According to its charter, the National Commission on Risk Assessment and Risk Management is charged with investigating "the policy implications and appropriate uses of risk assessment and risk management in regulatory programs under various Federal laws." The demands of the risk assessment process far outstrip the ability of scientific investigation to give firm answers. Environmental statutes, however, place responsibility on certain Federal agencies to set regulatory limits on human exposure to potential environmental toxins so as to ensure public safety. The practical need remains, then, to make characterizations of the risk consequences (including the uncertainty about those consequences) of various potential actions. Faced with this practical problem, regulatory agencies have arrived at practical methodology. This methodology includes reliance on procedures that, while attempting to embody information from the available data, of necessity rely on uncertainty-bridging principles derived from a combination of general knowledge about chemicals, their behaviors in the environment and their toxic effects, a desire to maintain internal case-by-case consistency in how uncertainties are resolved, and a desire to ensure that regulatory decisions are likely to fulfill the legislative mandates about public health protection.

On the broad scale, Federal risk assessment practices follow the structure and methodological recommendations of the 1983 National Academy of Sciences report Risk Assessment in the Federal Government: Managing the Process. In detail, however, current practices in these areas vary among Federal agencies and even among regulatory programs within the EPA, reflecting the lack of a single, agreed-upon scientific procedure for the assessment of health risks from chemical exposures. In part, the diversity of methods can be attributed to the different questions being asked of the risk assessment process in different regulatory contexts by different environmental statutes. In part, it reflects different institutional judgments about the most appropriate methods and different scientific judgments about matters with high scientific uncertainty. And in part. it reflects simple policy choice made for the sake of consistency within each organization (which, owing to independent histories, becomes inconsistent among organizations). The effect of this diversity is to make it difficult to compare risks, or the actions taken to mitigate those risks, from one regulatory program to another.

The present report comprises a survey of chemical health risk assessment methodology among the Federal agencies primarily charged with regulating the production, use, emissions, and disposal of potentially toxic chemicals. The primary focus is on differences in standard methodology for assessment of potential chemically induced chronic health effects, examined in the context of each group's legislative mandates. The groups included are the Food and Drug Administration (Center for Food Safety and Applied Nutrition), the Occupational Safety and Health Administration, the Consumer Product Safety Commission, and the Environmental Protection Agency, with special attention given to the various regulatory programs within the last agency. In conducting this survey, each regulatory program's enabling legislation--the statutes that mandate regulatory activity--was examined regarding legislative purposes, mandates, and the nature of the regulatory powers granted as they affect the conduct of risk assessment by particular groups. Special attention is focused on the laws' requirements about who in the exposed population is to be protected, how the distribution of exposures among people comes into play, and how sufficiently protective standards are defined. Each organization's principal documentation on risk assessment policy and methodological guidance was examined. Many of the specific procedures are not clearly codified, however; office-specific practices are to be found in the patterns of analyses used in particular cases as documented in specific rulemaking actions. To develop information on these practices, and to gain a perspective on the operation of each regulatory office and its activities, a series of interviews was conducted with 23 key officials, risk assessors, and scientists in each of the offices covered by this survey.

Many of the methods of quantitative risk assessment, in the face of usually incomplete case-specific data, make conservative assumptions, on the grounds that "worst-case" analyses will at least not underestimate the true human risks. An application of the worst-case principle that has received considerable attention is the emphasis on risks calculated for the "maximally exposed individual" or MEI. The notion is that, in order for a regulatory action to protect the entirety of an exposed population, it must protect the person with the most exposure; hence, the most exposed person's potential risk serves as a benchmark for the adequacy of a proposed strategy to control, restrict, or ameliorate environmental concentrations of a chemical agent. The questions arise how often in current EPA practice and policies does the risk to the MEI actually form the basis of a regulatory decision and whether any such use follows from specific mandates in the regulatory statutes. Accordingly, particular attention is focused on the question of how various programs characterize exposure, on how individual risk versus population risk play in setting regulatory levels, and in particular on the role of estimates of the high end of individual exposure in this process.

The results of the survey are presented in discussions of each regulatory program's practices. Within the discussion of each program are sections on the program's enabling legislation and its risk mandates, notes on implementation of these mandates, and discussions of program-specific issues in hazard identification, dose-response analysis and characterization of quantitative potency, exposure assessment, and risk characterization and regulation. The main differences among agencies and EPA regulatory programs are summarized in tabular form.

To a large degree, the body of environmental laws that seek to establish practices that will ensure safety (or at least mitigate risk) of chemical exposures were established before risk assessment was a well recognized and codified discipline. Most of the methodology of risk assessment has been invented in reaction to the calls by these laws to define limits on exposure that will "protect the public health" or lead to "a reasonable certainty of no harm." That is, in passing the laws, Congress called on the regulatory agencies to develop means to assess risks so as to define exposure levels that would achieve the stated qualitative goals of health protection. The presumption in this approach (which is not always borne out) is that there will be relatively few such exposures in need of control and that controls that are clearly sufficient to achieve protection can be had at reasonable cost to those responsible and to society as a whole.

The present report has attempted to examine the major environmental laws for their mandates on risk and for their calls for risk assessment to address these mandates. Since the laws largely precede risk assessment methodology, there is little call for specific analytical actions on the part of regulatory agencies. Nonetheless, the need for risk assessment is implicit in every call to define levels of exposure in regard to the potential health effects they may cause.

The different risk mandates are all rather vaguely worded, and it is not possible to discern calls for different methods of risk estimation from a mandate to assure "reasonable certainty of no harm" and one to "protect the public health with an adequate margin of safety." The chief difference among mandates is whether they call for balancing costs and benefits or whether they account for feasibility of controls, issues that affect the uses to which assessed risks are to be put in regulation but that do not affect the conduct of risk estimation itself. Only in the Consumer Product Safety Act are the criteria for balancing risks and benefits, and the particular findings in this regard that must be made to justify regulation, explicitly spelled out.

The environmental laws do not allow the regulatory agencies any action to control risks--they specify the nature of the regulatory actions to be undertaken, whether these be the issuance of permits or registrations, the definition of acceptable ambient concentrations, the limitations of discharges, and so on. The nature of the regulatory actions required vary more among laws than do the risk mandates, and the regulatory powers under each law are tailored to the nature of the regulated enterprise or activity, hinging largely on practical questions regarding where regulatory control can be effectively administered to accomplish the ends and purposes intended.

From the point of view of risk assessment, this variation in regulatory powers tends to manifests itself in different exposure assessment methods. Consequently, there is more variation among regulatory agencies and programs in exposure assessment methods procedures than in assessment of toxic effects. In this report, an attempt has been made to relate the methods used in risk assessment (and in particular, exposure assessment) to the nature of the law's regulatory activities. Given these differences in the regulatory powers granted by the various laws, it is unreasonable to expect exposure and risk assessments to be equally realistic across regulatory groups. By their nature, laws acting through permits will define exposures above those usually seen in compliance since they regulate by specifying maxima; laws acting through ambient concentration standards that represent ambitions to control pollution will define exposures below those typically seen, since they regulate by specifying goals to be striven for; and laws acting through specification of difficult to achieve technical controls will define exposures (or at least emissions) close to that actually achieved, since they act by imposing uniformity in control.

Some regulatory activity must be prospective, aiming at controlling potential risks from activities yet to occur, while others focus on mitigation of current risky activity. Some laws empower regulators to require data on toxicity and exposure from petitioners, while in other settings risk analysts must make do with whatever existing data can be identified. Some laws permit regulatory control of many aspects of potentially risky activity, while others must allow for considerable unregulated variation in the public's activities regarding frequency, manner, and magnitude of exposure to compounds as a consequence of variation in lifestyles and preferences.

When the express aim of a law is to manage risks to the population, the exposure assessment should attempt to characterize the full distribution of exposure levels in the population as accurately as possible, so that the distribution of risks can be examined (and changes or shifts in the burden of risk under different regulatory options noted). In this circumstance, it is important to attend not only the existence of high individual risks, but also to the total burden of risk on the population. Many current environmental laws, however, are written so as to require protection from risk. Permits are issued, standards are set, conditions of use are defined, or cleanups are mandated so as to set limits on exposure such that few if any of the population of concern will experience risk levels that are "unacceptable." In this setting, the focus is on setting regulations to protect those at the high end of the risk distribution. This focuses the attention of the assessment on defining the upper end of the range of exposure scenarios for which it is intended to furnish protection. Depending on the law, this may be the top end of the actual distribution of exposures near a source (as in the Clean Air Act §112), a person of somewhat above average consumption of a medium contaminated up to a limit deemed permissible (as in the Safe Drinking Water Act), or an especially frequent consumer of a foodstuff containing an additive (as in the Federal Food, Drug, and Cosmetic Act). The present survey found much emphasis on high-end exposures and hypothetical exposures that would be the maximum allowable under a proposed regulation, but the only instance where a true "maximally exposed individual" serves as the basis of regulatory decision is in the Clean Air Act's provisions for triggering further risk analysis owing to "residual risk" after technical engineering controls on emissions have already been applied.

Whether the protected exposure is actual or hypothetical (and whether a hypothetical exposure is high or low compared to the upper end of actual exposures) may have less to do with data availability or willingness to use different exposure estimation techniques than with the intent of the law. A key factor is which parts of the exposure equation are under regulatory control and which are not. For instance, in setting pesticide tolerances, the assumption is made that all foods on which the agent is permitted in fact bear it, and at the maximally permissible level, when conducting initial exposure assessments. This is done not simple to be "conservative," but because the law requires setting levels that will be safe for consumers of the foods, and this must include protection of someone who chooses to eat all the foods containing the agent, even though few people may actually do so. Moreover, since permitting residues up to the tolerance level implies that such all such levels are acceptably safe, the tolerances have to be set such that they would be safe if they occur, irrespective of whether they in fact occur.

In other words, much of the attention to estimates of risk that are conservative in the face of uncertainty about potency and much of the focus on the upper end of exposures arise because these methods were invented to implement the calls from the statutes for defining regulatory actions that would ensure safety. As notions of effective risk management evolve, it is becoming clear that such methods are less well suited for estimating the actual burden of exposure and risk in populations. The discussions of each statute and regulatory program in this report attempts to examine how the methods that have evolved in each program reflect the tasks set for regulators, either explicitly or implicitly, by the various statutes as they set mandates about what is to be accomplished and by what regulatory actions.

The inconsistency of methods for dose-response assessment cannot be so easily explained in terms of response to different regulatory needs. The variety of methods seems to reflect the somewhat separate history of development of potency estimation in the different groups and the lack of a definitive scientific basis to guide these independent evolutions along exactly the same path. The variety of methods correctly reflects the uncertainty about the best or most appropriate procedures, but it results in the awkward result that different agencies can arrive at different characterizations of an agent's carcinogenic potency from the same set of data, based only on differences in preferred methods and precedents from earlier analyses. It would seem that harmonization of these methods to the extent achievable would be beneficial. At the same time, harmonization achieved through rigidity in rules for choice of methods would falsely imply that the mandated set of approaches is more correct than others and would stultify application of case-by-case judgment.

As with exposure assessment, the focus of much potency analysis is on defining levels of exposure that can be more or less assured of posing "acceptable" risk. The methods that are used in the face of uncertainty can usually be understood in this light. As the questions being asked by the risk management process move beyond such issues of assurance of safety, existing methodology and practices established in response to current environmental statutes become less appropriate.

Fundamentally, risk assessment methods are practical inventions put in place to address the kinds of questions asked of regulatory analysis by the mandates of the environmental laws. These laws and their mandates can be changed, and the methods for assessing risks will have to change with them, to respond to new needs.