HomeMy WebLinkAbout09.c EDB HIRA Report 2026 coy
ti
o 1--
4..\
0,0
T�
AUPTIA"
Hazard Identification
and Risk Assessment
July 21, 2026
Table of Contents
Executive Summary 2
Hazard Identification and Risk Assessment Methodology 2
HIRA Risk Register 4
HIRA Highlights 6
Human Resources 8
Cybersecurity 8
Conclusion 8
1
Executive Summary
This report describes the 2026 Hazard Identification and Risk Assessment(HIRA).HIRA provides
an evaluation of risks facing the Clay County Utility Authority(CCUA),prioritizes them based on
severity and likelihood, and outlines current controls and recommended mitigation strategies. The
goal is to reduce operational, reputational, and safety-related impacts through proactive planning
and action.
This assessment assists senior managers in accomplishing the following:
1. Identifying potential risks facing the organization.
2. Assessing and prioritizing risks based on their projected impact and likelihood.
3. Allocating limited resources to the greatest effect.
4. Organizing and implementing strategies to mitigate and avoid risks.
5. Preparing for and responding to risk events that do occur.
6. Staying informed of new and evolving risks.
Hazard Identification and Risk Assessment Methodology
Enterprise level risks were collaboratively identified through interviews conducted by the Risk&
Safety Manager with each Department Head and the Environmental Compliance Manager. Each
identified risk was scored from 1 (low) to 5 (high) for both Impact and Probability, with a final
Risk Rating calculated as their product(Impact x Probability). Risks were ranked from the highest
to lowest Risk Rating. Control measures and additional remedies were identified.
HIRA Rating Guidelines
These guidelines inform, but do not replace, managerial judgement. Probability is the likelihood
or frequency that an undesired event will occur. Table 1 provides the guidelines used to estimate
the frequency of a particular event.
Rate Guideline
Remote - not more than 1 event in 10 years
Rare -not more than 1 event in 5 years
3 Occasional -more than 1 event in 5 years, but less than annually
4 Frequent- at least 1 event annually
Common - 5 or more events annually
Table 1—Probability Ratings
2
Impact is the severity should an event occur. Table 2 provides the guidelines used to estimate the
impact of an event. The number assigned should be the highest rate with at least one of the listed
criteria.
Rate Guidelines
Insignificant- fiscal impact to CCUA is <$5,000; little to no impact on
ri operations; no stakeholder concerns
Some - fiscal impact to CCUA is>$5,000 and<$100,000; little to no risk of
injury; some limited impact on operations; limited stakeholder concerns
Moderate - fiscal impact to CCUA is>$100,000 and<$300,000; risk of injury;
3 significant impact on operations; multiple or influential stakeholders have
concerns
Severe - fiscal impact to CCUA is >$300,000 and<$1,000,000; risk of death or
4 multiple injuries; extensive impact on operations; extensive stakeholder
concerns
Critical - fiscal impact to CCUA is >$1,000,000; risk of multiple deaths; total
disruption of services to at least one neighborhood for at least 2 weeks
Table 2—Impact Rating
Risk Rating
Risk=Probability x Impact
Risk Level Threshold General response
Critical x>20 Expedite action
High 20>x> 16 Prioritize planning and implementation
Medium 16>x> 8 Planned approach; temporary fix
Low 8 >x Tolerate or resolve quickly
Table 3—Risk Rating
3
HIRA Risk Register
Primary Impact Prob Rating
Rank Hazard Description Impact Description Risk Owner Current Control 1-5 1-5 1-25 Additional Possible Remedies
Vehicle Accidents Auto accidents involving CCUA owned vehicles. Liabilities and repair costs due to bodily injury Chief Human License checks. •Advanced driver assistance systems(as they become available).
and property damage;injury;death. Resources .Training&vehicle familiarization. •Periodic vehicle inspections by supervisors.
Officer .Liability insurance. •Behind-the-wheel defensive driving training by in-house instructors.
1 •GPS monitoring&Dash Cams. 5 •Implement progressive discipline for seat belt violations and repeated unsafe driving.
•In-house vehicle repair&maintenance.
Contracted defensive driving training.
Workforce Health and Workplace accidents,injuries,or health issues. Decreased productivity;increased operating Chief Human .Regular department level training and awareness. •Quick reference guide for chemical exposure and release.
Safety Incidents costs;legal liabilities;damage to employee Resources Formal training(initial and periodic)and safety awareness •Complete revision of safety manual.
morale;damage to company reputation;injury. Officer (monthly safety newsletter). •Assess availability of contractor led ergonomic training.
•Periodic PPE audits.
2 •Facility inspections. 4 5 20
•Safety Manual&Emergency Quick Reference Guide.
Quarterly safety meeting for managers.
Light duty retum to work after an injury.
•Random and post accident drug testing.
Sewer Backup/Water Damaged pipes or joints,aging infrastructure, Liabilities due to property damage or loss of Chief •Fats,oil,and grease educational outreach. •Use Asset Management system(in work)and FOG database to efficiently target outreach and sewer inspections.
Main Break blockage due to grease and roots,loss of power business revenue;loss of public trust;DEP Operations •Alarm systems in lift stations. •Monitor EPA approval and JEA testing results relating to sonar profiling technology;implement technology to better deploy
to lift stations leading to sewer backups and consent orders. Officer •TV line inspections of sewer mains on 10 year preventative sewer line inspection assets.
3 water runoff onto property. maintenance schedule. 3 15 •Implement SCADA monitoring(in-work)of remaining 50%of lift stations.
•$1MM annual relining of sewer mains. •Competitively solicit risk response and remediation contractors to create a pre-approved list of best value contractors.
•$1MM CIP to replace aging water mains. •Personally meet each commercial customer concerning fats,oil,grease.
•50%of lift stations have SCADA monitoring. •Purchase additional Vac-Con truck to increase volume of sewer maintenance activities.
i
Data Breach and Unauthorized access to sensitive employee Legal consequences;identity theft;loss of trust Information •Multi-factor authorization. •Ensure effective implementation of Cybersecurity policy.
Cybersecurity Threats information such as payroll data,personal details,from customers and employees;damage to Technology •External 24/7 network security monitoring.
to Administrative IT and performance reviews. Ransomware, employee morale;financial costs associated with Manager •Firewalls,endpoint protection,patching.
4 Systems malware,and similar threats. remediation and recreating lost data;damage to •Security audits. 4 3 12
brand and public reputation. Multi-level backup and recovery.
User training.
•Written Cybersecurity policy.
Utility Coordination Increased roadway construction in Clay county Unplanned financial expenditures due to county Chief Engineer •CCUA Sr Engineer reviews county roadway plans •Monitor and continue with existing controls.
Failures will increase the risk of requirements to move changes to roadway construction plans late in the throughout the design.
5 CCUA infrastructure from county right of ways. development process. •Sr.Engineer coordinates with County. 3 12
•Sr Engineer manages CCUA costs throughout design and
construction.
Nature-related Risks Natural events that cause destruction of physical Property damage. Chief .Sandbagging of specifically identified lift stations in •Ensure all lift stations in 100 year flood zones have elevated electrical controls when installed new or rehabbed.
facilities. Operations designated flood zones.
6 Officer •Alarm monitoring for excessive water intrusion or lift 4 3 12
station failure during a hurricane.
•Submersible pumps all LS's in 100 yr flood zone
Environmental Lab Lack of control over laboratory analysis errors. Non-compliance penalties and sanctions;delayed Environmental •Test results received from contracted lab are reviewed by •Transfer work to contractor with higher demonstrated performance.
7 Testing Errors corrective action affecting public's safety;loss of Compliance hand. 4 3 12
consumer and stakeholder trust. Manager •CCUA lab conducts common tests.
Non-Compliance with Failure to comply with employment laws and Legal consequences such as lawsuits and fines; Chief Human Formal complaint process. •Monitor employment related claims.
Employment Law regulations can result in lawsuits,fines,and loss of employee trust;financial costs associated Resources Formal hiring process.
8 damage to the organization's reputation. with remediation and compensation;and damage Officer •Anonymous ethics hotline. 2 10
to brand reputation. •HR open door practices.
•Annual supervisor training.
Employee Injury An employee injured or accosted while working Lass of life;injury;workers'compensation costs. Chief •GPS units are deployed on vehicles. •Create list of work that requires more than one employee on a site such as confined space entry,working with hazardous
While Working Alone off shift while alone or in a remote location. Operations •Eliminate unnecessary solo shifts. chemicals,electrical work,working at height,or operating heavy equipment.Annotate work orders with multiple employee
9 Officer •Protocols for periodic check ins and entering customer 2 10 requirements.
residences.
Physical Security Terrorist or criminal activities that damage water Inability to provide drinking water to the Chief •Alarms to detect intrusion into water plants. •Quarterly security working group meetings to assess remedies.
Breach of Water delivery systems or contaminates drinking water. community;delivery of contaminated drinking Operations •Re-routing water and isolating sections of infrastructure. •Coordinate with CCSO for security audit.
10 Plants and Wells due water;financial liabilities;loss of public and other Officer •Implemented security policy. 2 10
to Malicious Actors stakeholder trust. •SCADA monitored pH sensors.
•Annual Operations exercises.
4
Primary Impact Prob Rating
Rank Hazard Description Impact Description Risk Owner Current Control 1-5 1-5 1-25 Additional Possible Remedies
Supply Chain Risk Disruption of the chemical supply chain outside Inability to process water and wastewater;rapid Chief Store wastewater until supply chain disruption is over. Diversify suppliers/collaborate with other utilities.
CCUA controL Volatility of energy costs due to and unexpected increase in operational costs; Operations Move chlorine from low flow to high flow plants. Stockpile essential supplies.
11 fluctuations in global energy markets. sudden increases in energy prices make budgeted Officer .Agreement with GRU re:exchange of LS controllers. 5 2 10 Energy efficiency initiatives;life cycle costing for pump purchase decisions;alternative or renewable energy sources.
funds inadequate to pay electricity or fuel costs. Plan to recalibrate quality to EPA standards. Assess solar alternative energy options for Mid-Clay.
High Profile Lead is highly toxic,especially to children. Public outrage-loss of community trust and Environmental •Engaged consultant to meet requirements of Lead and •Implement new initiatives(compliance database,CCUA staff service line field identifications,wastewater and biosolids
Contaminants(lead CCUA is required to comply with the Lead and reputation;fines,mandatory corrective actions, Compliance Copper Rule Improvements. sampling)and maintain ongoing compliance with existing rules.
service lines,PFAS) Copper Rule Improvements which is and increased administrative costs due to Manager 'Contract plumbers identified—4000 service lines.
promulgated by the EPA and enforced by DEP. increased scrutiny from regulators;replacing lead •FY26/27 budget includes funding for CCUA staff to identify
12 Forever chemicals like PFAS and PFOA are components in CCUA infrastructure;treating remaining—10,000 lines 5 2 10
known carcinogens.EPA has set limits for PFOS in effluent and/or biosolids is very costly; -PFAS sampling in drinking water is complete with no
certain PFAS in drinking water.New legislation legal and settlement costs due to lawsuits. detects.
requires wastewater&biosolid sampling. -PFAS sampling in wastewater and biosolids.
Third Party Injury or Abandoned and sometimes unmanned structures Injury or death to child or other intruder due to Chief 'Abandoned structures are fenced. .Complete physical audit of structures.
13 Death at Abandoned present an attractive nuisance. failure to remove or secure abandoned structures; Operations 'Access is limited by removing ladders,installing barriers, 5 2 10
Facilities associated premises liability;loss of trust of Officer and locking facilities.
public or other stakeholders.
Environmental Failure to comply with federal,state,and local Fines;litigation;reputational damage. Environmental Audits,mock inspections,and training conducted by the Add staff to the Environmental Compliance department to increase the number of audits,mock inspections,and trainings.
14 Compliance Failure environmental regulations. Compliance Environmental Compliance office. 3 3 9
Manager
Contractual Failures Contractual and legal documents leading to Unbudgeted,increased costs of construction; Chief Engineer •Using industry standard EJCDC contract. •Develop CCUA standard contract templates consistent with CCUA processes.
15 unfavorable outcomes. costs and expenses due to contractual related 4 2 8
disputes.
Employee Relations Conflict between employees,grievances,or Decreased productivity;increased absenteeism; Chief Human •Annual wage survey,employee survey,market competitive •Human Resource conferences.
Issues dissatisfaction with management. decreased morale;potential legal action;damage Resources salary,retirement,and benefits. •Human Resources department presentations.
to the organization's reputation as an employer; Officer Take home vehicle.
increased administrative and legal costs due to Tuition reimbursement.
16 organized labor activities. .Employee retirement committee. 3 2
Wellness incentive program.
Professional development through training and conferences.
Supervisor training program.
New employee tour and Executive Director luncheon.
Risks arising from Dependence on other public entities. Delayed or inefficient operational effects; Chief .Engage the services of lobbyist. No changes
relationships with increased costs due to liabilities assumed by Operations .Networking through professional associations and
17 independent public actions or inactions of other entities. Officer managerial contacts with regulators. 3 2
entities. .Managers monitor proposed rule-making actions.
Violence Against an Acts of workplace violence. Injury or death of an employee due to violence in Chief Human Police presence on cutoff days. Monitor for threats.
Employee the work place. Resources 'Police presence for select adverse employment actions.
18 Officer 'Badges,panic systems,cameras. 1
Background checks.
EAP services.
Talent/Skills Shortage Difficulty in recruiting and retaining employees Inability to meet business objectives and staff for Chief Human •Internship Program. •Monitor vacancy rates and recruitment.
with the necessary skills and expertise,including organizational growth;increased recruitment Resources •Maintain market competitive wages.
skilled technical positions such as engineers. costs;loss of operational effectiveness;and Officer
19 Indicated by 2 or more posted job openings that potential delays in project delivery. 5 1 5
post for longer than one month without
identifying a qualified candidate.
Workforce Turnover High turnover rates(exceeding 12%). Increased recruitment and training costs;loss of Chief Human •Market competitive wages/raises. Monitor employee turnover.
institutional knowledge;decreased productivity; Resources .Training programs.
20 disruption in operations;increased workload and Officer 4 1 4
decreased morale among remaining employees.
5
HIRA Highlights
Observations
• Risks linked to human resources (Non-Compliance with Employment Law, Talent/Skills
Shortage, Employee Relations Issues, Workforce Turnover)moved lower on the Risk
Register year over year.
• External forces such as aging systems and regulatory oversight influence infrastructure
and environmental related risks (e.g., sewer backups, construction delays, PFAs, Lead
and Copper).
• Cybersecurity continues to be a risk of particular concern.
Summary of Top Risks
Risk Rating Owner
1 Vehicle Accidents 25 Chief HR Officer
2 Workforce Health and Safety Incidents 20 Chief HR Officer
3 Sewer Backup/Water Main Break 15 Chief Operations Officer
Key themes: Personnel safety,public liability, infrastructure resilience, and legal/regulatory
compliance.
Issues and Remedies
1. Vehicle Accidents (Rating: 25)
• Issue: Highest-rated risk due to daily exposure and potential for injury or death.
• Current Mitigations: License checks; Online training &vehicle familiarization
checklist; Liability insurance; GPS monitoring; Dash Cams; In-house vehicle repair&
maintenance.
• Discussion: This year CCUA completed contractor led, classroom and in-vehicle training
for the 110 employees who are assigned or frequently drive CCUA-owned vehicles.
Additionally, CCUA qualified 4 high-caliber employees to be in-vehicle defensive
driving instructors. All new employees will receive vehicle familiarization training with
a CCUA instructor. Additionally, these instructors will conduct remedial training on an
as needed basis.
6
2. Workforce Health and Safety (Rating: 20)
• Issue: Incidents may lead to lawsuits,workers compensation claims, and workforce
dissatisfaction.
• Current Mitigations: Regular department level training and awareness; Periodic PPE
audits; Safety policy manual & Emergency Quick Reference Guide; Quarterly safety
meeting for managers; Use of light duty to return employees to work after an injury;
Random and post-accident drug testing.
• Discussion: Work-related injuries have been minor this year and are largely due to the
nature of the job. Bureau of Labor Statistics data indicates water and wastewater workers
have injury rates twice that of the average American worker. Fortunately, CCUA has not
suffered serious injuries that can arise from confined space work, chemical and biological
exposures, trenching, and work zone traffic - common exposures faced by CCUA
workers. CCUA relies on training, communication, and professional supervision to
reduce and prevent injuries. Currently, a team of selected employees is working to
simplify and clarify procedures in the CCUA Safety& Health Manual for consideration
by management. Simple, clear expectations are more likely to be understood and
followed by employees.
3. Sewer Backups/Water Main Breaks (Rating: 15)
• Issue: Affects public trust; Liability costs for damage and lost revenue, DEP consent
orders.
• Mitigations: Fats, oil, and grease (FOG) educational outreach; Alarm systems in lift
stations; TV line inspections of sewer mains on 10-year schedule; $1MM annual for
relining sewer mains; $1MM annual to replace aging water mains.
• Discussion: This risk has led to 6 figure settlements and has the potential to go higher.
Aging infrastructure and FOG are ongoing hazards that make some level of back-ups and
breaks inevitable. However, lift station failures can potentially lead to million-dollar
claims by causing system backups into multiple residences and businesses. To prevent
this, CCUA has installed SCADA monitored alarms in 50% of its lift stations and the
remaining 50% should be completed in the coming year. Regarding FOG, CCUA will be
purchasing another Vac Con truck, which will enable it to substantially increase the
mileage of pipes cleaned each year. In parallel, CCUA continues to reach out to
commercial companies to reduce the quantity of damaging FOG being discharged into
the sewer system. Aging pipes are being steadily replaced through consistent funding
from year to year. Finally, CCUA management aggressively assesses each overflow and
transfers liability to subcontractors or other organizations, such as cable companies, when
appropriate.
7
Human Resource
Human Resource issues have stabilized,particularly in talent acquisition and retention. A strong
package of benefits and perks along with competitive market wages have proven effective in the
current labor market. New HR employee outreach efforts and more comprehensive new hire
orientations are aimed at supporting employee commitment to the organization. Finally, CCUA
implemented a supervisor training program to give new supervisors the skills they need to be
effective leaders and to foster continuous improvement in its incumbent managers.
Cybersecurity
Cyber threats continue to evolve. The emergence of AI and the increasingly hostile overseas
threats provide real challenges. CCUA's continuous modernization of its Operational
Technology and electronic integration of its infrastructure will continue to provides new
challenges. This year, CCUA instituted a comprehensive Cybersecurity and AI use policy. The
coming year will largely be committed ensuring the policy is effectively implemented and
enforced. Although Information Technology leadership has been volatile over the last years,
CCUA is confident that it now has in place skilled personnel needed to effectively stabilize and
lead its IT programs.
Conclusion
The 2026 HIRA register lists and prioritizes significant risks to CCUA's operations and
reputation. To the extent CCUA implements alternatives, they will reduce vulnerability,
safeguard personnel and customers, and promote organizational resilience.
8