Water Utility Risk Register: Compliance Artifact or Decision Tool?
A mid-sized water utility with 1,200 staff supplies 180,000 households. Its enterprise risk register contains 640 entries, reviewed once a year by the compliance manager, who is also the only person with edit rights. The board receives a quarterly 5×5 heat map. The matrix has no definitions for likelihood or consequence, and risk scores are calculated as likelihood × consequence. The risk appetite statement says only: “The company has a low risk appetite.” In March, the duty pump and standby pump at a treatment works failed within four minutes of each other because both were overdue for maintenance. Operators manually dosed chlorine for nine hours; no unsafe water reached customers. The register had scored “chlorine dosing failure” as 4 (low) with the note “no history of failure.” The emergency plan existed but had never been tested, and no operator had been consulted when the risk was rated. Senior managers now want to add more red items to the heat map and increase the review frequency to quarterly.
1. Assess the utility’s approach against the ISO 31000 principles. Which principles are most clearly compromised, and what specific changes would address them?
Read the worked answer
ISO 31000:2018 principles are not a checklist to certify; they describe how risk management creates value. The clearest gaps:
- Integrated: risk is a compliance artifact, not embedded in maintenance, capital, or operations. The maintenance backlog that caused the common-cause pump failure was outside the register’s view.
- Structured and comprehensive: 640 entries reviewed annually with a 5×5 matrix lacking scale definitions produces inconsistent scores; the process is neither systematic nor complete.
- Customized: a one-line “low appetite” statement is not tailored to water safety, regulatory, supply, or financial objectives.
- Inclusive: operators, maintenance planners, and customer representatives were excluded; the compliance manager is sole editor.
- Dynamic: annual review did not pick up the overdue pumps or the near miss; the response is to add red items, not to set triggers.
- Best available information: “no history of failure” was used despite maintenance records showing overdue service. Historical absence is weak evidence where common-cause failure is possible.
- Human and cultural factors: operators knew the manual workaround but were not consulted; the untested emergency plan reinforces a paper-based culture.
- Continual improvement: there is no learning loop from the near miss.
Changes should start with executive risk owners, defined risk criteria and scales, integration with maintenance and incident systems, operator consultation, near-miss escalation, and risk-based review triggers. The appetite statement should be replaced with category-specific tolerances (e.g., zero tolerance for unsafe water; maximum hours of supply interruption) that decision-makers can apply.
2. The register’s score of 4 for chlorine dosing failure was produced by likelihood × consequence. Explain why that score is misleading and what analysis should replace it.
Read the worked answer
Under ISO 31000, risk is the effect of uncertainty on objectives, usually expressed through risk sources, potential events, consequences, and likelihood. A single likelihood × consequence score collapses these dimensions and hides the reasoning. The score of 4 is misleading for three reasons:
- The scale is undefined. Without descriptors, “likelihood 2” and “consequence 2” are personal judgements; the score looks quantitative but is not comparable.
- Likelihood was inferred from absence of history. “No history of failure” does not mean low likelihood when both pumps were overdue for maintenance, creating a common-cause failure pathway. Exposure, control effectiveness, dependency, and maintenance performance should inform likelihood.
- Consequence was understated. A chlorine dosing failure at a works serving 180,000 people could cause unsafe water, regulatory action, reputational harm, and emergency costs; the score does not reflect the severity or the near miss.
A better analysis would use a bow-tie or fault tree to show the common-cause pathway, review maintenance and failure data, test the emergency plan, and define consequence ranges for public health and regulatory breach. The evaluation should compare the analysed risk against pre-set criteria (e.g., zero tolerance for unsafe water), not against a matrix number. Document assumptions, data quality, and confidence; then set treatment and monitoring. The revised score may still be a matrix output, but it must be traceable to evidence and criteria.
3. What changes to recording and review would make the register a decision tool rather than an audit artifact?
Read the worked answer
To make the register a decision tool, the utility should define its purpose and audience first: executive decisions on maintenance, capital, and emergency preparedness, not audit evidence. Practical changes:
- Criteria before scoring: define likelihood and consequence scales with water-specific descriptors, and set tolerances for safety, regulatory, supply continuity, and cost.
- Risk ownership and accountability: assign each significant risk to an executive who can allocate resources; the compliance manager may maintain the process but not own all risks.
- Evidence and rationale: record sources, assumptions, control effectiveness, data confidence, and the reason for the rating; separate inherent and residual risk.
- Triggers, not blanket cycles: review when incidents, near misses, maintenance backlog thresholds, regulatory changes, or project milestones occur; annual review only as a backstop.
- Integration: link risks to maintenance plans, capital bids, emergency exercises, and incident investigations; capture near misses automatically.
- Reporting by exception: the board should see risks at or above tolerance, trend, treatment progress, and decisions needed-not only a heat map.
- Consultation: include operators and maintenance staff in identification and review; test the emergency plan and feed results back.
Quarterly review of 640 entries without prioritization would add bureaucracy, not assurance. A smaller set of significant risks with clear owners, evidence, and triggers would better satisfy the integrated, dynamic, and inclusive principles.