Resilience Adaptation Through Risk Analysis for Wastewater Treatment Plant Operators in the Context of the European Union Resilience Directive

Abstract

To combat new threats to critical infrastructure, the European Union enacted new regulations for their member states. With the directive on measures for a high common level of cybersecurity (NIS2) and the directive on critical infrastructure resilience (EU RCE), EU member states must identify critical infrastructure (CIs) and enable measures to reduce the risk of default in stress situations. The topic of resilience in urban water systems has already been of interest in previous research. However, there are still open questions. As it is a multidisciplinary term, understanding resilience and its adaptation into management systems is not an easy task for practitioners. This study will provide an overview of resilience within the framework of municipal wastewater treatment plants (WWTP) and show the current situation of existing implementation of safety and security regulations, taking Germany as an example. One of the main requirements of the EU RCE is a risk assessment (RA) for CIs. Until now, risk analysis for WWTP in research was mostly carried out for individual WWTP. By applying guidelines from the drinking water sector, this paper shows a possible methodology for a risk analysis. This paper aims to support practitioners by forming a common understanding of resilience and risk as well as providing an example for a risk analysis.

1. Introduction

Resilience has been a topic of scientific discussion for several years. Recent crisis-ridden years have given this discussion an additional boost. Alongside global crisis, there have been spatially limited events that directly affected population and environment. In Germany, there are two prominent examples from the past years. The first is the heavy rain and flooding in the Ahr valley during July 2021 with economic damage estimated at over 30 billion € [1], and the second is the mass dying of fish in the Oder River in 2022. The fish die-off was caused by the influence of saline discharge into the waterbody under higher temperatures and lower water levels, leading to the proliferation of the brackish water algae Prymnesium parvum, which is toxic to fish [2]. Those events affected operators of critical infrastructure (CIs) and exposed potential future weak points. Low water levels and heavy rainfall events are well-known examples of the consequences of anthropogenic climate change. In wastewater treatment, heavy rainfall can lead to damage to technical equipment, as in the Ahr valley. On the other hand, low water levels in receiving water bodies also make discharges of inadequately treated wastewater into water bodies a critical factor. With the COVID-19 pandemic the main risks were a shortage of staff and shortage in supply [3]. The Russo-Ukrainian War increased problems in the supply chain as well as causing an increase in energy prices [4,5]. The flooding of the Ahrtal valley and the fish dying in the Oder showed two exemplary sides of anthropogenic climate change for the water sector.

The adoption of the directive on the resilience of critical entities (EU RCE) by the European Union (EU) in 2022 aims to reduce vulnerabilities and strengthen the resilience of critical infrastructure [6]. Among other things, the directive includes facilities for the disposal and treatment of wastewater. Operators of municipal wastewater treatment plants (WWTP) must regularly conduct risk analysis and ascertain risks that could inhibit the main services of critical infrastructure (CIs). During this assessment, measures to strengthen resilience must be taken. One could argue that WWTP, as technical facilities, already apply a variety of measures to safeguard security of facilities. However, there is not yet a standardized procedure, so the implementation can vary from plant to plant.

To understand the missing links between the current framework and specifications and the EU RCE, this paper will investigate the definition of resilience in the EU RCE and other publications in the wastewater sector. Secondly, an existing legal structure for ensuring safety and security is described, using Germany as an example. A main part is the description of a risk analysis incorporating the resilience approach to adapt to the changed requirements. The risk analysis is based on an existing approach from the German Federal Office of Civil Protection and Disaster Assistance (BBK). In order to adapt the methodology to WWTP, a literature analysis and information from a previously conducted qualitative survey were used.

This study was conducted under the dtec.bw research project RISK.twin founded by European Union–NextGenerationEU.

2. Methods

A literature review was carried out to bring together the various meanings of the term resilience. This mainly involved literature from the field of urban water management. This study employed a systematic literature review to explore the concept of resilience and its application in risk analysis. The methodology followed the guidelines of the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) framework, ensuring transparency and rigor in the selection, screening, and synthesis of sources. The literature review for resilience was conducted using international databases, including Web of Science, Scopus and Google Scholar, to gather both theoretical and empirical studies on resilience and risk analysis. The search was performed using key terms such as “resilience”, “risk analysis”, “vulnerability”, “adaptation”, “wastewater treatment”, and “hazard analysis” with appropriate Boolean operators to refine the results. Studies from various sectors, including water management, urban planning, and disaster risk reduction, were considered to ensure a comprehensive understanding of resilience across different contexts.

The inclusion criteria were based on relevance to the topic, publication within the last 10 years, and availability in English or German. Articles that primarily focused on resilience in a non-risk-related context or lacked methodological transparency were excluded. Both peer-reviewed journal articles and grey literature, such as reports from governmental and international organizations and reports from respective associations at the German level, were included.

The initial search yielded 32 results for resilience terminology. After removing duplicates and conducting title and abstract screening, 17 articles were retained for full-text review. Data from the final selection of articles were extracted following a standardized template, which included resilience framework and sectoral focus. For risk assessment the initial search yielded 47 results. Research papers were divided into examples for risk analysis for specific WWTP for comparison of methodology, leading to three results. For methodologies of risk assessment, the results were screened for data on general methodology. For a better understanding on a national level, qualitative interviews with wastewater treatment plant operators were conducted. The interviews were carried out in 2021 and 2022 with German operators of WWTP [7]. In total, the interviewed experts covered around 140 WWTP in different areas in Germany with WWTP of different capacities (population equivalent in total over 15 million) [7]. The interviews covered the topics of dealing with past incidents, perceived risks and dealing with risks.

A qualitative synthesis was performed to identify key themes, trends and gaps in literature.

3. How Is Resilience for a WWTP Defined?

Resilience is a multidisciplinary term and rose to become a guiding principle in the last few years [8]. Even though the term resilience has been used in the water sector for quite a while, e.g., [9], there are several uses of the term without a clear definition [10]. Resilience was originally a concept to help understand the capacity of ecosystems under stress and their ability to adapt to the stress and enter a new stable state [10,11]. Over time, different fields transferred this idea. In 2006 Folke identified engineering resilience, ecological/ecosystem resilience, social resilience and social/ecological resilience concepts [12]. For example, the social aspect can refer to the ability of human communities to handle shock situations to their social infrastructure [13]. As social systems are dependent on ecological systems (e.g., resources), both systems should be assessed together [12,13]. The ideas in the concepts are similar, but the focus of systems engineering is different for social systems. Engineering resilience is the ability to adapt to changes, reduce sensitivity against stressors, build reserve capacities, have a fast recovery, develop a safety culture and understand interdependencies [14]. Brucherseifer et al. [15] identified anticipation, monitoring, response and learning as four properties for handling system disruption. In the water sector, the main named properties of resilience were rapidity, robustness and flexibility [10]. The EU RCE describes resilience as the “ability to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from an incident” [6]. When comparing these definitions, there are differences in the description of resilience. Figure 1 shows the different keywords. The keywords are sorted according to the chronological order of events. Theoretically, the course of an incident can vary [9]. However, in general, resilience concepts have in common that the function of the system is impaired after a failure. The systems will then find, depending on its properties, a new equilibrium [9]. Individual keywords of the different resilience definitions were assigned along this progression. The individual definitions focus on different temporal sequences. As Juan-Garcia et al. [10] points out, most definitions of resilience in the water sector leave out the reflective, inclusive and integrated character of resilience definitions from other sectors [10].

For operators of CIs the question on this point remains how to implement and measure the resilience of an organization or a facility.

There are several methods for measurement of resilience for different research topics, like hydraulic and graph-theoretical methods for net structures as well as economic methods for society-oriented approaches [16]. The quantitative measurement of resilience is described with the system performance over time [17] (see Formula (1)).

$$R={\int }_{t_0}^{t_1}100\%-Q\left(t\right)\mathrm{d}t ,$$

(1)

With the resilience R being the space between wanted and actual system performance Q(t) in between the beginning of a stress (t₀) and the recovery (t₁). To determine resilience in this case, the performance must be quantifiable. For urban drainage systems, Mugume et al. [17] proposed global resilience analysis (GRA) [18]. Here, different failures with different magnitudes and durations for a drainage system are modelled. The model also incorporates links between different failures. The resulting loss of functionality is measured, resulting in a resilience index [18].

The U.S. EPA has developed a Vulnerability Self-Assessment Tool (VSAT) to support WWTP operators in their resilience assessment [19]. As a self-assessment tool, the VSAT can support a first identification of risks and vulnerabilities. The VSAT already incorporates the ideas of resilience and risk assessment by using the Utility Resilience Index (URI). The URI was developed as a simple method based on commonly available utility data [20]. The selection of indicators was based on the following attributes [20]:

• Affordability—data accessible/generated for reasonable cost/level of effort
• Availability—easy to collect and measure
• Reliability—consistent over time
• Simplicity—ease of comprehension by decision-makers
• Transparency—the data can be reproduced and verified

The URI is divided into operational and financial indicators. The URI should reflect the water sector’s ability to prepare for, respond to, recover from and manage stress [20]. URI indicators for the water sector are listed in

Table 1. Operational and financial indicators of URI according to Morley [20].

Emergency Plans	Basic Coverage WWTP	Economic and Financial Protection
Emergency Response Plan National Incident Management System Mutual Aid and Assistance Emergency Power	Daily Demand Critical Parts and Equipment Critical Staff	Business Continuity Plan Bond Rating Financial Condition Assessment Unemployment Median Household Income

. The URI indicators can be fulfilled to different extents. By going through each indicator, the operator can calculate the current capabilities of the utility. For example, the URI Emergency Response plan in the VSAT can at one end be “unknown”, or there might even be “functional exercises” [19]. The basic coverage indicators describe the ability of a facility to meet demand if the plant is non-functional. The critical parts and equipment indicator includes the lead time to repair, replace, or restore operational critical parts [19]. Financial and economic indicators indicate the resilient properties of the utility and of the municipality. For example, the indicator Unemployment is in the VSAT described as a “general socioeconomic indicator of a community’s health” [19].

Another approach for implementation of resilience in the water sector was given by Butler et al. [20] with Safe und SuRe. The Safe and SuRe approach provides operational strategies incorporating management strategies and planning approaches [21]. The Safe and SuRe approach includes risk assessment as a top-down approach. Even though the link between resilience and risks is still not completely clear, strategies for risk mitigation are a way to build resilience [22].

These explained concepts provide a general assessment of resilience for a utility. However, the reliability of the treatment process is of key importance. Therefore, Walker and Salt [22] additionally refer to the terms general and specific resilience. In this case, specific resilience would focus on one process or process step in the wastewater treatment of a WWTP [23,24]. In addition to the EU RCE, there are other regulations concerning the safety of CIs. The next chapter provides an overview of these regulations at the EU and national levels to better understand the requirements for WWTP operators.

Current Implementation of Safety and Security Measures for WWTP in Germany

The operators’ task is to treat wastewater to protect people and the environment. WWTP are technical facilities and are subject to various legal obligations during planning and operation of the plant. Figure 2 shows a selection of regulatory requirements. The legislation is divided into European and national legislation. For plant operators, environmental protection, occupational health and safety, and the security of the facility have to be considered. As can be seen in Figure 2, there are several regulations for operational safety and security of facilities in the EU. As the implementation of these regulations differs from country to country, Germany is used as an example. The regulations for occupational health and safety are clearly structured. The occupational safety and health framework of the EU has been transferred into the German occupational health and safety act (ArbSchG) [25,26]. On the operational level, the state of the art for systems requiring monitoring is clarified in the technical rules for plant safety (TRBS), technical rules for operational safety (TRB) and technical rules for hazardous substances (TRGS) (for example [27,28,29]). The water and wastewater sector references these in its own worksheets and information sheets. The German association for water management, wastewater, and waste (Deutsche Vereinigung für Wasserwirtschaft, Abwasser und Abfall e. V. (DWA)) adapts those regulations to the wastewater sector with worksheets like the DWA-A 199 or the DWA-M 215-2 [30,31,32]. Some worksheets refer to safety and security, hence their positioning in the center of the figure. The DWA-A 199 contains guidelines for handling of internal malfunctions, like on-call duty and precautionary measures, and advises the recording and evaluation of malfunctions. The DWA-A 215 covers calculation approaches for the reliability of system components. The newly published code of conduct for power outages includes examples for risk assessments [33]. In regard to environmental protection, the EU Water Framework Directive is crucial for the water sector [34]. At the national level, this is implemented, for example, by the Federal Water Act (WHG) and Wastewater Directive [35,36]. Germany does not yet have an environmental code. As a result, regulations are scattered across various pieces of legislation.

EU RCE emphasizes the security of critical infrastructures. The directive on measures for a high common level of cybersecurity (NIS2) regulates minimal requirements for cybersecurity for CIs [37]. In Germany, the regulation is adopted with a general CI “umbrella law” (KRITIS Dachgesetz) for operators of identified CIs [38]. The drinking water sector already has standards for security regulations from the German Technical and Scientific Association for Gas and Water (DVGW) [39,40,41]. In Germany, to ensure safety and quality management with this number of requirements, a facility can implement Technical Safety Management (TSM). TSM offers guidelines for the water, gas, industrial gas, biogas and liquid gas sectors and was adopted by the DWA. TSM proposes guides to systemically analyze the safety management of an organization and the fulfillment of legal requirements. The fulfillment of these requirements will be externally audited [42]. Next to safety hazards, financial aspects are included and therefore focus mainly on internal risks. It was shown that there are several regulations in the EU for safety and security. Additionally, there are also management strategies like TSM to ensure the implementation of legal provisions. However, herein is a gap between the legal requirements and the previously presented approaches to resilience. Until now, WWTP operators had to define measures in case of emergencies. In the EU RCE, resilience will entail carrying out risk assessment (RA) [43]. With RA, existing measures will be assessed, and possible gaps can be identified.

4. How to Move from Risk to Resilience

The risk concept is widely used in different sectors, and therefore has no uniform definition [44]. Alongside the different sectors in general, there are also specific risk terms like toxicological risks or black swan risk, which differ by future predictability and their level of randomness [22]. Other prominent terms are systemic, cascading and compound risks. Systemic risks are highly ambiguous, complex and have high uncertainty [45]. Cascading risks describe uncontrolled chain losses [46]. One example of cascading disasters is the Great East Japan Earthquake, resulting in a tsunami and the nuclear disaster at Fukushima [46,47]. Compound risks occur when processes interact and create simultaneous or successive hazards. The term is often used in relation to climate change [46].

The ISO 31000 generally defines risk as the impact of uncertainty on a target [41]. ISO 31000 provides a framework for risk assessment for organizations. The basic steps, like risk identification, risk analysis and risk evaluation, can be found in risk analysis for WWTP as well (e.g., [48]). In risk analysis for WWTP, case studies have been carried out according to ISO 30001 e.g., [48,49,50,51]. Concurring with Tuser and Oulehlová [50], Morley [20] also points out that there is an existing body of research with parallel methodological approaches but there is no single approach that was consistently advanced. The EU stipulated a risk analysis every four years [6].

Procedure for Risk Analysis for a WWTP

The German Federal Office of Civil Protection and Disaster Assistance (BBK) has developed a guideline for risk assessment for the drinking water supply [52]. In the recently published code of conduct for ensuring wastewater disposal in the event of a power failure from the DWA, a similar risk analysis was carried out [33]. Presented here is an approach from the BBK [52] transferred to the wastewater treatment. Like the ISO 31000, it advises preparatory measures like establishing a task group before the risk analysis (see Figure 3). The BBK emphasizes the importance of different stakeholders and operators/managers of critical infrastructure from the municipality coming together [52,53]. This is also crucial for risk and resilience management to divide responsibilities as well as in risk communication [49,52]. Especially when different groups of interest come together, the establishment of a common dataset is of importance. One of the conclusions from the Ahrtal flooding in 2021 from the Federal/State Working Group on Water (LAWA) was greater cooperation between spatial planning, urban development and water [54]. As hazards, for example natural hazards, are not limited by national borders, an intensification of transnational exchange at the level of the international river basin commissions was recommended as well [54]. This was also an issue for the fish die-off in the Oder River in 2022, where both the Polish and German river courses were affected [2].

Figure 4 shows the steps in the approach from the BBK. The figure emphasizes the iterative nature of risk assessment [53]. The iterative nature can, for example, adopt the PDCA (plan-do-check-act) strategy. The first step is a system description to define the system and relevant information. This contains characteristics of the municipality, the facility, historical data, and the external and internal context [33,53]. The description should be in relation to the different scopes of application (strategic, operational) and their goals [53]. At this point the protection goals should be described as well. If the protection goals are too broad, it can be problematic to apply them to risk assessment [55]. Protection goals are the baseline for applying targeted measures as a result of a risk analysis [56].

Table 2. Protection goals with an example for WWTP acc. to [56,57,58].

	Explanation	Example for WWTP
Protected good and protection goals	General protection goal	Population
Strategic protection goal	Target area, Prevention/emergency planning Stakeholder groups; who defines the protection goal?	Treatment of wastewater
Operationalized protection goal	Desired level of protection with subject areas or threshold values	Mechanical equipment of wastewater
Actor	Responsibility for subsequent implementation of measures	Primarily operator and state
Measure	Derivation of measures based on the formulated protection goal	Redundancy of equipment, supply with emergency power

shows an example for the structured layout of protection goals derived for an emergency drinking water supply [56]. In the report of the BBK, this is further broken down into minimal and partial supplies (for power supply) [57].

Before conducting the assessment, the level of detail should be clear. Already existing information for safety management can contain vital information like guidelines for health and occupational safety, explosion protection, and contact lists in case of emergencies.

In the stressor analysis, the main potential sources for risk scenarios are defined. The BBK refers to the all-hazard approach, which is a guideline from the German government as an implementation from the Sendai Framework for risk reduction [59,60]. The term hazard is often associated with natural hazards, whereas the term threat is more related to human failures [61]. Recent years have shown how different risks, e.g., the COVID-19 pandemic or the war in Ukraine, affected the procedures and operations of WWTP [3,4]. An overview of accidents at different WWTP was carried out by Travnicek based on a French database [62]. In this work, device and structural failure were the main causes of accidents. However, there is no database for different accidents at WWTP. Tuser identified operational, object, health, and natural disaster risks as risk groups. Other risk groups could also be operational (internal/external), market risks, financial risks and legal risks [51]. Butler (2016) divided internal and external stress into acute and chronic stress. Comparing different risk assessments of WWTP, Tuser and Oulehlová [50] deduced that the current focus is individual risks for specific WWTP. Often not all risk groups are included in the risk identification, which focuses more on internal risks [50].

Table 3. Overview of potential hazards according to [21,51,64].

Stressor		Acute	Chronic
Internal stressor	Human failure	Operational failure	Operational failure
		Organizational failure	Organizational failure
			Negligence
			Skill shortage
			Degree of Outsourcing
	Technical failure	System failure
		Software error
		Obsolete plant components
External stressor	Natural hazard	Extreme weather events
		Forest and heath fires
		Seismic events
		Epidemics/pandemics
	Human and technical failure	System failure	Urban creep
		Operational failure	Operational failure
	Terrorism and crime	Sabotage
		Terrorism
		Other crimes
		Wars
	Other stressors	Market stress	Change of regulation
		Financial stress
		Legal issues

shows an overview of possible stressors for WWTP. Various scenarios can be derived from this table. As mentioned by Yu et al. [14], risk assessment should also incorporate interdependencies. Interdependencies could include electricity, firefighting, communication, natural disasters, or epidemics [63].

The perceived risk for a specific WWTP can differ from the risks presented in Table 3. Qualitative interviews were conducted to assess the perceived risks for WWTP. The interviews were carried out in 2021 and 2022 with German operators of WWTP [7]. The main identified stressors are shown in Figure 5. There was a wide variety of responses. No general statements on risks could be derived. The risks identified were mainly dependent on regional conditions, the specifications of the system and past events.

In the third step of the risk analysis, scenarios for the relevant hazards are described within a given set of parameters [52]. The scenario definition is crucial for the following steps of risk assessment and for understanding the temporal and spatial impacts. For the description of the event, methods like the bowtie diagram and event tree analysis for the impact of the event can be used [50,53]. As the intensity of stress events can vary, severity categories can be developed. In the DWA-M 320, power outages were divided into three different categories: nationwide, transregional and regional [33]. The BBK points out that just one singular event should be described. However, the problem of risk analysis is that there is seldom only one clear causality, but rather multiple relationships between hazard and effect [20]. Therefore, even when describing singular events, multiple possible triggering events and their effects should be considered to enforce resilient CIs. Fekete [61] designed a framework for CIs and possible cascades. Fekete describes different cascades that affect different parts of a system and the surrounding infrastructure. The description of an impact should, if possible, already consider how the event impacts the system. Consequences of hazards can be manifold and thus prove difficult to lay out one linear chain of effects. A helpful tool can be impact pathway-based risk identification. In this approach, an individual impact pathway contains a linear cause and effect chain [64]. For each impact pathway, the cause is defined as the last event in a causal chain that has direct impact on a water management system [64]. At this point the interdependencies between other critical infrastructure should also be taken into account [14].

Interdependencies could be drinking water availability, electricity, fire protection, communication, or epidemics [63]. The result of this step should be a common understanding of the scenario. The BBK advises a description of each scenario with the following properties: Place of impact, time, warning time, duration, spatial capacity, intensity, order of events, description of impact (functional, structural, organizational), other involved CIs, possible reference scenarios [52]. Figure 6 shows a bowtie diagram with possible hazards and their impact on WWTP, and consequently on the population, the environment and the plant. In this figure, all possible stressors are intertwined, as they can impact each other depending on the stressor.

Vulnerability is linked to the coping capabilities of a system [65]. Therefore, a vulnerability analysis should be carried out in order to find security failings and protection gaps for different stresses [66]. The main questions in the step are:

• Which components are highly critical for system performance?
• To which stressor is the component exposed and vulnerable?
• Are previous safety measures sufficient?

Like the other steps in the risk analysis, the level of detail should be clear. In the BBK approach for vulnerability analysis, the main functional components of the system are classified. Each scenario is described in terms of exposure and its functional and organizational substitutability. This leads to grading into security classes for each component and the relevant scenarios [52]. However, for the evaluation of detailed failure scenarios, other methods can be used. One example could be the GRA [18]. The problem with vulnerability analysis for WWTP lies in the complexity of the system. Technical components are the foundation for the required process. However, in the larger view, the technical system includes economic, legal, organizational, societal, and other contextual factors [67]. To address these different aspects, Johansson [67] developed a method for a vulnerability analysis considering vulnerabilities from different viewpoints with a global vulnerability analysis, a critical component analysis and a geographical vulnerability analysis. In

Table 4. Examples for subprocesses in a WWTP based on [52].

Subprocess in WWTP System		Components
Structural and functional	Rain and wastewater drainage to the WWTP	Sewer system, pumping stations (other structures, stormwater retention structures, culverts)
	Wastewater drainage in WWTP	Pumps and pipes in WWTP
	Wastewater treatment—mechanical	Rakes and sieves
	Wastewater treatment—biological	Compressor, microbiology
	Wastewater treatment—other	Filter, chemicals
	Rainwater treatment	Stormwater retention basins, relief basins, mechanical treatment, biological treatment, advanced treatment
	Sludge treatment	Digester, microbiology
	Digester gas treatment	Combined heat and power unit
Organizational	Communication	Mobile, landline
	Logistics	Staff, operating resources

, examples for different processes are given. The categorization into functional, structural, and organizational vulnerabilities will enhance the focus on the impact rather than the stressor. A structural stress is failure of a technical component, like a pump or pipe. Functional stress focusses on the functionality of the process, like the inhibition of nitrogen removal or hydraulic overload. In reality, structural and functional stress must be considered individually; as the components are similar, the table was simplified. Organizational stress describes the management within a system. In a pandemic, organizational stress could be caused by staff shortages.

After the vulnerability analysis, a risk analysis is carried out. In this analysis, the severity and the probability of an event are defined. This is usually carried out with a 5 × 5 risk matrix [48,50,52]. The definition of both can be qualitative or quantitative. Quantitative analysis needs sufficient data; however, there is no collective databank for incidents at WWTP [62]. In the conducted interviews with WWTP operators, the documentation of incidents varied [7]. In RA studies from other WWTP, a qualitative approach with a verbal description is used [48,50,68]. Impact categories could be defined by a range, e.g., from marginal to catastrophic, and for the probability of the event, it could be negligible to very high. In the 5 × 5 matrix risk and impact can be multiplied to calculate the risk score [69]. The impact should reflect the protection goals of the facility. The BBK estimated the severity for a stress event based on the impacted population. The DWA gave an example for protection goals for flood protection for WWTP [70]: impacts on humans, impact on environment, impact on material assets, or other impacts (legal, tax law, public image).

In the last steps, the risk of each scenario is compared in a risk matrix. By comparing risk scores, a prioritization of risk scenarios is summarized [66]. This means that risks with high probability and high impact are prioritized. In general, future risks are usually rated with a low probability of occurrence [71]. Thus, critical infrastructure risks with high impact and low probability (tail risks) should be taken into consideration as well.

After the risk analysis, measures must be taken according to the evaluation. Possible measures against a threat are identified and evaluated, as well as how risk can be lowered with and without the countermeasures. Moreover, measures can be compared with a cost–benefit analysis. Hochrainer-Stigler et al. [71] proposed a risk layering approach to conceptualize the relationship between risk and the appropriateness of investment options. Possible events were grouped into a so-called risk layer according to their frequency. In

Table 5. Overview of stressors and different management strategies (based on [52,55,62]).

Stress	Strategy
Organizational and hierarchical	Cross-training of staff, defining roles and responsibilities
Structural	Asset management, redundancy, maintenance
Functional (e.g., biological/chemical)	Process management, advanced process control, early warning systems (simulation and modelling)

, examples for possible strategies and measures are shown.

The strategies are divided into three categories. Risk should be communicated at an early stage in a comprehensive and transparent manner that allows a discourse [56]. Resilience, and risk management, pursue the goal of an overall resilient facility. This would mean integration into the overall corporate planning and orientation. If this is the goal, it would also mean a change in the organizational structure. Greener describes institutions as “sticky” and as systems in which “actors protect existing models” [72]. There are several factors that can facilitate the implementation of policy change, like the local structure, size, and institutional complexity [73,74]. The institutionalization of a resilience concept must be a management task covering the different layers of a facility and its stakeholders. As there is no one-size-fits-all solution for a successful implementation of the policy, the individual circumstances influence the process [73]. Miceli showed a concept for companies to include resilience on the firm level in a multi-domain model for agile management [75]. In recent years, Business Continuity Management (BCM) has emerged in different industries. For companies, a quick recovery from crises is vital in order to stay competitive [76]. The German Federal Office for Information Security (BSI) adapted this idea into a standard for companies, authorities and other public or private organizations [77]. BCM, defined by the BSI, focuses on the institution’s time-critical business process, which are to be protected against failures [77].

5. Discussion and Conclusions

The secure management of wastewater is key to health and environmental protection. Possible internal and external risks are to be mitigated by increasing resilience. Risk analysis can be a tool to address those requirements. With the EU RCE, risk assessment becomes obligatory. Risk assessments have already been carried out in the literature, but with different approaches and only for individual WWTP. The risks identified here are not directly transferable. The paper presents a possible approach to risk analysis for WWTP. This approach, based on the BBK methodology for risk analysis for drinking water, factors interdependencies and vulnerabilities into the analysis. For each step, examples for implementation at WWTP were given. The aim was to present a general approach. As the interviews conducted show, identified risks are site/plant specific. Improvement is still necessary for the identification of hazards. For future risk assessments, it would be helpful for operators to be able to learn from historic events. Another area where the methodology could be improved is in determining the impact and magnitude of an event. In addition, a connection to the protection goals is necessary when determining impact and magnitude. The protection goals are usually not clearly defined, making an estimation make a differentiated assessment difficult.

In the EU RCE, the member states of the European Union are required to identify critical infrastructure like WWTP, and operators should carry out a risk assessment. For operators, this can prove a chance to further strengthen their systems. To increase resilience and awareness, it needs to be clear to operators and staff what resilience means. Often, in the water sector, resilience is defined by rapidity, robustness and flexibility [10]. However, one of the main conclusions was that resilience also describes the behavior before, during and after an event, like being able to anticipate, recover and learn from an event. For example, the URI even takes the municipality’s economic properties into account when looking at the resilience of a facility. The URI shows an approach for a qualitative description of resilience. This could also be a possible addition to a risk analysis, by defining resilience with certain common indicators.

As future requirements will impact different structures of plants as well, it clearly shows that resilience should be seen as a corporate management task as well. Risk and resilience management should be implemented on the corporate governance level as a top-down approach. The sole consideration for each organizational unit would hinder the consideration and treatment of risks in higher-level plant operations. Long-lasting infrastructure can have difficulty adapting to changes and, as hazards are a diffuse risk with often low probabilities of occurrence, external specifications or motivations may be required. Implementation of resilience means incorporating a set of dynamic skills and coping strategies [15].

To support operators, a guideline for risk assessment is necessary. In particular, operators of smaller WWTP might not have the financial means by themselves. The respective associations need to provide incentives or guidelines with a top-down approach. There have been examples for possible methods, like the VSAT in the U.S.A. Technical Safety Management (TSM) could be a tool to check the additional implications of resilience requirements. Until now, there is no common failure database. A hazard database for WWTP could help to learn from measures taken during and after an event. Improved documentation can increase recommendations for action and risk awareness. Building common understanding and risk awareness is an important aspect for the successful implementation of resilience. For operators this might prove difficult, because it could also mean a loss of image. Therefore, this database could be more informal and try to focus on the exchange between operators.

A main motive for risk analysis is the continuity of the process. Risk analysis is always incomplete as the time variable is always evolving. Thus, there is always room for improvement of resilience as well. By continuously improving processes and adapting to possible hazards, resilience will be improved over time. Risk, and therefore resilience, must take into account changes over time. The continuity of the process and the constant improvement are of major importance for sustainable resilience of CIs. The past years have shown us multiple uncertainties and challenges. Risk always implicates the unknown; however, the better operators, staff and even public are aware of hazards, the better they can react during hazardous situations.