The Clean Water Voice

By: Shari St. John, Carollo Engineers

Recertification deadlines for America’s Water Infrastructure Act (AWIA) compliance are rapidly approaching, with large drinking water utilities serving over 100,000 customers required to update their Risk and Resilience Assessments (RRAs) by March 31, 2025, and Emergency Response Plans (ERPs) by September 30, 2025, followed by smaller drinking water utilities. To meet AWIA requirements and enhance resilience, utilities use tools like the AWWA J100 Standard, which provides a methodical approach to defining asset criticality and threat types, and assessing key risk factors for utilities — i.e., assessing consequence, vulnerability, and likelihood of threats on critical assets. This process helps water utilities to prioritize risks and results in the creation of essential hazard mitigation documents critical to improving operational continuity and resilience.

But information is not resilience, and planning is not preparedness. In emergency management, we don’t say there are natural disasters anymore. There are only natural hazards that we’ve failed to prepare for. The difference between a managed outcome or a disaster is the transition from knowing information to using information, and from developing plans to practicing plans. In my experience, it is common to hear that organizations know exactly what needs to be done to improve their emergency preparedness and reduce their risk, and yet they’ll remain in the same vulnerable position for years due to a lack of clear direction and designation of responsibility. So how can this be fixed?

Implementation Plans

With the completion of the RRA, your utility should already understand its top vulnerabilities and risks. After compliance, the next critical step toward resilience is to make an implementation plan to reduce vulnerabilities and mitigate risk. An implementation plan may look like an Excel spreadsheet, or an online Project Management tool, or a weekly check-in meeting and agenda to track progress toward utility resilience. However the plan is designed, i t is important that risk reduction initiatives are documented and actioned.

Ideally, each risk reduction initiative should follow the SMART goals and objectives framework: make your resilience goals specific, measurable, assignable, relevant, and time-bound. This acronym was first coined in a 1981 edition of the journal Business Review by a business management consultant who wanted to make goal-setting more effective. It has since been adopted as a tool in program planning by various organizations such as the Centers for Disease Control and Prevention and the United States Department of Education. In Emergency Management, we recommend the use of SMART objectives to make otherwise generic or large-scale resilience tasks more manageable.

• Specific: Define the exact outcomes to be achieved. List out the necessary equipment, staff, and resources required to achieve risk reduction at a particular asset.
• Measurable: Determine what success looks like. For a physical security upgrade, success may be achieved when new cameras are installed at a water treatment plant. For an operational resilience project, success may be achieved when staff regularly participate in emergency response plan trainings and exercises.
• Assignable: Assign ownership over risk reduction goals to establish responsibility for its completion. This can help to get more people involved in risk and resilience initiatives across your utility if each staff member is involved in a specific task.
• Relevant: Cross-reference risk and resilience initiatives against your risk assessment. Will completion of this goal reduce consequences or vulnerability from your identified hazards and threats?
• Time-Bound: Make your goals time-bound. Deadlines are key to keeping tasks organized and encouraging their completion. Once your deadlines and milestones are identified, add them to your work calendars and set reminders as an additional organizational tool.

Infrastructure Design-Basis

Another way to action RRA findings is to roll them into physical infrastructure plans and design-bases. In the nuclear industry, the design basis is an event that a nuclear plant system, including its structures and components, must be designed and constructed to withstand without loss of functions necessary to protect public health and safety. In the water industry, this type of document may more commonly be referenced as a Basis of Design Report, and incorporation of RRA findings into it is critical to building resilient water infrastructure and systems. Using the RRA risk rankings, your utility can establish baseline requirements for all assets based on likely threats and vulnerabilities. As an example, if flooding is a significant risk in your region, your design basis for any new assets constructed in the area may be that they must be able to withstand a 1-in-100-year flood event. Or, if long-term power outages are common in your area, you may determine that all assets must be installed with back-up generator capabilities which can power essential functions for at least 96 hours.

By incorporating your risk assessment findings into the design basis of new water infrastructure projects and facility upgrades, your assets are more likely to be resilient against future hazards and threats. This activity allows you to mitigate risks in the early stages of design and development, avoiding expensive retrofits after construction is complete. 

Emergency Response Plan Exercises

Plans are the foundation for emergency response, but achieving a state of emergency preparedness requires more effort. It is in action that plans become preparedness, and where resilience converts from theory to reality.  

contact information hasn’t been updated in three years. Nor is it a good time to find out that a critical process depends on your long-term operator who retired six months ago.

One of the best ways to learn whether or not your plan is relevant, helpful, and accessible is to run ERP validation activities, such as an exercise with a simulated emergency scenario. Exercises provide an opportunity to dust off your ERP and bring staff together to think critically about its format and content. If an emergency happens in the next five minutes, do your staff know what to do? Emergency preparedness is achieved when you can confidently answer yes to this question.

Exercises can range from discussion-based activities to boots-on-the-ground drills and simulations. Most exercises follow a similar structure: they have objectives, an emergency scenario, scenario escalations, a document, process, or procedure to be validated, and a facilitator to ask prompting questions and guide discussions. The result of ERP validation activities is a plan that’s valuable to you, because it’s built by you. A successful plan is the one that you’re going to use, the plan you’re going to understand, and the plan that you’re comfortable with. 

It’s also a good idea to involve external organizations to coordinate information and response expectations. Effective emergency response – especially for large-scale emergencies – is often dependent on collaboration and coordination between multiple organizations. Consider your potential support requirements from police, the fire department, paramedics, HAZMAT experts, vendors, suppliers, and neighboring jurisdictions. Each organization is responsible for a unique part of emergency response, and without coordination, your utility may not have a complete understanding of response requirements. Will the police treat your utility as a priority call during a large-scale emergency? How quickly can the fire department arrive onsite? Can paramedics respond to injuries at your treatment plant if there’s a risk of chemical release? What internal health and safety procedures might prevent emergency responders from performing their role in the way that you’d expect? These questions are best answered before an emergency.

Community Awareness

On the topic of collaboration, you can improve your likelihood of success during emergency response by sharing aspects of your ERP with your community ahead of time. To be clear, it is not recommended to share sensitive information with the public, but letting your community know that you have a plan, that you’ve engaged with other critical stakeholders, and that staff are well-prepared and familiar with the plan can go a long way in building community trust and relationships. Established relationships with the community are important in emergency scenarios where your utility may have to ask the public to reduce their water consumption, or where you have to release a Boil Water Advisory. Perception is key during emergencies, and if the public perceives that they have to change their habits because of a lack of preparedness on the utility’s end, there may be less buy-in to necessary measures. Alternatively, if the community knows the utility staff, knows that they’re prepared to resolve the issue, and that they’re committed to finding a solution, there can be better reception of unfortunate information.

ERPs and Technology

My final recommendation involves staying up to date with technologies after your ERP is certified to continuously enhance your emergency response capabilities. For better or worse, technology has taken over the way we work, think, and operate. There are various technologies which can support water utilities in emergency response, from digital twin systems, to online emergency operations center applications, to artificial intelligence platforms.

Digital twin systems – i.e., an exact replica of physical infrastructure or systems displayed in the virtual sphere –  can support water utilities in emergency plan development, and are already being used for this purpose in the U.S. During an AWWA digital twins webinar in 2024, a water utility in Nevada shared an overview of how they’ve used their water system digital twin model to improve their risk assessments and emergency response. With their digital twin model and SCADA reporting, the Nevada utility was able to determine the exact location of a system failure as it occurred, and rapidly dispatch teams to make repairs. Having a digital twin also allows water utilities to model emergencies before they happen, helping to identify vulnerable system components which need reinforcement. Because the virtual model is an exact replica of the physical system, utilities can see the real consequences of loss or disruption to any singular system component. Equipped with this knowledge, utilities can then develop emergency workarounds and make better-informed decisions on things like equipment inventory requirements for emergency repairs. This information is critical to an effective ERP, and digital twin models support up-to-date, relevant, and well-informed planning for emergency response.

Another key component of response is situational awareness. While there are various emergency coordination applications which can support utilities in staying securely connected throughout an emergency, I want to highlight the use of Microsoft Teams Emergency Operations Center (EOC). With water system assets often spread out across large distances, it’s unlikely that all essential utility staff can or will be centrally located during an emergency to coordinate information and assign tasks and duties needed for response. Microsoft Teams EOC provides a virtual solution to maintaining situational awareness wherever your location, allowing staff to securely message, assign tasks, track progress and resources, share pictures, and update management from their phone, iPad, or computer. This supports more effective and efficient response, while ensuring everyone has the necessary information to make real-time decisions.

The third technological recommendation comes with a significant caution against using AI as a single source of truth. However, AI tools are rapidly becoming commonplace in work environments, and can provide helpful guidance when additional direction is required for how to complete a task. At another 2024 AWWA webinar, “AI in Water,” the presenter demonstrated how AI can be used to develop frameworks for cybersecurity policies and procedures. I emphasize the term “framework,” because AI should not be used to develop your detailed emergency response policies and procedures. However, AI can provide a detailed table of contents, directing you toward the type of information that is generally included in these types of procedures. My recommended compromise for the use of AI in emergency management is to use it as a guidance tool for developing procedure headings and subheadings, but to develop detailed content for each section offline, in consultation with utility operators, management, and relevant emergency response stakeholders. This helps to ensure that your data remains secure, and that your procedures are relevant to your utility and not a generic facility.

Summary

In summary, there are many ways that utilities can move from intention to action with resilience initiatives. Whether tracking risk reduction projects, updating design standards, or engaging utility staff, stakeholders, and the community in emergency preparedness efforts, every action counts toward increasing overall utility resilience. The result? RRA and ERP documents that are valuable to your organization. Actions which transcend compliance requirements to create real impacts at your utility and in your community, mitigating disaster before it happens.

About the Author

Shari is the Lead Resilience and Sustainability Analyst with Carollo Engineers. She has a Master’s degree in Infrastructure Protection and International Security from Carleton University, and a Graduate Diploma in Climate Risk Management from the University of Waterloo. Since 2021, she has been involved in over 35 resilience projects, working with both public and private sector clients to conduct risk and vulnerability assessments, develop emergency management plans, and design and deliver simulation exercises for emergency preparedness. Most recently, Shari is supporting clients across the United States to update and recertify their Risk and Resilience Assessments and Emergency Response Plans required under America’s Water Infrastructure Act of 2018.

The views expressed in this resource are those of the individual contributors, and do not necessarily reflect those of NACWA.