You are here

AWIA of 2018: How to Start A Risk and Resilience Assessment

Note: This is the fifth part in a series about the AWIA of 2018. Read the first parts: part one here, part two here, part three here and part four here. 

The clock is ticking for U.S. water systems to comply with the American Water Infrastructure Act of 2018 requirements for Risk and Resilience Assessments and Emergency Response Planning.

Compliance deadlines begin in March 2020 for water utilities to assess infrastructure risks from natural and man-made hazards and to develop plans for improved resilience and emergency response against those risks.

Large utilities are recommended to initial the Risk and Resilience Assessment as soon as possible to meet the March 31, 2020 compliance deadline.  Medium and Small utilities are recommended to begin preparations by allocating budget and resources over the next 9 to 18 months, respectively.

Not sure where to start? The first step is creating a Risk and Resilience Assessment, which should examine all hazards and probabilities of occurrences to critical assets at risk. It should also develop a management plan to mitigate those risks.

Here are the basic steps for the Risk and Resilience Assessment.

1. Characterize Utility Assets

  • Document mission-critical functions of the Utility
  • Determine which assets are most critical, meaning to identify the assets that, if compromised, could result in widespread service interruption, injuries or significant economic loss
  • Document existing protective countermeasures on critical assets
  • Conduct an initial ranking or screening of assets based on consequences to identify the highest priority asset

 2. Characterize Threats

  • Identify malevolent threats, such as active assailants, workplace violence, terrorism, cyberattack, bomb threat, contamination of the water system, unauthorized entry, etc.
  • Identify natural hazards, such as tornadoes, hurricanes, flooding, fire, ice storms, earthquakes, etc.
  • Identify dependency and proximity hazards, such as chemical release, power outage, loss of key suppliers, source water contamination, inability/unwillingness of key employees to come to work, etc.
  • Evaluate and rank various threat-asset pairs according the judged magnitude of the resulting consequences
  • Select critical threat-asset pairs to be included in more detailed analysis

3. Consequence Analysis (C) - Level of damage expected if the hazardous event occurs

  • Identify the consequences of a hazardous event, such as the number of fatalities/serious injuries, financial loss to the utility, time duration of service denial, coverage extent of service denial, and economic loss to society/general public
  • Develop worse-reasonable case assumptions for reach threat
  • Record consequence values for each threat-asset pair

4. Vulnerability Analysis (V) – Likelihood of damage occurring if the hazardous event occurs

  • Identify the vulnerability of structures, equipment, piping, etc.
  • Review details of facilities and facility layouts
  • Conduct site visits of critical assets to assess vulnerability
  • Record vulnerability estimates for each threat-asset pair

5. Threat analysis (T) – Likelihood of the hazardous event occurring

  • Malevolent events
    • Likelihood of malevolent events will be based on attractiveness of the region (high profile locations) or facility (visibility of asset) relative to alternate targets
  • Natural hazards
    • Probability of natural hazards will be based on historical records for the specific location of the asset and trends for the future
  • Dependency hazards
    • Likelihood of dependency hazards will be based on local historical records for frequency, severity and duration of service denials
  • Record threat analysis for each threat-asset pair

6. Risk and Resilience Analysis (R=C*V*T)

  • Calculate risk for each threat-asset pair
    • Risk (R) is calculated as product of Consequence (C), Vulnerability (V) and Threat (T)
  • Calculate resilience level for overall water system

7. Manage Risk and Resilience

  • Define acceptable levels of risk scores
  • Identify countermeasures or mitigation options
  • Develop costs projections
  • Calculate benefit/cost ratio of mitigation options
  • Select, prioritize, and implement mitigation options through CIPs, operational improvements, and other approaches

8. Submit Compliance Certification to EPA

How Freese and Nichols Can Help You

Freese and Nichols' approach can help you go beyond compliance to get the best value for your water-infrastructure assets. Our team of water and wastewater engineers has extensive experience developing Vulnerability Assessments, Risk Management Plans and Evaluations, and Resilience Programs for many water utilities from less than 3,000 to more than a million. Our team can help you successfully complete your Risk and Resilience Assessment and develop or update your Emergency Response Plan.


Our team will be happy to help if you have any further questions. Here's whom you can reach out to.

Central Texas Stephanie Nieses, PE

North Texas Scott Cole, PE, or Rusty Gibson, PE

Southeast Texas David Munn, PE

Florida/Georgia Trooper Smith, PE

North Carolina Brian White, PE

Oklahoma Clay Herndon, PE

See Also:

New EPA Risk and Resiliency Requirements For Water Systems

AWIA of 2018: Where Do I Get Started?

AWIA of 2018: EPA Releases Aug. 1 Baseline Threat Guidance

Subscribe to our Blogs

TagsAWIA of 2018, EPA, water infrastructure, resiliency, asset management, asset, emergency response,