AWIA Risk and Resilience Assessment Recertification

This template covers the five-year recertification of a community water system risk and resilience assessment. It walks through scope verification, physical assets, natural hazards, malevolent acts, cybersecurity, and emergency response documentation. It is designed to capture what changed since the prior assessment and what corrective actions remain open.

This template is written for community water systems that need to maintain an AWIA risk and resilience assessment on the five-year cycle. It is not a generic utility audit and should be used only where the recertification requirement applies. Smaller systems can still use it as a structured internal review if they want the same evidence trail.

Use it on the five-year recertification cadence and whenever a major change affects risk, such as a new source, treatment upgrade, SCADA migration, flood event, or security incident. The template includes a due-date check so the team can confirm the next cycle before the current one expires. Many utilities also run it earlier as a management review to avoid last-minute gaps.

The best results come from a cross-functional team that includes operations, engineering, cybersecurity or OT support, emergency response, and management. A competent person familiar with the system should lead the walk-through and collect evidence. If the utility uses consultants, they should support the review rather than replace the people who actually run the system.

The template is aligned to the AWIA risk and resilience framework and supports documentation that can be retained for compliance purposes. It also reflects common expectations from drinking water security, emergency preparedness, and resilience programs. Where relevant, it helps organize evidence that may also support state primacy agency reviews or internal audits.

Common mistakes include reusing the prior assessment without updating hazards, leaving cyber controls out of scope, and documenting assets too broadly to be useful. Another frequent issue is treating the recertification as a paperwork exercise instead of verifying open corrective actions and changed conditions. The template is most effective when each item is tied to an observable condition or current control.

Yes. You can tailor the asset list, hazard profile, and emergency response references to match a small groundwater system, a surface water plant, or a multi-site distribution network. The structure stays the same, but the evidence fields should reflect your actual facilities, interconnections, and control systems.

Yes. Many utilities link this template to preventive maintenance logs, SCADA asset inventories, emergency response plans, cybersecurity policies, and corrective action tracking. That makes it easier to prove that the recertification reflects current conditions rather than a one-time review. It also reduces duplicate data entry across compliance and operations records.

Start by assigning one owner for scope control and one reviewer for each major domain: physical security, natural hazards, cyber, and emergency preparedness. Then collect site-specific evidence for each treatment plant, pump station, storage tank, and interconnection before the final sign-off. A phased rollout works well when the system has multiple facilities or shared control systems.