I’ve written before about the need to understand internal and external context on the risk management process. But in a COVID-19 era, what are the things that water utilities need to understand before they can determine the risk on their objectives – what do you need to be doing differently, if anything? Here I take a look at the importance of understanding your products and services, your objectives, the risk to your objectives, what you should be looking at in managing the issues and how you know that the risk is being managed.

What are your products and services?

Clause 6.3.1 of ISO 31000 notes that an organisation should define the scope of its risk management activities. This aspect is of relevance because the risk management process should be contexualised enough to allow it to apply at different levels, but remain able to allow comparison of risks across the enterprise.

Utilities these days are diverse in many ways including the products and services they provide, the governance structures in which they are set up, whether they are public, private or community-based, the jurisdiction they operate in and the services they outsource. Therefore, before you go anywhere near the risk equation, you need to understand your context. So, at the product and service level, what things should you be identifying as a utility? Some of your products and services will be obvious, while others may be hidden or not necessarily thought of as products and services e.g.:

So, in managing your utility risks in a COVID-19 scenario, you should be casting the net widely as you may need to triage some of these products and services for prioritisation in terms of management and resource allocation. You’ll need to understand to whom you provide your products and services, what parties might be impacted by risk to product and service provision and who could impact on your product and service provision.

Understand your objectives

Next comes understanding your objectives. Objectives will be based on a number of things including your internal utility objectives as well as statutory and guideline obligations or requirements. Depending on the products and services you provide, you should be asking the following question as part of your COVID-19 preparedness:

“Can I still keep meeting my objectives with the system as it currently stands?”

Some examples of products and services and the considerations you will need to be making are provided in Table 1. Any consideration and outcome that you arrive at, should be backed up with an evidence base to help you show that you have been duly diligent[1] in your deliberations. Your evidence base needs to be credible including peer-reviewed papers, government advice and even your own utility data if it is sound and you have confidence in it.

Understand your risks

We now know our objectives and the parties to whom we supply our products and services, so what actual risks are we creating or need to understand for management? We’ve already done some of this background analysis in Table 1, what you will now need to do it to articulate your risks specifically so you can start to understand if you need to manage them differently. Examples of risks you might be facing, in terms of inability to meet product and service provision objectives include:

• Not fully understanding the implications of COVID-19 on our business.
• Increasing your community’s anxiety by adding to the misinformation on COVID-19 and drinking water or creating an information vacuum.
• Not having a communication piece in place for your customers on COVID-19 and drinking water and overall service provision.
• Creating anxiety in your human resources (staff and service providers) through not providing appropriate and timely information on the risks to them in their roles and responsibilities.
• Loss of staff due to illness and ‘burnout’ or inability to work due to severe anxiety or caring for others.

Your risks should be assessed through your normal enterprise risk framework.

Understand your controls

Once you have identified and assessed your risks, the next step is identifying your controls and then re-assessing the risk with those controls in place. It is likely that given the nature of the situation (global pandemic, emergency declaration), that your utility is already on alert and that your business continuity plans have been activated. For those objectives which you have deemed to still be able to meet, there may not be much else that you need to do in terms of extra controls, for others, you will need to be identifying which controls need to be implemented and when e.g.:

• Ensure treatment processes are running smoothly – double check your CCP performance (especially filtration and disinfection as these are key barriers for virus removal).
• Make sure you have adequate supplies of chemicals and materials.
• Make sure your business continuity processes are in place and that your team knows what to do.
• Commence actions in the business continuity plan as appropriate (including community messaging and duty roster review for emergency management situation as appropriate).
• Ensure your community messages reflect credible advice from health regulators and industry associations.
• Ensure that your workers and service providers are not forgotten in terms of the impacts of the virus and your responses, on their roles and responsibilities – state what it means for them and what they should expect – reduce their uncertainty as far as you are able.

Understand if you are appropriately managing the risk

Just because you have implemented your controls, does not mean that it is set and forget. You will still need to be monitoring the situation carefully. Checks that you will need to have in place include:

• Keep close watch on the performance of your CCPs – do you know if you are about to trend out of control?
• Keep a close eye on the health and wellbeing of your operators and service providers (remembering that if you have contractors, you are also responsible for their health and safety). Make sure you have in place and implement assistance programs if/as required.
• Keep yourself informed by monitoring industry and health regulator updates.
• Be prepared to put out new messages to your customers and staff, if appropriate and relevant to do so – as advice from our health regulators and the government may change quickly.

Where to from here?

I joined Sydney Water in 1998 just before the Cryptosporidium contamination incident, but this scenario is one which I, and most of us in the industry, have never lived through – in terms of its scale. However, with the frameworks that we largely have in place all across the country, our regulators have prepared us for a world where risk management in the water industry is the norm – we should all have ‘use-ready’ business as usual risk management and emergency risk management plans in place that have been scenario-tested and now, are being implemented in real life. When the dust settles, we will do what we always do in good risk management frameworks, we will review our actions and see if there’s anything that could be done differently in the future. Until then, we must closely monitor the trajectory of this event as it unfolds, ensure that we keep reassessing and managing the risks to our objectives and ensure that we are able to make sensible decisions that are based on evidence rather than reaction based on fear and anxiety.

[1] Davison, A.D., Pryor, E.L., Howard, G. and Deere, D.A. (2005) Duly diligent utilities. Water Science and Technology: Water Supply 5(2): 115–122

BIO:

By Annette Davison, Director and Principal, Risk Edge Pty Ltd; Director and Chief Risk and Product Officer, D2K Information Pty Ltd

Director and Chief Risk and Product Officer, D2K Information Pty Ltd

#catchmenttotap #waterqualitymanagementservices #watersupplygovernance #sourcetoendpoint #supplychainrisk #waterqualitysupplychainrisk