Water safety planning and risk assessment

The Inspectorate’s Risk Assessment team is responsible for understanding risks to water quality and sufficiency, adapting to new mitigation requirements, and developing approaches to Drinking Water Safety Planning (DWSP).

During 2025, the team assessed substantial volumes of data and documentation submitted by companies. Through systematic review of risk lines uploaded through regulation 28 reporting, the team strengthened its understanding of how effectively risks to water quality and sufficiency are being managed across the industry. This work enables the Inspectorate to identify where action is required and to support companies in complying with regulations 27 and 28 through DWSP audits, individual line assessments of regulation 28 data, and legal instrument closure audits. Collectively, these activities help maintain and improve risk management practice across the water industry.

The Risk Assessment team continues to engage with industry through the quarterly DWSP Forum, providing updates on current work and addressing issues raised by water companies and NAVs. To further support consistent implementation of DWSP requirements, the team has also introduced liaison meetings with companies and NAVs to provide additional support and guidance.

DWSP Guidance

In July 2025, the Risk Assessment team published the Guidance on risk assessment and risk management specific to Drinking Water Safety Plans (DWSPs) following collaboration with water companies through the Drinking Water Safety Planning Forum and a small in-person working group convened to resolve outstanding issues. The guidance provides a comprehensive framework for the delivery of a DWSP and introduced a new category, category J, for recording carried-forward risk. The introduction of category J is to enable consistent reporting of categories and methodology for carrying risk scenarios forward to downstream stages across the industries water supply systems and will be a requirement from February 2027. This increases the fairness of scoring within the Risk Assessment Risk Index (RARI) used to indicate companies’ current and trending risks.

Alongside this change to reporting categories, the use of hazardous events is being further endorsed by the Inspectorate through the DWSP guidance so that there is better clarity regarding root cause analysis and control measure/mitigation application for risks. Using hazardous events contributes to understanding risk scenarios at an asset, stage and cumulative supply system level to give a more accurate representation of potential risk to water quality and quantity at the consumer tap.

Sufficiency

In September 2024, the National Infrastructure Commission (now NISTA) published its report, Developing Resilience Standards in UK Infrastructure. In response, the Inspectorate sought to assess the extent to which companies understood their own sufficiency and resilience arrangements and wrote to them in December 2024 requesting further information.

The Risk Assessment team initially reviewed companies’ regulation 28 reports to determine which sufficiency-related risks had been reported to the Inspectorate and what mitigation measures were in place. However, this review proved inconclusive due to variations in the way companies reported hazardous events, with some companies not reporting sufficiency risks at all.

Consequently, the team drew on the three key recommendations set out in the NISTA report and requested this information from all water companies and new appointments and variations (NAVs). The responses provided an evidence base to inform the development of guidance on the delivery of a draft water sufficiency guidance in late 2025. The team has since revised the Sufficiency Guidance so that it aligns with the principles of DWSPs and this will be published in 2026.

Per and polyfluoroalkyl substances (PFAS)

Following the Inspectorate’s PFAS guidance issued in August 2024, companies were required to monitor 6:2 FTAB (6:2 fluorotelomer sulphonamide alkyl betaine), which was added to the list of PFAS parameters, and to report the ‘Sum of PFAS’ from January 2025.

The above monitoring requirement was extended to New Appointments and Variations (NAVs) also. The NAVs are also expected to exchange information and data and to maintain a forward-looking PFAS strategy. Annex C of the Information Direction lists all PFAS chemicals of interest. Companies are also required to notify the Inspectorate if additional PFAS chemicals not listed are identified at concentrations above tier 1.

The PFAS guidance was updated in March 2025, Information Letter 03/2025, to provide further detail on PFAS tiers and associated actions, alongside requirements for monitoring and reporting, regulation 27 risk assessments, regulation 28 reporting, and company PFAS strategies. The updated guidance also set out expectations for bulk supplies, including those involving NAVs.

Audits

Through DWSP audits, the Risk Assessment team has continued to identify recurring issues in the way companies record risks, contributing to inconsistency across the industry and an ongoing reliance on reactive rather than proactive measures to reduce risks.

Companies should take a proactive approach to identifying and addressing risks, rather than waiting for issues to emerge before considering investment needed to protect public health. A reactive approach weakens the effectiveness of risk management and makes it harder to compare risk profiles across companies.

Companies must strengthen their DWSP arrangements to support the early identification and management of risks, thereby protecting public health and securing compliance with regulatory parameters, rather than relying on retrospective action in response to water quality or sufficiency issues. Companies must also ensure full compliance with regulations 27 and 28. To date, the majority of DWSP audits have resulted in ‘minded to enforce’ decisions and/or the issue of legal instruments requiring companies to review regulation 27 risk assessments and regulation 28 reporting.

In July 2025, the team conducted a technical and drinking water safety plan (DWSP) audit at United Utilities at Watchgate Water Treatment Works(WTW) and Bird Hill Service Reservoir (SR). The audit revealed significant deficiencies around asset maintenance and risk management, highlighting the need for improved inspections, risk assessments, and control measures to ensure water safety and regulatory compliance as well as to develop holistic raw water contingency plans. At Bird Hill SR there was also a requirement for the company to address fencing and security deficiencies.

The team identified deficiencies in the Drinking Water Safety Plans including incomplete risk identification, misaligned PFAS risk assessments, and discrepancies in risk scoring and reporting. There were issues identified with control measures and misappropriated association with hazards and hazardous events. This means that risk assessments may not being carried out effectively to understand what control measures can be used for particular hazards/hazardous events, and therefore residual risk outputs from reg 27 assessments may not be accurate or understood correctly.

The DWSP did not sufficiently reflect significant risks, despite the company’s regulation 27 assessments and regulation 28 submissions showing that nearly all risks were scored 10 (amber) and categorised as A – ‘Target risk mitigation achieved, verified, and maintained’. The consistently applied risk scores limited differentiation between risks and reduced the ability to prioritise the most significant issues for improvement and investment.

Audit findings identified weaknesses in United Utilities’ DWSP risk assessment arrangements, requiring the company to revise its methodology, improve risk scoring and control measure evaluation, and complete reassessments across treatment works and connected raw water assets. Due to the deficiencies identified in the DWSP, the company was served with a companywide regulation 28 notice to address these.

Due to reduced team capacity, substantial input into legal instruments arising from audits undertaken in 2024, and wider internal Inspectorate commitments, this was the only onsite audit carried out in 2025. Other programmed audits were rescheduled to 2026.

RAR Reporting and Company Breakdown of DWI Categories

The annual submission of companies’ regulation 28 data took place in October. Companies used the Inspectorates’ online portal for this year’s submission including uploading of their DWSP methodologies and declaration with Director sign off. Any issues experienced with this process were easily resolved with good communication from companies and input from the Inspectorate’s Data Management Team.

Companies’ risk assessment record (RAR) data is submitted using the DWI categories shown with definitions in the table below in table RA1. Companies must apply DWI categories appropriately to allow data to be meaningful and to give clarity in risk management.

DWI category	Description
A	Target risk mitigation achieved, verified, and maintained
B	Additional or enhanced control measures which will reduce risk are being validated
C	Additional or enhanced control measures which will reduce risk are being delivered
D	Additional or enhanced control measures are required to materially reduce risk
E	Risk under investigation
F	Partial mitigation
G	No mitigation in place: control point downstream
H	No mitigation in place and none required
I	Future risk not requiring mitigation at present
J	No mitigation in place, carried forward risk: control point upstream
X	Line no longer relevant.

Table RA1 – DWI categories

Risk Assessment Risk Index (RARI)

The risk assessment risk index (RARI) is dependent on DWI category application to risks perceived by companies. Companies are required to report risk assessments and show where risks are carried forward through supply systems from catchment/source to the consumer tap. Since the introduction of DWI categories, companies have used different methods to show carried forward risks, either by indicating this by using the DWI categories applied at assets with active risks and applying the same categories at downstream assets or using residual risk scoring to demonstrate risks moving forward through a supply system.

As such, RARI values for companies have not been comparable across the industry and can only show changes over time when viewed on an individual company risk profile. RARI has been reported for companies within the DWI Annual reports since 2019. The index is a useful tool in showing active risks within companies and is being redeveloped as companies implement changes to how DWI categories are applied in line with the DWSP Guidance, gaining a more consistent approach over the coming years. This includes the introduction of a new category ‘J’ for carried forward risks although this category will not be included in the RARI calculations at this time, it will allow for a more consistent approach within the industry to category application across company supply systems.

This graph excludes NAVs and shows changes in company risk scores between 2024 and 2025. These changes reflect several factors, with some companies showing increased RARI scores due to an increase in assets and as the industry has increased hazard identification and recording of risks. It is expected that this is likely to be the case over the AMP 8 period through improvements made to this hazard identification processes companies use in line with DWSP Guidance.

NAVs

The graph shows a significant decrease in RARi scoring for LEEP. This reduced score is related to a removal of duplicate lines and an increase in assets. This leads to an increase in lines included in the calculation and a reduced RARI. This instance highlights why this metric is used for intra company comparison

Top 10 current identified risks in England (as a % sum of industry RARI)

Category I is used to indicate perceived future risks that may need to be investigated and mitigated. Such risks include hazards that may be associated with climate change, emerging contaminants, changes in raw water quality and sufficiency, and asset condition and longevity. These risks are not necessarily manifesting now, but companies are keeping a watching brief over them. However, increasing temperatures and periods of prolonged dry weather were seen across England in 2025 with some companies continuing to have a drought order into the winter months.

The top ten hazards where category I has been used in company submitted regulation 28 data is shown below.

Table of contents