By Annette Davison, Sarah Loder and Peter McLennan
Most organisations believe they are managing cross-connection control (CCC) risk. But time and time again as incidents unfold, all is revealed that many actually aren’t. From our experience, we think the difference comes down to capability and risk management maturity, rather than intent.
What is a Cross-connection?
A cross-connection is any actual or potential link between a drinking water supply and a non-potable source such as wastewater, chemicals, or untreated water, where contamination could occur.
These connections can be obvious, like a hose submerged in a bucket of chemicals, or for most of the time, remain hidden within plumbing systems through faulty installations, backflow-prone equipment or device failures. The risk arises when pressure changes, such as a drop in mains pressure or a surge within a connected system, allowing contaminants to flow backwards into the clean water supply, a process known as backflow. Without appropriate controls like backflow prevention devices and regular inspections, cross-connections can compromise water quality and pose serious public health risks.
Why Should I Care?
Cross-connections don’t just make the water taste or smell bad, they can cause life-threatening contamination impacts. If you’re responsible for a building or a reticulation system, a cross-connection is not just an operational issue, it’s a direct risk to public health, compliance, and your reputation, potentially even legal consequences.
If you are a facility manager, a cross-connection could mean exposing occupants, visitors, or tenants to unsafe water, leading to illness, liability claims, and operational disruption. For a utility or network manager, the consequences scale up quickly, one failure point can compromise multiple properties, trigger regulatory breaches, and require costly incident response and flushing programs. Beyond the immediate health risk, cross-connection failures can result in penalties, loss of trust, and significant remediation costs. In short, managing cross-connections is a core risk control that protects people, assets, and system integrity.
What Really Happens with CCC
Cross-connection failures rarely happen because something was never done. They happen because something was assumed to be under control when it wasn’t. A quick look at our incident database[1] reveals lots of CCC history including:
- 1933, Chicago, Illinois, USA. A backflow incident led to an outbreak of amoebic dysentery. It took time to trace the source, which was ultimately linked to inappropriate cross-connection control in two major hotels. Contamination occurred when water backflowed from an improperly connected cooling tank used for ice production. The system included a pump and a direct connection to a sewer line, creating a clear pathway for contamination into the drinking supply. This event was so significant that it initiated a focus on backflow and cross-connection protection.
- 1994, Aotearoa, New Zealand. A backflow incident occurred at a dairy factory, where caustic soda (used as a cleaning agent) back-siphoned into the town’s water supply system due to a maintenance error. The incident resulted in at least six people suffering chemical burns, some of which were serious. The event was attributed to the lack of a proper boundary backflow prevention device, which could have contained the contamination within the factory.
- 2007, Bangholme, VIC, Australia. An incident occurred at a new administration building at the Eastern Treatment Plant in Bangholme. Recycled water was inadvertently supplied to a drinking water tap, as a result of a cross connection, and 25 employees and contractors who had been using the building had been exposed to the recycled water for up to19 days.
- 2017 Newent, Gloucestershire, England, UK. Residents in Newent reported pink water from taps, prompting Severn Trent to issue “do not drink” notices and begin testing. The cause was a cross-connection at a nearby fruit farm, where a private irrigation system was connected to the mains. A booster pump created higher pressure, forcing fertiliser-contaminated water back into the drinking supply. The connection was disconnected and the company was prosecuted and fined.
- 2024, Bay County, Florida, USA. Bay County issued a “do not use” advisory after a contractor mistakenly connected a sewer line to the potable water system. The error went unnoticed for about three weeks. The utility disconnected the cross-connection, flushed the system, and supplied bottled water while testing confirmed safety.
What Actually Drives CCC Risk?
We’ve developed a rapid CCC risk diagnostic tool based on five core categories (Table 1). Each one tells a different part of the risk story.
Table 1. CCC risk management maturity assessment categories.
| Category | Comments | Risk Story |
| Organisational Capability |
This is where the event’s journey either starts, or is prevented. If leadership commitment, resourcing, accountability, and competence are unclear, CCC becomes fragmented. Policies might exist, but they won’t translate into consistent practice. |
If control isn’t sustained, failure is only a matter of time. |
| Risk Visibility |
Without a complete register, clear hazard classification, and visibility of high-risk or temporary connections, organisations operate with blind spots. Unknown cross-connections are the ones most likely to cause incidents. |
You can’t control what you can’t clearly see. |
| Control |
Devices are only effective if they match the risk and are installed correctly. Incorrect device selection, poor installation, or misunderstanding system pressure conditions creates a false sense of protection. A device in the ground does not mean the risk is controlled. |
Controls only work if they match the real risk. |
| Verification |
Paperwork is not proof. Testing programs, records, and field inspections are what confirm whether controls actually work in reality. |
If you don’t verify, you’re relying on assumption. |
| Response and Learning |
Every incident, or near hit, is a signal. Organisations that investigate, identify root causes, and improve systems move toward control. Those that don’t remain reactive. We often see a gap in failing to close what we call this “risk loop”. |
If you don’t learn and respond, failures will repeat. |
Why Understanding Risk Matters
Cross-connection risk is dynamic. It changes with:
- New developments
- Temporary connections
- Operational conditions
- Human behaviour
That means CCC is never “done”. It must be continuously understood, verified, and improved. And as we saw above, just because you are a big utility, does not mean you are immune from CCC risk.
How Mature is your CCC Program?
We see the real question as not whether you have devices, registers or testing programs in place, but whether you can put your hand on your heart and say with confidence, that your program works in reality. To help with assessment, we’ve developed a rapid CCC risk diagnostic tool to help organisations quickly identify where they sit, from “blind” through to “controlled”, across the five categories outlined above.
This tool allows organisations to cut through paperwork and focus on what matters:
- Are you supported by management?
- Can you see the risk?
- Are controls appropriate?
- Is performance verified in the field?
- Are you learning and improving?
If you’re serious about moving from “false confidence” to “real control”, it’s time to take the first step on your CCC risk management maturity journey.
[1] Currently (May 2026) at https://www.riskedge.com.au/incidents-online-tool/, moving to app.likwd.com late 2026.