not risk averse but consequence averse and can be
shown to be compatible with the economic laws that entities with
the same utility should be valued equally.
Multiple fatalities can create more disutility than single fatali-
ties, just by the fact that they occur simultaneously, in the same
event and by the same cause. This finding is a further confirmation
of the findings in Slovic et al. in 1978. It should be borne in mind
that expressing the consequences in terms of fatalities is using a
proxy for all the attributes of a multi-fatality event, sometimes
referred to as social disruption. Slovic at al. called it ‘‘dread’’, which
stands for attributes such as disastrousness, inability to cope with-
out help, beyond control, man-made. When asked directly people
probably will say that it does not matter whether the number of
people killed is one by one, or in a single accident. This does not
take away from the fact that 100 people killed in a train crash leads
to social debate and parliamentary enquiries, while the same num-
ber killed on the road does not cause any societal ripple.
Therefore multiple fatality accidents should not be compared
with multiple accidents with a single fatality by the number of
people killed alone, which strengthens the argument that values
of statistical lives derived from road safety are not transferrable
to other areas of industry. It also strengthens the doubts as to
whether a value derived from one realm can be transferred to
another realm per se. If indeed there is no law of nature from
which an acceptable risk level can be derived, there is no reason
a priori to assume that the level would be equal for each realm.
This in turn does not prevent any decision maker from deciding
to adopt a level in one realm which is equal to that in another
realm, but this needs separate justification, as for instance was
done in the Dutch Premises for Risk Management (TK, 1988).
4.6. Values used
All these publications and the elusiveness of the value of human
lives does not prevent authorities from adopting standard values
for the value of a statistical life. The Australian Government’s
Office of Best Practice Regulation adopted a value of 3.5M $US
per life and a value of 151,000$US per statistical life year. It is sta-
ted that these estimates are based on the assumption that the aver-
age person has another 40 years to live, which implies an average
life expectancy of 80 years. There is no indication that they noticed
that these values are completely inconsistent.
The UK Health and Safety Executive stated a value of £1M in
their report R2P2 (HSE, 2001). The UK Department of
Environment, Transport and the Regions now uses £1.74M2 for
road traffic (2014b). For risks close to the limit of intolerability the
2 3
The value is given in 7 significant digits: 1,742,988.
95
value used was increased (DoT, 1995). According to Cullen and Uff
there does not seem to be a scientific reason for this difference. In
their report however Cullen and Uff do not give a judgement on
these values, as the issue under their investigation is already settled
by law. It looks as though they are of the opinion that this does not
by implication set a value on a human life, but they are unclear about
this. From the more recent amended Railways and Other Guided
Transport Systems (Safety) Regulations 2006 (NN, 2014a,b,c) it
appears that this difference no longer is used.
The Dutch government uses €5.8M for an average life lost in a
flood (Deltares, 2011; IENM, 2013). This is based on studies by
Bockarjova et al. (2009a, 2009b, 2009c) who state that the use of
their findings as an estimate for the VOSL is problematic, given
the answers of the respondents in their study, show that people
behave more as ‘‘homo politicus’’ than as ‘‘homo economicus’’
(Bockarjova et al., 2008).
Helsloot et al. (2010) propose to use €3.2MEuro for an average life
lost as a uniform amount for all policy decisions in the Netherlands.
The ministry of Infrastructure and Environment proposes €2.9M per
life lost in the CBA for the introduction of the European Rail Traffic
Management System (MuConsult, 2014) which is half the value in
the CBA for the height of the dykes, which underpins the current pro-
posal3 for the new ‘‘Delta’’ works (IENM, 2013).
In health care the Dutch Health Councils prefers a value of
€80,000 per Quality Adjusted Life-year (QALY) (RVGZ, 2006).
However, when the costs of medicines decreases this may lead to
the conclusion that it is worthwhile to treat half of the Dutch pop-
ulation against hypertension even when this risk of adverse conse-
quences is marginal (Smulders and Thijs, 2006). Recent decisions
according the preference of the Health Council regarding the treat-
ment of among other things Pompe’s disease resulted in a parlia-
mentary debate and in a revoking of the decision to no longer
pay for this treatment under the basic health insurance system in
the Netherlands.
4.7. CBA in decision making
Just as ALARP, CBA based decision making has its merits and its
disadvantages. Its primary merit is that it is precisely defined and
the decision is predictable. Its disadvantage is that it does not take
into account the imponderables that more often than not weigh
into the decision. Using CBA also suggests that the Value of Life
is a known and universal constant while there is no scientific evi-
dence other than that the VOSL varies over a large range and highly
depends on the circumstances and on the method used to deter-
mine it.
What seems to be emerging from the examples in (4.6 above) is
that decisions on statistical human lives and anonymous future
victims are much easier than on real human beings. In the latter
example of Pompe’s disease there are only some 10 patients in
the Netherlands. In that case the future victims were no longer sta-
tistical but real. This is in line with the findings of Slovic et al.
(1978), that the possibility of identification with the victims makes
a risk – or a consequence – less acceptable.
5. Multi criteria analysis
Decisions are made. The processes involved are not always
made explicit. They are the result of a complicated value judge-
ment in which many attributes play a role.
A possible escape from explicit valuation of human lives is
Multi Criteria Analysis (MCA). In MCA criteria are not necessarily
expressed in a common metric (such as money), but the relevant
The ministry considers this decision as being taken.
96 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
attributes are described in their own terms, leaving the weighting
to the decision maker. MCA appeals to decision makers and others
who are uncomfortable with numbers (Vlek, 1996) or are of the
opinion that the use of numbers implicitly suggests an accuracy
that these numbers do not have. The latter suggestion is some-
times reinforced by expressing the VOSL in seven significant digits
as is done in the CBA for the introduction of ERTMS in the
Netherlands.4 The different attributes of risk are expressed in qual-
itative form and judged qualitatively. This does not take away from
the fact that after the decision, which in this case is a matter of the
willingness to pay, can be evaluated in terms of what the decision
means for the – now implicit – economic valuation of a human life.
This form of decision making removes another problem that is
created by an explicit valuation; specifically that the numbers used
are based on studies in which it is stated explicitly that the valuation
deduced from willingness to pay investigations or evaluations of
past decisions have a wide spread and that these values should
not be taken as the basis for future decisions without further discus-
sion. Nevertheless, as described above, the value from the ExternE
report seem to percolate through CBA based decision making.
The Safety Case Regime, that applies to certain industries in
Australia, New Zealand, and the United Kingdom can be considered
to fall into the multi-attribute category of safety demonstrations.
The United Kingdom Offshore Installations (Safety Case)
Regulations 2005 are an example. For the purpose of a design noti-
fication or a relocation notification, the particulars to be provided
include among other particulars ‘‘a description of how a chosen
design concept is intended to ensure that risks with the potential
to cause a major accident are reduced to the lowest level that is
reasonably practicable’’ (UK Government, 2005). The process for
the Verification of Compliance with UK Shelf Regulations (DNV,
2011) provides an illustration of how the Offshore Safety
Regulations are being implemented as follows:
ALARP is particularly important for fixed installations and float-
ing installations located at a fixed location. However, mobile units
coming to the UK will also have to demonstrate an acceptable level
of safety including reasonable application of the ALARP principle.
The basic principles for hazard management are:
– systematic identification of major hazards on the installation
– taking action to design out, avoid and reduce hazards at source
– risk analysis and assessment of major accident hazards, includ-
ing PFEER Regulation 5 assessment
– inclusion of ergonomics and human factors issues within the
risk assessment process
– establishing appropriate prevention, detection, control and mit-
igation measures, including safety-critical elements and their
performance standards, to manage remaining hazards
– linking to an acceptable verification scheme covering the SCEs
identified
– providing suitable evacuation, escape and recovery resources
– demonstration of fulfilment of the ALARP principle.
The above work forms the basis for development of the safety
case(s).
In terms of the above, an ALARP demonstration, while an impor-
tant part of the safety assurance process is not the only part.
6. Optimisation
ALARP is a form of driving the optimal solution of a complicated
problem in a certain direction: One should make the risk as low as
4
The value given for a death is €2,877,857, the value for an injured €295,870 Euro;
(€ 2013), before tax.
reasonably practical. It is meant perhaps to counter the drift to
danger under market forces as described by Rasmussen (1997). It
should be noted however, that there is a general rule for optimisa-
tion, which is that the solution is not in the interior of the area of
feasible solutions, but always on the boundary. This means that if
there are no bounds the solution can be anywhere. It also means
that once a limit is set, the solution will be on this limit, unless
another constraint is more demanding. In the case of a non-
bounded risk problem, the boundary condition for costs is zero
costs. This means that the risk will rise until the costs are zero. If
there is a risk limit, the risk will be on this limit, unless other
demands, such as the operability, are more stringent. The resulting
‘lower than the limit’ risk then is just a co-incidence. If the risk
limit puts excessive financial demands on the activity, the activity
will be stopped. The remark made in several VOSL studies that the
VOSL varies widely, may be the result of a process in which other
factors were dominant. In many ex post evaluations of decisions
these factors may not be retrievable, because they are only known
to the people involved. As an example the fine for not having a
fence around a swimming-pool in France is €40,000. In terms of
valuation of a statistical life this may seem an enormous amount,
unless one knows that the regulation came into force after the
grand child of the responsible minister drowned in a swimming
pool. He judged apparently that it was unreasonable that children
drown in swimming pools regardless of the costs of protection.
There are many of these decisions known. They have in common
lives that were not valued before the decision, and therefor the
value was the accidental result, not a pre-set criterion.
7. Dams and the question ‘‘How safe is safe enough?’’ – A brief
overview
The failure of a large dam or important flood defence dyke,
while perhaps less frightening than a nuclear catastrophe, is com-
parably destructive. The publication of Tolerability of Risk from
Nuclear Power Stations, and in particular the content of
Appendix 4 provided British Columbia Hydro, an owner of large
hydropower and flood control dams, with a basis to propose a
new approach to the assessment of the safety of dams for flood
and earthquake hazards (BC Hydro, 1993). The proposed BC
Hydro criteria of life safety were mid-way between the ‘‘local scru-
tiny line’’ and the ‘‘negligible line’’ for ‘‘major hazards of transport’’
(Figure D1 of the Tolerability of Risk report). BC Hydro’s objective
was to set ‘‘safety standards’’ for dams in terms of risk to life and
economic risk that would be used to determine that a dam would
be deemed to be acceptably safe to the Company and to the Dam
Safety Regulatory authority.
At the same time, the Australian National Committee on Large
Dams, an industry association, was working towards a similar
objective as BC Hydro (ANCOLD, 1994, revised 2004). In 1995, a
study carried out for State of Victoria office of water reform pub-
lished the Victorian Headworks Review (SMEC, 1995) that repre-
sented the first application of a version of risk assessment to a
portfolio of dams for prioritisation purposes.
CBA has been used for many years to justify the costs of invest-
ments in new water resource infrastructure, including flood
defences where it plays a very significant role. However the idea
of using CBA, which was central to the BC Hydro proposal in the
determination of the extent to which safety features for dams to
withstand the effects of severe flooding was rejected by the engi-
neering profession, the dams industry and government authorities,
largely on moral and ethical grounds relating to the problem of val-
uation of life. The approach adopted in the Netherlands for flood
protection dykes was not adopted by the dams industry. The US
Bureau of Reclamation (United States Bureau of Reclamation
 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
(USBR), 1986) considered the matter with respect to the safety of
dams in the mid-1980s but did not pursue it. However, owing to
the very high cost and little apparent benefit of traditional safety
measures for dams the matter remained of interest in a small num-
ber of countries, most notably in Australia and in British Columbia,
Canada.
BC Hydro withdrew its proposal in 1997 because of difficulties
in providing a scientifically robust analysis of the risk, difficulties
that continue to inhibit the application of risk analysis in determin-
ing the safety of dams, and because of legal and corporate social
responsibility concerns. In the same year, the US Bureau of
Reclamation (USBR) established a similar criterion to that of BC
Hydro for prioritising its expenditures on dam safety improve-
ments. These criteria have remained in place at the since. Since
1997, and in recognition that the setting of societal risk control
goals is a matter of politics that must be addressed on a jurisdiction
by jurisdiction basis, BC Hydro has focused its efforts on the matter
of improving the industry’s capabilities to perform scientifically
robust risk analysis methods. In 2004, the New South Wales Dam
Safety Committee, the State’s Regulatory Authority for the safety
of dams established a policy of progressive improvement of the
safety of dams based on risk assessment criteria that reflected
the Tolerability of Risk and ALARP philosophy of the UK Health
and Safety Executive, as re-interpreted by the Australian National
Committee on Large Dams. This Australian approach to risk assess-
ment for dams, the use of which is widespread in Australia for pri-
oritisation of dam safety improvements, adopted societal risk
criteria that combine the UK HSE’s Tolerability of Risk criteria
and the F-N societal risk criteria used in the Netherlands for the
control of industrial risk, and for flood defences.
Subsequent to the publication of Reducing Risks, Protecting
People, the use of the HSE’s Tolerability of Risk Philosophy became
increasingly accepted for prioritisation purposes in the dams
industry (e.g. Brown and Godson, 2004). However, this use of the
HSE philosophy in the dams industry is not widespread being
restricted to Common Law countries, nor is it fully in accordance
with the philosophy as set out in Tolerability of Risk from
Nuclear Power Stations. Thus far the New South Wales Dam
Safety Committee has been the only dam safety regulatory author-
ity to establish dam safety criteria for dams and only in the context
of progressive improvement towards established deterministic
standards. In 2007 the Canadian Dam Association published pro-
posed societal risk criteria for dams in Canada (CDA, 2007), a pro-
posal that was revised in 2013. In 2009, the US Army Corps of
Engineers (Munger et al., 2009) prepared its own interpretation
of the HSE’s Tolerability of Risk philosophy that serves as an ‘‘inter-
nal regulation’’. In 2013 in the UK, the Department of Environment,
Food and Rural Affairs (DEFRA) published its Guide to risk assess-
ment for reservoir safety management. However, the DEFRA Guide
does not form part of the reservoir safety legislation in the
United Kingdom in the same way as the Offshore Installations
Safety Case Regulations. In 2014, the new policy on the safety of
flood protection dykes in the Netherlands which meets BC
Hydro’s original objective for dykes in the Netherlands was pub-
lished (Ministerie van Infrastructuur en Milieu, 2014). However,
for the legal and political reasons previously described is not
applicable to BC Hydro’s dams or to dams in other jurisdictions
where the common law system prevails and where the enabling
legislation has not been enacted.
The situation in the dams industry in common law countries
has analogues in other industries such as railways. The existence
of the Common Safety Method for Risk Evaluation and
Assessment for technical risk aspects of railway safety in the
European Union provides a useful means of examining the matter
of ALARP, SFAIRP and CBA. In the EU regulation, design targets,
97
referred to as harmonised quantitative design targets have been
specified in terms of an acceptable rate of failures per hour.
In response the Rail Safety and Standards Board (RSSB), an
industry organisation has provided guidance to rail operators on
the matter of risk management and demonstrating that risks have
been reduced So Far As Is Reasonably Practicable (RSSB, 2014).
‘‘The obligation to ensure safety SFAIRP is sometimes expressed as a
requirement to reduce risk to a level that is as low as reasonably
practicable. Although SFAIRP and ALARP are different in law, they
are used interchangeably in the GB rail industry and are regarded
as representing the same health and safety legal test.’’
For the purpose of CBA, the RSSB ‘value of preventing a fatality’
(VPF) was £ 1.826 million in June 2014. In terms of the RSSB
Guidance on the use of cost-benefit analysis for ensuring safety,
CBA should only provide an input to the overall decision rather
than giving a definitive result. Notwithstanding the extensive guid-
ance provided by RSSB to operators, a degree of uncertainty
remains with respect to the safety decision because as in other sit-
uations in the common law system, the adequacy of a duty holder’s
safety measures will ultimately be determined by the Courts after
an accident.
While in the case of railways in the United Kingdom, guidance
on risk-decisions and CBA is provided by the industry, the guidance
for dams is provided by a Government Agency. However, in both
cases, the risk assessment and CBA information inform the safety
decision, they do not form the sole basis for the decision.
However, unlike the railway industry, there is no EU-wide reg-
ulation on the safety of dams and reservoirs.
Thus, after more than 20 years of activity in the domain or risk
assessment in dam safety practice, dam owners in common law
jurisdictions are still faced with the problem of comprehensively
demonstrating that their dams are acceptably safe. In simple
terms, the uncertainty associated with the safety decision as
described in the Introduction remains a dominant matter for these
dam owners with only partial assurance being provided by their
ALARP demonstrations and the Cost-Benefit Analysis regardless
of how well grounded these analyses are. This is in marked con-
trast to the situation with respect to flood defences in the
Netherlands (or other Napoleonic jurisdictions that choose to)
where the responsible duty holders know how much safety to pro-
vide as specified in terms of acceptable risk criteria and CBA.
8. Fusing the extremes
As is described above the expression of risk in quantitative
terms and the valuation of human lives is not going to disappear.
In a market driven society the bottom line of all decisions is an
amount of money to be paid by a company, a victim, a bank,
society, the consumer or the taxpayer. That does not necessarily
mean that the non-material damages and the non-material bene-
fits associated with a risk bearing activity need to be valued at
the same price in every situation, in every context and in every
decision. It should be borne in mind though that the judgement
about risk is influenced more heavily by interests than by the abil-
ity to influence the decision. Vlek and Stemerding (1984) showed
that people judge more favourably on the risks of LPG if they drive
a car which is fuelled by it and even more favourably if they sell
LPG (Vlek and Stallen, 1981; Vlek et al., 1983).
In many cases the risk bearer is not the risk taker. Many studies
indicate that a better and more accepted decision can be reached
by involving the stakeholders (Smulders and Thijs, 2006; Renn,
2008). Many of these are less familiar with numbers than engi-
neers or economists. Discussions in qualitative terms may help to
98 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
VOSL
ethics
CBA
QRA
ALARP
Economy Industry
standards
Industry
ethics
Fig. 1. The forces around a hazardous activity.
build understanding about what the – unavoidable – numbers
actually mean.
In this context the use made of ALARP in the UK policy making
is not a bad idea at all. First a problem is analysed in quantitative
terms as far as possible, including what taking certain measures
mean in terms of the implied value given to a human life. Then
these numbers are combined with all the qualitative information
that is available and a decision is made.
For repetitive decisions such as allowing hazardous activities
near populated areas or exposing people to chemical or noise a
standard or limit can be set. Such a limit prevents the drift to dan-
ger (Rasmussen, 1997) caused by the continuous market pressure
to reduce costs. It also prevents malicious exposure of third parties
to risks that only benefit some and finally it prevents exposure to
risks of a small group ‘‘to the benefit of society’’ without proper
compensation.
9. The bottom line
The fusion of this all can best be described using a figure (Fig. 1).
An industrial activity is subject to many forces. One of these is the
legal requirement. In this respect the ‘‘lowest’’ level of safety cul-
ture on the ‘‘Hudson’’ maturity scale can also be seen as the bottom
line of obligations. Indeed making the lawyers happy is a minimum
requirement unless one wants to be a criminal. Showing that what
has been done in terms of safety is ALARP can be part of the reg-
ulation, but as long as there is no guidance this remains a matter
of opinion and therefor a matter of a power struggle between the
regulator and the regulated. As discussed before, this is more rele-
vant to common law than to Roman law. ALARP may be translated
to industry standards, by which the industry complies. This is usu-
ally by their-own volition, but sometimes also because the law can
demand it directly or, and while the authors are not aware of any
precedents, the regulation could define ALARP as the boundary for
reasonability.
emoons
Societal
demands
Performance
Risk criteria demands
Technical
ALARP
prescripons
Legal
requirements
Future
license to
operate
Client
demands reputaon
What is considered to be reasonable can be evaluated purely
qualitatively, but it is usually based on information on the resulting
risk derived from a quantitative risk analysis. Additionally infor-
mation can be made available on the costs and the balance
between costs and benefits. This information also drives the
demands of society in general. However since QRA and CBA are
supposed to be ‘‘factual’’ and ‘‘objective’’ there is not much room
for ethics in these exercises. Ethics and ‘‘emotions’’ are important
drivers for human behaviour and thus for society. Although deci-
sion makers sometimes try to objectify their decisions, it cannot
be ignored that politicians lean heavily on emotions during elec-
tion time. So unless one favours a technocratic dictatorship emo-
tions will be part of the decision making process, as Slovic and
others have shown over decades of research. Also Lord Cullen
and Prof. Uff (2001) conclude in the Southall and Ladbroke Grove
Joint Inquiry into Train Protection Systems that CBA is a factor to
take into account, but should not be the only factor. It is remarked
on the side that technocratic dictatorships seem to have a rela-
tively short life span, due to the same emotions and the sometimes
violent expression thereof. The resulting societal demands then
find their way into ALARP, into the regulatory framework and will
result at some point in the value attached to a human life in the
case under consideration.
10. Conclusion
In all cases QRA and CBA remain information and not overriding
criteria. The boundary conditions set in law are the only real limits.
The laws could set acceptable risk explicitly, but they do not have
to. If the level of acceptable risk is not explicitly set, the risk level
resulting from compliance to the regulations is just as accidental as
the VOSL found from ex-post evaluations of decisions.
What remains is that ALARP, QRA and CBA are part of the
grander scheme of making decisions. ALARP defines to a certain
extent what is done with the information gained by performing a
 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
QRA and a CBA, by specifying what is reasonable: whether the
costs should be equal to the benefits or disproportional costs are
reasonable until the disproportion is gross? This represents a re-
evaluation of the benefits, including the implied VOSL, making
ALARP and CBA the same.
How the responsible decisions-makers, be they in industry, in
government service, or in government office, utilise the informa-
tion that can be obtained from ALARP and CBA demonstrations will
be dependent on the general and specific contexts of each decision.
Unlike CBA are no hard and fast rules that define the process as to
how such decisions can be made. The manner in which ALARP and
CBA are utilised either individually or together can also be
expected to be context dependent, with the context being influ-
enced by prevailing political, social, economic and industrial condi-
tions. However, after an accident, and even if regulatory support
for the approach to safety has been obtained a-priori, the courts
can be expected to judge each case on its merits with each case
turning on the facts that are unique to that particular case.
Acknowledgement
The authors are grateful to Dr. James McQuaid, formerly Chief
Scientists and Director of Science and Technology at Her
Majesty’s Health and Safety Executive, for invaluable input,
comments and Discussions.
References
Ale, B.J.M., 2005. Tolerable or acceptable, a comparison of risk regulation in the UK
and in the Netherlands. Risk Anal. 25 (2).
ANCOLD, 1994, 2004. Australian National Committee on Large Dams, Guidelines on
Risk Assessment.
Bagnall, David, 2008. Letter to the Editor HSE Magazine March/April 2008.
BC Hydro, 1993. Interim Guidelines for Consequence-Based Dam Safety Evaluations
and Improvements, HED Report H2528.
Bedford, T., 2013. Decision making for group risk reduction: dealing with epistemic
uncertainty. Risk Anal. 33 (10), 1884–1898. http://dx.doi.org/10.1111/
risa.12047.
Blaeij, de A., 2003. The value of statistical life in road safety: a meta-analysis.
Accident Anal. Prev. 35, 973–986.
Blaeij, Arianne de, 2000. In: Florax, Raymond J.G.M., Rietveld, Piet, Verhoef, Erik
(Eds.), The Value of Statistical Life in Road Safety: A Meta-Analysis, TI 2000-089/
3 Tinbergen Institute Discussion Paper.
Bockarjova, M., Rietveld, P., Verhoef, E.T., 2008. Valuation of Flood Risk in the
Netherlands: Some Preliminary Results, ESREL 2008 & 17th SRA Conference,
22–25 September, Valencia, Spain.
Bockarjova, M., Rietveld, P., Verhoef, E., 2009a. First Results Immaterial Damage
Valuation: VOSL in Flood Risk Context – A Stated Preference Study (I).
Department of Spatial Economics, VU Amsterdam.
Bockarjova, M., Rietveld, P., Verhoef, E., 2009b. First Results Immaterial Damage
Valuation: Value of Statistical Life (VOSL) in Flood Risk Context and Value of
Travel Time Savings (VOT), A Stated Preference Study (II). Department of Spatial
Economics, VU Amsterdam.
Bockarjova, M., Rietveld, P., Verhoef, E., 2009c. First Results Immaterial Damage
Valuation: Value of Statistical Life (VOSL), Value of Evacuation (VOE) and Value
of Injury (VOI) in Flood Risk Context, a Stated Preference Study (III). Department
of Spatial Economics, VU Amsterdam.
Brown, A., Godson, J., 2004. An Interim Guide to Quantitative Risk Assessment for
UK Reservoirs. Institution of Civil Engineers.
Button, K., 1993. Overview of Internalising the Social Costs of Transport, OECD
ECMT Report.
CDA, 2007. Dam Safety Guidelines. Canadian Dam Association.
Cullen, Lord W., 2001. The Ladbroke Grove Rail Inquiry. Her Majesties Stationary
Office, Norwich, ISBN: 0 7176 2056 5.
Cullen, Lord, Uff, Prof John, 2001. The Southall and Ladbroke Grove Joint Inquiry into
Train Protection Systems. HMSO, Norwich, UK, ISBN: 0 7176 1998 2.
DEFRA, 2013. Guide to Risk Assessment for Reservoir Safety Management.
Department of Environment, Food and Rural Affairs. Environment Agency.
Deltares, 2011. Maatschappelijke kosten-baten analyse Waterveiligheid 21e eeuw
(Societal Cost Benefit Analysis Water Safety 21 Century) Deltares, 1204144-
006-ZWS-0012, 31 maart 2011.
DoT, 1995. Department of Transport. Mawhinney Endorses HSC View on Future of
Automatic Train Protection. DoT Press Notice 98, 30 March 1995.
Det Norsk Veritas (DNV), 2011. Verification for Compliance with UK Shelf Regulations,
Offshore Service Specification, DNV-OSS-202Ó. <http://www.dnv.com>.
99
Dolan, Paul, Metcalfe, Robert, Munro, Vicki, Christensen, Michael C., 2008. Valuing
lives and life years: anomalies, implications, and an alternative Health
Economics. Policy Law 3, 277–300 (ª Cambridge University Press 2008. http://
dx.doi.org/10.1017/S1744133108004507).
Evans, Andrew W., 1996. The economics of automatic train protection in Britain.
Transp. Policy 3 (3), 105–110.
Evans, A.W., 2005. Railway risks, safety values and safety costs. Proc. Inst. Civ. Eng.
Transp. 158 (TR1), 3–9 (February 2005).
Evans, Ron, 2008. Letter to the Editor HSE Magazine March/April 2008.
Evans, A.W., Verlander, N.Q., 1993. What is wrong with criterion FN-lines for
judging the tolerability of risk? Risk Anal. 17 (2), 157–168.
HeLsloot, I., 2012. Veiligheid als (bij)product (Safety as Byproduct). Oratie Radboud
Universiteit Nijmegen.
Helsloot, I., Pieterman, R., Hanekamp, J.V., 2010. Risico’s en Redelijkhed (Risk and
reasonability). Boom Juridische Uitgevers, ISBN: 978-90-8974-243-8.
Hidden, Anthony, 1989. Investigation into the Clapham Junction Railway Accident.
HMSO, London, ISBN: 0101082029.
HSC, 1999. <http://www.hse.gov.uk/consult/condocs/cd131.pdf> (as per 14.12.14).
HSE, 2001. Reducing Risk, Protecting People, Her Majesty’s Stationery Office,
Norwich NR3 1BQ, p. 36. ISBN: 0 7176 2151 0.
HSE, 2014a. <http://www.hse.gov.uk/risk/theory/alarpglance.htm?goback=%2Egde_
2315060_member_187907945#%21> (as per 16.09.14).
HSE, 2014b. Principles and Guidelines to Assist HSE in its Judgements that Duty-
holders have Reduced Risk as Low as Reasonably Practicable. <http://www.
hse.gov.uk/risk/theory/alarp1.htm>.
IENM, 2013. Letter of 26 April 2013 to the Parliament, Ministerie van Infrastructuur
IENM/BSK 2013/19920.
Loewen, Eric P., 2011. Is ALARA Reform Needed? Address to both Eastern
Washington and Trinity Sections of the American Nuclear Society on May 19
& 20, 2011. Remarks by Eric P. Loewen, Ph.D. Vice President/President Elect
American Nuclear Society.
Ministerie van Infrastructuur en Milieu, 2014. Deltaprogramma:
Synthesedocument deelprogramma Veiligheid, DG Ruimte en Water, Directie
Algemeen Waterbeleid en Veiligheid.
Morall, J.F., 1986. A review of the record. Regulation 10 (2), 1986.
MuConsult, B.V., 2014. Maatschappelijke Kosten-batenanalyse ERTMS Datum 12
maart 2014 Kenmerk IM035 (Societal Cost Benefit Analysis ERTMS, date 12
March 2014) Amersfoort.
Munger, D.F., Bowles, D.S., Boyer, D.D., Davis, D.W., Margo, D.A., Moser, D.A., Regan,
P.J., Snorteland, N., 2009. Interim tolerable risk guidelines for US army corps of
engineers dams. In: Proceedings of the Annual Meeting of the US Society on
Dams, Nashville.
Munson, L.H., 1988. (Chairman), Herrington, W.N., Higby, D.P., Kathren, R.L.,
Merwin, S.E., Stoetzel, G.A., Vallaria, E.J. DOE Project Manager, Health Physics
Manual Of Good Practices For Reducing Radiation, Exposure To Levels That Are
As Low As Reasonably Achievable (Alara) June 1988, Prepared for the U.S.
Department of Energy Assistant Secretary for Environment, Safety, and Health
under Contract DE-AC06-76RLO 1830.
NN, 1949. Edwards vs The National Coal Board (1949) 1 A11 ER 743.
NN, 1995. Externe, Externalities of Energy, vol. 2, Methodology, European
Commission EUR 16521 EN.
NN, 2014a. <http://en.wikipedia.org/wiki/Best_available_technology> (20140412).
NN, 2014b. <https://www.gov.uk/government/uploads/system/uploads/attachment_
data/file/244913/rrcgb2012-02.pdf> (as per 13.12.14).
NN, 2014c. <http://orr.gov.uk/__data/assets/pdf_file/0018/2547/rogs_2006_
consolidated_with_amendments.pdf> (as per 13.12.14).
Pikaar, M.J., Seaman, M.A., 1995. A Review of Risk Control, Report nr SVS 1994/27A.
Ministry of Housing Physical Planning and Environment, The Netherlands.
Rasmussen, J., 1997. Risk management in a dynamic society: a modeling problem.
Saf. Sci. 27 (2/3), 183–213.
Renn, O., 2008. Risk Governance. Coping with Uncertainty in a Complex World.
Earthscan, London, ISBN: 978010844-7-291-0.
Rothery, Dave, 2008. Letter to the Editor HSE Magazine March/April 2008.
RSSB, 2014a. Taking Safe Decisions, Rail Safety Standards Board.
RSSB, 2014b. Guidance on the Use of Cost-benefit Analysis When Determining
Whether a Measure is Necessary to Ensure Safety so far as is Reasonably
Practicable, Rail Safety Standards Board.
RVGZ, 2006. Zinnige en duurzame zorg (Sane and Sustainable Care). Raad voor de
Volksgezondheid en Zorg, Den Haag.
Slater, D., 1994. Private communication.
Slovic, P., Fischoff, B., Lichtenstein, S., Read, S., Combs, B., 1978. How safe is safe
enough, a psycho-metric study of attitudes towards technological risks and
benefits. Policy Sci. 8, 127–152.
Smulders, Y.M., Thijs, A., 2006. Kostprijs per gewonnen levensjaar: trends en
tegenstrijdigheden (Value per Lifeyear Gained, Trends and Contradictions) Ned
Tijdschr Geneesk. 2006 11 november, 150(45).
Snowy Mountains Engineering Corporation Limited, 1995. Final Report on the
Review of Headworks. Office of Water Reform (Department of Conservation and
Natural Resources), State of Victoria, Australia.
Tawney, R.H., 1926. Religion and the Rise of Capitalism. Penguin Books.
Tengs, T.O., Adams, M.E., Pliskin, J.S., Safran, D.G., Siegel, J.E., Weinstein, M., Graham,
J.D., 1995. Five hundred life saving interventions and their cost effectiveness.
Risk Anal. 15, 369–390.
The Supreme Court, 2011a. UKSC 17 on Appeal from [2009] EWCA Civ 499 dd 13
April 2011, nr. 214, p. 96.
100 B.J.M. Ale et al. / Safety Science 76 (2015) 90–100
The Supreme Court, 2011b. UKSC 17 on Appeal from [2009] EWCA Civ 499 dd 13
April 2011, nr. 184, p. 83.
TK, 1988. Omgaan met Risico’s, Tweede Kamer, vergaderjaar 1988–1989, 21137, nr.
5. Under the Same Number the Translation in English is Titled: Premises for Risk
Management TK (2001) Records of the Second Chamber of Parliament of the
Netherlands, year 2001–2003, 27603 nr. 52.
United Kingdom Government, 2005. The Offshore Installations (Safety Case)
Regulations 2005, Statutory Instrument 2005 No. 3117. The Stationary Office
Limited.
United States Bureau of Reclamation, 1986. Guidelines on Decision Analysis, ACER
Technical Memorandum No. 7, US Department of the Interior.
United States Bureau of Reclamation, 1997/2003. Guidelines for Achieving Public
Protection in Dam Safety Decision Making. US Department of the Interior.
Viscusi, W.K., Aldy, J., 2003. The value of a statistical life: a critical review of market
estimates throughout the world. J. Risk Uncertain. 27, 5–76.
Vlek, C.A.J., 1996. A multi-stage, multi-level and multi-attribute perspective on risk
assessment decision making and risk control. Risk Decis. Policy 1 (1996), 9–31.
Vlek, C., Stallen, P.-J., 1981. Judging risks and benefits in the small and in the large.
Organiz. Behav. Human Perform. 28 (2), 235–271.
Vlek, C.A.J., Stemerding, S., 1984. Beschrijving en beoordeling van risico’s verbonden
aan het gebruik van gevaarlijke stoffen. Deelrapport I. Probleemstelling,
projectoverzicht, samenvatting, conclusies en aanbevelingen (Description and
Judgement of Risks Associated with the Use of Hazardous Materials. Part 1,
Problem-Statement, Project Description, Summary, Conclusions and
Recommendations) IVEM-rapport nr. 3. Groningen 1984.
Vlek, C., Kuyper, H., Boer, H., 1983. Large-scale Risk as a Problem of Technological,
Psychological and Political Judgement, Environmental Impact Assessment,
Technology Assessment, and Risk Analysis. roc.