AWIA of 2018: How to Start A Risk and Resilience Assessment

For medium utilities, the deadline is looming to begin risk and resiliency assessments, while those in the small category an encouraged to budget and begin work by the end of the year.

Not sure where to start? The first step is creating a Risk and Resilience Assessment, which should examine all hazards and probabilities of occurrences to critical assets at risk. It should also develop a management plan to mitigate those risks.Here are the basic steps for the Risk and Resilience Assessment.

1. Characterize Utility Assets

• Document mission-critical functions of the Utility
• Determine which assets are most critical, meaning to identify the assets that, if compromised, could result in widespread service interruption, injuries or significant economic loss
• Document existing protective countermeasures on critical assets
• Conduct an initial ranking or screening of assets based on consequences to identify the highest priority asset

 2. Characterize Threats

• Identify malevolent threats, such as active assailants, workplace violence, terrorism, cyberattack, bomb threat, contamination of the water system, unauthorized entry, etc.
• Identify natural hazards, such as tornadoes, hurricanes, flooding, fire, ice storms, earthquakes, etc.
• Identify dependency and proximity hazards, such as chemical release, power outage, loss of key suppliers, source water contamination, inability/unwillingness of key employees to come to work, etc.
• Evaluate and rank various threat-asset pairs according the judged magnitude of the resulting consequences
• Select critical threat-asset pairs to be included in more detailed analysis

3. Consequence Analysis (C) – Level of damage expected if the hazardous event occurs

• Identify the consequences of a hazardous event, such as the number of fatalities/serious injuries, financial loss to the utility, time duration of service denial, coverage extent of service denial, and economic loss to society/general public
• Develop worse-reasonable case assumptions for reach threat
• Record consequence values for each threat-asset pair

4. Vulnerability Analysis (V) – Likelihood of damage occurring if the hazardous event occurs

• Identify the vulnerability of structures, equipment, piping, etc.
• Review details of facilities and facility layouts
• Conduct site visits of critical assets to assess vulnerability
• Record vulnerability estimates for each threat-asset pair

5. Threat analysis (T) – Likelihood of the hazardous event occurring

• Malevolent events
  • Likelihood of malevolent events will be based on attractiveness of the region (high profile locations) or facility (visibility of asset) relative to alternate targets
• Natural hazards
  • Probability of natural hazards will be based on historical records for the specific location of the asset and trends for the future
• Dependency hazards
  • Likelihood of dependency hazards will be based on local historical records for frequency, severity and duration of service denials
• Record threat analysis for each threat-asset pair

6. Risk and Resilience Analysis (R=C*V*T)

• Calculate risk for each threat-asset pair
  • Risk (R) is calculated as product of Consequence (C), Vulnerability (V) and Threat (T)
• Calculate resilience level for overall water system

7. Manage Risk and Resilience

• Define acceptable levels of risk scores
• Identify countermeasures or mitigation options
• Develop costs projections
• Calculate benefit/cost ratio of mitigation options
• Select, prioritize, and implement mitigation options through CIPs, operational improvements, and other approaches

8. Submit Compliance Certification to EPA

How Freese and Nichols Can Help You

Freese and Nichols’ approach can help you go beyond compliance to get the best value for your water-infrastructure assets. We are currently assisting several large water utilities to meet their initial
compliance deadlines. Freese and Nichols staff from across the company are trained, certified, involved
and currently leading water utilities efforts in the large category. Our team can help you successfully complete your Risk and Resilience Assessment and develop or update your Emergency Response Plan.

Questions?

Our team will be happy to help if you have any further questions. Here’s whom you can reach out to.

• Central Texas: Stephanie Nieses, PE
• North Texas: Scott Cole, PE, or Trey Shanks, CFM, IAM
• Southeast Texas: David Munn, PE or Richard Weatherly, PE
• West Texas: Heather Keister, PE
• Florida: Craig Wells, PE 
• Georgia: Paula Feldman, PE
• North Carolina: Brian White, PE
• Oklahoma: Wick Warden, PE