Vale Brumadinho made tailings-dam stability declarations an independent-assurance accountability test

Summary

• On 25 January 2019, Dam B1 at Vale's Corrego do Feijao mine failed at about 12:28 local time. The technical panel retained through Vale's legal counsel estimated that roughly 9.7 million cubic metres, about three quarters of the stored tailings, left the impoundment in less than five minutes. Two hundred and seventy people died. The physical mode most consistently supported across the technical record is static flow liquefaction of loose, saturated and brittle tailings in a dam whose upstream raises had left later construction resting over weaker material.
• A stability declaration was not a complete safety finding. The signed declaration communicated a binary result while the underlying analyses contained marginal factors of safety, method-dependent assumptions, drainage concerns and commitments to future work. Vale's board-commissioned Independent Extraordinary Consulting Committee for Investigation found that the declaration support was not uploaded in full to the federal system and that senior reporting emphasized the percentage of positive declarations rather than the specific uncertainty at Dam B1.
• Practical control was distributed but not equal. Vale controlled the facility, operating data, expert procurement, budgets, land use below the dam, emergency planning and the decision whether to stop, drain, reinforce or relocate. TUV SUD Bureau de Projetos e Consultoria supplied the March and September 2018 declarations and had professional duties over its own work. The National Mining Agency, or ANM, set and enforced the mining-dam regime but depended heavily on owner-reported information and had limited field capacity. Municipal, state and federal responders could not replace decisions that belonged upstream in the lifecycle.
• The exact initiating event remains contested. The company-directed technical panel attributed initiation to continuing internal creep combined with a wet-season reduction in suction, and found no sufficient global trigger from drilling taking place that day. A later Federal Police theory treated water-injection drilling as determinative. In June 2026, Brazil's Superior Court of Justice said that this technical dispute must be tested in the criminal trial; it did not decide the merits. The disagreement does not erase the common antecedent: a structure already susceptible to brittle liquefaction and an assurance process that did not force conservative action.
• Enforcement outcomes must be separated. Civil and administrative measures have produced a R$37.69 billion judicial reparation agreement, an R$86.3 million anti-corruption-law fine against Vale that survived review in the Superior Court of Justice, and a federal administrative sanction against TUV SUD. Securities claims in the United States settled without Vale admitting or denying the settled allegations. Criminal proceedings against individuals and companies remained active in 2026, with no final criminal merits judgment establishing guilt as of the access date.
• Repair is material but not yet reducible to a completion percentage. Vale reported in December 2025 that it had completed de-characterisation work on 19 of 30 upstream structures and said it had implemented the Global Industry Standard on Tailings Management across its portfolio. Those are company disclosures, not a substitute for regulator acceptance, independent conformance evidence, long-term water and health results, or proof that compensation and collective projects have restored affected lives. Official Minas Gerais pages still described health and ecological risk studies, water monitoring and agreement obligations as continuing in July 2026.

The declaration was a control output, not the condition of the dam

Brumadinho is often narrated as a conflict between one signed paper and one collapsed structure. That framing is too narrow. A Declaration of Stability Condition, known in Brazil as a DCE, was the visible output of a larger control system. The system included the dam's construction history, geotechnical models, laboratory assumptions, instrumentation, visual inspections, drainage performance, contractor judgments, Vale's internal risk processes, board escalation, regulatory data and emergency consequences. A valid signature could only be as reliable as that chain.

If uncertainty was filtered out before it reached the signer, or if a paid signer could state stability while making future measures a condition of comfort, the declaration ceased to function as independent challenge.

The initial ANM public note records that Dam B1 had declarations associated with March, June and September 2018, with the September declaration attributed to an independent audit, and that Vale's December 2018 inspection entry reported no safety issue. ANM classified the dam as having low risk but high associated potential damage. That combination is important: a low probability label did not mean low consequence, and a positive declaration did not mean that every credible failure path had been eliminated. The initial record is available at https://www.gov.br/anm/pt-br/assuntos/noticias/2019/nota-a-imprensa-1.

The accountability failure was therefore semantic as well as technical. “Stable” could be read by an executive, regulator or investor as a broad assurance of safety. In the engineering work beneath the declaration, it meant that selected analyses met an accepted minimum under selected assumptions. Vale's board-commissioned investigation later described factors of safety near the boundary, disagreements over the applicable minimum and planned measures that had not yet changed the structure.

Binary reporting hid the distance between “calculation passes” and “risk controlled.” A robust control would communicate the margin, sensitivity, data quality, unresolved anomalies, consequence exposure and actions still open. It would also state who had the authority to stop operations or remove people while those actions remained open.

This distinction matters beyond mining. Public agencies, enterprise platforms and smaller service providers all consume assurance outputs. A signed result may propagate automatically through procurement, insurance, financing, licensing and continuity plans. If downstream users see only a pass status, automation increases the speed and scale of misplaced confidence. Brumadinho demonstrates that assurance data needs provenance, supporting evidence and escalation states. It should never allow a single Boolean field to erase a high-consequence exception.

Practical control followed the evidence, money and authority

Vale held the dominant practical controls. It owned and operated the mine; inherited and managed Dam B1; commissioned geotechnical studies; supplied instrumentation and operational data; selected and paid contractors; decided where employees and contractors worked; maintained the emergency plan; controlled the downstream administrative buildings and dining area; and could fund drainage, reinforcement, de-characterisation, relocation or closure. It also controlled what travelled from site specialists into corporate risk reporting and public disclosure. None of that means every Vale employee had the same knowledge or legal responsibility.

It means the corporation could combine information and resources in a way no external entity could.

The assurance contractor held a narrower but still consequential control. TUV SUD's Brazilian unit performed work supporting the stability declarations. A professional firm controls its methodology, acceptance threshold, qualifications, documentation, reservations and willingness to sign. It can refuse an engagement, qualify an opinion or withdraw when evidence is limited public evidence. Yet its decision operated inside a commercial relationship. Vale's committee found that firms performing dam reviews could also seek other geotechnical assignments from the same business area, and it described communications in which commercial pressure was perceived. TUV SUD has publicly contested allegations and said after the disaster that the Brazilian declaration framework involved uncertainty; its position is recorded at https://www.tuvsud.com/en-us/press-and-media/2019/april/accident-in-brazil-collapse-of-dam-of-a-retention-basin. The existence and legal effect of any pressure are matters for the competent proceedings, but the structural conflict is independently visible: the party needing the declaration chose and paid the party whose refusal could disrupt its plans.

ANM controlled regulation, registry requirements, inspection, enforcement and interdiction. It did not control the day-to-day condition of the dam or generate the owner's raw data. Its post-failure technical account said that the federal system relied substantially on information submitted by operators and identified discrepancies between Vale's records and the entries in the Integrated Mining Dam Safety Management System, or SIGBM. ANM also reported that its regional team had eight technical staff responsible for 425 dams covered by the national policy at the relevant time, and that the last agency field inspection at Dam B1 had been in 2016. The agency's account is at https://www.gov.br/anm/pt-br/assuntos/noticias/2019/agencia-nacional-de-mineracao-conclui-o-relatorio-tecnico-sobre-barragem-de-brumadinho. Resource limits explain part of the surveillance gap; they do not transfer the operator's duty to know and report its facility.

Other institutions controlled later stages. State environmental and civil-defence bodies had licensing, emergency and response functions. Prosecutors could seek injunctions and reparation. Labour inspectors could investigate workplace protection. Courts could impose or review remedies. Investors and lenders could demand disclosure or alter capital access. Communities possessed local knowledge and rights, but they did not have the same access to instruments, models, contracts or board papers. Calling all actors “stakeholders” can obscure this asymmetry.

Accountability should follow the actor's actual ability to see the risk, change the physical condition, prevent exposure or compel another actor to act.

The right control map is therefore temporal. Before failure, Vale and its assurance chain had the strongest prevention controls; ANM had oversight and compulsion controls; emergency authorities had preparedness controls; and workers and residents had little more than reliance and the ability to report visible concerns. After failure, prosecutors, regulators, courts and governments gained stronger enforcement and reparation controls. A post-disaster payment cannot retroactively equal a pre-disaster engineering veto. Likewise, an external regulator cannot inspect continuously enough to become the operator.

Each control should be assessed at the moment it could have changed the outcome.

A long construction history created a condition that snapshots could miss

Dam B1 began operating in the 1970s and was raised upstream over decades. The technical panel's report describes ten raises across roughly 37 years, with deposition ending in July 2016 and no raise after 2013. In upstream construction, later embankment stages advance over previously deposited tailings rather than remaining entirely on a conventional downstream foundation. That method can be managed only if material state, water, drainage, geometry and loading remain understood and controlled. It is inherently sensitive to the strength and saturation of the tailings beneath later raises.

The panel found that the stored tailings were unusually heavy because of their iron content, and that portions were loose, saturated, bonded and brittle. Under small deformation, such material can appear to carry load; after its structure breaks down, it can contract and lose strength rapidly. The upper raises had also moved the slope outward over weaker fine tailings, while internal drainage did not control the water regime as intended. The panel concluded that a flow liquefaction mechanism was possible without a conventional external shock. Its complete report is available at https://bdrb1investigationstacc.z15.web.core.windows.net/assets/Feijao-Dam-I-Expert-Panel-Report-ENG.pdf.

That report has high technical value but a defined independence boundary. Vale disclosed that the panel was retained by Skadden at Vale's direction to provide legal advice, that neither Skadden nor the panel undertook work independent of the company, and that the panel was not retained by the board's extraordinary investigation committee. Vale's own hiring notice states those limits at https://vale.com/ca/w/vale-informs-on-the-hiring-of-expert-panel. This does not invalidate the measurements or calculations. It means readers should compare the panel's conclusions with regulator, police, labour, legislative and judicial records rather than treat the report as a neutral adjudication of responsibility.

The dam's history also defeats a common snapshot error. An instrument can remain inside its alert threshold on the final morning even when the structure has approached a brittle limit over years. A visual inspection can find no new crack even though the model is sensitive to assumptions about undrained strength. Water levels can appear stable while the material's suction changes during rain. Stability is not a photograph; it is a claim about how the structure will respond across plausible states.

For a high-consequence upstream dam, the assurance process needed to integrate construction legacy, material variability, drainage performance, seasonal change and uncertainty, not merely ask whether the latest readings crossed a preselected line.

This is why retrospective evidence should not be simplified into “the instruments warned” or “there was no warning.” ANM later identified reportable anomalies and data discrepancies. The technical panel found no clear, accelerating precursor in the particular monitoring series it assessed. Both can be true. A control system may have enough evidence to demand caution without producing a neat, final signal that predicts the minute of collapse. Independent assurance earns its value precisely when evidence is ambiguous but consequences are extreme.

From 2016 to 2018, marginal evidence was converted into a pass

Vale's Independent Extraordinary Consulting Committee for Investigation, abbreviated CIAEA in the reference, was appointed by the board after the failure. Its February 2020 executive report reconstructs a sequence in which stability concerns existed before the 2018 declarations. It says 2016 analyses produced unfavourable results and that later work remained marginal. In one central analysis, the peak-undrained factor of safety was about 1.09. The report says a minimum of 1.05 was used, although the referenced publication did not establish that value as a general minimum for this application.

It contrasts that approach with other Vale dam practices and a Brazilian engineering recommendation of 1.3.

A factor of safety is a model result, not a physical shield. Its meaning depends on geometry, material strengths, pore pressures, drainage assumptions, loading cases and the failure surface analysed. A difference between 1.09 and 1.05 is not a four-percentage-point safety reserve that can be understood like a financial ratio. Uncertainty in input parameters can be larger than the numerical margin. For a brittle material and a consequence zone containing a workplace, a marginal result should intensify challenge, sensitivity testing and exposure reduction.

The committee says TUV SUD initially indicated that it could not issue a declaration where the result was below 1.3, then issued the March 2018 declaration using the lower threshold after discussions and with commitments for future actions. The report also describes a previous consultant's departure from work amid a divergence over criteria and later communications around the September declaration. These are findings of a committee commissioned by Vale's board, not final judicial findings against any individual or company. The committee explicitly said it was not determining legal responsibility and could not guarantee that it had found every relevant fact. Its executive report, including those limitations, is at https://vale.com/documents/44618/1272931/20.02.20_CIAEA_Report_i.pdf/b3fe6efd-bdba-abfd-3622-677369d820d4?version=1.0.

The critical control defect is visible without resolving every disputed message. A stability declaration represented present condition, while some of the comfort supporting it depended on work still to be done. Where a dam passes only if planned drainage, investigations or operational controls later improve confidence, the system should not display an unqualified current pass. It should display a restricted state, completion deadline, named owner and automatic escalation if evidence is late or adverse. Otherwise, an action list becomes an invisible condition attached to a public assurance.

The declaration also travelled without its full analytical context. CIAEA reported that the DCE was a short document and that the detailed factor-of-safety analysis was not itself placed in SIGBM. That design gave the regulator a result without the same ability to test the assumptions behind it. It also allowed corporate reporting to aggregate positive declarations across many dams. A portfolio showing 100 per cent positive DCEs sounds reassuring, but it does not reveal whether one high-consequence structure passed by a narrow and contested method.

Vale's committee further found that risk information changed as it moved upward. It described Dam B1's appearance in a more detailed technical risk panel and its absence, by name, from higher-level enterprise views. It also found no evidence that the board discussed the low factor of safety or removal of the downstream administrative facilities. This does not prove that every executive knew every technical fact. It shows that the governance architecture did not reliably preserve facility-specific severity as information was summarized. Accountability attaches to that architecture because aggregation was a design choice.

Monitoring data did not become a conservative decision

ANM's 2019 mining-dam safety report lists a substantial monitoring estate at Dam B1: piezometers, water-level instruments, inclinometers, survey points, flow measurements and radar. Instrument count alone did not produce control. The agency found inconsistencies between internal Vale information and regulatory reporting, including a drainage-related event, readings and radar behaviour that were not represented in SIGBM with the severity ANM later considered appropriate. It also described a piezometer emergency occurrence on 10 January 2019 that was not reported to the agency in the required way. The detailed annual report can be reviewed at https://www.gov.br/anm/pt-br/assuntos/barragens/relatorios-anuais-de-seguranca-da-barragens-de-mineracao-2/relatorio-anual-gsbm-2019-v-final.pdf/@@download/file.

The lesson is not that every anomalous reading proves imminent failure. False positives, faulty instruments and local effects are normal engineering realities. The lesson is that a high-consequence assurance system must preserve anomalies until an authorized, documented review explains them. A local score should not become a lower national score through unexplained mapping. An instrument classified as emergency should create a durable case record, independent review and closure evidence. Radar movement should be reconciled with survey and geotechnical models.

The owner should not be the only party able to see the raw series or change the interpretation supplied to the regulator.

ANM concluded that correct and timely information could have changed its response, including possible precautionary measures or interdiction. That is the agency's counterfactual assessment, not proof that a particular inspection would certainly have prevented the failure. It remains relevant because it identifies the control lost through incomplete reporting. A regulator cannot risk-rank what it cannot see. Conversely, the existence of a registry does not make the regulator the author of company data.

The agency interdicted the Corrego do Feijao complex on the day of the failure, as recorded at https://www.gov.br/anm/pt-br/assuntos/noticias/2019/anm-interdita-vale-em-brumadinho-mg. Interdiction after collapse protected against additional hazards but illustrates the timing problem. A stop-work power matters most when evidence crosses a pre-failure decision threshold. The future system therefore needs graded states before a declaration expires: normal, heightened surveillance, restricted operation, people removed from the self-rescue zone, and emergency. Those states must be driven by uncertainty and consequence as well as measured movement.

On 25 January, the failure outran the emergency architecture

Video and technical reconstruction place the initial collapse at about 12:28. The panel reported that the principal movement unfolded in seconds and most released material left within minutes. Administrative and dining facilities stood directly downstream. Vale's committee said inundation studies indicated that some occupied areas could be reached in roughly one minute. A warning system designed around siren activation after confirmation of failure could not provide a meaningful evacuation interval to people located that close.

The sirens did not sound effectively before the wave reached the mine facilities. That failure mattered, especially for understanding emergency readiness and potential warning farther along the path. But it should not be used to hide the prior land-use decision. The first life-safety control was to keep routinely occupied buildings outside the self-rescue zone. The official labour inspection analysis treats workplace location, emergency planning and the dam's physical condition as connected occupational controls, not isolated systems. The report is at https://www.gov.br/trabalho-e-emprego/pt-br/assuntos/inspecao-do-trabalho/seguranca-e-saude-no-trabalho/acidentes-de-trabalho-informacoes-1/relatorio_analise_acidentes_brumadinho.pdf.

This separation is important for accountability. Stability prevention, exposure reduction and warning are independent layers. A positive stability declaration should never waive safe siting. Safe siting should never waive monitoring. A siren should never be the only plan for an occupied zone with one minute of modelled arrival time. When one layer is weak, another must remain effective. At Brumadinho, the same organization controlled the structure, the workplace below it and the emergency arrangements, yet the controls did not compensate for one another.

The exact number used in public memorial language also requires care. Two hundred and seventy people were killed, including two women who were pregnant; commemorations in Minas Gerais often refer to 272 lives or “jewels” to include the two unborn children. The distinction explains why official sources can display 270 and 272 without describing different disasters. A Minas Gerais Civil Police memorial account explains the convention at https://www.agenciaminas.mg.gov.br/noticia/policia-civil-homenageia-joias-de-brumadinho-no-instituto-de-identificacao. This article uses 270 people for the fatality count while respecting the memorial total.

The physical failure mode is clearer than the initiating trigger

The strongest common technical conclusion is that Dam B1 underwent static flow liquefaction. Once deformation broke down the loose and brittle structure of saturated tailings, their available strength fell and a rapidly propagating failure followed. The panel identified several long-term contributors: weak fine tailings beneath parts of the raised embankment, high water conditions, inadequate internal drainage, the geometry of upstream raises, material bonding that encouraged brittle response, and continuing creep. No evidence of an earthquake or mine blast before the collapse supplied a conventional external trigger.

This is a root-cause account at the physical-system level. It is stronger than saying “rain caused the dam to fail” or “one borehole caused the dam to fail.” Seasonal rain can change suction and pore-water conditions, but a properly controlled high-consequence structure should tolerate expected weather. Drilling can locally alter stress or water conditions, but its effect depends on the already marginal state of the material. A trigger is not the same as the accumulated susceptibility that allows a tiny disturbance or internal change to produce catastrophic loss.

The company-directed panel's numerical work supported initiation by internal creep and loss of suction during the wet season. It examined drilling occurring on 25 January and concluded that the modelled disturbance was not sufficient to cause global failure. That conclusion has not ended the matter. A later Federal Police report advanced the theory that drilling with water injection was a determinative initiating event. Defendants have challenged the relationship between that theory and the panel's account.

In June 2026, the Superior Court of Justice maintained criminal cases against Vale and TUV SUD engineers and said the competing technical interpretations require evidentiary testing at trial. The court's report notes that omissions and an active trigger need not be mutually exclusive legal theories. It did not find that drilling caused the collapse, validate every prosecution allegation or determine guilt. The decision and its procedural scope are described at https://www.stj.jus.br/sites/portalp/Paginas/Comunicacao/Noticias/2026/16062026-STJ-mantem-acoes-penais-contra-engenheiros-da-Vale-e-TUV-SUD-por-rompimento-da-barragem-em-Brumadinho.aspx.

The disciplined conclusion is therefore layered. Confirmed fact: the dam was susceptible to a brittle liquefaction failure and did fail by rapid flow. Supported but contested inference: long-term creep and wet-season suction loss initiated the failure without a large external event. Open adjudicative question: whether same-day drilling with water injection was a determinative trigger and how any act or omission maps to individual criminal liability. A responsible account does not wait for the trigger dispute to acknowledge the antecedent control failure, and it does not treat the panel's model as a criminal verdict.

Paid assurance needed institutional independence, not an adjective

The word “independent” can describe a contractor that is legally separate from the operator while saying little about the engagement's incentives. Functional independence asks harder questions. Who appoints and removes the reviewer? Who negotiates fees? Can the reviewer sell other work to the same operating unit? Does refusal threaten future business? Does the reviewer have direct access to raw data and staff? Can it report to the board and regulator without management editing? Are the review criteria fixed before results are known? Is there a mandatory cooling-off period? Who records disagreements?

CIAEA found that Vale's geotechnical area engaged reviewers and other specialists, sometimes within wider commercial relationships. It described pressure perceived by reviewers and a culture in which challenge could be narrowed by hierarchy and silos. The committee did not state that every assurance opinion was corrupt, and the record does not support that generalization. It showed a procurement design unable to demonstrate independence where it mattered most: at the point a negative or qualified result could close a facility, impose large cost and contradict corporate confidence.

The minimum remedy is not simply to rotate firm names. The review mandate should be controlled by a body outside the operating business, with a protected budget and authority to communicate directly with the accountable executive, board committee and regulator. Other-services revenue should be disclosed and restricted. Selection criteria, scope changes, model assumptions and technical disagreements should form part of the assurance record. A reviewer should be paid for competent work, not for a positive outcome, and contract renewal should not depend on whether the declaration is convenient.

Regulatory architecture must also avoid outsourcing public judgment to the private opinion. An owner-funded review can supply expertise, but the regulator needs access to the full support package, raw time series, model files, laboratory basis, sensitivity results and unresolved exceptions. It should be able to commission a second review at the operator's expense without allowing the operator to select that reviewer. High-consequence, marginal or legacy upstream structures should receive more external scrutiny even when a declaration is positive.

Vale later published an accountability report on its response to CIAEA recommendations, saying it had adopted governance and risk changes. That is relevant evidence of management action, not independent proof of effectiveness. The company account is at https://www.vale.com/w/vale-releases-the-accountability-report-on-the-ciae-a-recommendations. Effectiveness requires evidence that adverse findings now reach decision-makers unchanged, that reviewers have issued qualified or negative outcomes without commercial retaliation, and that such outcomes cause physical or exposure controls. Policies and committee charts cannot establish those results on their own.

Board assurance failed when portfolio reporting erased facility severity

A board cannot run a piezometer network, but it can decide what information must reach it and what consequence follows. Brumadinho shows why aggregate compliance measures are dangerous. A report that all declarations are positive answers whether forms exist; it does not answer whether the most consequential dam is marginal, whether reviewers disagree, whether actions are overdue or whether people remain in the inundation zone.

CIAEA described compensation and performance systems in which safety measures existed but financial components remained larger, and where safety reporting focused significantly on audits and declarations. It also found that budgets were not readily traceable at the level needed to identify spending on an individual structure. These findings do not establish that a particular compensation payment caused a technical decision. They support a governance inference: the corporate system made formal completion and financial performance easier to see than the residual risk of Dam B1.

Board-level assurance should therefore operate by exception, not averages. Every high-consequence facility should have a named accountable executive and a concise record of minimum factor, sensitivity range, top unresolved observations, overdue actions, downstream occupancy and assurance conflicts. The board should receive the reviewer's dissent directly. A change from one consultant to another after a criteria disagreement should automatically surface. So should any use of a lower acceptance threshold than the operator applies elsewhere.

Public disclosure needs the same discipline. In April 2022, the US Securities and Exchange Commission alleged that Vale had made false and misleading claims about dam safety and sustainability before the failure. The complaint is an allegation document, not a judgment, and is available at https://www.sec.gov/files/litigation/complaints/2022/comp-pr2022-72.pdf. In 2023, Vale agreed to pay US$55.9 million to settle the stated claims without admitting or denying them; Vale also reported that the SEC would not oppose dismissal of claims framed as intentional or reckless. The company's filing is at https://www.sec.gov/Archives/edgar/data/917851/000129281423001206/vale20230328_6k.htm. The distinction prevents an enforcement settlement from being recast as an admission while preserving the accountability lesson: broad safety statements need traceable support at facility level.

The harm extended beyond a fatality count

The release killed 270 people, overwhelmingly workers and contractors in or near Vale's facilities, as well as residents and visitors downstream. It destroyed families' income and care structures, displaced people, disrupted roads and services, burdened emergency responders and generated years of searches. The speed and density of the flow made the workplace layout an impact multiplier. The loss cannot be represented by compensation totals alone.

Tailings moved through the Ferro-Carvao stream corridor and affected the Paraopeba watershed. Federal and state authorities documented land, vegetation, animal-rescue, water-quality and public-health concerns. IBAMA issued environmental enforcement measures, including a daily fine related to animal rescue, and described hundreds of hectares affected; the enforcement note is at https://www.gov.br/ibama/pt-br/assuntos/notas/copy_of_notas/ibama-aplica-multa-diaria-a-vale-por-falhas-no-salvamento-de-animais. A fine establishes an administrative response to specified conduct; it is not a complete ecological damage inventory.

Current official monitoring shows why causal wording must remain precise. Minas Gerais continues to monitor wells and cisterns in affected territory and reports nonconforming microbiological, sensory and chemical results at monitored points. Authorities continue to advise users to follow official restrictions. Those results do not mean every exceedance was caused solely by the tailings release; baseline conditions, local sanitation and contaminant pathways require site-specific study. The current water-monitoring record is at https://www.mg.gov.br/pro-brumadinho/pagina/reparacao-brumadinho-monitoramento-da-qualidade-da-agua-para-consumo-humano.

The state also describes continuing human-health and ecological risk assessments across target areas. As of July 2026, that work had not been reduced to a final, universal declaration of restored condition. The program page is at https://www.mg.gov.br/pro-brumadinho/pagina/brumadinho-estudos-de-avaliacao-de-risco-saude-humana-e-risco-ecologico. This is evidence of continuing measurement and intervention, not evidence that no repair has occurred. It sets the correct burden: a company claiming completion should be able to show exposure pathways closed, water uses safely restored, health findings addressed and ecological functions recovering over an appropriate period.

Economic effects were distributed. Vale bore remediation, legal, operational and financing costs; public bodies bore response and oversight demands; suppliers and smaller businesses faced disrupted demand and access; households faced health, transport and employment consequences. River-dependent and Indigenous communities required evidence tailored to their use of water, land and cultural resources. A generic project-delivery percentage cannot demonstrate restoration for each group.

Enforcement produced several kinds of accountability, not one final verdict

The major civil framework is the judicial reparation agreement signed in February 2021 by Vale, Minas Gerais institutions and justice bodies. The stated economic value was R$37,689,767,329. It covers specified collective and diffuse damages, programs, income transfer, mobility and environmental obligations. The state explains the agreement and its annexes at https://www.mg.gov.br/pro-brumadinho/pagina/entenda-o-acordo-judicial-de-reparacao-ao-rompimento-em-brumadinho. The agreement did not extinguish individual claims or criminal proceedings. Its headline value is not equivalent to cash already paid, and expenditure on a government project is not automatically proof that every affected person has been repaired.

Vale's 2025 annual filing said that, by 31 December 2025, 81 per cent of the updated commitment value had been disbursed, with differing progress between payment obligations and obligations to perform. Those figures are audited corporate disclosure within a securities filing, but the definition of disbursement still needs to be matched to outcomes. The filing is at https://www.sec.gov/Archives/edgar/data/917851/000129281426001844/valeform20f_2025.htm. A later integrated report said that almost all eligible out-of-court individual proceedings had been finalized and gave housing and payment figures. Those remain company-reported outputs. They should be reconciled with claimant access, disputed eligibility, delivery quality and government monitoring.

Administrative enforcement addressed data integrity and assurance conduct. Brazil's Comptroller General imposed a fine of about R$86.3 million on Vale under the Clean Company Act for obstructing mining-agency oversight through false or incomplete information in SIGBM. In April 2025, the Superior Court of Justice maintained that fine. The court's account is at https://www.stj.jus.br/sites/portalp/Paginas/Comunicacao/Noticias/2025/30042025-Primeira-Secao-mantem-multa-de-R--86-milhoes-contra-Vale-por-dificultar-fiscalizacao-em-Brumadinho.aspx. This is a final administrative-liability outcome as described by the court, distinct from deciding the physical trigger or individual homicide responsibility.

The Comptroller General also sanctioned TUV SUD's Brazilian entity and, in January 2025, denied reconsideration in the administrative responsibility proceeding. The agency said the case concerned false stability declarations and imposed the sanctions stated in its decision. Its notice is at https://www.gov.br/cgu/pt-br/assuntos/noticias/2025/01/cgu-indefere-pedido-de-reconsideracao-de-empresa-em-processo-administrativo-de-responsabilizacao/. TUV SUD has maintained defences in public and judicial forums. An administrative finding should not be expanded beyond its legal scope, but it directly tests the accountability of paid assurance.

Criminal proceedings move under a different burden of proof. Federal court hearings began in February 2026 in cases involving corporate and individual defendants. The Federal Regional Court for the Sixth Region described the hearing phase at https://portal.trf6.jus.br/trf6-inicia-audiencias-do-caso-brumadinho-a-partir-desta-segunda-feira-23-de-fevereiro/. In April 2026, the Superior Court of Justice restored the former Vale chief executive as a defendant, holding that the prosecution had sufficient threshold support for proceedings to continue. That procedural decision, at https://www.stj.jus.br/sites/portalp/paginas/comunicacao/noticias/2026/07042026-ex-presidente-da-vale-volta-a-ser-reu-em-acoes-penais-pelo-rompimento-da-barragem-de-brumadinho--mg-.aspx, did not decide guilt.

As of 15 July 2026, the criminal merits remained unresolved. Every defendant retains the presumption of innocence. It would be inaccurate to use the civil settlement, SEC resolution, administrative fines or decision to receive charges as a substitute for a criminal judgment. It would be equally inaccurate to say accountability is absent merely because criminal trials are not final. The record contains enforceable civil obligations, administrative sanctions, corporate governance changes and active criminal adjudication. Each should be measured against its own legal question.

Law and regulation changed the default for upstream dams

Brazilian authorities moved from case-specific enforcement to structural rules. ANM Resolution 13 of August 2019 prohibited use of the upstream construction method for mining dams under its scope and established requirements for de-characterisation and safety measures. The resolution is at https://www.gov.br/anm/pt-br/assuntos/barragens/resolucao-anm-no-13-de-8-de-agosto-de-2019.pdf. Federal Law 14,066 of September 2020 amended the National Dam Safety Policy, prohibited construction or raising of mining dams by the upstream method, strengthened responsibilities, addressed self-rescue zones and revised emergency and inspection requirements. The statute is at https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2020/lei/l14066.htm.

These reforms change legal defaults, but a prohibition is not the same as elimination of inherited risk. Existing structures must be de-characterised or otherwise brought into the legal regime through technically staged work. De-characterisation is itself a high-risk construction process: water may need control, tailings may need stabilization, buttresses and drainage may be installed, and earthworks must avoid destabilizing the facility being removed from dam functions. Deadlines can shift for technical or licensing reasons.

Accountability therefore requires structure-by-structure milestones, reasons for delay, interim risk controls and regulator acceptance.

The stronger law also does not solve the data problem by itself. A regulator still needs accurate submissions, qualified people, prioritization methods, inspection capacity and enforcement follow-through. Owners need to preserve source data and report exceptions. Emergency planning must reflect actual arrival times. The effectiveness test is whether a marginal structure now produces earlier restriction and exposure reduction, not whether the statute contains more duties.

At the international level, the Global Industry Standard on Tailings Management was launched in 2020 with 15 principles and 77 auditable requirements spanning affected communities, integrated knowledge, design, governance, emergency response and public disclosure. It assigns accountability to the highest organizational level and calls for independent review. UNEP's official description is at https://www.unep.org/resources/report/global-industry-standard-tailings-management. The standard is a substantial reference, but voluntary adoption and self-declared implementation require credible conformance assessment. Brumadinho's history warns against allowing a new label to become another binary declaration.

Vale's repair program is measurable, but its claims need external closure evidence

Vale says it established new tailings governance, independent technical review boards, 24-hour monitoring and a program to eliminate upstream structures. In December 2025 it reported completion of de-characterisation work on 19 of 30 structures, or 63 per cent of its program, with about R$12.7 billion spent since 2019. For at least the newly completed structure discussed in that release, Vale said evidence had been submitted to the authority for validation and that monitoring would continue. The disclosure is at https://www.vale.com/w/vale-completes-decharacterization-work-on-19th-upstream-dam.

The wording matters. “Work completed” by the operator, “de-characterised” under engineering criteria, and “accepted by the regulator” are related but not identical states. Long-term performance after earthworks is another state. A transparent register should show all four: physical work, responsible engineer's record, regulator decision and post-work monitoring. It should also show remaining structures by emergency level, interim controls and forecast completion.

Vale also reported in August 2025 that it had implemented the Global Industry Standard across all its tailings dams. The company account is at https://vale.com/w/vale-has-implemented-gistm-across-all-its-tailings-dams. The claim indicates a portfolio-wide management effort. It is not, by itself, evidence that every facility has received independent certification from the Global Tailings Management Institute or that every requirement is effective in practice. The evidentiary distinction should be explicit in investor, regulator and community reporting: implementation claimed by the operator; conformance reviewed by a named assessor; certification, if any, under a defined scheme; and unresolved findings.

The same distinction applies to CIAEA recommendations. Vale can document revised policies, organizational changes, committees and systems. Independent accountability asks for operational tests: examples where reviewers were selected outside the business line; adverse findings reached the board; people were removed from a consequence zone before a failure; model files reached the regulator; and a declaration was withheld until physical work closed the risk. Publishing these cases in redacted but auditable form would provide stronger evidence than a percentage of recommendations marked complete.

Reparation has similar layers. Money committed, money transferred, assets constructed, services operating and human outcomes restored are different measures. Minas Gerais has published project and agreement reporting, including completed government projects, at https://www.mg.gov.br/pro-brumadinho/pagina/reparacao-brumadinho-prestacao-de-contas-final-dos-projetos-realizados-e-concluidos-pelo-governo-do-estado. That reporting improves traceability. It does not close health, ecological, individual or criminal questions that fall outside a completed project list.

What is established, what is inferred and what remains unknown

Established facts. Dam B1 used upstream construction and had a long raising history. Tailings deposition had ceased before the failure, but the structure remained water-bearing and susceptible. Vale controlled the facility and commissioned the declarations. TUV SUD's Brazilian unit issued stability declarations in 2018. The detailed record included marginal stability calculations and unresolved concerns. ANM's system did not contain all information in the same form later identified in Vale records. The dam failed rapidly on 25 January 2019, the warning system did not provide an effective evacuation interval, and 270 people died. The failure involved flow liquefaction. A large civil reparation agreement and administrative sanctions followed. Criminal merits were not finally decided by the access date.

Supported inferences. The declaration process gave decision-makers more confidence than the underlying margins justified. Commercial relationships weakened demonstrable independence even where individual engineers may have believed their work met accepted practice. Aggregated corporate reporting made it harder for a facility-specific exception to reach the board. Complete, timely anomaly reporting would have increased the chance of regulatory scrutiny or precautionary restriction. Removing occupied buildings from the immediate inundation zone would have reduced exposure even if the failure time remained unpredictable. These inferences are supported by converging technical, regulatory and governance records, but they remain causal judgments rather than direct observations.

Unknown or contested matters. The precise initiating contribution of same-day drilling remains disputed in active criminal proceedings. Public records do not establish what every individual defendant knew at every decision point, and guilt is for the courts. The counterfactual effect of any one drainage measure, inspection, siren action or report cannot be known with certainty. The full long-term health and ecological outcome remains under study. Public data do not yet prove that every upstream structure in Vale's program has passed final external closure and post-work performance review. Company-reported GISTM implementation does not answer every independent-conformance question.

This taxonomy prevents two opposite errors. One is maximalism: treating every allegation as proven and assigning identical knowledge to every actor. The other is minimalism: using uncertainty about the last trigger to deny a well-supported lifecycle and assurance failure. A high-quality accountability record can hold settled facts, supported inferences and open questions at the same time.

Missing evidence is itself a governance finding

Several records would materially improve accountability if published in usable form. First is a complete, timestamped chain from each raw instrument and inspection observation to the score entered in SIGBM, including every override, author and rationale. Second is the full assurance engagement record: selection, fees, other services, scope changes, acceptance criteria, model versions, dissent and communications with the operator. Third is the escalation chain showing exactly what site, business, executive, board and regulator levels received about Dam B1 and when.

Fourth is a facility-level repair register. For every remaining upstream structure, it should state present condition, interim exposure controls, independent reviewer, regulator milestone, physical progress, forecast, delays and post-de-characterisation monitoring. Fifth is a reparation outcome ledger connecting expenditure to beneficiaries, delivered services and independently measured human or ecological outcomes. Commercial confidentiality and personal privacy can justify redaction, but not the absence of auditable fields.

Sixth is independent evidence about the effectiveness of the new assurance model. How many declarations have been qualified or refused? How often did an independent technical review board change a design or operating decision? Did the accountable executive or board receive every high-severity exception? Were people relocated because uncertainty exceeded tolerance even without visible movement? A system that produces only positive results may be exceptionally safe, or it may still be filtering dissent. The output distribution alone cannot distinguish the two.

Finally, court-tested technical evidence is still developing. The active proceedings may clarify the drilling sequence, individual communications, expert differences and legal duties. Until then, a responsible analysis must not fill the gap with certainty. It can still conclude that the pre-failure system lacked a sufficiently independent mechanism to convert marginal stability and extreme consequence into conservative control.

A durable independent-assurance accountability test

The lasting test begins with control rather than blame. For every high-consequence tailings facility, identify who can change design, deposition, water, drainage, monitoring, review, land use, warning, closure and disclosure. Assign one accountable executive, but preserve named duties for engineers, reviewers and regulators. Make the board responsible for ensuring that facility-specific exceptions reach it without being averaged away.

Second, separate assurance governance from the operating unit. The reviewer should be selected and overseen outside the business that needs the declaration. Other commercial work should be prohibited or tightly bounded and disclosed. Criteria should be fixed in advance. A refusal or qualification should trigger a protected escalation, not a search for a more accommodating method. The regulator should receive the support package and have power to commission a second opinion.

Third, replace the binary pass with an evidence-rich status. Publish the controlling factor of safety and method, sensitivity range, material uncertainties, instrument exceptions, overdue actions, downstream exposure and reviewer reservations. Machine-readable systems should preserve provenance and prevent silent downgrading of anomaly severity. Automation should carry exceptions forward until an authorized closure record exists.

Fourth, make consequence control independent of failure prediction. No routinely occupied facility should remain where modeled arrival time makes evacuation unrealistic. Warning systems should be tested, but sirens cannot justify exposure inside the self-rescue zone. Restriction, relocation and evacuation criteria should respond to uncertainty and consequence, not only to a forecast of imminent movement.

Fifth, prove repair through external states. Company completion, engineer sign-off, regulator acceptance, independent conformance and sustained environmental performance should be reported separately. Compensation should connect money to access and outcome. Health and water restrictions should remain visible until competent authorities close them. Criminal allegations should remain identified as allegations until adjudicated.

Brumadinho made these controls concrete at catastrophic cost. The warning for other institutions is not that assurance is useless. It is that assurance becomes dangerous when a paid conclusion is detached from its evidence, commercial context, uncertainty and consequence. A declaration should be the beginning of accountable scrutiny, not the end of it.