Background According to the National Inventory of Dams, as of January 2016 there  are approximately 90,500 dams in the United States and about 2.5  percent of these (approximately 2,100 dams) are associated with  hydropower projects. Hydropower projects are owned and operated by  both non-federal entities—such as private utility companies,  municipalities, and state government agencies—or federal government  agencies—primarily the U.S. Army Corps of Engineers (the Corps) and  the Bureau of Reclamation. Collectively, these dams associated with  hydropower projects account for about 8 percent of the total electric  generating capacity in the United States. Hydropower projects generally  consist of one or more dams and other key components associated with  hydroelectric power generation and water storage, and are uniquely  designed to accommodate watersheds, geology, and other natural  conditions present at the time of construction. These components  include both those that allow operators to adjust reservoir water levels,  such as spillways and gates, as well as those that produce and distribute  electricity, such as transmission lines and powerhouses, among others.  (See fig. 1.) The Federal Power Act provides for FERC’s regulatory jurisdiction over a  portfolio of about 1,000 non-federal hydropower projects comprising over  2,500 dams. While FERC does not construct, own, or operate dams, it  licenses and provides oversight of non-federal hydropower projects to  promote their safe operation. Licensees are responsible for the safety and  liability of dams, pursuant to the Federal Power Act, and for their  continuous upkeep and repair using sound and prudent engineering  practices. FERC officials in each of the agency’s five regional offices work  directly with licensees to help ensure these projects comply with licenses  and meet federal guidelines for dam safety. In addition, stakeholder  groups such as the Association of State Dam Safety Officials can assist  licensees in staying current on federal and state dam laws and  regulations, dam operations and maintenance practices, and emergency  action planning, among other things. FERC’s regulations, supplemented by its Operating Manual and  Engineering Guidelines, establish a framework for its dam safety  oversight approach. FERC’s Operating Manual provides guidelines for the  FERC staff performing inspections that are aimed at ensuring that  structures are safe, are being properly maintained, and are being  operated safely. FERC’s Engineering Guidelines provides FERC staff and  licensees with procedures and criteria for the review and analysis of  license applications, project modification proposals, technical studies, and  dam designs. For example, one chapter presents guidelines for FERC  staff to use to determine the appropriateness and level of geotechnical  investigations and studies for dams. The Engineering Guidelines states  that every dam is unique and that safety analysis of each dam require  that engineers apply technical judgement based on their professional  experience. As part of FERC’s safety oversight approach, it assigns a hazard  classification to each dam in accordance with federal guidelines that  consider the potential human or economic consequences of the dam’s  failure. The hazard classification does not indicate the structural integrity  of the dam itself, but rather the probable effects if a failure should occur.  Depending on the hazard classification, the extent of and the frequency of  safety oversight activities can vary. Low hazard dams are those where failure —an uncontrolled release  of water from a water-retaining structure—would result in no probable  loss of human life but could cause low economic and/or environmental  losses. Significant hazard dams are those dams where failure would result in  no probable loss of human life, but could cause economic loss,  environmental damage, or other losses. High hazard dams are those dams where failure would probably  cause loss of human life. FERC has designed a multi-layered oversight approach that involves both  independent and coordinated actions with dam owners and independent  consultants. Key elements of this approach include ensuring licensees  have a safety program in place, conducting regular safety inspections,  reviewing technical analyses, and analyzing safety as a part of project  relicensing. (See fig. 2.) Licensee’s dam safety program. According to FERC guidance,  licensees have the most important role in ensuring dam safety  through continuous visual surveillance and ongoing monitoring to  evaluate the health of the structure. Beyond this expectation for  continuous oversight, FERC requires licensees of high and significant  hazard dams to have an Owner’s Dam Safety Program. FERC dam safety inspection. The dam safety inspection, also called  operation inspection, is a regularly-scheduled inspection conducted by  a FERC regional office project engineer primarily addressing dam and  public safety. FERC’s Operating Manual establishes the frequency  that a FERC engineer conducts dam safety inspections. Independent consultant inspection and potential failure mode  analysis. FERC requires licensees to hire a FERC-approved  independent consulting engineer to inspect and evaluate high hazard  dams and certain types of dams above a certain height or size and  submit a report detailing the findings. Additionally, FERC requires  the licensee of a high or significant hazard dam to conduct a potential  failure mode analysis. A potential failure mode analysis is an  exercise to identify and assess all potential failure modes under  normal operating water levels and under extreme conditions caused  by floods, earthquakes, and other events. FERC relicensing of projects. FERC issues hydropower licenses for  the construction of new hydropower projects, and reissues licenses  for existing projects when licenses expire. Licensees may submit  applications for a new license for the continued operation of existing  projects as part of a process known as relicensing. During relicensing,  in addition to the power and development purposes for which FERC  issues licenses, FERC must evaluate safety, environmental,  recreational, cultural, and resource development among other factors  when evaluating projects, according to its guidance. In addition, FERC requires licensees to conduct various engineering  studies related to dam performance in accordance with FERC safety  requirements. Required engineering studies focus on dam performance  as affected by hydrology, seismicity, and dam stability. Licensees may  also produce engineering studies, such as a focused spillway  assessment, for their own operations or at the request of FERC. FERC Staff Collect  Safety Information  during Inspections of  Individual Dams, but  FERC Has Not  Analyzed Dam Safety  across Its Entire  Portfolio FERC Staff Generally  Followed Guidance to  Collect Information during  Safety Inspections of  Individual Dams That We  Reviewed but Have  Inconsistently Recorded  Such Information  Information Collection We found, based on our analysis of the 42 dam safety inspections we  reviewed, that FERC staff generally conducted and collected information  from these inspections consistent with guidance in its Operating Manual.  According to FERC’s Operating Manual, staff’s approach to conducting  these inspections and collecting information is to include preparing for the  inspection by reviewing documents, conducting a field inspection of the  dam and associated project components, and discussing inspection  findings with licensees and with FERC supervisors. Preparation for inspection: We found that FERC staff generally met  document review requirements in preparation for safety inspections of  the 42 dams we reviewed. (See table 1.) According to the Operating  Manual, FERC staff are to review safety-related information contained  in documents such as potential failure mode analyses and hazard  potential classifications. For example, we found that staff documented  their review of the most recent independent consultant inspection  report and potential failure mode analysis for each of the 16 high  hazard dams we reviewed. FERC staff told us that they generally  used checklists when preparing for these inspections. For example,  some of the staff told us they tailor the checklist included in the  Operating Manual, based on the dam’s type, characteristics, and  hazard classification. Additionally, for each of the dams in our sample,  staff stated that they prepared for the inspection by reviewing prior  inspection reports and recommendations. Field inspection: We found that FERC staff generally met  requirements for reviewing project components and documenting their  findings from field inspections of the 42 dams we reviewed. (See table  2.) According to the Operating Manual, FERC staff are to conduct  visual inspections of the dam, typically alongside the licensee, to  assess the dam and project components by observing their condition  and identifying any safety deficiency or maintenance requirement.  Also during the inspection, FERC staff are to compare current  conditions of the dam and project components to those described in  prior inspection reports, and as applicable, collect information on the  licensee’s progress towards resolving deficiencies and maintenance  issues that can affect safety. To assess safety, FERC staff we  interviewed stated that they primarily rely on their engineering  judgment. Inspection findings: According to our interviews with FERC staff from  selected projects, we found that staff generally followed FERC  guidance in discussing inspection findings with licensees and  supervisors prior to preparing inspection reports to document their  findings. According to the Operating Manual, following the dam safety  inspection, FERC staff are to discuss the inspection with the licensee,  giving direction on how to address any findings. Additionally, upon  returning to the office, staff are to discuss inspection findings with their  supervisors who may suggest additional actions. FERC staff are  then to develop a dam safety inspection report that documents  observations and conclusions from their pre-inspection preparation  and their field inspection and identifies follow-up actions for the  licensee. We found that FERC staff prepared inspection reports to  document findings from the 42 dam safety inspections we reviewed.  In response to inspection findings, FERC requires licensees to submit  a plan and schedule to remediate any deficiency, actions that FERC  staff then reviews, approves, and monitors until the licensees have  addressed the deficiency. Information Recording While we found that FERC staff conducted inspections and collected  inspection findings consistently in the files we reviewed, FERC’s  approach to recording information varies across its regions, thus limiting  the usefulness of the information. FERC’s approach to recording  inspection information relies on multiple systems to record inspection  information and affords broad discretion to its staff on how to characterize  findings, such as whether to track inspection findings as maintenance  issues or as safety deficiencies. As related to systems for recording inspection information, FERC staff  use the Data and Management System (DAMS), the Office of Energy  Projects-IT (OEP-IT) system, as well as spreadsheets. In particular,  according to FERC staff: Four out of FERC’s five regional offices use DAMS—which is primarily  a workload tracking tool—to track plans and schedules associated  with safety investigations and modifications as well as inspection  follow-up items. FERC staff stated that since the inspection  information in DAMS is recorded as narrative text in a data field  instead of as discrete categories, sorting or analysis of the information  is difficult. One regional office uses OEP-IT to track safety deficiencies while the  system is more widely used across FERC to track licensees’  compliance with the terms and conditions of their licenses. Three out of FERC’s five regional offices also use spreadsheets and  other tools that are not integrated with DAMS or OEP-IT to track  inspection information and licensee progress toward resolving safety  deficiencies. FERC staff said that use of these different systems to record deficiencies  identified during inspections limits their ability to analyze safety  information. For example, according to FERC officials, OEP-IT was not  designed to track safety deficiency information and is not compatible with  DAMS for use in tracking information on a national level. Furthermore,  because spreadsheets and other tools are specific to the regional office in  which they are used, FERC staff does not use the information they  contain for agency-wide analysis. Concerning decisions on how to characterize inspection findings, FERC  staff relies on professional judgment, informed by their experience and  the Engineering Guidelines, to determine whether to track inspection  findings as a safety deficiency or as a maintenance item, according to  FERC officials. With input from their supervisors, FERC staff also  determines what information to record and how to track the status of the  inspection finding. For example, staff assigned to a dam at a FERC- licensed project in New Hampshire observed concrete deterioration on  several parts of the dam and its spillway and asked the licensee to  monitor all concrete surfaces, making repairs as necessary. According to  staff we interviewed, regional staff and supervisors decided not to identify  this as a deficiency to be tracked in DAMS because concrete  deterioration is normal and to be expected in consideration of the area’s  harsh winter weather. In contrast, staff assigned to a dam at a FERC- licensed project in Minnesota observed concrete deterioration on several  parts of the project, including the piers and the powerhouse walls, and  entered the safety item in DAMS as requiring repair by the licensee.  FERC officials stated they are comfortable with the use of professional  judgement to classify and address inspection findings because it is  important to allow for consideration of the characteristics unique to each  situation and how they affect safety. FERC’s approach to recording inspection information is inconsistent  because FERC has not provided standard language and procedures  about how staff should record and track deficiencies including which  system to use. Federal standards for internal control state that agencies  should design an entity’s information system and related control activities  to achieve objectives and control risks. In practice, this means that an  agency would design control activities—such as policies and  procedures—over the information technology infrastructure to support the  completeness, accuracy, and validity of information processing by  information technology. FERC officials acknowledged that there are  inconsistent approaches in where and how staff record safety deficiency  information, approaches that limit the information’s usefulness as an input  to its oversight. While the agency has not developed guidance, officials  stated that FERC plans to take steps to improve the consistency of  recorded information by replacing the OEP-IT system with a new system,  tentatively scheduled for September 2018, that will have a specific  function to track dam safety requirements. However, this new system will  not replace the functions of DAMS, which FERC will continue to use to  store inspection information. The two will exist as parallel systems with  the eventual goal of the two systems’ sharing information. By developing  standard language and procedures to standardize the recording of  information collected during inspections, FERC officials could help ensure  that the information shared across these systems is comparable, steps  that would allow FERC to identify the extent of and characteristics  associated with common safety deficiencies across its entire portfolio of  regulated dams. Moreover, with a consistent approach to recording  information from individual dam safety inspections, FERC will be  positioned to proactively identify comparable safety deficiencies across its  portfolio and to tailor its inspections towards evaluating them. FERC Has Not Used  Inspection Information to  Fully Assess Safety Risks  across Its Regulated  Portfolio of Dams While FERC uses inspection information to monitor a licensee’s efforts to  address a safety deficiency for an individual dam, FERC has not analyzed  information collected from its dam safety inspections to evaluate safety  risks across the entire regulated portfolio of dams. For example, FERC  has not reviewed inspection information to identify common deficiencies  among certain types of dams. Federal standards for internal control state  that agencies should identify, analyze, and respond to risks related to  their objectives. These standards note that one method for management  to identify risks is the consideration of deficiencies identified through  audits and other assessments. Dam safety inspections are an example of  such an assessment. As part of such an approach, the agency analyzes  risks to estimate their significance, which provides a basis for responding  to the risk through specific actions. Furthermore, in our previous work on  federal facilities, we have identified that an advanced use of risk  management involving the ability to gauge risk across a portfolio of  facilities could allow stakeholders to comprehensively identify and  prioritize risks at a national level and direct resources toward alleviating  them. FERC officials stated that they have not conducted a portfolio-wide  analysis in part due to the inconsistency of recorded inspection data and  because such an evaluation has not been a priority compared to  inspecting individual dams. According to officials, the FERC headquarters  office collects and reviews information semi-annually from each of its five  regional offices on the progress of outstanding dam investigations and  modifications in those regions. FERC’s review is designed to monitor  the status of investigations on each individual dam but does not analyze  risks across the portfolio of dams at the regional or national level. For  example, officials from the New York Regional Office stated they do not  perform trend analysis across the regional portfolio of dams under their  authority, but they compile year-to-year data for each separate dam to  show any progression or changes from previous data collected from  individual dams. A portfolio-wide analysis could help FERC proactively identify safety risks  and prioritize them at a national level. FERC officials stated that a  proactive analysis of its portfolio could be useful to determining how to  focus its inspections to alleviate safety risks, but it was not an action that  FERC had taken to date. The benefits of a proactive analysis, for  example, could be similar to those FERC derived from the analysis it  conducted in reaction to the Oroville Dam incident. To conduct this  analysis, FERC required 184 project licensees, identified by FERC  regional offices as having spillways similar to the failed spillway at the  Oroville Dam, to assess the spillways’ safety and capacity. According to  FERC officials, these assessments identified 27 dam spillways with  varying degrees of safety concerns. They stated that FERC’s spillway  assessment initiative was a success because they were able to target a  specific subgroup of dams within the portfolio and identify these safety  concerns at 27 dam spillways. FERC officials stated that they are working  with the dam licensees to address these safety concerns. A similar and  proactive approach based on analysis of common deficiencies across the  portfolio of dams under FERC’s authority could also help to identify any  safety risks that may not have been targeted during the inspections of  individual dams and prior to a safety incident. FERC Applies Agency  Guidance and Uses  Professional  Judgment to Analyze  Engineering Studies  of Dam Performance  and Evaluate Safety Licensees and Their  Consultants Develop the  Engineering Studies Used  to Assess Dam  Performance As directed by FERC, licensees and their consultants develop and  review, or update, various engineering studies related to dam  performance to help ensure their dams meet FERC requirements and  remain safe. FERC regulations and guidelines describe the types and  frequency of studies and analyses required based on dams’ hazard  classifications. For all high hazard and some significant hazard dams,  existing studies are to be reviewed by each licensee’s consultants every 5  years, as part of the independent consultant inspection and  accompanying potential failure mode analysis. According to FERC  officials, for those significant hazard dams that do not require an  independent consultant inspection and for low hazard dams, FERC’s  regulations and guidelines do not require any studies, but in practice  FERC directs many licensees to conduct them. FERC also may request  engineering studies in response to dam safety incidents at other projects,  or engage a board of consultants to oversee the completion of a study.  For example, as previously noted, following the Oroville Dam incident in  2017, FERC requested a special assessment of all dams with spillways  similar to the failed spillway at the Oroville Dam. To develop these studies, all six of the consultants we interviewed stated  that they follow guidelines provided by FERC and other dam safety  agencies. Specifically, they stated that they use FERC’s Engineering  Guidelines, which provide engineering principles to guide the  development and review of engineering studies. In recognition of the  unique characteristics of each dam, including its construction, geography,  and applicable loading conditions, the Guidelines provides consultants  with flexibility to apply engineering judgment, and as a result, the  approach that licensees and their consultants use and the focus of their  reviews of engineering studies may vary across regions or projects. For  example, one independent consultant we interviewed noted that  seismicity studies are not highlighted during the independent consultant  inspections for projects in the Upper Midwest in comparison to projects in  other areas of the country because the region is not seismically active,  but that inspections do look closely at ice loads during the winter months. To create these studies, we found that licensees and their consultants  generally use data from other federal agencies and rely on available  modeling tools developed by federal agencies and the private sector to  evaluate dam performance. For example, many of the engineering  studies we reviewed rely on data from the National Weather Service and  the National Oceanic and Atmospheric Administration to estimate  precipitation patterns and the U.S. Geological Survey to estimate seismic  activity. In addition, licensees and their consultants use modeling tools  and simulations, such as those developed by the Corps to estimate  hydrology, to develop engineering studies. FERC staff noted that the engineering studies developed by licensees  and their consultants generally focus on the analysis of extreme events,  such as earthquakes and floods. In reference to extreme events, FERC  staff said that both actual past events and likely future events are  considered in determining their magnitude. FERC staff noted the probable  maximum flood—the flood that would be expected to result from the most  extreme combination of reasonably possible meteorological and  hydrological conditions—as an example of a dam design criterion that is  based on application of analysis of extreme events. In describing the  efficacy of probable maximum flood calculations, FERC officials stated  that they had not observed a flood that exceeded the probable maximum  flood calculated for any dam and noted that their Engineering Guidelines  provides a conservative approach to estimating the probable maximum  flood and other extreme events. FERC officials stated that requiring a  conservative approach to estimating extreme events helps to mitigate the  substantial uncertainty associated with these events, including in  consideration of emerging data estimating the effects of climate change  on extreme weather events. Once developed, engineering studies we reviewed often remained in  effect for a number of years, until FERC or the licensee and its consultant  determined an update was required. For example, we found that the  hydrology studies were 20 years or older for 17 of the 42 dams in our  review, including for 9 of the 16 high hazard dams in our sample. FERC’s  Engineering Guidelines states that studies should be updated as  appropriate. For example, FERC’s Engineering Guidelines on hydrology  studies state that previously accepted flood studies are not required to be  reevaluated unless it is determined that a re-analysis is warranted. The  Guidelines notes that FERC or the consultant may consider reanalyzing  the study for several reasons, including if they identify (1) significant  errors in the original study; (2) new data that may significantly alter  previous study results; or (3) significant changes in the conditions of the  drainage basin. FERC staff and consultants we interviewed stated that  age alone is not a primary criterion to update or replace studies and that  studies should be updated as needed depending on several factors  including age, new or additional data, and professional judgment. Consultants we interviewed identified some limitations that can affect their  ability to develop engineering studies for a dam. For example, they noted  that some dams may lack original design information, used prior to  construction of the dam, which includes the assumptions and calculations  used to determine the type and size of dam, the amount of water storage  capacity, and information on the pre-construction site geology and  earthquake potential. FERC officials estimated that for a large percentage  of the dams they relicense, the original information is no longer available.  For example, according to the report from the independent forensic team  investigating the Oroville Dam incident and as previously noted, some  design drawings and construction records for the dam’s spillway could not  be located and some other documents that were available were not  included in the most recent independent consultant inspection report  submitted to FERC. To overcome the lack of original design information,  FERC told us that licensees and their consultants may use teams of  experts, advanced data collection techniques, and other modern  methods, where feasible, to assess the dam’s ability to perform given  current environmental conditions. In cases where design or other  engineering information is incomplete, consultants stated that they  generally recommend the licensee conduct additional studies based on  the risk presented by the missing information but also noted that the  financial resources of a licensee may affect its willingness and ability to  conduct additional studies. However, FERC officials stated that FERC  staff are ultimately responsible for making decisions on whether additional  engineering studies are needed to evaluate a dam’s performance. FERC’s Staff Reviews of  Engineering Studies of  Dam Performance Are  Based on Its Engineering  Guidance, and  Professional Judgment  Informs Aspects of Its  Safety Oversight Approach FERC has established policies and procedures that use formal guidance,  and permit the use of professional judgment, to evaluate and review  engineering studies of dam performance submitted by licensees and their  consultants. FERC officials in both the headquarters and regional  offices emphasized that their role as the regulator is to review and  validate engineering studies developed by the licensee and their  consultants. FERC generally does not develop engineering studies as  officials noted that dam safety, including the development of engineering  studies, is primarily the licensee’s responsibility. To carry out their responsibility to ensure public safety, FERC staff stated  they use procedures and criteria in the FERC Engineering Guidelines to  review engineering studies and apply professional judgment to leverage  their specialized knowledge, skills, and abilities to support their  determinations of dam safety. FERC’s Engineering Guidelines provides a  framework for the review of engineering studies, though the Guidelines  recognizes that each dam is unique and allows for flexibility and  exemptions in their use. Moreover, the Guidelines notes that analysis of  data is useful when evaluating a dam’s performance, but should not be  used as a substitute for judgment based on experience and common  sense. Because FERC’s Engineering Guidelines allows for the application of  professional judgment, the methods used to review these studies vary  depending on the staff, the region, and individual dam characteristics. For  example, FERC staff said that when they review consultants’  assumptions, methods, calculations and conclusions, in some cases they  may decide to conduct a sensitivity analysis if—based on the staff’s  judgment—they need to take additional steps to validate or confirm  factors of safety for the project. FERC officials also stated that staff may conduct their own independent analyses, as appropriate, such as  evaluating a major structural change to the dam or validating submitted  studies. For example, as part of its 2016 review of the Union Valley Dam  in California, FERC staff validated the submitted hydrology study by  independently calculating key inputs, such as precipitation rates and peak  floods, to evaluate the dam’s performance and verify the spillway’s  reported capacity. In addition, FERC has established various controls to help ensure the  quality of its review, including using a risk-based review process,  assigning multiple staff to review the studies, and rotating staff  responsibilities over time. We have previously found in our reporting on  other regulatory agencies that practices such as rotating staff in key  decision-making roles, and including at least two supervisory staff when  conducting oversight reviews help reduce threats to independence and  regulatory capture. Risk-based review process. FERC’s review approach is risk-based, as  the frequency of staff’s review of these studies is based on the hazard  classification of the dam as well as professional judgment. FERC  relies on three primary engineering studies (hydrology, seismicity, and  stability), and others as appropriate, which form the basis for  determining if a dam is safe. In addition, FERC requires licensees to  hire a FERC-approved independent consulting engineer at least every  5 years to inspect and evaluate high hazard and other applicable  dams and submit a report detailing the findings as part of the  independent consultant inspection process. In general, for the dams  we reviewed, we found that FERC staff reviewed engineering studies  for dams subject to independent consultant inspections (which are  typically high or significant hazard dams) more frequently than those  engineering studies associated with dams for which FERC does not  require an independent consultant inspection (typically low hazard  dams). For example, we found FERC staff had reviewed the most  recent hydrology studies for all 22 high and significant hazard dams in  our sample subject to independent consultant inspections within the  last 6 years and documented their analysis. According to FERC  officials, for dams not subject to an independent consultant inspection,  FERC staff review engineering studies on an as needed basis,  depending on whether the underlying assumptions and information  from the previous studies are still relevant. For example, for the 20  dams in our study not subject to an independent consultant  inspection, we found that most (15) of these studies were reviewed by  FERC within the past 10 years, usually during the project’s  relicensing. Multiple levels of supervisory review. As part of FERC’s quality control  and internal oversight process, multiple FERC staff are to review the  studies produced by the licensee and its consultant, with the number  of successive reviews proportional to the complexity or importance of  the study, according to FERC officials. FERC’s Operating Manual  establishes the general procedure for the review of engineering  studies. To begin the review process, the staff assigned to a dam is to  review the engineering study and prepares an internal memo on its  findings; that memo is then to be reviewed for accuracy and  completeness by both a regional office Branch Chief, and the  Regional Engineer. If necessary, Washington, D.C., headquarters  office staff are to review and approve the final memo. Upon  completion of review, FERC staff are to provide a letter to the licensee  indicating any particular areas where additional information is needed  or where more studies are needed to evaluate the dam’s  performance. According to FERC officials, each level of review adds  successive quality control steps performed by experienced staff. We  have previously found in reporting on other regulatory agencies that  additional levels of review increases transparency and accountability  and diminishes the risk of regulatory capture. Rotation of FERC staff responsibilities. As part of an internal quality  control program to help minimize the risk of missing important safety- related items, FERC officials told us they rotate staff assignments and responsibilities approximately every 3 to 4 years. According to FERC  officials, this practice decreases the chance that a deficiency would be  missed over time due to differences in areas of engineering expertise  between or among staff. We have previously found in our reporting on  other regulatory agencies that strategies such as more frequently  rotating staff in key roles can help reduce the risk to supervisory  independence and regulatory capture. Some FERC regional offices have developed practices to further enhance  their review of these studies. For example, the New York Regional Office  established a subject matter expert team that helps review dams with  unusually complex hydrology issues. This team was created, in part,  because FERC staff noted that some of the hydrology studies conducted  in the 1990s and 2000s were not as thorough as they would have wanted,  and warranted a re-examination. Currently, the New York Regional Office  is reviewing the hydrology analysis associated with 12 dam break studies  to determine if the hydrology data used in developing these studies were  as rigorously developed and validated. According to the FERC staff in  this office, utilizing a team of subject matter experts has reduced Regional  Office review time and improved the hydrology studies’ accuracy. FERC  staff in the New York Regional Office also told us that they are working  with other regional offices on setting up similar technical teams. For  example, FERC staff in the New York Regional Office have been working  with the Portland Regional Office to set up a similar team. FERC procedures require the use of engineering studies at key points  over the dam’s licensing period to inform components of its safety  oversight approach, including during the potential failure mode analyses  of individual dams as well as during relicensing. Potential failure mode analysis. The potential failure mode analysis is  to occur during the recurring independent consultant inspection and is  conducted by the licensee’s independent consultant along with other  key dam safety stakeholders. As previously explained, the analysis  incorporates the engineering studies and identifies events that could  cause a dam to potentially fail. During the potential failure mode  analysis, FERC, the licensee, the consultant, and other key dam  safety stakeholders are to refer to the engineering studies to establish  environmental conditions that inform dam failure scenarios, the risks  associated with these failures, and their consequences for an  individual dam. Further, according to a FERC white paper on risk  analysis, FERC is beginning to use information related to potential  failure modes as inputs to an analysis tool that quantifies risks at each  dam. With this information, FERC expects to make relative risk  estimates of dams within its inventory and establish priorities for  further study or remediation of risks at individual dams, according to  the white paper. Relicensing. During relicensing, FERC staff are to review the  engineering studies as well as information such as historical  hydrological data and extreme weather events, which also inform their  safety evaluation of the licensee’s application. FERC officials also  stated that as a result of their relicensing review, they might alter the  articles of the new license before it is issued should their reviews  indicate that environmental conditions affecting the dam’s safety have  changed. FERC Summarizes  Information from  Required Sources to  Evaluate Dam Safety  during Relicensing We found that FERC generally met its requirement to evaluate dam  safety during the relicensing process for the 42 dams we reviewed.  During the relicensing process, we found that for the dams we reviewed,  FERC staff review safety information such as the past reports,  inspections, and studies conducted by FERC, the licensee, and  independent consultants and determine whether or not a dam owner  operated and maintained its dam safely. According to FERC staff, the  safety review for relicensing is generally a summary of prior safety and  inspection information, rather than an analysis of new safety information,  unless the licensee proposes a change to the operation or structure. FERC’s review during relicensing for the high hazard and significant  hazard dams we reviewed was generally consistent with its guidance and  safety memo template, though the extent of its review of low hazard dams  varied. (See fig. 3.) For example, for the 22 high and significant hazard  dams we reviewed, the safety relicensing memos followed the template  and nearly all included summaries of hydrology studies, stability analyses,  prior FERC inspections, and applicable independent consultant reports.  For the 20 low hazard dams, FERC staff noted that some requirements in  the template are not applicable or have been exempted and therefore  were not reviewed during relicensing. While low hazard dams were  more inconsistently reviewed during relicensing, FERC staff also noted  that there has been a recent emphasis to more closely review, replace, or  conduct engineering studies, such as the stability study, for low hazard  dams during relicensing. Moreover, FERC staff told us that the safety  risks associated with these dams are minimal, as the failure of a low  hazard dam, by definition, does not pose a threat to human life or  economic activity. According to FERC staff, if a licensee proposed altering the dam or its  operations in any way as part of its application for a new license, FERC  staff would review the proposed change and may recommend adding  articles to the new license prior to its issuance to ensure dam safety.  FERC officials noted that, as part of their review, any structural or  operational changes proposed by the licensee during relicensing are  reviewed by FERC. These officials also noted that FERC generally  recommends modifications to the licensees’ proposed changes prior to  their approval and inclusion in the new license. However, FERC officials  noted that, in some cases, additional information is needed prior to  approving the structural or operational change to ensure there are no  risks posed by the changes. In those instances, FERC may recommend  that articles be added to the new license, that require the licensee to  conduct additional engineering studies of the issue and submit them to  FERC for review and approval. For example, during the relicensing of the  Otter Creek project in Vermont in 2014, the licensee proposed changes to  the project’s operation resulting from construction. As a result, FERC’s  staff recommended adding a number of articles to the license, including  that the licensee conduct studies to evaluate the effect of the change on  safety and to ensure safety during construction. During relicensing, third parties—such as environmental organizations,  nearby residents and communities, and other federal agencies, such as  the U.S. Fish and Wildlife Service—may provide input on various topics  related to the project, including safety. However, FERC officials said that  very few third parties file studies or comments related to dam safety  during relicensing. FERC’s template and guidance do not specifically  require the consideration of such analyses as part of its safety review,  and we did not identify any safety studies submitted by third parties for  dams or reviewed by FERC in our sample. According to FERC officials,  when stakeholders submit comments during relicensing, the comments  tend to focus on environmental aspects of the project, such as adding  passages for fish migration. Further, FERC is not required under the  Federal Power Act to respond to any comments, including those related  to dam safety, from third parties, according to FERC officials. However,  according to FERC officials, courts have held that the Administrative  Procedure Act precludes an agency from arbitrarily and capriciously  ignoring issues raised in comments. Furthermore, these officials stated  that if a court determines that FERC did not sufficiently address issues  raised during the relicensing process, its orders are subject to being  reversed and remanded by applicable United States courts of appeals.  Moreover, FERC officials noted that the information needed to develop  third party safety studies, such as the dam design drawings and  engineering studies, are property of the licensee, rather than FERC. In addition, this information may not be readily available to third parties or  the public if FERC designates it as critical energy infrastructure  information, which would preclude its release to the general public. FERC staff we interviewed stated that there have been no instances  where the Commission denied a new license to a licensee as a result of  its safety review during relicensing. FERC staff stated that given the  frequency of other inspections, including the FERC staff inspections, and  independent consultant inspections, it is unlikely staff would find a  previously unknown major safety issue during relicensing. FERC staff told  us that rather than deny a license for safety deficiencies, FERC will keep  a dam owner under the terms of a FERC license to better ensure the  licensee remedies existing safety deficiencies. Specifically, FERC staff  noted that under a license, FERC can ensure dam safety by (1) closely  monitoring the deficiency’s remediation progress through its inspection  program, (2) adding license terms in the new license tailored to the  specific safety deficiency, and (3), as necessary, pursuing compliance  and enforcement actions, such as civil penalties or stop work orders, to  enforce the terms and conditions of the license. For example, prior to  and during the relicensing of a FERC-licensed project in Wisconsin in  2014, FERC’s review identified that the spillway capacity was inadequate.  While the project was relicensed in 2017 without changes to the spillway,  FERC officials stated that they have been overseeing the plans and  studies of the remediation of the spillway through their ongoing inspection  program. However, if an imminent safety threat is identified during the  relicensing review, FERC officials stated that they will order that the  licensee take actions to remedy the issue immediately. Moreover, FERC  officials noted that, if necessary, a license can be revoked for failure to  comply with the terms of its license. Conclusions FERC designed a multi-layered safety approach—which uses  inspections, studies, and other assessments of individual dams—to  reduce exposure to safety risks. However, as the spillway failure at the  Oroville Dam project in 2017 demonstrated, it is not possible to eliminate  all uncertainties and risks. As part of a continuing effort to ensure dam  safety at licensed projects, FERC could complement its approach to  evaluating the safety of individual dams by enhancing its capability to  assess and identify the risks across its portfolio of licensed dams.  Specifically, while FERC has collected and stored a substantial amount of  information from its individual dam safety inspections, FERC’s approach  to recording this information is inconsistent due to a lack of standard  language and procedures. By clarifying its approach to the recording of  information collected during inspections, FERC officials could help ensure  that the information recorded is comparable when shared across its  regions. Moreover, the absence of standard language and procedures to  consistently record inspection information impedes a broader, portfolio- wide analysis of the extent of and characteristics associated with common  safety deficiencies identified during FERC inspections. While FERC has  not yet conducted such an analysis, a proactive assessment of common  safety inspection deficiencies across FERC’s portfolio of licensed dams— similar to its identification of dam spillways with safety concerns following  the Oroville Dam incident—could help FERC and its licensees identify  safety risks prior to a safety incident and to develop approaches to  mitigate those risks. Recommendations for  Executive Action We are making the following two recommendations to FERC: FERC should provide standard language and procedures to its staff  on how to record information collected during inspections, including  how and where to record information about safety deficiencies, in  order to facilitate analysis of safety deficiencies across FERC’s  portfolio of regulated dams. (Recommendation 1) FERC should use information from its inspections to assess safety  risks across its portfolio of regulated dams to identify and prioritize  safety risks at a national level. (Recommendation 2) Agency Comments We provided a draft of this report to FERC for review and comment. In its  comments on the draft report, FERC said it generally agreed with the  draft report’s findings and found the recommendations to be constructive.  FERC said that it would direct staff to develop appropriate next steps to  implement GAO’s recommendations. These comments are reproduced in  appendix IV. In addition, FERC provided technical comments, which we  incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Chairman of FERC  and other interested parties. In addition, the report will be available at no  charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact  me at 202-512-2834 or vonaha@gao.gov. Contact points for our Office of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix V. Appendix I: Summary of the Federal Energy  Regulatory Commission’s Actions to Help  Ensure Licensee Compliance with  Requirements Related to Dam Safety FERC seeks to ensure licensees’ compliance with FERC regulations and  license requirements, including remediating safety deficiencies, by using  a mix of preventative strategies to help identify situations before they  become problems and reactive strategies such as issuing penalties. As  part of its efforts, FERC published a compliance handbook in 2015 that  provides an overall guide to compliance and enforcement of a variety of  license requirements, including dam safety. The handbook includes  instructions for implementing FERC rules, regulations, policies, and  programs designed to ensure effective compliance with license  conditions, which include dam safety, to protect and enhance beneficial  public uses of waterways. FERC developed a range of enforcement  actions, that include holding workshops to encourage compliance and  issuing guidance, that increase in severity depending on the non- compliance issue. (See fig. 4.) More broadly, FERC’s guidance directs  officials to determine enforcement actions and time frames for those  actions on a case-by-case basis, depending on the characteristics of the  specific compliance issue. According to FERC officials, many of these safety compliance  discussions are handled informally. In addition, their compliance  approach emphasizes activities that assist, rather than force, licensees to  achieve compliance, according to its guidance. These activities include  facilitating open lines of communication with licensees, participating in  technical workshops, and publishing brochures and guidance documents,  among other efforts. Also, according to these officials, FERC works with  licensees to provide guidance and warnings of possible non-compliance  matters, in order to avoid usage of any enforcement tools, if possible.  According to FERC officials, any safety issues that endanger the public  will result in immediate penalty or removal of the dam from power  generation, but this action is not lightly taken. Additionally, the length of  time between when a safety deficiency is identified and is resolved varies  substantially depending on the specific project. As stated earlier in this  report, FERC works with licensees to determine a plan and schedule for  investigating safety issues and making any needed modifications.  However, FERC officials stated that the majority of safety compliance  issues are resolved within a month. However, FERC officials stated that if a licensee repeatedly does not take  steps to address a compliance issue, FERC will explore enforcement  actions through a formal process. According to officials, FERC’s  enforcement options are based on authorities provided under the Federal  Power Act and such options are flexible because of the variation in  hazards, consequences, and dams. According to FERC officials, to  ensure compliance with safety regulations, if a settlement cannot be  reached, FERC may, among other things, issue an order to show cause,  issue civil penalties in the form of fines to licensees, impose stop work or  cease power generation orders, revoke licenses, and seek injunctions in  federal court. Nevertheless, FERC officials stated that there is no  specific requirement for how quickly the compliance issues or deficiencies  should be resolved and that some issues can take years to resolve. For  example, in 2004, the current licensee of a hydroelectric project operating  in Edenville, Michigan, acquired the project, which was found by FERC to  be in a state of non-compliance at that time. FERC staff made numerous  attempts to work with the licensee to resolve the compliance issues.  However, they were unable to resolve these issues and as a result issued  a cease generation order in 2017, followed in 2018 by a license  revocation order. In practice, FERC’s use of these enforcement tools to  resolve safety issues has been fairly limited, particularly in comparison to  other license compliance issues, according to FERC officials. Since 2013,  FERC has issued one civil penalty for a safety-related hydropower  violation and has issued compliance orders on eight other projects for  safety-related reasons, including orders to cease generation on three  projects. Appendix II: Information on Selected Models  and Data Sets Used to Develop and  Evaluate Dam Performance Studies For the 14 projects and 42 dams we reviewed, FERC licensees and their  consultants used a variety of tools to develop engineering studies of dam  performance (see table 3). These tools included programs and modeling  tools developed by government agencies, such as the U.S. Army Corps  of Engineers (the Corps), as well as commercially available modeling  tools. FERC officials stated that they also used a number of the same  tools used by its licensees and consultants. Similarly, for the 14 projects and 42 dams we reviewed, FERC licensees  and their consultants used a variety of datasets to develop engineering  studies of dam performance (see table 4). These datasets included data  maintained and updated by various government agencies, including the  United States Geological Survey and National Oceanic and Atmospheric  Administration. FERC officials stated that they also used a number of the  same datasets used by its licensees and consultants. Appendix III: Objectives, Scope, and  Methodology This report assesses: (1) how FERC collects information from its dam  safety inspections and the extent to which FERC analyzes it; (2) how  FERC evaluates engineering studies of dam performance to analyze  safety, and (3) the extent to which FERC reviews dam safety information  during relicensing and the information FERC considers. This report also  includes information on FERC actions to ensure licensee compliance with  license requirements related to dam safety (app. I) and selected models  and data sets used to develop and evaluate engineering studies of dam  performance (app. II). For each of the objectives, we reviewed laws, regulations, FERC  guidance, templates, and other documentation pertaining to FERC’s  evaluation of dam safety. In addition, we reviewed an independent  forensic team’s assessment of the causes of the Oroville Dam incident,  including the report’s analysis of FERC’s approach to ensuring safety at  the project, to understand any limitations of FERC’s approach identified  by the report. We also reviewed dam safety documentation, including  dam performance studies, FERC memorandums, the most recent  completed inspection report, and other information, from a non-probability  sample of 14 projects encompassing 42 dams relicensed from fiscal  years 2014 through 2017. (See table 5.) We selected these projects and  dams to include ones that were geographically dispersed, had varying  potential risks associated with their potential failure, and had differences  in the length of their relicensing process. We developed a data collection  instrument to collect information from the dam safety documentation and  analyzed data from the sample to evaluate the extent to which FERC  followed its dam safety guidance across the selected projects. To  develop the data collection instrument, we reviewed and incorporated  FERC oversight requirements from its regulations, guidance, and  templates. We conducted three pre-tests of the instrument, and revised  the instrument after each pre-test. To ensure consistency and accuracy in  the collection of this information, for each dam in the sample, one analyst  conducted an initial review of the dam safety documentation; a second  analyst reviewed the information independently; and the two analysts  reconciled any differences. Following our review of the information from  the dam safety documentation, we conducted semi-structured interviews  with FERC engineering staff associated with each of the 14 projects and  42 dams to obtain information about FERC’s inspections, review of dam  performance studies, and analysis of safety during the relicensing of  these projects. Our interviews with these FERC staff provided insight into  FERC’s dam safety oversight approach and are not generalizable to all  projects. We also interviewed FERC officials responsible for dam safety  about dam safety practices. In addition, to review how FERC collects information from its dam safety  inspections and the extent to which FERC analyzes it, we also reviewed  inspection data from FERC’s information management systems from  fiscal years 2014 through 2017. To assess the reliability of these data, we  reviewed guidance and interviewed FERC officials. We determined that  the data were sufficiently reliable for our purposes. We compared FERC’s  approach to collecting, recording and using safety information to federal  internal control standards for the design of information systems and  related control activities. We also reviewed our prior work on portfolio- level risk management. To evaluate how FERC evaluates engineering studies of dam  performance to analyze dam safety, we reviewed FERC policies and  guidance. We interviewed six independent consultants having experience  inspecting and analyzing FERC-regulated dams to understand how  engineering studies of dam performance are developed. We selected  consultants who had submitted an inspection report to FERC recently  (between December 2017 and February 2018) based on the geographic  location of the project they reviewed and experience conducting these  inspections, and the number of reports submitted to FERC over this time  period. (See table 6.) Our interviews with these consultants provided  insight into FERC’s approach to conducting and reviewing studies and  are not generalizable to all projects or consultants. To evaluate the extent to which FERC reviews dam safety information  during relicensing and the information it considers, we reviewed  templates developed by FERC to assess safety during the relicensing  and analyzed the extent to which staff followed guidance in these  templates for the 14 projects and 42 dams in our sample. We also  interviewed stakeholders, including the National Hydropower Association  and Friends of the River to obtain general perspectives on FERC’s  relicensing approach. Our interviews with these stakeholders provided  insight into FERC’s approach to relicensing, and these views are not  generalizable across all stakeholders. To review actions to ensure licensee compliance with license  requirements related to dam safety, we reviewed FERC’s guidance  related to compliance and enforcement and interviewed FERC officials  responsible for implementation of the guidance. To review information on  models and datasets used to develop and evaluate engineering studies of  dam performance, we reviewed dam safety documentation associated  with the projects in our sample (described previously), reviewed FERC  documentation, and interviewed FERC officials. We conducted this performance audit from July 2017 to October 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix IV: Comments from the Federal  Energy Regulatory Commission Appendix V: GAO Contact and Staff  Acknowledgments GAO Contact Andrew Von Ah, (202) 512-2834 or vonaha@gao.gov. Staff  Acknowledgments In addition to the contact named above, Mike Armes (Assistant Director);  Matt Voit (Analyst-in-Charge); David Blanding; Brian Chung; Geoff  Hamilton; Vondalee Hunt; Rich Johnson; Jon Melhus; Monique Nasrallah;  Madhav Panwar; Malika Rice; Sandra Sokol; and Michelle Weathers  made key contributions to this report.
In February 2017, components of California's Oroville Dam failed, leading to the evacuation of nearly 200,000 nearby residents. FERC is the federal regulator of the Oroville Dam and over 2,500 other dams associated with nonfederal hydropower projects nationwide. FERC issues and renews licenses—which can last up to 50 years—to dam operators and promotes safe dam operation by conducting safety inspections and reviewing technical engineering studies, among other actions. GAO was asked to review FERC's approach to overseeing dam safety. This report examines: (1) how FERC collects information from its dam safety inspections and the extent of its analysis, and (2) how FERC evaluates engineering studies of dam performance to analyze safety, among other objectives. GAO analyzed documentation on a non-generalizable sample of 42 dams associated with projects relicensed from fiscal years 2014 through 2017, selected based on geography and hazard classifications, among other factors. GAO also reviewed FERC regulations and documents; and interviewed FERC staff associated with the selected projects and technical consultants, selected based on the frequency and timing of their reviews. The Federal Energy Regulatory Commission's (FERC) staff generally followed established guidance in collecting safety information from dam inspections for the dams GAO reviewed, but FERC has not used this information to analyze dam safety portfolio-wide. For these 42 dams, GAO found that FERC staff generally followed guidance in collecting safety information during inspections of individual dams and key structures associated with those dams. (See figure.) However, FERC lacks standard procedures that specify how and where staff should record safety deficiencies identified. As a result, FERC staff use multiple systems to record inspection findings, thereby creating information that cannot be easily analyzed. Further, while FERC officials said inspections help oversee individual dam's safety, FERC has not analyzed this information to identify any safety risks across its portfolio. GAO's prior work has highlighted the importance of evaluating risks across a portfolio. FERC officials stated that they have not conducted portfolio-wide analyses because officials prioritize the individual dam inspections and response to urgent dam safety incidents. However, following the Oroville incident, a FERC-led initiative to examine dam structures comparable to those at Oroville identified 27 dam spillways with varying degrees of safety concerns, on which FERC officials stated they are working with dam licensees to address. A similar and proactive portfolio-wide approach, based on analysis of common inspection deficiencies across the portfolio of dams under FERC's authority, could help FERC identify safety risks prior to a safety incident. Guidelines recognize that each dam is unique and allow for flexibility and exemptions in its use. FERC staff use the studies to inform other components of their safety approach, including the analysis of dam failure scenarios and their review of safety to determine whether to renew a license.