If your smoke alarm started beeping for no reason, you’d probably head out to the hardware store and buy a new one. Indeed, as part of the City of Ottawa’s “Wake Up! Get a Working Smoke Alarm” program, residents are urged test their smoke detector and change the battery twice a year. But apparently it took a $562,000 fine to wake up City staff.

In this case, it wasn’t about smoke detectors but, rather, the alarm system that would have alerted staff as 764 million litres of sewage poured into the Ottawa river.

According to the recent report by Ottawa’s Auditor General Alain Lalonde, in August 2006 sewage continued to flow into the Ottawa river for twelve days after a storm ended. It only stopped when a staff technician noticed an anomaly in the flow monitoring data.

So what went wrong? City management blatantly ignored best practices. Nearly 40 years ago, the American Public Works Association (APWA) reported that the type of equipment used by the City required, “a continuous preventive maintenance program in order to function properly,” and and made two recommendations:

• Inspections once per week and after each storm, and in no case less frequent than twice per month; and,
• After each storm.

Despite these recommendations, in 2001, following Ottawa’s municipal amalgamation, inspections were reduced to once per month and none after rain events. And, as if ignoring recommended inspections wasn’t bad enough, the auditor general points out another shocking problem:

“The former Regional Municipality of Ottawa-Carleton (RMOC) had a system of alarms on these regulators. The alarms were connected to the pagers of the program managers and supervisors in the sewer maintenance system. The alarms would go off frequently and a number of false alarms occurred. Shortly after amalgamation, the alarm system was allowed to fail and was never repaired. During interviews for the audit, the Manager, WDSD and Program Manager, Sewer Maintenance acknowledged responsibility for the decision to reduce the frequency of inspections and to not replace the alarm system.”

From a security perspective, this type of scenario is far too common: Best practices were ignored, security controls were removed and the combination resulted in a high level of risk that was not recognized until it was too late. While the managers involved should obviously have known better (and, since three of them were subsequently fired, it would appear that someone at the City agrees), incidents like this are usually indicative of a much larger problem — and that’s unfortunately where Lalonde’s report falls short.

If the City of Ottawa had a good risk management framework in place these critical changes would have triggered an updated risk assessment, the increased risk would have been immediately obvious and action would have been taken to reduce the risk. Accidents happen but this was no accident. The City of Ottawa failed its citizens on several levels. Hopefully, they’re awake now.