Increasingly, utilities need to think of their operations as businesses and as such, they are not only in the business of providing raw and drinking water, sewage services and stormwater services, they also need to acquit those operations in a manner consistent and compliant with the jurisdiction in which they operate. In this paper, we discuss the legal frameworks with which utilities should be familiar and show how having comprehensive and defensible risk management systems in place can demonstrate that a utility is conducting its business in a duly diligent fashion.