Ofwat’s vulnerability assessment sets a baseline. Delivery is where confidence is won or lost

Between 2020 and 2025, water companies increased Priority Services Register coverage from 2% to 12.8% of customers.

That’s major progress. So what next?

Vulnerability strategies are now final and public across the water sector. That means regulators, customers, and stakeholders can see exactly what’s been promised. And regulators like Ofwat have made it clear that strategies count only if they deliver, with performance monitored through customer research, data reviews, and ongoing engagement.

But not all organisations are equally prepared for that scrutiny.

Some organisations can show how customers are identified early, how support adapts as circumstances change, and how decisions hold up during incidents. Others rely on static records and limited evidence once services are under pressure.

Ofwat’s assessment set a baseline, but from here, vulnerability management will be judged through delivery, data, and outcomes.

This blog looks at what that means for water companies right now and where vulnerability strategies are most likely to face their toughest tests.

What this blog covers What Ofwat’s vulnerability assessment is really signalling to the sector, beyond individual company performance Why vulnerability strategies are now being judged through delivery, evidence, and outcomes rather than intent Where identification beyond self-disclosure often breaks down in practice How incident response exposes gaps between strategy and operational reality What Ofwat’s monitoring approach means for assurance, accountability, and regulatory confidence going forward

What Ofwat’s assessment really represents

Is Ofwat’s vulnerability assessment there to pass judgment on individual companies? No. It sets a benchmark.

The review establishes a shared reference point for the sector. It defines what’s now considered acceptable, where approaches are still developing, and where confidence remains limited. By doing that, it resets expectations without having to spell them out.

Here’s what runs consistently through the assessment:

Vulnerability is treated as an operational capability. The focus is on how extra help is designed into everyday services and how it performs during disruption. What’s written in a strategy document comes second to that.

Identification and delivery are examined together. Ofwat repeatedly links the ability to identify customers who need extra help with the ability to deliver support effectively. This is especially true for customers who haven’t self-declared, because those are the hardest ones to reach.

Data quality underpins confidence. The assessment places weight on how needs are recorded, reviewed, and kept current as circumstances change. Having registers is one thing, keeping them accurate and up to date is another.

Incident response acts as a stress test. How vulnerability is handled during incidents shows whether strategies actually work in real-world conditions.

What’s changed? Ofwat wants to see whether companies can rely on their vulnerability offer when it’s most needed. It will review performance through customer research, relevant datasets, and ongoing stakeholder engagement. Where commitments aren’t met, action will follow.

The bottom line: Confidence will be shaped by how consistently vulnerability is identified, acted on, and proven through delivery, particularly during incidents and periods of pressure.

Priority one: Vulnerability identification beyond self-disclosure

This is where delivery often starts to strain.

Self-disclosure has always been important, and many customers will continue to tell their provider when circumstances change. But Ofwat’s assessment makes it obvious that this is only one route into support, and often the least reliable.

Customers delay disclosure for many reasons. Some don’t recognise their own circumstances as vulnerability. Others avoid raising issues until a service failure, an incident, or financial pressure forces the conversation. By that point, options for early support are narrower and harm is harder to prevent.

Evidence from our own dataset supports this. 66% of people had already turned to payday or high-cost loans to cover essential household bills, including energy costs. By the time support was offered, interventions focused on stabilising fuel use and reducing ongoing costs, rather than addressing debt alone.

Further reading: What 66% reliance on emergency loans tells us about financial resilience

This is why Ofwat repeatedly links identification to outcomes. The ability to surface needs early shapes everything that follows. And this is where problems start to appear.

Many organisations describe a commitment to proactive identification. Fewer can show how that operates consistently across their customer base. Identification activity may exist, but it’s often fragmented. Data points are siloed across different systems. Reviews happen on fixed cycles. And frontline teams rely on partial context when making decisions.

Ofwat’s focus on data quality and review addresses exactly this problem. Identification requires timely insight, regular updates, and a way to turn what you know into actions that actually support those in financial stress.

When that doesn’t happen, here’s what you start to see:

• Customers remain on priority registers long after circumstances have changed, or are missed entirely during periods of transition
• Identification relies heavily on manual prompts or isolated triggers rather than joined insight
• Vulnerability is surfaced late in the customer journey, often during incidents or complaints
• Teams lack confidence in the completeness or currency of the information they hold

 

These weaknesses come up in delivery. And Ofwat’s November 2025 update reinforces this. Monitoring now draws on customer research, data review, and stakeholder engagement, which brings identification practices into view, particularly where customers report inconsistent experiences.

The regulatory expectation: Identification should reduce friction for customers. They shouldn’t have to repeat information across interactions, and support should follow from insight rather than being triggered only when someone reaches a point of distress.

Further reading: What to look for in a vulnerability dashboard

Priority two: Vulnerability incident responses

This is where vulnerability strategies are exposed. Essentially, incidents test whether organisations can respond to them.

Here’s how: Incidents compress time, increase customer need, and remove the buffer that routine operations provide. What works day to day gets tested openly and at speed when services are disrupted.

That is why incident response features so prominently in Ofwat’s assessment and subsequent commentary. It offers a direct view into how well vulnerability arrangements translate into operational delivery.

During incidents, weaknesses are quickly revealed.

Customer contact volumes rise, information moves across teams, and decisions get made under pressure. Here, reliance on static records or fragmented insight becomes obvious. Customers who need extra help are more likely to experience delays, inconsistent communication, or repeated requests for information. And these experiences show up through complaints, customer research, and stakeholder feedback.

Now, Ofwat’s focus here is less on the existence of incident plans and more on how vulnerability is prioritised when those plans are activated. That includes:

• how customers who need extra help are identified at speed
• how support is prioritised when resources are constrained
• how communications are adapted as situations evolve
• how teams know which customers require follow-up once normal service resumes

 

When vulnerability strategies are tightly integrated into operational systems, incident response tends to hold together. Teams trust the information they’re using. Prioritisation follows established rules and support decisions stay consistent across channels.

When strategies sit alongside operations rather than within them, the opposite happens. Insight is patchy. Decision-making varies by team or channel. Customers fall through gaps in processes that were never designed to handle pressure.

For organisations, what you need to focus on is whether vulnerability arrangements actually work when things go wrong.

The regulatory expectation: Strong incident handling shows that vulnerability insight is current, accessible, and can be acted on across the organisation. Weak handling exposes problems with identification, data quality, and governance that go well beyond the incident itself.

Further reading: Find more vulnerable customers today – get your free ebook now

Vulnerability evidence and assurance: what delivery now needs to show

In terms of putting all this into practice, here’s what you need to be able to show:

Move from intent to assurance

Ofwat flags that strategies only carry weight when performance can be shown over time, across different customer journeys and operating conditions. This means assurance needs to be a constant practice.

Bring delivery into view through monitoring

Ofwat’s monitoring approach combines customer research, dataset review, and stakeholder engagement. These create a view of performance from multiple angles, which makes it hard to rely on cherry-picked examples or explanations after the fact. Consistency is key here. 

Demonstrate repeatability

Strong delivery shows up through patterns rather than one-off wins. A single example of good support carries less weight than evidence that vulnerability gets identified early, acted on consistently, and reviewed as circumstances change. This applies as much to routine operations as periods of disruption.

Connect strategy to delivery through governance

Vulnerability strategies now require someone to own them and oversee them. Senior leaders need visibility into how vulnerability is being managed, where performance is improving, and where attention is needed. Without that, assurance falls apart quickly.

Build regulatory confidence through evidence

Evidence sits at the centre of this approach. It includes how vulnerability is recorded, how decisions are documented, and how learning feeds back into service design. Over time, this builds a picture of control and shows that organisations understand vulnerability as something that changes, with delivery adapting accordingly.

Treat strategies as live operating frameworks

With strategies published, attention has moved beyond what’s written to how commitments get met through delivery. Vulnerability strategies now operate as live frameworks, embedded into everyday activity and backed by data and governance. The ability to demonstrate that consistently is what underpins confidence now.

What Ofwat’s assessment leaves in place

Confidence will be shaped by how effectively vulnerability is identified, how consistently support is applied, and how outcomes can be evidenced over time. Strategies provide the framework, but assurance comes from how they operate within everyday services and during periods of pressure.

As Ofwat’s monitoring continues, vulnerability will be judged through experience, data, and delivery. To sum all this up, for water companies, that means the focus has moved from what’s been documented to what can be proven as active vulnerability support.

And that’s where confidence will be built across regulators, customers and peers.

Keen to learn more? Read our follow-on blog: From Ofwat’s assessment to ongoing scrutiny: where vulnerability delivery will be tested next.