Fluvial flood risk management in a changing world

Flood risk emerges from the interaction of hazard and vulnerability. Over recent decades the notion of risk being the basis for flood management decisions has become widely accepted and operationalised through the use of models and quantified risk analysis providing the evidence for risk-informed decision making. However, it is now abundantly apparent that changes in time, at a range of scales, of pertinent variables that determine risk are not a second order consideration but, instead, fundamentally challenge the conventional approach to flood risk management. The nature of some of these changes, particularly those that operate on extended timescales, are highly uncertain, yet decisions that may have implications for several decades still have to be taken. In this paper we explore how flood risk management may be adapted to address processes of uncertain future change. We identify a range of levels at which change may be incorporated in decision making: in the representation of uncertain non-stationary quantities; in the rules that are used to identify preferred options; in the variety of options that may be contemplated for flood risk management; in the scope of problem definition, which increasingly extends to address multiple hazards and multiple functions of river basins; and in the social and organizational characteristics that promote adaptive capacity. Integrated responses to changing flood risk need to attend to each of these levels of decision making, from the technicalities of non-stationarity, to the promotion of resilient societies. Correspondence to: B. Merz (bmerz@gfz-potsdam.de)


Flood risk and its components
The focus of this paper is on damaging floods, i.e. floods that have adverse impacts on the social system, the natural system or the built environment.Typically, river floods are defined hydrologically in terms of a river's water level or discharge.Pielke (2000) points to the weak relationship between hydrological and damaging floods: even if we know much about hydrological floods in a certain area, we may know little about damaging floods.Damaging floods result from a combination of physical and societal processes.The decisive role of societal processes is mirrored in the definition of disasters, e.g.given by ISDR (2004) as "... a serious disruption of the functioning of a community or a society causing widespread human, material, economic or environmental losses which exceed the ability of the affected community or society to cope using its own resources".
Disaster risk management is discussed by using a variety of terms, such as risk, hazard, exposure, vulnerability, coping capacity, resistance, resilience and adaptive capacity.On most of these terms there is no consensus (e.g.Gallopin, 2006;Cutter et al., 2008).Hence, we need to define the terms we use in this paper.
Hazard denotes a chance phenomenon capable of causing harm.Fluvial flood hazard can be characterized by the probability and intensity of high river flows and resulting inundations, and depends on the physical processes of flood generation.Vulnerability V represents the societal processes and is composed of exposure E, susceptibility S and response capacity RC.For instance, exposure of a flood-prone community is equal to the assets that may be affected by floods.In its broadest sense assets comprise the built environment, humans and their socio-economic systems, and the natural environment.These need not be restricted to assets that are located in inundation areas, since indirect flood effects may damage assets outside the flooded area.Susceptibility S is the degree to which the system is damaged by certain floods.For example, buildings with precautionary measures implemented would be hit less hard, or adequate early warning and prepared citizens would allow emergency measures and, hence, reduce the damage.Response capacity RC describes the ability to respond to and to recover from a flood.For example, building owners with greater financial or personal resources or with flood insurance have a greater availability of means to repair damage and to recover.Further, we define adaptive capacity AC as the ability to adjust to observed or expected changes in flood risk.Adaptations may include modifying susceptibility, increasing its response capacity and reducing exposure: V (t) = f (E (AC(t)), S (AC(t)), RC(AC(t))) (1) The concept of vulnerability involves various dimensions (De Bruijn, 2005;Cutter et al., 2008;McDaniels et al., 2008): social (e.g.age, education level, social embeddedness), economic (e.g.abundance of monetary resources), and organizational/institutional (e.g.sharing of information to aid in the recovery process, zoning and building standards).Although vulnerability is a local characteristic, it is influenced by national and regional aspects (Yohe and Tol, 2002).While various studies have assessed different dimensions of vulnerability of systems (such as communities) to natural hazards, and while a number of indicator sets have been proposed for quantifying these dimensions, challenges remain in the development of consistent metrics (Cutter et al., 2008) and in the transformation of these concepts into operational tools for management purposes (Klein et al., 2002).Fluvial flood risk, as interaction of hazard and vulnerability, is frequently given as the expected annual damage: i.e. the mathematical expectation of flood damage within a given time period, depends on the probability density function f h (h,t) of the flood water level h, and on the relation between h and damage D. The lower integration limit is h D , the threshold water level above which flood damage occurs.Since vulnerability and hazard are non-stationary, risk changes in time.

A brief review of flood risk management
Flood risk management can be defined as the "continuous and holistic societal analysis, assessment and mitigation of flood risk" (Schanze, 2006).Traditionally, fluvial flood risk reduction has been concentrated on river training, construction of embankments and retention by reservoirs.Such measures, also called flood control strategies, aim at reducing the flood hazard, i.e. the probability of flooding.Attempts to decrease vulnerability, i.e. the other aspect of risk, have been of minor importance (Vis et al., 2003).Meanwhile, it is well recognized that structural flood control alone does not solve the flood problem.For example, Tobin (1995) discusses the dominant reliance of historical flood mitigation on dikes in the United States, and comments this as an "undying love affair" with dikes.He points to the so-called levee-effect: once a levee has been constructed, the structure may generate a false sense of security, leading to greater development in the dike hinterland and reduced flood awareness and precaution.
Figure 1 illustrates human effects on riverine flood risk including risk reduction options.Different spatial domains are involved and the effects and interventions act on different time scales.Whereas human activities in the upper three domains modify the flood hazard, activities in the lower two domains impact vulnerability and adaptive capacity.Most human effects on flood risk have rather long time scales.For example, land use change and urbanisation develop with time scales of decades and centuries and short term corrections are not possible.
There has been a shift over the past one or two decades, from flood protection to flood risk management.This shift can be described in a very condensed form by three developments (Hall et al., 2003b;Sayers et al., 2002): 1. Managing all flood events: traditional flood engineering has focused upon the definition of a design flood event and specification of systems that are intended to prevent flooding in conditions of that severity.Flood risk management, by contrast, addresses a full range of events, including those that exceed the design standard, and also addresses processes that may cause flooding even if the event is below the design standard.This may be due to unexpected failure modes or other flooding sources, such as intense local rainfall or groundwater flooding.The idea of "living with floods" acknowledges the illusion of complete safety against floods (e.g., ISDR, 2004), leading to a stronger focus on decreasing vulnerability.The emphasis in flood risk management is upon reducing harmful outcomes rather than prescriptive approaches to responding to particular flooding mechanisms.
2. Risk-informed decision making: estimates of flood risk, the costs of options and any other (perhaps unquantifiable) costs and benefits, form the basis for decision making.There is a strong emphasis upon a proportionate response to risk, so that the amount invested in risk reduction is in proportion to the magnitude of the risk and the cost-effectiveness with which that risk may be reduced.The process of estimating risk is transparent and the results are accessible, so that risk estimates may be used to inform multiple decision makers, including the general public.

Integrated systems approaches:
it is recognized that fragmented approaches towards risk reduction need to be replaced by integrated, more holistic views (e.g., Bogardi, 2005;Ashley and Blanksby, 2007).Increasingly, technical flood defence is being complemented or replaced by measures for reducing effects of flooding, such as warning systems, emergency measures, spatial planning regulation, flood-proofing of buildings or insurance solutions.Measures and strategies for flood risk reduction do not stand alone and should be considered in the context of other river functions (Middlekoop et al., 2004).This shift in flood risk reduction policies can be observed in the European Flood Directive on the assessment and management of flood risks (European Commission, 2007).It requires developing management plans for areas with significant flood risk, focusing on the reduction of the probability of flooding and of the potential consequences to human health, the environment and economic activity.Flood risk management plans will be integrated in the long term with the river basin management plans of the Water Framework Directive, contributing to integrated water management on the scale of river catchments.
Shifts in flood risk management policies are also under way in European countries.In Germany, the August 2002 flood in the Elbe and Danube catchments triggered an intensive public discussion.A comprehensive analysis of the disaster and the state of flood risk management by the German Committee for Disaster Reduction (DKKV, 2003) concluded, among others, that: -The reduction of potential damage should have top priority.Risk reduction through spatial planning must be strengthened.Private precaution should be systematically developed.
-Although technical flood defense is essential for reducing extreme flooding, it is only effective up to certain return periods.The residual risk must be accounted for and published.
-Flood risk management is a cross-sectional task and requires cooperation between different stakeholders and interests, such as nature protection or drinking water protection.Actions covering complete catchments and extending across political borders are essential.
-All measures of flood risk reduction must be considered in a holistic way within the catchment.They must be weighed in accordance to their importance and their effectiveness, and with regard to their interaction.
-An open discussion process on flood hazard and vulnerability, on limitations and possibilities of risk reduction measures has to be initiated and maintained.Risks have to be disclosed.
This study and similar publications, such as the "Instruments and recommendations for the implementation of forwardlooking flood protection" of the Working Group on Water of the German Federal States (Länderarbeitsgemeinschaft Wasser, LAWA 2004), have found widespread acceptance, however, the implementation of such recommendations is difficult.
The need for a strategic approach to flood protection in the UK was recognized in the Ministry of Agriculture's (MAFF & Welsh Office, 1993) policy document on flood and coastal defence.Over the subsequent decade and a half a risk-based approach to integrated flood management has been developed and put into practice.The principles of risk-based decision making were first set out for MAFF in Meadowcroft et al. (1997).Severe floods in the autumn of 2000 shifted flooding up the political agenda, and the government launched its Foresight Flood and Coastal Defence project (Evans et al., 2004), which examined possible changes in flood risk at a national scale on a timescale of 30 to 100 years into the future.The Foresight study analysed the drivers of changing flood risk under a range of different climate and socioeconomic scenarios.It went on to explore possible responses and strongly advocated the need for portfolios of integrated flood risk management measures, implemented in a phased way and tailored to the needs of particular localities.These recommendations were taken up on the government's policy document Making Space for Water (Defra, 2005).This evolution of flood risk management practice in the UK has been underpinned by a progressive improvement in the quality of flood risk analysis and decision support available at a range of scales.
National flood risk assessments based on the approach described by Hall et al. (2003a) have been undertaken periodically since 2002.The quantified RASP (Risk Assessment for System Planning) methodology was also used in the Foresight study (Evans et al., 2004) and has been progressively improved, thanks to improved national datasets.The original RASP methodology did not address surface water flooding in urban areas, but since 2007 there has been a rapid acceleration in risk analysis methods that can analyse flooding from multiple sources in urban areas (Dawson et al., 2008;Falconer et al., 2009;Hankin et al., 2008) in order to inform integrated urban flood risk management.

Purpose of the paper
The rapid evolution of flood risk management that has been summarised briefly above is mirrored in different ways in many countries worldwide.It is stimulated in part by the recognition that long term processes of change threaten to increase flood risk significantly in the future.Yet these processes of change also undermine some of the assumptions, such as the stationarity assumption, upon which flood risk analysis and management has traditionally been based and present very substantial challenges for decision makers (Milly et al., 2008).In the following sections this paper briefly touches the types and magnitude of changes in flood risk in Europe, and summarises that these changes lead to larger uncertainty for flood risk management.The focus of the paper is the discussion of emerging approaches for managing flood risk in a non-stationary environment riddled with uncertainty and unpredictability, in order to identify flood risk management strategies that are sustainable in a rapidly changing world.

Typology of change
A broad consensus exists that flood risk is already changing at a significant rate, and that the rate of change will intensify in the next decades.For example, the declaration of the 4th International Symposium on Flood Defence, 6-8 May 2008, Toronto, acknowledged that (1) "...costs associated with floods in terms of both lives lost and damages sustained continue to rise on a global scale", and (2) "...the threat from climate change continues to grow and changes the frequency and severity of floods and coastal storms" (ISDF4, 2008).Hence, it is of utmost importance to quantify past and current changes (identification), to associate identified changes with their causal drivers (attribution), and to quantify expected future changes (prediction).

Drivers of change
The EEA's (European Environment Agency) DPSIR model can be used to conceptualise changes which demand adaptions of risk management.The planning cycle of implementation is based on the general scheme of Driving forces, Pressure, State, Impact and Responses (DPSIR) adopted by EEA (1999): 1. Socio-economic developments result in driving forces (D).
3. Environmental pressures lead to changes in environmental state (S).
4. Changes in environmental state are reflected in environmental and socio-economic impacts (I).
5. Stakeholder gains/losses from impacts lead to policy responses (R) which affect one or several of the components mentioned before.
Whilst the DPSIR framework deals with the changes in system state, an extended framework is required to evaluate instantaneous system state in terms of risk.A well-established framework in environmental risk assessment is the Source-Pathway-Receptor (SPR) model (DETR et al., 2000), which is based upon the causal linkage between the source of environmental hazard (for example a pollutant), the mechanism by which it is transmitted (for example in the groundwater) and the receptor, which suffers some harmful (in the case of pollution) impact.The same framework is useful in the context of flooding, as it reflects the physical processes by which flooding occurs.In the case of flooding: -Sources are the weather events or sequences of events that may result in flooding (e.g.heavy or sustained rainfall).
-Pathways are the mechanisms that convey flood waters that originate as extreme weather events to places where they may impact upon receptors.Pathways therefore include fluvial flows in or out of river channels, overland urban flows and failure of flood defence structures or urban drainage systems.
-Receptors are the people, industries and built and natural environments that may be impacted upon by flooding.
The instantaneous flooding system state can be captured in terms of a set of state variables that characterise flooding sources, pathways, receptors, or a combination thereof.Typical state variables might be flood defence levels, numbers of properties in the floodplain, etc.Some state variables may be naturally fluctuating, for example rainfall intensity or tide level in an estuary, so will be characterised by probability distributions representing (stationary) time-averaged behaviour.
The changes in the flooding system captured in the DPSIR model are reflected in changes in the state variables over a range of time scales.Any phenomenon that may change the time-averaged state of the flooding system is referred to as a driver (Evans et al., 2004;Hall, 2003;Thorne et al., 2007).Some of these drivers will be under the control of flood managers, e.g.construction and operation of flood defence systems or introduction of flood warning systems to reduce the consequences of flooding (i.e.reduce the number of human receptors).Many other drivers, e.g.climate variability, or increasing values of house contents, are outside the control of flood managers and even government in general.The distinction between these two types of driver is not crisp and in terms of policy relates to the extent to which government has power to influence change and the level of government at which power is exercised.For example, decisions regarding local flood defence improvements are devolved to local decision-makers, whereas decisions about river training are taken at national and international levels.
The range of drivers that may influence flooding systems was surveyed in the UK Foresight Future Flooding project (Evans et al., 2004).The drivers identified as being relevant for fluvial flooding were ranked in terms of their potential for increasing flood risk in the future, in the context of four different socio-economic and climate change scenarios.Whilst the ranking was based largely upon expert judgement and a broad scale quantified risk analysis, it did provide some indications of the relative importance of different drivers of change for flood managers in the future.

Is it possible to identify, attribute and predict change in flood risk?
Changes in flood risk and its components can be classified according to time scales and temporal behaviour (such as short term versus long term change, gradual versus abrupt change, periodic versus episodic change), and according to space scales (local versus regional versus global change).In processes like flooding, which vary naturally at a range of time scales, change may become visible in several different respects and be apparent in more than one statistic.For example, flood times series may show a decrease in the mean flood and, at the same time, an increase in variability (Delgado et al., 2010).Changing auto-correlation will be reflected in the degree of clustering of flood events.
B. Merz et al.: Fluvial flood risk management in a changing world Due to this variety of types of change, there are many different methods for identification, attribution and prediction of change.Two main methodological approaches can be differentiated, namely (1) the (mainly statistical) analysis of observation data in order to detect and attribute past changes, and (2) the simulation of changes in order to detect and attribute past changes or to assess possible future changes.Currently, our ability to identify, attribute and predict changes in flood risk is very limited due to: -Lack of reliable and sufficient data: flood magnitude, in terms of water levels, discharges and inundation areas, are difficult to measure.Whereas today most flood events are measured and documented in a satisfying way, information on many floods of the past is sparse.Reliable time series of flood magnitude or frequency are often too short to derive reliable statements on changes.The large natural variability of flood time series makes the detection of changes particulary challenging (Radziejewski and Kundzewicz, 2004).Time series required to detect change and separate it from low-frequency climate variability are seldom available.We even may not know what the longest period of variability is.Although studies of historical floods and paleofloods, i.e. events before the period of systematic observations, provide an exciting avenue for understanding variability and changing characteristics of floods (e.g.Thorndycraft et al., 2002), they are often limited in providing quantitative data.Information on flood vulnerability and damage is even more scarce and much more uncertain than hazard data.Pielke (1999) notes that data that enable determination of trends in the level of societal vulnerability to floods are lacking.In Germany, for example, data on flood damage are collected in inconsistent, isolated data sets, hosted by a number of organisations.Many data sets are surveyed by governmental agencies and insurance companies for the purpose of loss compensation and are not comprehensive enough for deriving statements on vulnerability (Elmer et al., 2009).Historical data must be carefully adjusted for changing conditions such as population growth or insurance coverage, and data on government relief payments for losses are biased due to politically-based decisions (Changnon, 2003).
-Lack of process understanding: flood levels and inundation areas are the result of complex physical processes (Fig. 1).While some processes that change flood hazard are well understood, the effects of many others are largely unknown.An example for the first group is the effect of river training works and retention measures on flood peaks (e.g. for the river Rhine: Lammersen et al., 2002).Blöschl et al. (2007) give some examples for the second group, such as the modification of catchment flow pathways as consequence of land use changes.Similar to the data problem, the understanding of processes of societal vulnerability is much less advanced than the understanding of the physical processes of flood generation.Although there are a number of studies that try to quantify the relation between flood vulnerability and underlying factors (e.g., Wind et al., 1999;Thieken et al., 2005), vulnerability to floods is poorly understood.
-Limitations of current-generation models for assessing flood risk and its past and future changes: a comprehensive model approach to assess changes in flood risk requires the combined simulation of all relevant domains, i.e. atmosphere, catchment, river network and floodplains, and indirectly affected areas, including predictions or scenarios of their future changes.Studies on the uncertainty of models simulating single domains of the flooding system reveal considerable uncertainty associated with flood hazard and risk estimates (e.g., Apel et al., 2008;Merz and Thieken, 2009).The uncertainty associated with a complete model chain is large, especially at the required level of decision-making.Dessai et al. (2009) hint at the explosion of uncertainty when climate change impact assessments aim to inform adaptation decisions, since uncertainties accumulate from the various levels of the assessment.Differences between different models or models setups remind us that the results are highly conditional on the assumptions made.
In summary, the identification and attribution of past changes in flood risk are, to a large degree, an open question.Changing patterns of flood losses over time are the result of an intricate puzzle of various factors, such as changes in weatherrelated processes, in population dynamics and economic development, risk reduction measures, changing policies, or changing thresholds of disaster losses (Hoeppe and Pielke, 2006).The superposition of these processes with the stochastic nature of floods makes the quantification of the contributions of different drivers to changing risk extremely difficult, if not impossible.Concerning future changes, Dessai et al. (2009) point out that the accuracy of climate predictions is limited by fundamental, irreducible uncertainties.Moreover, climate change is only one of many important processes effecting future flood risk.Other processes, e.g.future economic developments, demographic changes, are even harder to assess.

What dominates change in flood risk?
There is a rapidly growing amount of literature on changes in flood hazard.For many regions and rivers flood trends analyses are available.Due to the variety of influencing factors, a ubiquitous growth of floods is not seen and cannot be expected (e.g.Kundzewicz et al., 2005).On the regional and the catchment scale, increasing or decreasing flood trends have been identified and -in some cases -linked to changes in climate or catchment processes (e.g.Petrow et al., 2009).
Frequently, in very long time series clustering of extreme events becomes evident which results in fluctuations of statistical characteristics.
Trend analyses on flood damage are rare, due to the rarity of comprehensive data bases.However, the ubiquitous perception is that flood damages are growing fast or even dramatically.Two of these rare studies are Pielke and Downton (2000) and Barredo (2009) who both analysed rather trustworthy data sets compared to many other statements on the growth of flood damage.Pielke and Downton (2000) study the US national flood damage record of the National Weather Service for the period 1903-1997.The total annual flood damage, adjusted for inflation, grew in that period with a mean annual rate of 2.92%.Barredo (2009) compiles a time series of economic damages of major floods in 31 European countries for the period 1970-2006, based on the public databases NATHAN of Munich Re and EM-DAT of CRED (Centre of Research on Epidemiology of Disasters).15 out of 27 events occurred in the second half of the study period, and the raw data clearly shows increasing losses.In a further step, both studies normalise flood damage to account for time-varying socio-economic factors.Assuming that the annual US population growth (1.26%) is representative for the population growth in flood-prone areas, 43% of the increase in flood damage can be attributed to population growth.If it is assumed that the wealth in flood-prone areas grows at the same rate of the nation's wealth (3.13%), then all of the increase in flood damage can be explained by the economic growth.Similarly, Barredo (2009) normalises the raw damage data by considering inflation and changes in population and wealth.Further, inter-country price differences are removed by adjusting the losses for purchasing power parity.Once the economic losses are normalised, a significant trend is not found.Both studies conclude that the observed increase in the raw flood loss data is mostly driven by societal factors, although Pielke and Downton (2000) also find indications that increased precipitation is associated with increased flood damages.Llasat et al. (2008) analyse flashfloods in Catalonia and attribute the increase in the number of extraordinary flash-floods causing damage to infrastructure along rivers to the growth of urban development and, hence, to increasing exposure.Other studies, partially based on less reliable data or on more qualitative measures (Mitchell, 2003;Changnon, 2003;Choi and Fisher, 2003;Hoeppe and Pielke, 2006), come to similar conclusions: the observed growth of flood damage is dominated by societal change and economic development, although changes in weather-related extremes are deemed to play a role as well.Mitchell (2003) gives some illustrative examples of the impact of societal drivers on flood risk in Europe, such as the increased use of European floodplains by export-oriented businesses.The advantage of navigable waterways that connect deepwater international ports triggers increasing exposure to flood risks, as it is seen in the lower Rhine valley.Urban redevelopment projects in old river cities of northern Europe are designed to improve the attractiveness of waterfront areas.Low-value investments, such as old docks and crumbling warehouses, are giving way to higher-value investments, such as cultural facilities, shopping and entertainment complexes (Mitchell, 2003).At the same time, the increasing interconnectedness of modern societies and their dependence on infrastructures (energy supply, communication, transportation, water, etc.) produce new vulnerabilities, and sometimes unexpected second-order effects.For example, the UK floods in 2007 led to the loss of piped water for 350 000 people for up to 17 days (Pitt, 2007).Other, more subtle drivers include the aging of Europe's population which may contribute to increasing susceptibility and decreasing coping capacity and adaptive capacity.

Putting change in perspective
This brief review of changes in flood risk leads to the following conclusions from which risk management response are derived in the next section: -Flood risk is a dynamic entity.It is changing, and frequently increasing, due to changes in all its various domains.Increasingly fast changes are observed or expected.The drivers of change will in the foreseeable future not lead to some stable equilibrium, but change will accompany flood risk management.
-The contribution of different drivers is largely unknown, however, rapid economic, social, demographic, technological and political changes seem more important and immediate than climate change.The effects of climate change on flood risks should be considered in the context of other global changes that affect the vulnerability of flood-prone communities.
-Predicting change in flood risk is highly uncertain and partly impossible.Climate change and other dynamic processes increase the uncertainty with which flood risk management has to cope.

Five levels of response to change in flood risk management
Whilst the policies of flood risk management are still being assimilated into practice, increasing recognition of processes of change calls for a review and improvement of flood risk management.We characterize these various levels of response to change in Fig. 2, which is structured to expand from technical issues of uncertainty representation at the heart of the management decision making problem, to increasingly procedural and organizational issues to do with problem framing and organizational culture.In Fig. 2  following sections we go on to examine each of these levels in more detail.However, it should be clear that these various levels of response to change are not alternatives.There may be alternative approaches at any given level, which will need to be matched to the context of particular flooding systems.However, responding to uncertainty will require careful consideration and conscious adoption of strategies at each level in the hierarchy shown in Fig. 2. Responding to uncertain processes of change cannot solely be dealt with through careful analysis of uncertainties using statistical methods.It requires attention to questions of problem framing and institutional context.On the other hand, focusing only upon adaptive capacity at an institutional level does not provide sufficient information for flood risk managers to make decisions at a technical level.Responding at all of these levels requires a breadth of skills and perspectives which do not widely exist.

Level 1: uncertainty representation
Quantification of uncertainty is at the heart of formal approaches to decision making under uncertainty.Conventional risk-based decision making represents uncertainties in probabilistic terms and then establishes a preference ordering over the decision options on the basis of expected utility.This approach to decision making is central to flood risk management, which considers the probability and consequences of a wide range of flooding conditions.However, considera-tion of long term change and associated uncertainties means that probabilistic treatment of natural variability needs to be supplemented by representation of the surrounding epistemic uncertainties.These also have been treated in probabilistic terms (Vrijling and Van Gelder, 2006), but where uncertainties are severe, for example associated with long term socioeconomic changes, scenario-based approaches have tended to be adopted.

Sources of epistemic uncertainty
Hall and Solomatine (2008) review the sources of uncertainty in flood risk management decisions from the point of view of the various elements of a formal risk-based decision, namely: 1.The inevitable simplification of the flooding system in order to characterise it in terms of a finite vector of state variables x t .
5. The cost of the various flood risk management options at the disposal of the decision maker; and 6. the choice of discount rate or any alternative means of dealing with time preference.Hall and Solomatine (2008) then go on to describe a process whereby the various sources of uncertainty are documented, evidence is assembled and propagated through to relevant decision variables.

Estimating non-stationary processes and associated uncertainties
In conventional flood engineering there has been an assumption of stationarity in the probability distributions that describe the inherent variability of flooding systems.Changes in flood risk have been accommodated for by adjusting flood hazard estimates, such as flood quantiles, and flood risk estimates on an adhoc basis.Often, damaging floods have triggered such adjustments.Consideration of change admits the possibility, and now in many cases inevitability, that distributions are changing through time.The notion of time-varying risk (Eq.2) requires treating both components, hazard and vulnerability, as non-stationary quantities.
Non-stationary frequency analysis allows to estimate timevarying flood quantiles, e.g. by assuming a time-varying distribution function for flood water level f h (h,t).Although these approaches are relatively young, there is a rapidly growing number of studies using non-stationary flood frequency analysis (Khaliq et al., 2006;Villarini et al., 2009).Non-stationarity in observations is incorporated through time-varying moments or parameters of the distribution.Khaliq et al. (2006) point to the importance of careful diagnostics and interpretation of non-stationarity of extremes.Low frequency variability may cause effects which could be misinterpreted as trends in short series.In such cases an extension of the data base is essential.For example, if climate change is expected to be the cause of observed non-stationarity, its analysis in the regional context is recommended.The consistent detection of changes across a region increases the confidence that the non-stationarity of extremes is attributable to regional climate change.Time-varying approaches allow the extrapolation of flood quantiles into the future.However, future trends may be very different from the trends observed in the past.Introducing time-dependence into frequency analysis is just one option to approach changing flood hazard; another option is the use of simulation models incorporating assumed future changes.
If risk-based design is used, an estimate of the future development of the relation between flood water levels and damage will also be necessary.Whereas non-stationary modelling of flood hazard is a challenging task, the incorporation of non-stationarity in vulnerability estimation and modelling seems to be even more challenging.
As consequence of non-stationarity, flood quantiles, design floods and flood risk evolve in time.This poses particular problems for the design of flood protection infrastructure with lifetimes of several decades.If the future development could be estimated with sufficient reliability, the design could be based on the most unfavourable situation during the expected lifetime.However, in most cases uncertainty of future development will be great and will have implications for Levels 2 to 5.

Scenario analysis
Whilst probabilistic analysis of uncertainties applies a probability distribution over the space of possible future, scenario analysis explores the implications of a (usually small) set of contrasting possible futures without applying a probability distribution over that set.There is a large variety of scenarios approaches, from qualitative storylines to the detailed quantitative modelling of future developments.Flood risk scenario development requires defining key drivers of change, such as climate, economy, demography, technology and social values, and critical uncertainties.Scenarios are frequently constructed in a discussion process involving groups of experts or stakeholders and integrating different perspectives (Middlekoop et al., 2004;Raadgever and Becker, 2008).
Within scenario analysis there is an emphasis upon generating narrative descriptions of multiple facets of possible futures.That narrative is intended to ensure that the scenario is internally consistent.The use of a small set of scenarios is motivated by the fact that scenario construction and analysis depends heavily upon the judgement and insight of the individuals involved, so it is seldom feasible to work with more than a few scenarios.An alternative approach adopted in numerous studies by Lempert et al. (2003) is to describe a continuous space of possible futures (again with no probability measure applied over that space) and use computer simulation to explore the performance of decision options over that space.
As with every approach to uncertainty representation, to be of use in flood risk management, scenario analysis must be accompanied by an approach to decision making.The various approaches to responding to uncertain evidence are dealt with at the next level in our hierarchy of approaches.

Level 2: preference ordering
For a given set of flood risk management options, a decision is expressed as a preference ordering over those options, with the first rank option being the one that is selected.When the probabilities and utilities associated with decision options are well known, then it is hard to argue with preference ordering being established on the basis of maximization of expected utility.However, in situations of severe uncertainty concerning long term change, then it has been argued that it Statements on the uncertainty of flood risk analyses are an important input to decision making (Merz et al., 2008).Different stakeholders of the flood management process have different perspectives and the provision of a single estimate may not meet the decision needs of all stakeholders (Downton et al., 2005).Palmer (1999) shows that probability forecasts of weather and climate have greater potential economic value than single deterministic forecasts.On the basis of a probabilistic forecast, different users with different cost/loss ratios will take precautionary action at different forecast probability thresholds.A user who would suffer a catastrophic loss if a certain event occurred would take precautionary action even when a small probability of the event was forecasted.A user for whom precautionary action was expensive in comparison to the loss would take precautionary action only when a relatively large probability of the event was forecasted.This example illustrates that decision makers with different context, e.g.different cost/loss ratio, different attitude towards risk aversion, may decide differently given information on the uncertainty.

Criteria for preference ordering under severe uncertainty
In situations with severe uncertainty, as it is the case for flood mitigation planning for infrastructure with lifetimes of several decades, additional criteria besides the maximization of performance apply.An important criterion is robustness.
A variety of versions of robustness analysis have been presented, with early work in the context of water resource management (Hashimoto, 1982;Matalas and Fiering, 1977).Robust strategies perform well under different possible but initially uncertain future developments.Related to robustness is the no-regret approach (e.g.Heltbert et al., 2009).
No-regret solutions are solutions that yield benefits regardless of future developments.They seek to contribute to risk reduction measures that do not overly hinge on risk projections.No regrets options are attractive in principle but may not exist in practice.Another definition of no-regret solutions is the proposition that they should limit future options as little as possible (IRMA-SPONGE, 2002).A further criterion is flexibility, i.e. the ability to be adapted to changing circumstances (De Bruijn, 2005).Hence, the possibilities and costs of reversing or adapting measures if the future develops in unexpected ways need to be explored.
Measures that are robust and flexible differ from optimal strategies which provide the maximum benefit given the most likely future development but which may fail entirely if certain conditions are not met (Pahl-Wostl, 2008).They represent trade-offs and are associated with real or opportunity costs (Heltbert et al., 2009).Indeed, highly optimized systems may be particularly vulnerable to unexpected eventualities.
At Level 1 we introduced scenario analysis as a means of representing aspects of uncertainty that are difficult to quantify, in particular associated with socio-economic futures.Scenario analysis helps to identify different aspects of system performance and, in particular, circumstances in which decision options may not perform well.This approach was adopted in the UK Foresight study (Evans et al., 2004) where the scenarios in which flood risk management options might perform badly were isolated.Schanze et al. (2008) link the scenario approach to flood risk management options in order to explore the robustness of risk management alternatives.In addition, the scenario approach may be used to assess the possibilities and costs of reversing decision options: If the future is not or only partially predictable, future situations may be conceivable where today's decisions will be needed to be reversed (Pahl-Wostl, 2008).

Worst-case thinking
By definition, risk analysis is probabilistic.However, when the uncertainty about the flood risk within the planning horizon is very large, it may be wise to complement probabilistic thinking by possibilistic thinking, by elaborating worstcase scenarios.A systematic analysis of the sensitivity of the flood risk system and the alternative risk management options to unexpected events, even though they are assumed to have an extremely small probability of occurrence, may minimise surprise.Clarke (2005) discusses the value of worstcase thinking to disaster policy and provides examples of how neglecting worst-case possibilities can lead to serious mistakes.
Take dike breaches, as an example.The rarity of dike breaches during the last century in Germany led to a neglect of inundation due to dike failure before the August 2002 flood, although in the Federal State of Saxony it was known in June 2002 that the status of 42% of 730 km levees along the Elbe River and 480 km levees along the main tributaries in the middle section of the Elbe River did not match the technical standards.During the 2002 flood 131 levee failures occurred.Dike breaching is still not very well understood and -due to a threshold process -risk estimates may differ dramatically between scenarios with and without dike breaches.If the possibility of breaching is contemplated then it is no longer meaningful to indicate flooded and non-flooded (safe) areas for a certain flood.It may be necessary to make provisions for the case that the analysis underestimates the flood risk, for instance by preparing evacuations for the case that predictions are wrong and underestimate unsafe areas.Further, risk management options might be selected which have smaller potential for surprise.
The use of worst-case scenarios is not without problems.Frequently, decision makers refuse to consider them, since they are perceived as unrealistic.Furthermore their elaboration and communication to the public might trigger public pressure to rule them out in any case.Then the associated real or opportunity costs need to be made clear and weighed against other risk reduction options.The value of discussing worst-case scenarios in situations with large uncertainty is the additional dimension that this process adds to the risk assessment and risk management strategies.

Level 3: option generation
The concepts of robustness and flexibility can be used to analyse a set of options in order to identify choices that perform well under conditions of future change, but in order to apply such analysis it is necessary to generate a set of options, including options that have some prospect of being robust or flexible.Whilst Levels 1 and 2 in our typology deal with processes of analysis, option generation is a fundamentally creative process.It is therefore rather difficult to be prescriptive.Nonetheless, analogy to experiences in other industries and fields of environmental management provides hints at potential approaches to management of safety-critical systems under conditions of uncertainty.

Pluralism, diversification and decentralization
When generating candidate Flood Risk Management options under severe uncertainty, it is sensible to contemplate a very broad spectrum of options.In situations with very large social and political uncertainty, pluralism has been frequently recommended.Diverse approaches tend to increase the likelihood that at least some of these will prove useful (Shackley et al., 1998).Risk spreading by diversification is among the mechanisms for coping with change and crisis of socialecological systems (Adger et al., 2005).
Based on Modern Portfolio Theory in the area of financial investments, Aerts et al. (2008) analyse the overall risk reduction effect of different sets of investments in flood mitigation.In a simplified example for an area in the Netherlands, they show that by systematically combining four different mitigation measures in portfolios containing three or four measures, risk is reduced compared with portfolios that contain only one or two measures.Further, uncorrelated activities help to optimize the risk reduction.This example supports the idea that planning for an uncertain future should build on diversification.
Loosely linked to the idea of diversification is decentralization.Concentrating flood defence in large systems may create a more vulnerable system than decentralised defences.Large, centralised defence systems tend to create threshold processes, i.e. if they fail, the damage will be catastrophic.

Fail-safe approaches
Fail-safe describes a system which, in the event of failure, responds in a way that will cause a minimum of damage.Although failure may not be completely unavoidable, its consequences should not be catastrophic.Fail-safe is a widespread concept in safety considerations of technical devices, for example, in the aviation industry.However, it has penetrated flood risk management only partially.For example, today's rate and sequence of inundation in case of a flood exceeding the defence are the result of many past interventions whose implications for flood risk have not always be taken into account.Embankments of infrastructure (railway, roads) may significantly influence the rate and sequence of inundation.It seems to be a rational strategy, in order to promote fail-safe systems, to optimize the safety system consisting of many different measures, in order to minimize the damage caused by an inundation.
On the one hand, fail-safe approaches acknowledge that safety systems may fail.On the other hand, these approaches seek to minimise losses.Discussing flood risk management in the Netherlands, Vis et al. (2003) and Alkema and Middlekoop (2005) point to the growing awareness that it is impossible to guarantee totally secure defence, and put forward ideas for controlled flooding.Spill-over segments of dikes withstanding overtopping allow flooding in certain areas, also called temporary emergency retention basins.The floodprone area is subdivided in compartments and this compartimentalisation greatly controls the rate and sequence of inundation.Alkema and Middelkoop (2005) analyse impacts of historically grown compartimentalisation on flood risk and conclude that a well-designed compartment layout is needed in order to minimise flood losses.
However, this implies different safety standards within a country or region.Flooding a certain area in order to prevent the inundation of another, more valuable area is a politically critical issue.Different floodplains would pose different hazards to property, social structure and possibly life.Before such decisions can be taken, the expected damage and benefit must be assessed and communicated, measures to reduce damage must be thoroughly considered, and the issue of compensation needs to be settled.
Today, it seems unclear to what extent emergency retention basins and compartimentalisation approaches will be implemented.In Europe's democratic societies, these approaches need a certain public consensus.The Netherlands seems to be one of the European countries which do not completely oppose this thinking.Already today, there are different safety standards for flood-prone areas: four safety levels (1:1250, 1:2000, 1:4000, 1:10 000) are assigned to the 53 dike rings, based on the type of flooding and the population and investments inside the dike rings (Samuels et al., 2006).

Examples of robust and flexible damage reducing measures
Recently, the discussion of robust and flexible flood damage reducing measures has gained momentum.One strand is the adaptation of the built environment to the flood hazard.For example, Gersonius et al. ( 2008) and Tagg and Escarameia ( 2008) discuss flood proofing strategies, such as elevated configuration of buildings, sealing of buildings to prevent water entrance, use of materials and buildings in such a way that the impact of inundation is minimised or floating or amphibious buildings that can move with fluctuating water level.Tagg and Escarameia (2008) conclude that flood proofing construction has clear benefits: it can limit damage to the fabric of a building and minimise the time during which residents are without their home.Surveys of flooded households show that private precautionary measures may significantly reduce flood damage (Kreibich et al., 2005;Thieken et al., 2005Thieken et al., , 2007)).Whereas the damage reducing effect of flood proofing technologies has been shown, their economic efficiency is unclear, at least at the large scale (Gersonius et al., 2008).However, such approaches are robust in the sense that flood proofed buildings will experience lower damage in case of flooding, regardless of the exact future development of the flood hazard.Although it is frequently speculated that such measures are most cost-effective, the cost/benefit ratio depends on the boundary conditions, such as the costs for flood proofing.Zevenbergen et al. (2008) note that one third of the European building stock will be renewed within the next 30 years.This renewal provides a window of opportunity to consider flood reduction and, hence, to decrease flood vulnerability of the built environment.
Another example for a robust strategy is the enhancement of self-protective behaviour of people living and working in flood-prone areas.Grothmann and Reusswig (2006) note that self-protective behaviour of residents can drastically reduce monetary flood damage.If residents are aware of their flood risk and of their possibilities to undertake effective precautionary measures, and if this awareness can be maintained, flood damage will be reduced under different possible but initially uncertain future developments.Stalenberg and Vrijling (2006) give an example for flexibility in urban areas.A building combines flood protection with other functions, such as traffic and recreation.Its design takes into account the possibility to expand or add functions.For instance, if the flood level increases excessively, more floors can be added to the building.

Level 4: problem domain
In responding to changing flood risk, flood risk managers are seeking to make use of a wider range of possible measures.Several of these possible responses to flood risk were mentioned at Level 3, above.These extend to include land use planning and building construction, amongst a host of other measures.Yet flood risk is not the only, or indeed the primary, consideration that land use planners, for example, have to account for when making decisions.Thus, as the range of options that are considered as responses to flood risk expands, so too does the number of other issues that need to be taken into account in decision making, many of which may be quite unrelated to flooding.
Whilst flooding is distinctive in many respects, building capacity to deal with flood events may be best thought of in terms of decreasing multi-purpose vulnerability to natural and man-made hazards in general.If communities are to be reconfigured to be less vulnerable to flooding, and in certain instances this may involve wholesale retreat from the floodplain when the frequency of flooding or evacuation becomes intolerable, then surely the settlements they move to should be designed to be not only resilient to natural hazards but also sustainable in a much broader sense.Low vulnerability to flooding is one of many objectives in the design of communities.Another example of multi-purpose decision making is infrastructure planning and operation.The dependency of society on large-scale infrastructure systems, such as traffic, energy and communication networks, paves the way for increasing indirect losses.Infrastructure planning and operation should take into account the risks due to flooding and other hazards.
Flood risk management inevitably needs to be part of a broader multi-purpose process of system management at a range of scales, from communities in urban and rural areas, up to whole river basins.These sub-systems and systems serve multiple purposes and there will be plurality of objectives in their management.

Flood risk management as part of IWRM
The failure of localised attempts to deal with fluvial flooding has underlined the need to take a strategic approach to catchment management.There are equally compelling arguments to deal with other catchment functions at a river basin scale, including water supply and hydro-ecology.Therefore, flood risk management needs to become an integral aspect of a multi-functional approach to river basins as it is addressed in IWRM (Integrated Water Ressources Management).IWRM is defined as "process which promotes the coordinated development and management of water, land and related resources, in order to maximize the resultant economic and social welfare in an equitable manner without compromising the sustainability of vital ecosystems" (Global Water Partnership, 2000).The boundary conditions of IWRM, i.e. equity between economic, social and environmental aspects, are general guidelines for flood risk management as they are based on the concept of sustainable development.To date, flood defence has been considered as single-use facilities, with few exceptions such as multi-purpose dams.
Dual-or multi-use approaches that combine disaster risk reduction with other functions are particularly suitable in situations with severe uncertainty.They offer societal benefits even if disasters do not occur (Allenby and Fink, 2005).Further, the maintenance of single-use flood risk management options is challenging during prolonged flood-poor periods, when flood awareness decreases and the need for flood risk management is less obvious.In such periods it may be simpler to maintain the flood risk reduction function if it is combined with other purposes.Flood risk management options should therefore be systematically screened if they could be combined in multi-use solutions.
Examples for investments which could reduce flood risk and provide additional economic, social or environmental benefits are: -Tools for complex information management at the urban level: such tools could be developed for planning of emergency management for floods and other natural and man-made hazards, but also for routine management of complex urban infrastructure, and as educational tool for city managers and the public (Allenby and Fink, 2005).
-Multi-hazard warning system: advanced forecasting and warning systems contain elements that are similar for different purposes.For example, the data transfer in (near-) real time or provision of warnings to decision makers at the community level and for disaster management are to a large extent independent of the hazard type.Warning systems that are not only used for flood warning but also for warning against other threats could capitalise on common tasks and infrastructure.
-Enhancing water retention capacity in catchments: Increased water retention, for instance by enhanced soil water retention, contributes to flood risk reduction and decreases drought risk.
-Multi-functional zonal defence: The ComCoast activities (ComCoast, 2008 1 ) seek to move from traditional single-line defences at coastal sites of five North Sea countries to multi-functional coastal zone defence, integrating flood defence with other functions such as recreation and environmental development.Similar objectives of environmental enhancement alongside water management are entailed in the Dutch "Room for Rivers" policy.

Level 5: institutional culture
The final level at which we consider flood risk management is in terms of the organizations, institutions and society in which flood risk management is embedded.It is at this level that processes and cultures of decision making are established.Adaptive capacity, which is increasingly thought of as being desirable in the context of uncertain future changes, is cultivated and manifest at institutional and societal levels.

Adaptive management and regular updating
Major floods usually trigger policy change due to public outrage and political pressure (Samuels et al., 2006).This reactive behaviour should be replaced by proactive behaviour and strategies of adaptation.These strategies need to be developed over time, since adaptation will not be one-time necessity.
Adaptive management is a systematic process for improving management policies and practices by learning from outcomes of implemented management strategies (Pahl-Wostl, 2008).It is key for enhancing and maintaining adaptive capacity.Pahl-Wostl (2008) discusses the ingredients of adaptive management regimes, where a management regime is defined as the whole complex of technologies, institutions, environmental factors and paradigm that together form base for functioning of the management system targeted to fulfil a societal function.
An essential element of adaptive management are iterative learning cycles incorporated into the overall management approach (Pahl-Wostl, 2008).In flood risk management, the idea of learning cycles and regular updating is gaining ground.For example, DKKV (2003) discusses flood risk management as management cycle.Helbrecht and Smith (2008) report on the Disaster Mitigation Act of the US Federal Emergency Management Agency that requires State, Indian tribal, and local governments to develop mitigation plans that must be updated on a regular basis (three-year cycle for State level plans, five-year cycle for local and tribal plans) to ensure that the risk assessment data and the mitigation strategy are current.The Flood Defence Act of the Netherlands contains a provision to review the appropriateness of the legal safety standards with a ten year cycle, and the asset managers who are legally responsible for the defences meeting the standards have to demonstrate this every five years through a safety assessment that is reported to parliament (Flikweert and van Ledden, 2008).The EU flood directive requires reviewing, and if necessary updating, the flood risk assessment and the flood hazard and risk maps every six years (European Commission, 2007).

Risk dialogue and safety culture
As long as flood risk management consisted primarily of structural measures, such as retention basins and dikes, flood defence was, to the largest part, the task of administration.The increasingly prominent role of non-structural measures requires a much larger involvement of the public, and a functioning dialogue on the flood risk and mitigation options is an essential element of an integrated flood risk management (Pearce, 2003;ISDR, 2004;Ashley et al., 2007).There are examples where administration tended not to disclose flood risk information in order to avoid public panic (DKKV, 2003).However, several projects have demonstrated the benefit of involving the affected people.Examples are the neighbourhood emergency programmes along the Pacific Coast from California to Canada (Pearce, 2003) or the citizens' initiative "Floods Köln-Rodenkirchen" in Cologne/Germany.An approach for the involvement of the local stakeholders has been developed for municipalities in Switzerland (Bähler et al., 2001).In workshops moderated by risk experts, the knowledge and experiences of locals (e.g.members of authorities and organizations involved in disaster mitigation and disaster management, people that have been affected by floods) are systematically collected and structured, to derive representative damage scenarios, to assign probabilities to the scenarios, to establish a risk profile of the community and to discuss need for action.This approach does not only help local characteristics to be considered; it also triggers a risk dialogue that improves the understanding and acceptance of the derived safety measures.
The discussion of risk dialogue leads to the issues of safety culture (Pidgeon et al., 1992;Guldenmund, 2000).Safety culture comprises the set of norms, roles, beliefs, attitudes and social and technical practices within an organization which are concerned with minimizing exposure to dangerous conditions (Davies and Walters, 1998).Organizations can be crisis-prone or crisis-prepared.Davies and Walters (1998) describe organizational characteristics that either support or inhibit crises to develop to disasters.Strategies of crisisprepared institutions are: -Provide feedback on previous incidents: learning from disasters and from less dramatic incidents requires an attitude of openness and a no-blame culture (Davies and Walters, 1998).A natural response after a disaster is looking for someone to blame.However, the identification of the culprit supports superficial event analyses: when the culpable actions are found, the analysis is often stopped without an in-depth investigation why these actions have been carried out.There is a tendency for anyone faced with blame to limit himself to statements which do not damage his position -an attitude that does impede understanding and learning (Hale, 1997).
-Use disasters, less dramatic incidents and near-misses as starting point for improvement: since the same event is unlikely to occur again, the incident is seen just as one possible sequence of events among many others.Hence, the incident should be used to prevent as many other adverse situations as possible.Limiting learning to controlling just one sequence is a waste of resources (Hale, 1997).
-Generate appropriate attitudes towards safety: individual and group beliefs about risks and the importance of safety, and their motivation to act on those beliefs will generate safety attitudes (Davies and Walters, 1998).
-Educate in safety culture: Education and training create an environment of constant awareness of risk issues and safety measures.
-Continuously reflect upon practice through monitoring, analysis and feedback systems: this continual reflection is denoted as organizational learning (Pidgeon and O'Leary, 2000) and is at the heart of adaptive management.
The analysis of man-made disasters revealed that there are preconditions to any major system failure, some originating years prior to the actual events (Turner and Pidgeon, 1997).During this period of increasing system vulnerability -labelled as disaster incubation period by Turner (1978) a chain of concealed errors and partially understood events builds up which does not coincide with the existing beliefs and views about the hazard.Hence, it is important to scrutinize assumptions and beliefs routinely.To this end, safety imagination (Pidgeon and O'Leary, 1994) may be helpful.Table 1 lists recommendations for thinking and discussing about safety issues.These recommendations intend to resolve fixation in thinking and to become open to unexpected developments and unconventional solutions, by extending the scope of potential scenarios (2, 3, 7 in Table 1), countering complacency and the belief that it will not happen to us (1, 4 in Table 1), accepting uncertainty and ambiguity (6 in Table 1), and by abolishing traditional assumptions and views (5 in Table 1).

Capacity for crisis intervention
Severe uncertainty contains the possibility for surprise and for failure scenarios which have not been foreseen.An integral element of flood risk management under severe uncertainty is the development of crisis intervention capacity.Although the need for emergency planning and for maintaining the ability to react in unforeseen situations has been acknowledged (e.g.Klemes, 1991), implementation has frequently been slow.The notion that safety systems can fail should be familiar to decision makers and the public.
New technological developments provide new possibilities for supporting crisis intervention.For instance, detection of possible weak dike reaches during a flood event or provision of inundation extent from satellite in near-real time could be Nat.Hazards Earth Syst.Sci., 10, 509-527, 2010 www.nat-hazards-earth-syst-sci.net/10/509/2010/ 4. Allow no worst case situation to go unmentioned.5. Suspend assumptions about how the safety task was completed in the past.6. Approaching the edge of a safety issue a tolerance of ambiguity will be required, as newly emerging safety issues will never be clear.7. Force yourself to visualise "near-miss" situations developing into accidents.
valuable information for disaster management (e.g.Martinis et al., 2009).The enhancement of traditional flood forecasting and warning by including flood defence failure, inundation areas and impact forecasting would help disaster managers to minimise adverse flood impacts.

Conclusions
The notion of flood risk as interaction of hazard and vulnerability and as basis for risk-informed decision making has become widely accepted over recent years.However, the various aspects of flood risk are changing in time at a range of scales.Some of these changes are rapid and/or highly uncertain.Flood risk decisions may have implications for several decades, therefore, flood risk management needs to deal with future changes.The variety of drivers of change and their superposition with the stochastic nature of floods makes the quantification of their contributions to changing risk extremely difficult or even impossible.The future evolvement of drivers, such as economic development or climate change, is highly uncertain and increases the uncertainty with which flood risk management has to cope.In the foreseeable future, change will accompany flood risk management.
Taken change as starting point, we identify five levels at which change may be incorporated in flood risk management.These levels are interlocked, from technical questions through management aspects to societal issues.Level 1 "Uncertainty representation" acknowledges that uncertainty is an essential aspect of flood risk management, and hence, that uncertainty needs to be assessed.Ideally, this should be done for all sources of relevant epistemic uncertainty including non-stationarity.The development of scenarios will gain increased importance in this respect.
Level 2 discusses the rules that are used to identify preferred options.Alongside the traditional approach of maximising performance, additional decision criteria should be taken into account in situations of severe uncertainty concerning long term change.These are in particular robustness and flexibility.Risk reduction measures should be evaluated in terms of their potential to serve their intended purpose or to be adaptable in situations which develop not as predicted.As consequence, decision making may have to be grounded on scenarios and may be supported by the discussion of worst-case scenarios.
Based on criteria for decision making of Level 2, a set of risk reduction options need to be created at Level 3.This set should be broader than traditional risk reduction approaches.Given uncertainty and change, risk spreading and diverse options increase the probability that some of these options will be useful.
Level 4 enlarges the problem domain and embeds flood risk reduction options into the wider context.For example, the vulnerability of a community to floods may be linked to the vulnerability of this community to other natural or anthropogenic hazards.Flood risk issues should be aligned with other functions of river basins.Multi-use solutions that combine flood risk reduction with other functions are particularly suitable in situations with severe uncertainty.They offer societal benefits even if flood disasters do not occur.
Level 5, encompassing all other levels, deals with the social and organisational characteristics that promote risk reduction and adaptive capacity.Flood risk management should be understood as adaptive management where stakeholders go repeatedly through learning cycles in order to improve and maintain the risk management.Ideally, such a management should be supported by an open risk dialogue of all stakeholders and should be embedded in a safety culture which improves risk awareness and crises-preparedness.Integrated responses to changing flood risk need to attend to each of these levels of decision making, from the technicalities of non-stationarity, to the promotion of crisis-prepared societies.
The modern approach of flood risk management embraces the full spectrum of management processes from technical analysis to institutional arrangements.In this paper the framework for flood risk management has been extended to include a wide variety of processes that may be adopted in order to explicitly deal with change.All of the approaches we have mentioned, from non-stationary statistical analysis to social resilience, have been proposed elsewhere.In this paper we have analysed how these approaches may become integrated in the flood risk management process.In doing so, they offer a series of potentially effective responses to change, at a range of scales.The challenge posed by the recognition of change within flooding systems should, however, not be under-estimated.We have seen how deeply embedded in flood risk management are notions of stationarity.Thus recognition of processes of change within flooding systems is a new and urgent stimulus for culture change within flood risk management.That prospect may be daunting, given the culture change that has already been required to internalize concepts of flood risk management across Europe.However, in this paper we have demonstrated that a set of approaches exist with which to address change and that these may be fitted within a coherent framework.Thus we set the scene for an era in flood risk management in which change is explicitly recognized and its management is embedded in decision making processes at every level.

Figure 1 :Fig. 1 .
Figure 1: Examples of human effects on flood risk and of drivers changing the average state of the flood risk system, including flood risk reduction options (modified from Merz, 2006) Fig. 1.Examples of human effects on flood risk and of drivers changing the average state of the flood risk system, including flood risk reduction options (modified from Merz, 2006).

Figure 2 :Fig. 2 .
Figure 2: Levels of responding to change in flood risk management (FRM: Flood Risk Management; IWRM: Integrated Water Resources Management) Fig. 2. Levels of responding to change in flood risk management (FRM: Flood Risk Management; IWRM: Integrated Water Resources Management).

B
.Merz et al.:  Fluvial flood risk management in a changing world (Ben-Haim, 2006;Hall and Solomatine, 2008)in a changing world may not be the best strategy to use maximization of performance as the sole decision criterion(Ben-Haim, 2006;Hall and Solomatine, 2008).