From Ofwat’s assessment to ongoing scrutiny: where vulnerability delivery will be tested next

Final vulnerability strategies are now published across the water sector. They are visible, comparable, and open to review. 

Attention is now on delivery. Ofwat has said it will monitor performance through customer research, datasets, and engagement with stakeholders. The focus is on what customers experience and what organisations can evidence over time:

• How customers who need extra help are identified. 
• How vulnerability data is maintained. 
• How support performs during incidents, when pressure is highest.

 

I’ve spent a lot of time looking at what happens once vulnerability approaches move into business as usual. The same pressure points pop up again and again.

The first blog in the series looked at what Ofwat’s assessment tells us about expectations. This piece focuses on where those expectations start to collide with delivery.

Key takeaways Vulnerability strategies are now public and open to review across the sector Ofwat’s attention is centred on delivery, evidence, and customer experience Identification beyond self-disclosure will carry increasing weight Data quality and regular review underpin confidence in vulnerability support Incident response remains a critical test of operational readiness

Lesson 1: Identification will be judged on timing

Many organisations still rely heavily on customers telling them they need extra help, but this captures only part of the need. The trouble is, things like financial strain, health changes, and life events often develop without triggering a formal conversation with a provider.

Timing is where this becomes critical.

When a customer self-identifies, difficulties have often been present for some time. Support tends to start later in the journey, with fewer options available and less room to prevent harm. Ofwat’s focus on proactive identification reflects this.

Our own research supports the point. In our dataset, 40% of payday re-borrowers commit half their income to debt repayments. Where support followed, it focused on reducing fuel costs and improving energy efficiency, rather than addressing debt alone. By that stage, financial vulnerability was already established.

For utilities, this creates a challenge. Financial stress linked to essential services often appears before arrears, complaints, or direct contact. When identification depends on those triggers, support starts later than it needs to.

What Ofwat is now paying closer attention to is whether organisations can recognise vulnerability earlier and more consistently. That includes how information is gathered, how data is connected, and how quickly it leads to action. It also includes whether identification works across the whole customer base, rather than only for those willing to disclose.

Lesson 2: Data quality determines whether identification holds up

It is one thing to record vulnerability. It is another to keep that information current, usable, and trusted across teams.

In many organisations, vulnerability data is captured at a single moment in time. Records are created during a call, a form submission, or an incident, then left largely unchanged. Over time, circumstances move on. Health improves or deteriorates. Financial situations change. Support needs evolve.

When records do not keep pace, confidence drops.

Teams begin to question whether the information they are using still reflects the customer in front of them. Decisions rely more heavily on judgement than insight. And different parts of the organisation work from different versions of the truth.

Ofwat’s interest here extends beyond how data is stored to how often it is reviewed, who owns it, and how it informs action. Regular review is key, particularly for customers whose circumstances are likely to change.

This becomes more visible as vulnerability support moves into business as usual. Data that works during initial identification can struggle once it needs to support prioritisation, follow-up, and ongoing service decisions. Gaps tend to appear when records are out of date, fragmented, or difficult to access at the point of need.

This is why data quality underpins identification, informs delivery, and enables organisations to explain what happened and why.

Lesson 3: Incidents reveal whether vulnerability support really works

We briefly went over this in previous blogs, but it’s key to recap this again as incidents remain one of the most telling environments for vulnerability delivery.

For instance, teams struggle to prioritise customers who need extra help. Information held in one system fails to reach another. Customers repeat the same information across channels. And follow-up after service restoration lacks consistency.

None of this usually stems from a lack of planning. More often, it points to vulnerability data that is incomplete, outdated, or difficult to access when it is most needed.

For organisations, this places greater emphasis on readiness during everyday operations. Incident handling depends on vulnerability insight that is already in place, understood, and trusted across teams. There is little opportunity to compensate once disruption begins.

Lesson 4: Recording and review will define accountability

Customer research, datasets, and stakeholder feedback all rely on records that explain what was known, what action followed, and how circumstances were reviewed over time. Where that trail is thin, confidence is hard to sustain.

Recording vulnerability is rarely the issue. Most organisations capture information at the point of contact or during an incident. Review is where consistency drops away.

For example, customer circumstances change, financial strain eases or intensifies, health conditions fluctuate, and support that was appropriate at one point can become unsuitable later. Without regular review, records lose relevance and delivery becomes harder to defend.

This is where accountability starts to form.

Review creates continuity. It shows that vulnerability is understood as ongoing rather than fixed. It also provides a basis for explaining why support was offered, adjusted, or withdrawn. 

Ofwat’s emphasis on accountability reflects this need. Public strategies set expectations. Recording and review show whether those expectations are being met over time. They also reveal whether organisations are learning from outcomes and adapting their approach.

Delivery is now the test

Vulnerability strategies have moved into live delivery. What follows is sustained attention on how well those commitments hold up over time.

Identification, data quality, incident handling, and regular review now sit under the same lens. Together, they determine whether vulnerability support works consistently for customers who need extra help and whether organisations can explain their decisions when asked.

Ofwat’s focus on monitoring brings this into sharper relief. Confidence will be built through evidence that delivery is timely, proportionate, and repeatable across everyday service and disruption alike.

For water companies, this marks a more demanding phase. Accountability is no longer tied to what has been published, but to what can be demonstrated. Recording, review, and delivery now carry equal weight.

That is where vulnerability strategies begin to stand or fall.

For organisations reviewing how vulnerability delivery stands up in practice, KYVC provides a way to identify customers earlier, keep vulnerability insight current, and evidence delivery over time, particularly when services are under pressure.