Lessons Learned from AWIA Work: an Interview with Western Municipal Water District

Lessons Learned in Performing Risk and Resilience Assessments and Developing Emergency Response Plans: An Interview with Western Municipal Water District

Anita Wilcox

Stephen Baruch, Pacia Diaz, Scott Thomas

AWIA Requirements for Drinking Water Systems

The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Act) required water utilities to perform Vulnerability Assessments (VA). During the intervening years, it has become clear that the security focus of the VAs needed to be expanded to an “all hazards” approach. Utility managers have expanded their thinking from looking only at the vulnerability of their systems to directed attacks, to a more robust understanding of the risks their systems face from natural hazards and “dependencies,” such as utility power or key vendors and supply chains.

The America’s Water Infrastructure Act (AWIA) of 2018 requires that all community water systems serving at least 3,300 people assess the risks to, and the resilience of, their drinking water systems. The AWIA requires performance of a Risk and Resilience Assessment (RRA). Water utility managers have long understood the concept of managing risk. While “resilience” has gained traction more recently, water utilities regularly take measures to better withstand interruption of water service and to provide solutions and pragmatic “work-arounds” to restore service quickly. These are measures of resilience.

The RRA should focus upon the following elements of the drinking water system, which may be at risk from malevolent acts and natural hazards:

Pipes/conveyances, source water, water collection/intake pretreatment, treatment, storage and distribution, electronic, computer, or other automated systems (including security).
Monitoring practices.
Financial infrastructure.
Use, storage and handling of chemicals.
Operation and maintenance.

AWIA also requires that Emergency Response Plans (ERP) be developed (or updated), and that they incorporate findings from the RRA, including:

Strategies and resources to improve resilience, including physical security and cybersecurity.
Plans, procedures, and equipment for responding to a malevolent act or natural hazard.
Actions, procedures, and equipment to lessen the impact of a malevolent act or natural hazard. including alternative source water, relocation of intakes, and flood protection barriers.
Strategies to detect malevolent acts or natural hazards.

Deadlines for compliance are defined according to the size of the Community Water System.

AWIA Compliance Deadlines

Lessons Learned and Recommendations from AARC Consultants

AARC Consultants has experience coordinating AWIA compliance with dozens of water utilities and offers the following Lessons Learned as a guide to smaller utilities that are starting to plan for this requirement:

Get started now. Assign a Project Manager and determine whether a consultant should be hired. There are consultants that specialize in facilitation, but lack the technical credentials in water treatment, its infrastructure, operations, policies and procedures. It is also important to hire industry professionals, e.g., those who specialize in SCADA management, as well as possessing high levels of certification in cybersecurity.
Start the AWIA process as soon as possible by assembling key documents. Be certain that these documents are secure. Also, consider labeling the documents as FOIA exempt(AWWA, 2020).
Do not assume that you can dust off an old VA and declare success. RRAs address many more aspects of the utility’s water system than the Bioterrorism Act’s Vulnerability Assessments.
Get the right managerial/technical resources in place. You need a range of different voices to cover the multi-disciplinary requirements of AWIA. However, too many cooks in the kitchen can muddle the process and waste staff time. Also make sure the IT and SCADA systems are both represented in the assessment process.
Follow the AWWA J100-10 Risk and Resilience Management of Water and Wastewater Systems Standard, an industry standard for resilience assessments(AWWA, 2010). The J100 Standard provides a seven-step methodology to identify a utility’s critical assets and define the risks. The methodology includes assessing the threats, vulnerabilities, and consequences for each critical asset. Also, the methodology determines risks and guides mitigation measures to improve asset resilience. The goal of applying J100 is to prioritize the risks from malevolent acts and from natural disasters, develop countermeasures to appropriately mitigate the prioritized risks, and enable the utility to determine which capital investments and procedural improvements provide the most value to its customers.
Bring in stakeholders early in order to share information and obtain their input.
The AWWA Cybersecurity Risk Management Tool is very helpful for assessing vulnerabilities to IT and SCADA systems. However, it yields generalized output that should be augmented with utility-specific, detailed recommendations from experts (AWWA, 2019).

Lessons Learned and Recommendations from Western Municipal Water District

Western Municipal Water District (Western) is one of the largest public agencies in Riverside County California. It serves nearly a million people, both retail and wholesale customers who live, work and play within 527-square miles in one of California’s most populous regions. Western provides water supply, wastewater disposal and water resource management to the public in a safe, reliable, environmentally sensitive and financially responsible manner. Staffed by approximately 150 employees, Western is led by general manager Craig Miller, who also acts as its court-appointed watermaster, and the management team.

WMWD Operations Center

Providing customers with an exceptional user experience is Western’s top priority. Western strives to be more of a business than a bureaucracy and is run as cost-efficiently as possible by pairing exceptional customers service with diversified water supply. Western views their customers as essential partners in ensuring long-term water security for the region. Through transparency and open governance, they work hand-and-hand with their customers on important issues like water conservation and local water procurement. In summary, Western is focused on being the definitive leader in water and wastewater services. Western prioritizes public safety and is committed to providing essential service at all times. Western actively engages in emergency planning, practices regularly and is ready to support emergency response.

Western Wastewater Recycling Facility (WWRF)

Interview

Is the AWIA mandate beneficial to utilities overall? How? Why?

Emergency preparedness is a crucial part of the operation and maintenance of any infrastructure system. Western provides customers with approximately 85,000 acre-feet or 28 billion gallons of water annually. To maintain these service levels, Western establishes and maintains policies, procedures and organizational structure for response to emergencies that could cause significant disruption to operations. Being required to review and update these policies and procedures every five years helps ensure preparedness to respond to any emergency situation in a safe, effective and timely manner.

WMWD Arlington Desalter (ADS) Reverse Osmosis Water Treatment

WMWD Sterling Pump Station

What part(s) of the process did you find useful to your utility?

Western prioritized the development of the Risk and Resilience Assessment and Emergency Response Plan at the highest level of the agency, allowing its project manager full authority to source subject matter experts (SMEs) from each department. Participation of the SMEs proved highly valuable in the interpretation of Western’s experience and priorities, the development of meaningful threat-asset pairs and the refinement of risk assessments. To complement our in-house RRA and ERP expertise, we hired AARC Consultants to assist us.

Were there any “Aha Moments” during the process that you’d like to share?

The “Aha” came when Western’s SMEs got past the initial “sky is falling” shock of considering all potential hazards and worse case scenarios. This occurred during a workshop, processing the results of a preliminary threat assessment. After a few days of further considerations, the threats became fewer and less extreme. Western was able to develop a relevant and dynamic document that will inform business policies and procedures for years to come.

What would you do differently?

While emergency planning is a known priority, without guidelines or immediate need it can often be pushed lower on the daily to do list. Western would have benefited from allowing for more time for organic discussions, the insight offered by the SMEs and the collaboration that took place was tremendously valuable. Starting the assessments sooner would have offered additional time to explore identified risk areas and potentially put additional procedures in place

How did your utility benefit from the process?

Western’s various departments were able to have deeper conversations about emergency management and response. The development of the Risk and Resilience Assessment and Emergency Response Plan opened the door to new and ongoing discussions of Western’s vulnerability and potential risk mitigations. The process is leading to more dynamic policies and procedures. Allowing multiple staff from each of Western’s departments sufficient time to participate and contribute to the RRA and ERP process has reinforced the value of emergency planning for our customers and the region to ensure uninterrupted delivery of water and wastewater services, no matter the crisis.

What specific procedures/policies have improved because of the assessment?

The development of Western’s RRA aligned with its Capital Improvement and Facilities Planning (CIFP) process. The team was able to incorporate several new projects in the CIFP based on needs identified in the RRA.

Do you think the culture has changed somewhat (e.g. to reduce risk/improve resilience) since the workshops/assessments?

Western established an Emergency Operations Center (EOC) Committee in 2017. Members of Western’s EOC Committee worked closely with the SMEs and consultants in the development of the RRA and ERP. While previously focused on EOC activation, organization, and staff training, the committee is now transitioning to a broader emergency preparedness approach. The committee plans to use the RRA and ERP to guide development of new procedures, templates, and other tools, as well as ongoing procurement of resources. Western continues to enhance and improve its culture of emergency preparedness as evidenced during the recent COVID-19 pandemic. As an essential service, Western and its employees continue to maintain high levels of water and wastewater service during these challenging times.

How will the assessment be useful to your utility? How do you plan to utilize the output?

Western plans to use the output from the RRA and ERP to drive capital projects, operational enhancements, and further enhance our emergency planning.

Conclusion

The America’s Water Infrastructure Act of 2018 requires that all community water systems serving at least 3,300 people assess the risks to, and the resilience of, their drinking water systems. Therefore, it is suggested that you begin as soon as possible in order to meet the regulatory deadlines.

Although community water systems must comply with AWIA to avoid penalties, they must not miss this opportunity to benefit from this exercise. In Western’s experience, developing the RRA and ERP benefitted the public agency by opening the door to new and ongoing discussions of their vulnerabilities and potential risk mitigation needs, leading to more dynamic policies and procedures. Western was also able to align the RRA with Capital Improvement and Facilities Planning, which had the added benefit of incorporating several new projects into the CIFP.

Anita M. Wilcox is a Senior Management Analyst for Western Municipal Water District. Stephen Baruch, D.Env, is a Senior Emergency Response Planner; Pacia Diaz, PhD, is a Senior Engineer; and Scott Thomas, PhD, is Principal Scientist for AARC Consultants, LLC, a wholly-owned subsidiary of AARC Management, Inc. headquartered in Houston, Texas. AARC Consultants is a Minority- and Woman-Owned Business Enterprise, providing AWIA-compliant Risk & Resilience Assessments and Emergency Response Plans to Cities, Counties, Water Authorities and other public entities.