Â鶹´«Ã½

RRA¡¯s to Z: An overview

The RRA requirement replaces a previous law enacted post-9/11. AWIA broadens the assessment focus from ¡°terrorism and intentional attack¡± to ¡°natural hazards and malevolent acts.¡± Critical assets are typically paired with threats and evaluated to understand probability, likelihood, consequences, and deterrents in a comprehensive assessment. So, what needs to be covered?

• Risks to the system: From natural hazards to malevolent acts
• Assets/systems: Resilience of components like pipes and constructed conveyances, physical barriers, source water, collection and intake, pretreatment, treatment, storage, and distribution facilities, including security of electronic, computer, and automated systems
• Assessments: Monitoring practices, financial infrastructure, chemical use, storage and handling, as well as operations and maintenance of the system.

RRAs may also include evaluation of capital and operational needs. Oftentimes, the seven-step J100 risk assessment methodology is used to understand the utility¡¯s risk portfolio and make decisions when allocating scarce resources towards reducing risk and improving resilience. Ultimately, RRAs should inform risks, vulnerability, and resilience recommendations.

An informed and agile response

An emergency is typically defined as a situation that arises suddenly that can have considerable negative consequences if fast and effective corrective measures are not taken.

Water utilities¡ªregardless of their size and location¡ªhave a legal responsibility to provide clean, safe drinking water, even under emergency conditions. The ability of utility staff to respond rapidly in an emergency helps to prevent unnecessary complications and protect consumers¡¯ health and safety. Rapid response may also save money by preventing damage to water systems.?

The ERP details strategies, resources, plans, and procedures utilities use to prepare for, and respond to, an incident¡ªnatural or man-made¡ªthat threatens life, property, or the environment. Incidents can range from small water main breaks or localized flooding to large scale hurricanes, earthquakes, or system contamination. ERPs are traditionally two phases: Preparation and execution.

No later than six months after certifying its risk and resilience assessment, each system must prepare or revise an emergency response plan. The ERP includes:

• Strategies and resources: Roles and responsibilities, Incident Command System and communication schemes, including physical security and cybersecurity of the system
• Emergency plans and procedures: Core and incident specific tactics to be implemented, along with identification of equipment that can be utilized
• Risk mitigation policy: Actions, procedures, and equipment which can prevent or significantly lessen the impact on public health and safety, as well as supply of drinking water, including the development of alternative source water options, relocation of water intakes, and construction of flood protection barriers
• Detection strategies: Used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the system.

5 key factors

Having successfully completed both RRAs and ERPs for clients, here are five key factors to meaningful AWIA projects:

• Upfront support is crucial. As with any new directive, there is a lot to consider. From information gathering and gap analysis to risk assessment and review of existing emergency response documentation, collaborative client workshops are vital in the process. Making time for adequate and accurate data collection around critical assets sets up efficiencies for current and future assessments
• Risk-informed operations. The RRA lays the foundation for a strategic pathway to building resilience and a comprehensive emergency response program. During the RRA process, in addition to understanding risk, projects, policies, and procedures that can add resilience are identified and prioritized. The ERP update process is done through the guise of vulnerabilities identified during the RRA and AIWA requirements, helping the utility prepare for nearly any event
• Leveraging partnerships. Both the RRA and ERP require coordination with external partners such as an emergency management committee or information technology. This is a low-stress environment to build relationships and long-term resilience. Aligning operations with jurisdictional emergency management organizations is not only necessary but beneficial for expedited response and recovery
• Don¡¯t forget finance! Logically, most utilities will ask: ¡°What can we afford to do to enhance resiliency and minimize risk?¡± At Â鶹´«Ã½, we integrate our funding and finance experts to help clients understand two things. One, how an organization¡¯s financial health can impact resilience. But also, how to tailor funding strategies to reduce future risk, protect assets, and derive sustainable business benefit from this investment. Future grant dollars are anticipated for identified AWIA projects and we can help you develop a tailored strategy
• Meeting the letter and spirit of AWIA. Regulatory-driven efforts can easily run the risk of becoming a ¡®check the box¡¯ exercise. Utilities need to not just understand the requirements of AWIA, but the intent behind them. It takes prioritizing resources to certify with confidence as well as get value from the process to support a sustainable approach to risk and resilience management.?

On the surface, AWIA is just another requirement. However, on a deeper level it is much more. It is a call for the Water sector to use the process to make defensible, business case-based decisions about how to better manage risk and become a utility capable of providing vital water to its customers during and after disaster events.?