The Paris basin (France) is a particularly challenging setting for oil production: Besides lying under a metropolis of 12-million people, it is also exploited for low-temperature geothermal energy and is crossed by a deep, high-quality drinking-water aquifer of strategic importance, the Albian-Neocomian. Vermilion, the biggest producer in the area, undertook in 2012 a basinwide well-integrity risk-management project with the goal of understanding and minimizing the risk of freshwater-aquifer pollution.The Paris basin operations include 20 fields, for a total of 289 active wells, more than half of which were drilled in the 1980s. The objectives of the leakage risk assessment are twofold: First, identify high-risk scenarios and "must act" wells that require immediate intervention; second, adopt lean (i.e., eliminating waste) prevention and mitigation measures that satisfy the local regulator.The risk-assessment methodology is based on scenarios (i.e., ways in which the hazards, brines or hydrocarbons, can cause damage to targets, the freshwater aquifers). Each scenario involves the failure of a number of barriers with the function to prevent or mitigate damage. In this approach, evidence from in-depth failure analysis is used to build and calibrate scenarios, as well as to validate degradation mechanisms and understand their dynamics. Evidence considered is not limited to drilling reports and wireline logs, but includes all observations, measurements, and weak signals that one can use to test assumptions on the presence, absence, or aging of well integrity. Evidence-based scenarios are complemented by known failure mechanisms, thus reducing the risk of "black swans," very improbable but catastrophic events, even though their probability is constrained by observed behavior during the 4,000 well years of operations in the basin.The criticality (product of probability and severity) of each applicable scenario is then computed by use of an exhaustive database of the characteristics of each well, resulting in a complete risk profile for the basin. The risk-assessment process revealed that casing corrosion caused by brine injection is the biggest driver of well-integrity risk; it also allowed tailoring effective prevention and mitigation actions: For instance, the criticality of scenarios is reduced to an acceptable level if the time between tubing failure and injection stop is kept to 3 months or less. Furthermore, the analysis helps define the role of periodic logging and thus reduce possible waste (i.e., actions that do not contribute to understanding, preventing, or mitigating risk).The evidence-based approach, since applied to another French basin, has proved effective for managing risk at the basin level, by cutting a middle way between universal checklists and the excessively narrow focus of well-by-well analysis: The former are too large and hazy and may hide real dangers among hardly applicable generalities, whereas the latter tends to be expensive and unsystematic and misses recurring patterns. Heavy-duty analy...