Water safety plan software that checks every barrier against its own records each morning, so a missed reservoir inspection raises the hazard's risk that day, not at the audit
A living water safety plan, always audit-ready.
See one case, screen by screen ↓A water safety plan names every hazardous event from catchment to tap, puts a control on it and proves the control works. In many utilities that plan is a spreadsheet and a Word document, rebuilt once a year for the audit. The proof that each control works lives elsewhere: reservoir inspection records, chlorine analysers, sample results, hatch alarms, work orders and customer complaints, each in its own system.
So a missed check stays hidden. A monthly hatch inspection is cancelled because the crew is sent to a burst main, and nothing re-raises it; the hazard's rating in the plan still says Medium. When an incident or an audit finding comes in, the incident report closes and the hazard register is not touched, although the WHO method asks for the plan to be revised after every incident. Service reservoirs are where this goes wrong: in Alamosa, Colorado, in 2008, a breached storage reservoir made about 1,300 people ill.
Estimated split of the about 3 weeks the team spends assembling the plan pack for the internal audit (evidence for 86 critical controls, the change log, improvement actions), in working days, by hand and with the solution.
Five agents check every barrier against its records each morning and re-rate the hazard; the water safety plan lead confirms and the Head of Drinking Water Quality signs.
Kestrel Ridge service reservoir SR-07 holds 18 ML in two cells, was built in 1964 and supplies 41,200 people in Brackenfield and Oakmere. Its monthly hatch inspection was due on 12 October. On Monday 13 October 2026, here is what happens, screen by screen, in the working solution.
Amara owns the plan's 312 hazardous events. HZ-ST-017, microbial ingress into treated water at Kestrel Ridge, is drawn as a bowtie: four causes and nine preventive barriers on the left, three consequences and six recovery barriers on the right. The live risk is 5 · Medium, the same as plan v4.3. Barrier B1, hatch seals and locks, reads “Due 12 Oct · grace to 06:00”.
WO-77310: “Monthly hatch inspection cancelled: crew diverted to a 12-inch burst on Fenwick Road”
The record matcher reads 2,914 new records: 41 inspections, 2,806 telemetry readings, 58 laboratory results, 6 alarms and 3 complaints. The barrier watcher checks 1,148 barrier clocks and 412 limits. B1 has no inspection record by its due date, so it turns red. Hatch H2 opened on 9 Oct from 14:12 to 14:19 with no work permit or keyholder visit matched, so the hatch alarm turns amber; outlet chlorine has fallen from 0.62 to 0.41 mg/L in three days, so the outlet analyser turns amber too.
“B1 hatch seals and locks, SR-07: failing” — “Due 12 Oct, no record.”
One critical preventive barrier is failing and one is weakened, so the risk re-rater steps the likelihood from 1 to 3 and the dial swings to 15 · High. The plan still says 5 · Medium: only Amara can change it. The re-rater drafts the response: an urgent hatch inspection today at P1, daily outlet sampling at SR-07 until B1 is restored, and a message to Declan Muir and Samuel Adeyemi.
Left unticked: “Take cell 2 out of supply as a precaution — not advised: outlet samples clear, chlorine above alarm”
Amara confirms the interim rating of 15 · High. Urgent hatch inspection WO-77418 is raised at P1. At 07:40 Declan Muir assigns Tobias Lund; at 09:55 Hana Kovač's first daily sample, S-26-48113, is taken at the outlet. Each new record joins the feed beside the bowtie.
“Interim rating 15 · High confirmed · WO-77418 raised · daily sampling at SR-07”
Inspection INS-SR07-1013 arrives from the roof of SR-07: the H2 seal has perished on the hinge side, with an 8 mm gap and bird droppings on the outer rim, none inside cell 2. The seal is replaced with part HS-600, the hatch relocked and four photos attached. The record matcher ties it to B1 at 99 %, and it also explains the 9 Oct alarm.
“Also explains: the H2 contact event on 9 Oct — a perished seal lets the hatch lift in wind”
Amara accepts the inspection as evidence for B1. The barrier turns green, the likelihood returns to 1 and the live risk to 5 · Medium, with the H2 finding kept on the hazard. A minute later the plan writer adds the change to plan v4.4 and proposes improvement action IP-2026-031: seal condition checks and spare seals at the 9 reservoirs whose hatches are over 30 years old.
No barrier turns green without a record that proves it.
The incident analyst opens INC-2026-041, “Critical inspection cancelled and not re-raised, Kestrel Ridge SR-07”, and proposes two changes for Amara to accept or reject: a new rule for all 86 critical barriers, and a change to the hatch check on 46 reservoirs, so that an H2 seal marked “fair” at an inspection triggers a seal replacement within 30 days. It proposes only; Amara decides what reaches the hazard register.
New rule: “A cancelled inspection on a critical barrier is re-raised within 24 hours, on any site”
Draft v4.4 follows the plan's 11 modules, from the team to revision after incidents, and supersedes v4.3, approved on 14 Mar 2026. It lists 14 changes since v4.3, each with who, when, why and the evidence. HZ-ST-017 reads: 5 · Medium, interim 15 · High from 06:00 to 11:42 on 13 Oct, B1 restored by INS-SR07-1013.
Sign-off: “Drafted by Plan writer · Reviewed by Amara Osei · Approved by Samuel Adeyemi — waiting”
Samuel signs as Head of Drinking Water Quality and chooses the meaning: “I approve this plan as the current water safety plan”. v4.3 stays readable. The audit pack follows from the same records: the plan document, an evidence index for the 86 critical barriers, the change log, the improvement plan and incident learning.
“Plan v4.4 approved by Samuel Adeyemi · v4.3 kept read-only”
Today 99.5 % of barriers carry current evidence — 1,142 of 1,148. Since the daily check went live in May, failing critical barriers are found by the check, and in October they were restored in a median of 1.2 days, against 142 days for the 23 found at the March review. Hazards rated Very high fell from 4 to 2 between Q4 2025 and Q3 2026.
“60 failing barriers found in 12 months; 21 on storage, 14 of them hatch, vent or roof checks”
The same missed inspection, seen by the five people who carry the plan — what their year looked like, and what it looks like now.
Five agents check every barrier against its records each morning and re-rate the hazard; the water safety plan lead confirms and the Head of Drinking Water Quality signs.
Reads inspection records, telemetry, laboratory results, alarm events and complaints, and attaches each one to the barrier it verifies, with a confidence and the line of the record that proves the match.
Every day at 06:00, and on every alarm, checks each barrier's verification clock and monitoring limits and sets it green, amber or red — red when overdue past grace or out of limit, amber when due within 7 days, trending to a limit or corroborated by an unexplained event.
Recalculates the likelihood of each hazard from its barriers' status with the step rules in Settings, shows the live rating beside the plan rating and drafts the response for High or Very high: urgent work, extra sampling, who to tell.
Reads incidents, near misses and audit findings, finds the hazards they touch and proposes new causes, barriers, check frequencies or rules, with the evidence.
Keeps the plan document, change log and evidence index current in the utility's template, following the WHO modules; drafts each version and the audit pack.
Confirm, sign, dispatch the fix. The agents propose; a named person decides.
Ask about any hazard, barrier or record in the plan — or say what to change. Every answer points to its records.
Why did Kestrel Ridge go to High this morning?
The monthly hatch inspection at SR-07 was missed. It was due on 12 Oct; work order WO-77310 was cancelled on 11 Oct when the crew went to the Fenwick Road burst, and nothing re-raised it. Hatch H2 opened for seven minutes on 9 Oct with no permit, and its seal was already marked “fair” in September. Outlet samples are still clear. Likelihood went from 1 to 3, so the live risk rose to 15 · High against the plan's 5.
Which critical barriers are overdue right now?
Five checks are past due, four of them on critical barriers: Kestrel Ridge SR-07 hatch seals and locks, since 06:00 today; Hollin Edge T-02 hatch seals and locks, 8 days, chased twice; Fenwick Moor filter turbidity calibration, 11 days; and 14 Oakmere backflow device tests, 5 days. The Wrenfold nitrate trend review is 6 days overdue but not critical.
Re-raise any cancelled critical inspection within 24 hours
Done. New rule: “When a work order for a critical barrier's check is cancelled, raise a replacement within 24 hours and tell the operations manager.” It covers all 86 critical barriers and would have caught WO-77310 on 12 Oct. You can change it in Settings.
Draft the change log for plan version 4.4
Drafted: 14 changes since v4.3 (14 Mar). The newest is HZ-ST-017 — interim 15 · High on 13 Oct, back to 5 after INS-SR07-1013 — with IP-2026-031 added. Each entry carries its evidence. It is on The plan for Samuel Adeyemi to approve.
13 screens from the working solution, on its sample data. Pick one to see it large.
How the plan rates risk, how often each barrier is checked and who decides are settings, chosen by the water quality team.
| Setting | Default | Choose from |
|---|---|---|
| Risk matrix | 5 × 5, likelihood × consequence | Bands Low 1–4 · Medium 5–9 · High 10–15 · Very high 16–25 — click any cell to change its band |
| When a critical preventive barrier fails | +2 likelihood | Any other preventive barrier +1 · amber with an unexplained event +0, flagged · recovery barrier: readiness flag, likelihood unchanged |
| Hatch and vent security checks | Monthly | Grace 7 days · critical barriers until 06:00 the next day · 92 barriers |
| Reservoir outlet sampling | Weekly | Grace 0 days · critical barriers until 06:00 the next day · 46 barriers |
| Cell isolation drill | Yearly | Grace 30 days · critical barriers 14 days · 31 barriers |
| Confirm a re-rating | Amara Osei · water safety plan lead | Change — choose from the water quality team |
| Approve a plan version | Samuel Adeyemi · Head of Drinking Water Quality | Also approves improvement actions over $100,000 · taking a reservoir cell out of supply stays with Declan Muir and the control room, never an agent |
| Plan review triggers | On | Within 30 days of a red critical barrier · after any incident at Medium or above · re-check within 15 minutes after any alarm on a critical barrier · daily outlet sampling while a storage barrier is red |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = the demo utility's own estimate of about 3 weeks for the audit pack, and our split of those days · “typical” = published figures (Alamosa, Colorado, 2008: a breached storage reservoir, about 1,300 people estimated ill, state public health report). Context: WHO Water safety plan manual, 2nd ed. (2023); EU Drinking Water Directive 2020/2184, risk assessment of each supply system reviewed at least every 6 years. Lumina Water and every person, site and record named on this page are fictional — characters and sample data in the working solution.
Software that holds a drinking-water supplier's water safety plan — every hazardous event from catchment to tap, its controls and the checks that prove them — and keeps it current. Water Safety Plan Management draws each hazard as a bowtie and feeds every barrier from its own inspection, telemetry, laboratory, alarm and work order records, so the plan's status is computed from the records, not typed in.
Every day at 06:00, and on every alarm, the barrier watcher checks each barrier's verification clock and monitoring limits. A barrier whose check is overdue past its grace or whose monitoring is out of limit turns red, and the risk re-rater raises the hazard's live rating that morning. The water safety plan lead confirms the new rating and the response; the plan document, change log and evidence update as the fix is recorded.
The plan writer keeps the plan document, change log and evidence index current as changes are accepted. The audit pack — the plan, an evidence index for every critical barrier, the change log, the improvement plan and incident learning — is built from the same records. The target is an audit-ready pack in 1 day, against about 3 weeks by hand.
Yes. The incident analyst reads incidents, near misses and audit findings, and proposes new causes, barriers, check frequencies or rules, each with its evidence, following WHO's step of revising the plan after an incident. It proposes only; the water safety plan lead accepts or rejects each change.
Yes. The agents read records and never write to them. The plan rating changes only when the water safety plan lead confirms, each version needs the Head of Drinking Water Quality's signature with its meaning recorded, and no agent ever takes a reservoir cell out of supply.
Yes. The risk matrix and its bands, how much a failing barrier moves the likelihood, the check frequency and grace for each barrier type, the approvers and the plan review triggers are all settings.
The hazard register and control procedures you already have, and the records that prove each control works: inspection records, telemetry and alarm events, laboratory results, work orders, customer complaints, incidents and audit findings.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your current water safety plan, hazard register, control procedures and a sample of inspection and sampling records — and it goes live once every quality gate has passed. We will walk you through it on your own plan first.
Leak crews sent where the loss is certain, not where a meter is in doubt.
1-min demoWater Quality Compliance MonitoringExceedances caught the hour they happen, and low chlorine seen two days ahead.
1-min demoLeak Detection AnalyticsSend crews to real leaks, not false alarms.
1-min demoWe'll run Water Safety Plan Management on a sample of your own hazards, inspections and sample results.