Why risk acceptance criteria need to be defined by the authorities and not the industry?

In various industries it is common to use risk acceptance criteria to support decision-making. The criteria are seen as absolute in the sense that measures need to be implemented if the criteria are not met. In Norway the petroleum regulations state that the operator has a duty to formulate risk acceptance criteria relating to major accidents and to the environment. This practice is in line with the internal control principle, which states that the operator has the full responsibility for identifying the hazards and seeing that they are controlled. In this paper we discuss the rationale for this practice. The expected utility theory, which is the backbone for all economic thinking, is used as a basis for the discussion. We show that if risk acceptance criteria are to be introduced as a risk management tool, they should be formulated by the authorities, as is the common scheme seen in many countries and industries, for example in the UK. Risk acceptance criteria formulated by the industry would not in general serve the interest of the society as a whole.