SLOVENIA: IT audit - Managing business continuity in the field of drinking water supply
The Court of Audit published a report on the efficiency of the public utility company Komunala Škofja Loka d.o.o. in managing business continuity in the field of drinking water supply in the period from January 1st, 2023, to March 31st, 2024. According to the opinion of the Court of Audit Komunala Škofja Loka was partially efficient managing business continuity in the field of drinking water supply.
The audit aimed to evaluate the efficiency of Komunala Škofja Loka's management of continuous operations in the drinking water supply sector during the audited period. This assessment focused on whether Komunala Škofja Loka:
- efficiently managed business continuity in strategic documents and business continuity plans;
- conducted regular testing of these plans;
- managed the continuous operation of IT systems relevant to drinking water supply with appropriate plans or documents;
- regularly tested the IT disaster recovery plans.
Komunala Škofja Loka had not implemented a formalized business continuity management system, as it is not classified as a provider of essential services under the Information Security Act, thereby exempting it from the obligation to establish and maintain such a system. In 2023, Komunala Škofja Loka managed a public water supply network of 157,046 meters, serving a population of 19,712. Komunala Škofja Loka did not adopt specific documents explicitly addressing business continuity, nor did it incorporate this aspect into its strategic planning frameworks. Certain elements of business continuity were embedded within existing documentation developed in compliance with regulations governing disaster and emergency management and drinking water supply services. The company operated under a Protection and Rescue Plan for disruptions in water supply, which had not been updated since 2006. Operational objectives related to water supply were defined in business plans, though the company had not performed a business impact analysis, risk assessment, or established a risk register.
The company sought to ensure continuity of water supply services primarily through the execution of mandated municipal public utility tasks and by structuring its internal work organization and processes accordingly. A notable operational challenge arose in 2023, when severe floods significantly impacted the water infrastructure under Komunala Škofja Loka's management. These events served as a stress test for the company's resilience measures. Komunala Škofja Loka undertook all necessary measures to restore normal operations, prioritizing continuous, safe, and reliable water supply. In instances where uninterrupted supply could not be guaranteed, residents were promptly informed and instructed on preventive measures, such as precautionary boiling water.
In terms of information systems, the responsibility for ensuring service continuity was contractually assigned to external providers or the municipality. Komunala Škofja Loka did not have documented IT disaster recovery plans for its information systems and had not performed an inventory of critical systems or components. The key system relevant to water supply operations is the SCADA program, which facilitates remote monitoring and active management of the water distribution network. In case when the SCADA system shall be non-operational, Komunala Škofja Loka can switch to manual monitoring of water quality, perform disinfection, and operate pumps or redirect water flow from specific sources. During the 2023 floods, manual operation was implemented for sections of the network temporarily affected by SCADA system outages.
The Court of Audit provided Komunala Škofja Loka with a set of recommendations aimed at enhancing its operational resilience and strengthening its ability to ensure continuous service delivery in the drinking water supply sector. These recommendations are intended to address identified gaps and improve the robustness of its business continuity planning and response capabilities.
Full report (in Slovene language):
https://www.rs-rs.si/revizije-in-revidiranje/arhiv-revizij/revizija/ucinkovitost-upravljanja-neprekinjenega-poslovanja-javnega-podjetja-komunala-skofja-loka-doo/