Water safety planning and risk assessment

The Inspectorate’s Risk Assessment team is responsible for understanding risks to water quality and sufficiency, adapting to new mitigation requirements, and developing approaches to Drinking Water Safety Planning (DWSP).

During 2025, the team assessed substantial volumes of data and documentation submitted by companies. Through systematic review of risk lines uploaded through regulation 28 reporting, the team strengthened its understanding of how effectively risks to water quality and sufficiency are being managed across the industry. This work enables the Inspectorate to identify where action is required and to support companies in complying with regulations 27 and 28 through DWSP audits, individual line assessments of regulation 28 data, and legal instrument closure audits. Collectively, these activities help maintain and improve risk management practice across the water industry.

The Risk Assessment team continues to engage with industry through the quarterly DWSP Forum, providing updates on current work and addressing issues raised by water companies and NAVs. To further support consistent implementation of DWSP requirements, the team has also introduced liaison meetings with companies and NAVs to provide additional support and guidance.

DWSP Guidance

In July 2025, the Risk Assessment team published the Guidance on risk assessment and risk management specific to Drinking Water Safety Plans (DWSPs) following collaboration with water companies through the Drinking Water Safety Planning Forum and a small in-person working group convened to resolve outstanding issues. The guidance provides a comprehensive framework for the delivery of a DWSP and introduced a new category, category J, for recording carried-forward risk. The introduction of category J is to enable consistent reporting of categories and methodology for carrying risk scenarios forward to downstream stages across the industries water supply systems and will be a requirement from February 2027. This increases the fairness of scoring within the Risk Assessment Risk Index (RARI) used to indicate companies’ current and trending risks.

Alongside this change to reporting categories, the use of hazardous events is being further endorsed by the Inspectorate through the DWSP guidance so that there is better clarity regarding root cause analysis and control measure/mitigation application for risks. Using hazardous events contributes to understanding risk scenarios at an asset, stage and cumulative supply system level to give a more accurate representation of potential risk to water quality and quantity at the consumer tap.

Sufficiency

In September 2024, the National Infrastructure Commission (now NISTA) published its report, Developing Resilience Standards in UK Infrastructure. In response, the Inspectorate sought to assess the extent to which companies understood their own sufficiency and resilience arrangements and wrote to them in December 2024 requesting further information.

The Risk Assessment team initially reviewed companies’ regulation 28 reports to determine which sufficiency-related risks had been reported to the Inspectorate and what mitigation measures were in place. However, this review proved inconclusive due to variations in the way companies reported hazardous events, with some companies not reporting sufficiency risks at all.

Consequently, the team drew on the three key recommendations set out in the NISTA report and requested this information from all water companies and new appointments and variations (NAVs). The responses provided an evidence base to inform the development of guidance on the delivery of a draft water sufficiency guidance in late 2025. The team has since revised the Sufficiency Guidance so that it aligns with the principles of DWSPs and this will be published in 2026.

Per and polyfluoroalkyl substances (PFAS)

Following the Inspectorate’s PFAS guidance issued in August 2024, companies were required to monitor 6:2 FTAB (6:2 fluorotelomer sulphonamide alkyl betaine), which was added to the list of PFAS parameters, and to report the ‘Sum of PFAS’ from January 2025.

The above monitoring requirement was extended to New Appointments and Variations (NAVs) also. The NAVs are also expected to exchange information and data and to maintain a forward-looking PFAS strategy. Annex C of the Information Direction lists all PFAS chemicals of interest. Companies are also required to notify the Inspectorate if additional PFAS chemicals not listed are identified at concentrations above tier 1.

The PFAS guidance was updated in March 2025, Information Letter 03/2025, to provide further detail on PFAS tiers and associated actions, alongside requirements for monitoring and reporting, regulation 27 risk assessments, regulation 28 reporting, and company PFAS strategies. The updated guidance also set out expectations for bulk supplies, including those involving NAVs.

Audits

Through DWSP audits, the Risk Assessment team has continued to identify recurring issues in the way companies record risks, contributing to inconsistency across the industry and an ongoing reliance on reactive rather than proactive measures to reduce risks.

Companies should take a proactive approach to identifying and addressing risks, rather than waiting for issues to emerge before considering investment needed to protect public health. A reactive approach weakens the effectiveness of risk management and makes it harder to compare risk profiles across companies.

Companies must strengthen their DWSP arrangements to support the early identification and management of risks, thereby protecting public health and securing compliance with regulatory parameters, rather than relying on retrospective action in response to water quality or sufficiency issues. Companies must also ensure full compliance with regulations 27 and 28. To date, the majority of DWSP audits have resulted in ‘minded to enforce’ decisions and/or the issue of legal instruments requiring companies to review regulation 27 risk assessments and regulation 28 reporting.

Due to reduced team capacity, substantial input into legal instruments arising from audits undertaken in 2024, and wider internal Inspectorate commitments, this was the only onsite audit carried out in 2025. Other programmed audits were rescheduled to 2026.

RAR Reporting and Company Breakdown of DWI Categories

The annual submission of companies’ regulation 28 data took place in October. Companies used the Inspectorates’ online portal for this year’s submission including uploading of their DWSP methodologies and declaration with Director sign off. Any issues experienced with this process were easily resolved with good communication from companies and input from the Inspectorate’s Data Management Team.

Companies’ risk assessment record (RAR) data is submitted using the DWI categories shown with definitions in the table below [table RA1]. Companies must apply DWI categories appropriately to allow data to be meaningful and to give clarity in risk management.

DWI category	Description
A	Target risk mitigation achieved, verified, and maintained
B	Additional or enhanced control measures which will reduce risk are being validated
C	Additional or enhanced control measures which will reduce risk are being delivered
D	Additional or enhanced control measures are required to materially reduce risk
E	Risk under investigation
F	Partial mitigation
G	No mitigation in place: control point downstream
H	No mitigation in place and none required
I	Future risk not requiring mitigation at present
J	No mitigation in place, carried forward risk: control point upstream
X	Line no longer relevant.

Table RA1 – DWI categories

Risk Assessment Risk Index (RARI)

The risk assessment risk index (RARI) is dependent on DWI category application to risks perceived by companies. Companies are required to report risk assessments and show where risks are carried forward through supply systems from catchment/source to the consumer tap. Since the introduction of DWI categories, companies have used different methods to show carried forward risks, either by indicating this by using the DWI categories applied at assets with active risks and applying the same categories at downstream assets or using residual risk scoring to demonstrate risks moving forward through a supply system. As such, RARI values for companies have not been comparable across the industry and can only show changes over time when viewed on an individual company risk profile.

RARI has been reported for companies within the DWI Annual reports since 2019. The index is a useful tool in showing active risks within companies and is being redeveloped as companies implement changes to how DWI categories are applied in line with the DWSP Guidance, gaining a more consistent approach over the coming years. This includes the introduction of category ‘J’ for carried forward risks. Category J will not be included in the RARI calculations at this time, however it will allow for a more consistent approach within the industry to category application across company supply systems in the future.

Figure RA1 – company average RARI scores

Top 10 current identified risks in Wales

Category I is used to indicate perceived future risks that may need to be investigated and mitigated. Such risks include hazards that may be associated with climate change, emerging contaminants, changes in raw water quality and sufficiency, and asset condition and longevity. These risks are not necessarily manifesting now, but companies are keeping a watching brief over them.

The top ten hazards where category I has been used in company submitted regulation 28 data is shown below.

Top 10 current identified risks in Wales (as a % sum of industry RARI)

The top three perceived risks remain the same as recorded in 2024, however the perception of these risks have increased, with the remaining being similar to last years figures.

Table of contents