Introduction

When a landslide that threatens human life is recognized, decision makers determine if those affected are safe enough, and if not, how much protection would make the risk tolerable. The decision process, which involves comparing risk of death by landslide with available resources and perceptions of tolerable risk, is known as risk evaluation (Fig. 1). Within a quantitative risk management framework, it is common to evaluate both individual risk and societal risk (e.g., Fell 1994; ERM 1998; HSE 2001; Macciotta and Lefsrud 2018). Individual risk is the probability of death due to a landslide for a specific individual (Fell et al. 2005). Societal risk considers the broader consequences of the landslide, including the potential number of people killed, economic losses, environmental losses, and service disruptions. This article provides a critical review of individual life-loss risk evaluation for landslide hazards within a quantitative risk management framework. It is a companion to our previous article on societal risk evaluation (Strouth and McDougall 2021); the concepts presented here for individual risk are relevant to societal risk evaluation, just as many of the suggestions in the companion paper apply equally to individual risk evaluation.

Fig. 1
figure 1

Landslide risk management framework (adapted from Fell et al. 2005; VanDine 2012; ISO 2018). Risk evaluation (highlighted in red) is the focus of this article

Full size image

Evaluation of individual risk appears simple at first glance because of the prevailing consensus across industries and countries for levels of tolerable and acceptable individual risk (Leroi et al. 2005; Macciotta and Lefsrud 2018). However, following a review of individual risk estimation methods and risk tolerance thresholds in literature and our own experiences, we have identified several overlooked and perhaps misunderstood details (adding to challenges identified by Bell et al. 2006) that are important for landslides:

  1. 1.

    Risk values are difficult to understand — Small numbers (e.g., 1 × 10−4) that describe risk and risk tolerance thresholds are not intuitively understood, which can inhibit risk communication and subsequent decision making. Use of the risk unit, micromort, helps to overcome this challenge.

  2. 2.

    Guidance for defining landslide magnitude scenarios is lacking — The individual risk estimate is typically comprised of various landslide scenarios that are summed to acquire the overall risk estimate. There is little guidance in literature for how to define and combine scenarios in a mathematically correct manner.

  3. 3.

    Unquantified risk scenarios can control risk management decisions — In some settings, risk from unquantified (or ignored) risk scenarios can exceed quantified risks, which can lead to incomplete or irrational risk management decisions.

  4. 4.

    Low risk tolerance thresholds can be unachievable — It can be impractical, inefficient, or impossible to reduce risk to a tolerance threshold that is overly restrictive, which undermines the utility of the threshold as a decision-making tool.

  5. 5.

    The ALARP principle is not always applicable — Risk is deemed to be As Low As Reasonably Practicable (ALARP) when the cost of further risk reduction is ‘grossly disproportional’ to the benefits gained. While commonly cited, the ALARP principle is not commonly achieved, and it may be an irrational objective in many landslide risk management situations.

  6. 6.

    There is no universal risk tolerance threshold for individuals — Individuals evaluate risks differently than governments, and the metrics used by governments to set thresholds vary from place to place. Therefore, despite the broad consensus in literature, risk tolerance thresholds may not be universally applicable.

  7. 7.

    Individual and societal risk evaluation thresholds are unrelated — Individual and societal risk tolerance thresholds originated from different places and have different meanings.

Although the literature review and the examples we provide focus on landslides, we believe the underlying concepts are applicable to other natural hazard types, such as floods, debris floods, and snow avalanches. This article is based on the authors’ experience primarily in Western Canada carrying out quantitative risk assessments of landslide and flood hazards and guiding local governments in risk evaluation. It is intended as a resource for risk analysts and community leaders who use quantitative methods to inform natural hazard risk management decisions. We welcome feedback and discussion, and ultimately hope that these discussions improve the consistency, clarity, and rationality of risk management decisions.

Risk values are difficult to understand

Although the objective of risk evaluation is to make decisions, the heart of risk evaluation is comparison. The purpose of quantitative risk assessment is to facilitate these comparisons. Estimated landslide risk at one location is compared to other sites and other hazards to set priorities. It is compared to risk thresholds and risk benefits to assess tolerability, and it is compared to available resources to set mitigation budgets. These comparisons are always made in the face of incomplete information and uncertainty, and an intuitive feel for the magnitude of risk and uncertainty is essential. Unfortunately, the absolute size of small risks is difficult to grasp.

For example, create a mental image of the number 1 × 10−4. Now double it. Now subtract 3 × 10−5. What is the result, and how does it compare to where you started? Despite our years working with these numbers, we pulled out a calculator to check our work.

To overcome this challenge, we use the risk unit, micromort, and we propose that it be used more widely in natural hazard risk management. A micromort is a one-in-a-million risk of sudden death (Howard 1980), and it has been used by the medical profession to explain medical procedure risks to patients (e.g., Walker et al. 2014; Ahmad et al. 2015). Any risk value can be translated to micromorts. For example, an annual landslide risk of 3 × 10−5 (which can be written using several notations: 3E-5; 0.00003; 1 in 3333) would be 30 micromorts per year; a 1 × 10−5 risk of death during a sky diving jump would be 10 micromorts per jump (Fry et al. 2016); and a 1 in 10,000-year risk tolerance threshold would be a 100 micromorts per year threshold (Fig. 2).

Fig. 2
figure 2

Risk of death in micromorts per year (left) and odds per year (right) for several populations, causes, and activities, estimated from annual deaths divided by total population in the USA (in 2017), except where Guatemala and COVID-19 are noted (CDC 2020; Kochanek et al. 2019; Sepulveda and Petley 2015). Dashed red lines (1 × 10−4 and 1 × 10−5) are common individual life-loss risk tolerance thresholds for landslides

Full size image

Try the mental math challenge again using micromorts. Start with 100 micromorts. Now double it. Now subtract 30. We bet you did not reach for a calculator.

Micromorts are equally useful to the risk analyst who is buried in a spreadsheet, as well as the decision maker or member of the public who is trying to understand what the risk value means. For the risk analyst, we have found that simple spreadsheet errors and inconsistencies in risk estimates (e.g., why is risk at the adjacent house 4 × larger?) become more apparent when risk values are converted to micromorts. The relationship between the average risk estimate and the uncertainty range also becomes intuitive and better able to inform our next steps (e.g., it is more apparent that the uncertainty is larger than the risk estimate itself when we compare [30|90|900] instead of [3E-5|9E-5|9E-4], where [lower bound|best estimate|upper bound]).

For decision makers and members of the public, micromorts can facilitate communication. Most people, even the highly educated, are not familiar with scientific notation. Risk values presented in scientific notation, at best, require explanation and, at worst, are meaningless. All decision makers immediately know that 90 is somewhat less than 100, but few draw that same conclusion from 9E-5 and 1E-4.

Use of micromorts overcomes another, related communication challenge. Before encountering micromorts, we often reported risk values as odds of occurrence, like 1 in 500 or 1 in 20,000, because this was more easily understood than scientific notation (2 × 10−3or 5 × 10−5). However, these risk odds are routinely confused with the hazard return period. For example, is risk of 1 in 10,000 the total risk associated with all return periods (typically, yes) or is it the risk associated with the 1 in 10,000-year return period event?

Figure 2 displays the correlation between micromorts and odds, and annual risk of death from common causes in the USA. It provides context that can help one understand the meaning of an estimated risk or risk tolerance threshold value.

Individual risk estimation

Estimation of risk at the site of interest is a prerequisite to risk evaluation (Fig. 1). The parameters and equation used to estimate individual risk for landslide hazards (Eq. (1)) are well established in literature (e.g., Fell et al. 2005; Leroi et al. 2005; Bründl et al. 2009; Porter et al. 2017; Mavrouli and Corominas 2018), with variations in notation. Methods used to estimate parameter values are also well established (e.g., Hungr et al. 2005; Corominas et al. 2014), and improvements to these methods are the current focus of many landslide research programs.

Individual risk is estimated quantitatively as:

$${R}_{j}=\sum_{i=1}^{n}{h}_{i}*{S}_{i,j}*{T}_{i,j}*{V}_{i,j}$$
(1)

where:

  • Rj is the annual probability of death to an individual (j) (often referred to as PDI);

  • hi is the annual incremental probability of landslide scenario (i), out of (n) total landslide scenarios;

  • Si,j is the spatial probability of impact, which given that scenario (i) occurs, is the probability that the facility (e.g., building, vehicle, trail) commonly occupied by person (j) is impacted;

  • Ti,j is the temporal probability of impact, which given that scenario (i) occurs and impacts the facility, is the probability that the person (j) is present at the time of impact; and

  • Vi,j is the life-loss vulnerability, which given that scenario (i) occurs and impacts the facility when the person is present, is the probability that individual (j) is killed.

We refer to h and S as ‘hazard’ parameters because they are primarily related to the process type, topography, and landslide initiation and motion mechanics. T and V are ‘consequence’ parameters that relate primarily to the character and behavior of the facility and person at risk. Individual risk is usually estimated for the individual most at risk within a facility, which is often the person who occupies the facility most frequently, or who is most vulnerable if impacted. This can be a child or elderly person in a residential setting or the worker who most frequently occupies the hazard zone in an industrial setting.

For landslide scenarios (e.g., rockfalls) that occur multiple times within a year, annual frequency (e.g., 10 rockfalls per year) is used in place of the annual probability in Eq. (1). Also note that annual incremental probability of the landslide scenario (h) is used in the calculation rather than the exceedance probability (H). The incremental probability defines the probability of exactly scenario (i) occurring, while an exceedance probability defines the probability that scenario (i) or larger occurs.

Overestimation of risk can lead the risk evaluation towards unnecessary land sterilization, disrupted livelihoods, and diversion of attention and resources away from other, more critical hazards. Overestimation of risk occurs when risk analysts apply ‘conservative’ assumptions to parameters of the risk equation, and when the probability of each landslide risk scenario is improperly defined, for example, by confusing incremental and exceedance probabilities.

Similarly, underestimation of risk can lead to poor risk management decisions, imparting a false sense of safety, or causing inaction at a time or place where action is needed. Underestimation of risk can occur when landslide risk scenarios are overlooked or omitted from the risk estimate.

To avoid these issues related to over- and underestimation of risk, risk estimates used for risk evaluation should be best estimates with transparent uncertainty bounds. Methods for assessing and presenting uncertainty in quantitative risk estimates are described elsewhere in literature (e.g., You and Tonon 2012; Aven et al. 2014; USBoR-USACE 2015; Macciotta et al. 2016a, b; Macciotta et al. 2020) and are beyond the scope of this article.

We elaborate below on two aspects of risk estimation that are important for obtaining a best estimate, including: (1) how to combine landslide scenarios, and (2) the potential importance of unquantified risks.

Guidance for defining landslide magnitude scenarios

Literature describes how landslide risk at a specific site can be estimated by summing various scenarios (e.g., Fell et al. 2005; Leroi et al 2005; Fell et al. 2008; Bründl et al. 2009; Porter and Morgenstern 2013; Corominas et al. 2014; De Biagi et al. 2017). General guidance also exists for identifying and combining scenarios that are mutually exclusive and statistically independent versus those that are correlated or have a common cause (e.g. USBoR-USACE 2015). But literature provides little guidance on how landslide scenarios should be defined and combined in a mathematically correct manner. In this article, we take a first step at addressing this gap, focusing on the division of landslide size uncertainty into mutually exclusive scenarios for risk estimation. Specifically, we show that the distinction between exceedance probability and incremental probability (or similarly, between cumulative frequency and incremental frequency) deserves careful consideration when defining hazard scenarios.

In many life-loss risk situations, the size of the potential landslide is uncertain, but can be estimated as a range. For landslide risk, size matters. Runout distance, area impacted, impact intensity, and risk typically increase with landslide size, and can vary substantially across the range of potential sizes. Therefore, many risk estimates are obtained by dividing the possible size range into magnitude classes, estimating risk for each class, and summing the risk components (e.g., Eq. (1)). The magnitude classes can be further discretized considering distinct mobilities or travel paths (i.e., avulsion scenarios), where warranted. An incremental probability (hi), which is the probability of exactly that scenario, is assigned to each magnitude, mobility, or avulsion scenario.

For spatially reoccurring landslides, like debris flows or rockfalls, it is common to refer to the magnitude classes by their return period. The return period is related to (i.e., it is the inverse of) the cumulative frequency or the annual exceedance probability (Lee and Jones 2014), not the incremental probability. For example, there is a 0.005 (i.e., 1/200) probability that the 200-year return period debris flow will be exceeded each year.

The transposition between landslide magnitude and return period occurs because the possible size range of a landslide tends to be described using a magnitude-probability style curve developed for the specific hazard site (e.g., Fig. 3). Magnitude-probability curves have multiple forms in literature. For example, Hungr et al. (1999) provide a magnitude–cumulative frequency (MCF) curve, with rockfall magnitude on the x-axis and cumulative frequency per year on the y-axis. Cumulative frequency describes how often a rockfall of size ‘M’ or larger will occur. Jakob et al. (2020) provide frequency-magnitude curves, with return period on the x-axis and magnitude on the y-axis. In this article, we have adopted a third format, with magnitude on the x-axis and annual exceedance probability on the y-axis. We do not advocate for any one format over another, as each serves a purpose. However, the formulation of the magnitude-probability curve, no matter how it is defined, must be clearly understood before hazard scenarios are defined and combined to estimate risk (Rj).

Fig. 3
figure 3

Example magnitude-probability curve (solid red line), divided into magnitude/return period classes

Full size image

In the magnitude-probability curve selected as an example in this article (Fig. 3), the point nearest the curve’s origin is the smallest, highest-probability landslide size, and the farthest point is the largest, lowest-probability landslide size. This curve is cumulative, which means it displays the probability of the landslide being size ‘M’ or larger (Fig. 3). As such, it is not a compilation of discrete events, but a continuous function that results in a single total landslide risk value for the person at risk.

For recurrent landslide hazards, such as rockfalls and debris flows, a ‘magnitude-frequency’ or ‘frequency-magnitude’ curve could be used instead of the magnitude-probability curve. Probability and frequency are approximately equivalent for rare events but are not equivalent for landslide scenarios that occur repeatedly over a short period of time (McClung 1999).

Calculation of the incremental probability (hi) of a landslide scenario that is defined only by a magnitude (or return period) class on an exceedance probability curve is described in Fig. 3 and Eq. (2).

$${h}_{i}={H}_{i, upper}- {H}_{i,lower}$$
(2)

where:

  • Hi, upper is the annual exceedance probability of the upper end of the magnitude range, for scenario (i).

  • Hi, lower is the annual exceedance probability of the lower end of the magnitude range, for scenario (i).

Various mobility or avulsion scenarios can also be defined, typically by discretizing each magnitude (or return period) class into two or more sub-classes. The incremental probability for the magnitude class (hi) is multiplied by a conditional probability that describes how likely the mobility or avulsion scenario is to occur, given the magnitude class occurs. The conditional probabilities of all sub-classes must sum to 1.0.

Addition or subtraction of individual hazard scenarios (hi) (regardless of whether they represent different return period classes, avulsion, or mobility scenarios) must not change the total probability of a landslide occurring (H). For example, dividing the landslide into ten as opposed to three scenarios should increase the precision of the estimate, and not automatically increase the total risk value.

Although we recognize that it is commonly more practical to define scenarios by return period classes (e.g., in general guidelines, and comparisons in the “Unquantified risk scenarios can control risk management decisions” section), the scenarios can often be more intuitively understood and communicated if differentiated by magnitude classes associated with changing spatial impact probability and consequence, rather than arbitrarily defined return periods. In fact, we attribute many common errors related to defining and combining landslide scenarios to the framing of the landslide scenarios by arbitrary return period classes. Where it is reasonable to do so, framing the landslide scenarios as magnitude instead of return period classes can reduce the number of scenarios assessed, avoid unrecognized risk scenarios (see the “Unquantified risk scenarios can control risk management decisions” section), and avoid the common confusion between incremental probabilities needed for risk estimation and the exceedance probability that is related to return periods.

Division of the landslide into magnitude classes involves estimating the magnitude and probability of the end points, which are the smallest landslide that could cause a fatality and the maximum credible landslide.

The smallest, highest probability landslide (i.e., point nearest the origin of the magnitude-probability curve) that could cause life loss often has a strong control on the total quantified risk because it also defines the total probability (H) of any and all landslide scenarios. Note that at some landslide sites (e.g. many rock avalanches), the smallest, highest probability landslide scenario has a very-low likelihood of occurrence and/or is a very-large magnitude.

The maximum credible landslide magnitude is important because it defines the maximum extent and maximum impact intensity of the landslide. The maximum credible landslide can often be defined based on a geologic control, kinematic feasibility, sediment supply limitation, historical fan area, or hydrologic limitations. Inclusion of the maximum credible landslide magnitude in the risk estimate avoids the potential errors associated with unrecognized risk scenarios (see the “Unquantified risk scenarios can control risk management decisions’ section). Also, the magnitude-probability function tends to approach the maximum credible magnitude asymptotically, meaning that the magnitude and related consequences of the maximum credible magnitude are potentially similar to events with a much more frequent return period (e.g. return periods of hundreds or thousands of years).

Although the continuous magnitude-probability function between the end points could be infinitely refined, one seeks the fewest number of classes that captures the possible range of consequences. Minimizing the number of classes in a risk calculation is done to avoid onerous and perhaps unnecessary risk estimation effort (e.g., to limit the number of numerical modeling scenarios) and to reduce potential for simple calculation errors. For example, if the smallest possible landslide causes the same consequence as the largest possible landslide (e.g., see Example A, “Unquantified risk scenarios can control risk management decisions” section), then there is no need to assess different magnitude class scenarios. However, when impact intensity (and hence life-loss risk) increases across the possible size range, several magnitude classes, each represented by a characteristic event, should be included. Inflection points in the magnitude-probability curve, runout area, and impact intensity value are useful markers for differentiating classes.

When return period classes are pre-defined by a local guideline or custom (e.g. Class 1 30 to 100 years; Class 2 100 to 300- years; Class 3 300 to 1000 years; Class 4 > 1000 years) the risk analyst needs to modify the starting point and end point of the classes. The arbitrary starting point set by the guideline (e.g. 30-year return period for Class 1) cannot be used in the risk calculation, as it has a strong (and often, unintended) control on the calculated total risk value. Instead, this starting point needs to be replaced by the return period of the smallest landslide that could cause life loss (inverse of H). The ending point should be the most frequent return period that causes consequences similar to the maximum credible event. For example, at a site where the return period of dangerous landslides is 80 years and the maximum size landslide has a return period of 500 years, return period classes could be defined as: Class 1, 80 to 100 years; Class 2, 100 to 300 years; Class 3, 300 to 500 years; Class 4 > 500 years.

Unquantified risk scenarios can control risk management decisions

Risk estimates from all possible landslide magnitudes, up to the maximum credible, are needed to obtain a complete estimate of landslide risk (Fig. 4). If the largest assessed magnitude is truncated artificially, for example by local practice or a guideline that limits an assessment to a 300 or 1000-year return period (e.g., Bründl et al. 2009; Ho and Roberts 2016; EGBC 2018), then there will typically be a portion of the total landslide risk that remains unquantified. This unquantified risk can be insignificant, or it can greatly exceed the quantified risk (Fig. 5), depending on the process type, variance in possible landslide size, and pattern of development. Therefore, unquantified risks should be recognized, presented, and used to inform the risk management decision. This concept is equally important in qualitative risk management frameworks: scenarios that are not rigorously assessed or estimated need to be acknowledged.

Fig. 4
figure 4

Individual risk calculations for three landslide scenarios with equivalent total risk despite distinct process types and risk profiles. The probability of the landslide scenario occurring (h) and the probability of death (R) are per year

Full size image
Fig. 5
figure 5

Total individual risk can vary substantially depending on which return period classes are included in the risk assessment. A, B, C are the examples in Fig. 4. Risk refers to risk of death per year

Full size image

Each hypothetical example in Fig. 4 uses the same return period scenarios to facilitate comparison between examples. Each example results in equivalent total individual risk of 402 micromorts per year (4.02 × 10−4; 1 in 2490) when the complete possible volume range is included in the estimate, however, the contribution of the different return period classes, which we call ‘risk profile’, is very different.

Example A (Fig. 4) considers individual risk from rockfalls to the operator of a mine shaft elevator who occupies a small control building located on a talus slope. Rockfalls from the slope above the building have a return period of approximately 10 years (H = 0.1). Even the smallest, most frequent rockfalls are likely to impact the building, and therefore the spatial probability of impact (S) is similar for both the smallest size (10-year return period, 0.8) and the largest size (> 10,000-year return period, 0.99). The temporal probability of impact (T) is constant for all scenarios and is a function of the operator’s work schedule, which includes 30 min per day, every day of the year, in the control building. The vulnerability of the operator (V) is a function of the rockfall size. The smallest sized rockfalls are relatively unlikely to cause death (10-year return period, 0.2), while the largest rockfalls are very likely to destroy the building and cause death (> 10,000-year return period, 0.9). Overall, the risk profile is dominated by the smallest, most-frequent events with 10 to 100-year return period. Unquantified risk would be relatively insignificant if the risk estimate were truncated at the 300-year return period event. Similarly, total risk could be reasonably estimated by considering only a single volume/return period class that includes all rockfall sizes with annual landslide probability, H, of 0.1.

Example B (Fig. 4) considers individual risk to the resident of a home on a debris-flow fan, who spends nearly all his time at home (T = 0.8). Debris flows occur approximately every 10 years on the fan (H = 0.1), but these small debris flows are unlikely to avulse from the main channel and impact the home (S1 = 0.01). Even if a small debris flow does impact the home, the flow intensity is low and is unlikely to cause death (V1 = 0.01). However, the debris-flow size can vary by several orders of magnitude, and the largest, lowest-probability debris flow could be catastrophic, and is very likely to impact the home (S5 = 0.9) with high intensity that very likely causes death (V5 = 0.9). All sizes of events with return periods greater than 100 years contribute significantly to the total risk, with the 300 to 1000-year return period making the largest contribution. Unquantified risk would greatly exceed the quantified risk if the risk estimate were truncated at the 300-year return period event. The spatial impact probability and vulnerability vary significantly with the event magnitude and it is therefore necessary to assess multiple return period class scenarios. A risk estimate derived from a single event size would be a poor approximation of the total risk.

Example C (Fig. 4) considers individual risk to the resident of a home located in a potential rock avalanche runout zone. The resident spends nearly all of her time at home (T = 0.8). The rock avalanche is a low-probability/high-consequence type event. Its annual probability of occurrence is mathematically equivalent to a return period of 1000 years (H = 0.001). If it occurs, it is very likely to impact the house (S >  = 0.9). For the smallest sized rock avalanche, the house is located at the distal margin of the runout zone, where impact intensity results in equal chance of death or survival (V5 = 0.5). A larger rock avalanche, with longer runout, would almost certainly destroy the house, killing the resident (V6 = 0.99). The risk profile of Example C is dominated by rare events that almost certainly cause death. Quantified risk would be zero, and all of the risk would remain unquantified, if the risk estimate were truncated below the 1000-year return period event.

A recognition of the full risk profile of a hazard site is needed to make an informed risk evaluation decision. Where feasible (technically and economically), risk should be quantified for up to the maximum credible landslide magnitude. When quantified risk is truncated at a return period (for example if the maximum return period is dictated by local practice, code, or guideline), a qualitative understanding of the unquantified risk needs to be developed, including: (1) Is unquantified risk significant compared to the quantified risk? (2) Is the unquantified risk relevant to the risk evaluation? and (3) Are risk reduction measures needed to mitigate the unquantified risk? This conclusion follows the holistic principle, which advocates that risk tolerance criteria and risk reduction measures can only be evaluated and established when total risk is assessed (with approximations, as needed) (Vanem 2012).

Furthermore, when a risk management framework is defined or codified by a government or organization, there needs to be clear direction of the maximum return period (or minimum hazard probability) included in the risk estimate and guidance for estimating and managing unquantified risk. As illustrated in Fig. 5, it is almost meaningless to select a risk tolerance threshold without also specifying these risk estimation parameters, because both are needed to rationally compare the two. The tolerability of each example is set as much by the maximum return period that is assessed as it is by the risk tolerance threshold.

To be clear, we are not suggesting that risk estimation needs to be more onerous or expensive. It can sometimes be simpler to estimate the maximum credible landslide magnitude (because it is based on a measurable physical limitation) than the specific magnitude and consequence of a given return period (e.g. 300-year return period debris flow). It should be common practice to estimate (quantitatively or qualitatively) the maximum credible landslide magnitude and associated consequences, and transparently incorporate this estimate into the risk management decision. Where landslide investigation resources are limited, the uncertainties of the estimate may be significant. In these cases, it is better to estimate the full risk profile with clear presentation of uncertainties, rather than to ignore the low-probability scenarios.

Selection of individual risk tolerance thresholds

Risk-taking is necessary to acquire the basic needs and desires of life. As individuals, we evaluate voluntary risks so commonly, and often sub-consciously, that it passes unnoticed. For example, we risk drowning when we swim, Covid-19 when we visit a grocery store, and being the next traffic fatality when we speed home from work. Although we have difficulty judging risks accurately, and the risk that we tolerate can vary dramatically from one hazard type to another, we make these evaluations intuitively by comparing risks with benefits (Slovic 2000). In fact, many individuals choose to live with recognized high landslide risk in return for economic opportunity (Oven 2009; LaPorte 2018) or simply a peaceful and familiar home (Kaminsky 2014).

Risk evaluation becomes more complex when one entity (e.g., government, consultant) imposes a risk evaluation on another individual. In a quantitative risk management framework, this is done by selecting a threshold that defines what value of risk ought to be ‘safe enough’ for a population of diverse individuals. In this context, unacceptable risks exceed the risk tolerance threshold and require measures to reduce risk to below the threshold. Tolerable risks are below the threshold and can be lived with if the risk is kept under review and further reduced if possible, and acceptable risks are far below the threshold at a value that is perceived to be negligible (Fell 1994; Finlay and Fell 1997; HSE 2001; Fell et al. 2005).

Risk tolerance thresholds defined by a government entity or large organization are necessarily determined without consideration of each individual’s perception of the benefits that come from living, working, or being in a landslide hazard zone. Instead, risk tolerance thresholds for landslides in one jurisdiction tend to be defined by matching thresholds employed in other jurisdictions or for other hazards or industries (Malone 2005; Hungr et al. 2016; Macciotta and Lefsrud 2018). These common threshold values originated in the developed world based on the idea that landslide risk should be insignificant compared to the risk of death from other causes (Fig. 6). For example: a risk level of 1 micromort/year (10−6) is a common acceptable risk threshold because it is “extremely small” compared to background risk (Vrijling et al. 1995; HSE 2001); in Switzerland, risk thresholds in the range of 1 to 10 micromorts/year (10−6 to 10−5) are targeted because these are on the order of 1% of the lowest background risk of death to individuals in the society (Bründl et al. 2009; FOEN 2016); and in many places (ERM 1998; HSE 2001; Leroi et al. 2005; BoR 2011; Porter and Morgenstern 2013; Tappenden 2014; FERC 2016), a risk level of 100 micromorts/year (10−4) is the tolerable risk threshold for involuntary risks because it is similar to the background risk of death of a child and the average risk of death due to common hazards like traveling by car.

Fig. 6
figure 6

Annual risk of death by age group for various countries (NVSS 2019; WHO 2020; Statistics Canada 2020)

Full size image

The broad consensus for levels of tolerable and acceptable risk suggests that these thresholds are useful. However, we have encountered two important challenges with their application, particularly to residential development: (1) an inability to achieve low risk tolerance thresholds with risk management measures, and (2) an inconsistency between risk thresholds imposed by governments and the tolerance of the at-risk individuals. Additionally, we have witnessed confusion about: (1) the implications of the commonly-referenced ALARP principle, and (2) the relationship between individual and societal risk evaluation thresholds. The following sections elaborate on these challenges.

Low risk tolerance thresholds can be unachievable

In our experience, low risk tolerance thresholds of 1 or 10 micromorts/year (10−6 or 10−5) are not generally achievable for landslide hazards unless low-probability/high-consequence events are ignored, or risk from these events is managed by avoidance. This is illustrated by the examples in Fig. 4; each of which would exceed these thresholds even if structural measures were designed to mitigate up to a 1000-year return period event. A risk tolerance threshold of 100 micromorts/year (10−4) tends to be more commonly achievable, but in some settings (e.g., Examples B and C in Fig. 4) prone to similar challenges as the lower thresholds.

In a risk management framework for development in landslide terrain, it is possible to achieve a low risk tolerance threshold by truncating risk estimates at a maximum return period to exclude low probability/high consequence events (see the “Unquantified risk scenarios can control risk management decisions” section). Afterall, ignorance is bliss. This reduces the total risk estimate to a ‘manageable’ value but provides an incomplete picture of risk, and it may lead to irrational or inappropriate decisions (Ale et al. 2020).

Alternatively, hazard avoidance can be an effective method to reduce risk to below these low risk thresholds. Hazard avoidance is most applicable in the context of new development (assuming it is feasible to overcome development pressures and restrict development in hazard zones).

For existing development, hazard zones can be temporarily avoided through evacuation during periods of elevated hazards. Evacuation is an imperfect risk reduction method (e.g., Bowser and Cutter 2015; Kean et al 2019). We are unaware of empirical data or a defensible method for quantifying landslide risk reduction achieved by evacuation. However, in many situations (e.g., where it is not feasible to manage the landslide hazard with structural measures or to relocate people permanently), evacuation may be the only reasonable risk reduction option to manage low-probability/high-consequence events. An effective evacuation requires: a population that is trained to respond to hazard notices and evacuation orders; a well-developed and well-communicated emergency response plan; and a landslide early warning system designed to monitor, forecast, and analyze conditions that could trigger a landslide (Calvello et al. 2020). For example, there is evidence that a person’s behavior during a landslide can have a more significant effect on vulnerability than the landslide impact depth or velocity (Pollock and Wartman 2020). Recognize also that evacuation does not reduce economic risks or service disruptions caused by landslide impacts to buildings and infrastructure.

When selecting a risk tolerance threshold, risk managers and decision makers should consider: the risk profile within their jurisdiction; the method for estimating risk; the method for incorporating low-probability/high-consequence events; options for managing risk; and the feasibility of achieving the selected thresholds. Additionally, risk management options should be evaluated with respect to available resources to identify measures that are feasible, affordable, fair, and can reasonably reduce risk below the selected threshold.

In summary, a strict risk tolerance threshold that is difficult to achieve with structural mitigation measures may be appropriate to encourage avoidance of hazard zones by new development. However, to be a useful tool for decision making at existing development, the selected tolerance value needs to be reasonably achievable with feasible mitigation measures.

The ALARP principle is not always applicable

A tolerable risk is in the transitional ‘grey-zone’ between clearly unacceptable (i.e., requiring risk reduction) and clearly acceptable (i.e., negligible). Tolerable risks tend to be conditional, meaning that the risk can be lived with if certain conditions are met. A commonly cited condition is that the risk must be reduced until it is As Low As Reasonably Practicable (ALARP) (e.g., HSE 2001, Leroi et al. 2005; Macciotta et al. 2016a, b). However, we argue here that ALARP should not be a condition that is adopted by default because ALARP can be an unachievable and undesirable objective in many landslide risk management situations.

The ALARP principle was derived from British common law, following a 1949 case (Edwards v. National Coal Board) that tested an employer’s obligation to ensure worker safety. The Edwards ruling held that industrial risk must be lowered to the point of “gross disproportion” between the costs and benefits of further risk reduction. In effect, a risk is ALARP if the risk is insignificant in relation to the cost in money, time, or trouble required to reduce it further (HSE 2001; Baecher et al. 2015; Aven 2016).

The ALARP principle has since been applied to worker safety (e.g., HSE 2001), industrial public safety (e.g., Baecher et al. 2015; Malone 2005), and dam safety regulations (e.g., FERC 2016). In the early 1990s, the ALARP principle was introduced to the landslide risk management world in Hong Kong following a series of fatal landslides from engineered slopes that were constructed to allow building development (ERM 1998; Malone 2005). Recently, in British Columbia, Canada, the ALARP principle has been used by a local government to allow new residential development to be constructed in a large, well-recognized, debris-flow hazard zone at Cheekeye River (DoS 2018).

In all these applications, those who benefit from taking the risk are different from those who bear the potential for injury or death. For example, the industrial plant owner and product consumers benefit from the safety risks taken by residents living adjacent to, and workers working at, the hazardous facilities. Similarly, land developers benefit financially from the safety risks taken by those who buy homes in landslide hazard zones. This imbalance in ownership of risk costs and risk benefits justifies the ALARP principle, making it a reasonable condition for risk tolerability in these situations. The ALARP condition requires those who reap the benefits of the risk to pay for additional risk reduction that meets the gross disproportion test.

However, many landslide risk situations do not share this risk ownership imbalance. For example, when a landslide on a natural slope is first recognized above an existing home, the residents bear both the risk’s potential costs (e.g. loss of property, injury, life loss) and the risk’s benefits (e.g. living at home). Similarly, when a landslide affects a public roadway, the road-users bear the risk’s potential costs (e.g. vehicle damage, injury, life loss) and the risk’s benefits (e.g. road remains open). In these situations, the gross disproportion test for further risk reduction tends to be inappropriate. The costs of risk reduction are real (and often immediate) and should not be overlooked. For example, costs can include: loss of a home or business, loss of a roadway or utility, or diversion of limited resources away from other more critical hazards.

When a single entity owns the risk costs and benefits, a policy of balance (or proportionality as opposed to disproportionality) will tend to be a better approach. In these situations, the conditions for tolerating a risk can include: keeping the risk under review, using available resources to reduce risk, seeking cost-effective measures to reduce risk, or applying standard practices in landslide risk reduction.

For landslide risk at existing development, risk reduction practices could include: landslide hazard mapping, education of residents, development of emergency response and evacuation plans, landslide early warning system, feasible structural mitigation measures, periodic review and change detection, and local protection measures at the building. At new development, best practices may include avoidance or large-scale structural mitigation measures. Gross disproportion between mitigation costs and risk reduction benefits may be a reasonable requirement for a new development or where one entity (who would pay for the mitigation) causes or transfers landslide risk to another individual. However, in the common scenario where the landslide hazard is natural and the person at risk and the local government have limited resources, the concept of gross disproportion is commonly unachievable and counter-productive. Therefore, rather than referring to ALARP as the default condition for tolerability, we recommend listing specific, clear, and achievable conditions.

There is no universal risk tolerance threshold for individuals

Residents are sometimes forced from their homes or choose to remain in their homes after government declares them uninhabitable due to high landslide risk. This phenomenon has been widely recognized and studied for other hazard types like hurricanes (e.g., Bowser and Cutter 2015), and we have observed this related to landslide risk in places as diverse as British Columbia, Canada, and Guatemala City, Guatemala (e.g., Faber 2016). In these situations, risk tolerance objectives imposed by governments are inconsistent with the tolerance of the individuals who are at risk. To the individual, the benefit of staying home outweighs the perceived risk.

While we acknowledge that there is no simple solution to this divergence of risk perception, incentives, and objectives, we suggest that some common ground can be gained by recognizing that there is no ‘universal’ risk tolerance threshold. Risk management decisions are informed by many other factors (Vanem 2012), such as availability of funding (Strouth and McDougall 2021), perceived liability, perceptions of voluntary versus involuntary risk exposure, societal risk, cultural norms, precedent, and necessity of being in a specific place (i.e., because there is no other place to go to). We recognize that some jurisdictions may need to define a single, clear risk tolerance threshold, even after weighing the other considerations raised in this article. However, as a network of practitioners and landslide risk managers, we may be able to achieve greater multi-hazard risk reduction, and save more lives, by selecting thresholds that are specific to the unique situation of each jurisdiction, and treating the thresholds as flexible guides that inform, rather than dictate, decisions. Perhaps most importantly, the individual at risk should have some ability to influence the risk management decision.

Risk tolerance threshold selection and policy development should consider the benefits perceived by residents to living in the landslide hazard zone, and recognize that a population’s background risk of death is highly variable. For example, the landslide risk tolerance threshold appropriate for countries like Guatemala and Nepal may be different than the thresholds that are applied in places like Hong Kong, Canada, and USA. This is partly because background risk of death is relatively higher in Guatemala and Nepal (Fig. 6), and a higher level of landslide risk is often tolerated to attain economic or other benefits (e.g., survival) that come with living in a landslide hazard zone or spending resources on managing hazard types (e.g., food insecurity, violence, disease) other than landslides (Oven 2009; LaPorte 2018).

Secondly, recognize that in all parts of the world, a person’s background risk of death varies over three orders of magnitude during their lifetime (Fig. 6), and the landslide risk tolerance threshold imposed by a government can vary from being insignificant to the most important risk faced by an individual. It may be appropriate for an individual community or home (e.g., occupied by an elderly person) to deviate from the typical practice, particularly when the risk and alternatives are clearly communicated and voluntarily accepted. This concept is illustrated by Fig. 7, which compares common landslide risk tolerance thresholds (in red) with risk of death from other causes in the USA (in black). Figure 7 suggests that a risk tolerance threshold of 10 micromorts/year is insignificant for all age groups, while a risk tolerance threshold of 1000 micromorts/year is significant for all age groups and nearly an order of magnitude higher than the background risk of death for children ages 5 to 14 years old.

Fig. 7
figure 7

Comparison of common risk tolerance thresholds (red) with risk of death per year in the USA from other causes for three different age groups (data from NVSS 2019). The area of each triangle is proportional to the risk in micromorts; it is neither a traditional pie chart nor polar bar chart

Full size image

Individual and societal risk evaluation thresholds are unrelated

When we describe risk evaluation thresholds, we are commonly asked about the relationship between the individual risk tolerance threshold (often 100 micromort, 1 × 10−4 annual life-loss risk) and the societal risk tolerance threshold (often annual probable life loss of 1 × 10−3, see reference line in Fig. 8).

Fig. 8
figure 8

An example societal landslide risk evaluation tool (Strouth and McDougall 2021)

Full size image

In short, individual risk tolerance thresholds are unrelated to, and need to be defined independently from, societal risk tolerance thresholds and reference lines. Individual and societal risk tolerance thresholds originated from different places and have different meanings. Societal risk tolerance thresholds refer to the probability of ‘N’ fatalities out of a larger population. They do not consider risk to any specific individual. The tolerable probability of one or more fatalities on a societal risk evaluation tool (Fig. 8) is not equivalent to an individual risk threshold.

For example, 1 fatality per year is expected if 1 million road users in a busy metropolitan area are exposed to a rockfall hazard site that causes an average annual individual risk of 1 in 1 million (1 micromort per year). The individual risk of 1 micromort per year would generally be perceived as tolerable both by individuals and by the methods described above for setting risk tolerance thresholds. However, the societal risk of 1 or more fatalities per year (probability approaching 1 at N = 1) at a single rockfall hazard site would be unacceptable in many societies. Specifically, societal risk tolerance criteria from various countries compiled by Ball and Floyd (1998) tended to tolerate only 1 fatality every 100 or 1000 years at a given hazard site.

Conclusions

Landslide risk evaluation decisions are sometimes made based on simple comparison of landslide risk estimates with a threshold defining the tolerable risk level. Although the methods for estimating individual landslide risk and values of tolerable landslide risk are well documented in the literature, several overlooked and perhaps misunderstood details remain. This article explored several of these details, making the following suggestions:

  1. 1.

    Use micromorts — Consider using the risk unit, micromort (one micromort is a risk of 1 in 1 million), to describe landslide risk. Risk values presented in micromorts are easier to understand than other common risk notations, which facilitates comparison of risk values and informed decision making.

  2. 2.

    Best estimates of risk are needed for risk evaluation — Inflated risk estimates are inappropriate for risk evaluation because they can disrupt livelihoods and divert resources from other, more critical hazards. Underestimates can cause inaction at a time or place where action is needed. Assess and present uncertainties transparently while using best estimates for risk evaluation.

  3. 3.

    Combine landslide scenarios properly to avoid overestimation of risk — Define landslide scenarios to capture the range of possible consequences, which is often a function of the landslide size and described as a return period (or probability of occurrence). Recognize that these scenarios may represent components of a continuous probability curve and not discrete events.

  4. 4.

    Recognize unquantified risks to avoid underestimation of risk — Do not ignore unquantified risk. Quantify risk for the full range of possible landslide volumes (where practical) or assess risk qualitatively and consider it in the risk evaluation decision.

  5. 5.

    Specify return periods to include in the risk estimate — In some places, a regional guideline or practice dictates the landslide return periods included in the risk estimate. In this case, the return periods included in the risk estimate can have greater control on the risk evaluation decision than the risk tolerance threshold. When a government or organization specifies a risk tolerance threshold, they need to also specify if all possible landslide volumes are to be included in the risk estimate, or if not, how the unquantified risk will be estimated and considered in the risk evaluation decision.

  6. 6.

    Adjust pre-defined return period classes — Return period classes that are pre-defined by guidelines for risk estimation typically need to be modified to match conditions at the site of interest. Replace the guideline’s arbitrary starting point (most frequent return period) with the return period of the smallest landslide that could cause life loss. Identify which return period class causes a consequence similar to the maximum credible landslide.

  7. 7.

    Avoid unachievable risk tolerance thresholds at existing development — Select a risk tolerance threshold that is achievable for the typical risk profile of landslides affecting the community, considering available resources and feasibility of risk management measures. A very low risk tolerance threshold that is unachievable is not a useful decision-making tool, except perhaps at new developments where the purpose is to promote hazard avoidance.

  8. 8.

    Select an appropriate condition for risk tolerability — The ALARP principle requires that spending on risk reduction measures is disproportionally high. This may be appropriate at new development or where one entity creates or transfers landslide risk to another. In other landslide risk situations, conditions that seek to evenly balance costs and benefits of risk reduction measures tend to be more appropriate.

  9. 9.

    Use landslide early warning systems — At some existing developments, the only feasible and affordable method to manage life-loss risk from low-probability/high-consequence events is evacuation during periods of elevated hazard. Evacuation is imperfect, but its effectiveness can be improved by a well-trained population, a well-developed emergency response plan, and an early warning system that monitors, forecasts, and analyzes landslide triggering conditions.

  10. 10.

    Recognize that risk tolerance thresholds are not universal — Common risk tolerance thresholds in literature are set based on the background risk level of children in the developed world. However, background risk levels and perceived benefits of living in a landslide zone vary widely across the world and within regions. Other factors should inform risk management decisions, including: alternatives for managing risk; resources available for managing risk; perceived benefits of tolerating the risk; and whether landslide risks are perceived as voluntary or involuntary. Additionally, the individual at risk should be able to influence the risk management decision.