Cross-connection control programs, tester certification and records

By the end of the Kingsway Tower job, Maya had installed, commissioned and helped test more than a dozen backflow preventers. On the last afternoon, Raj spread the binder of test reports across the site office table. "Everything we did is only as good as the paperwork that follows it," he said. "The utility doesn't see these devices. It sees reports. If a report is missing or late, as far as the utility is concerned the building is unprotected." This lesson pulls the course together by looking at the systems around the devices: the utility's cross-connection control program, the people who are allowed to test, the records that must be kept, and how enforcement works when something is not done.

What a cross-connection control program is

A cross-connection control program is the set of rules, procedures and records a water supplier uses to protect its distribution system from backflow. It is the reason containment devices exist. The plumbing code protects the people inside a building; the utility's program protects everyone on the public system. A typical program has five parts: legal authority, which lets the utility require devices and enter premises to inspect them; a survey process, which identifies which properties need protection and at what level; device requirements, which set the type of device for each hazard; a testing and reporting system, which tracks every device and its annual test; and enforcement, which deals with properties that do not comply.

In Ohio, public water systems must operate a backflow prevention and cross-connection control program under the state's drinking water rules, which require containment at premises with hazards and annual testing of the assemblies. Columbus runs its program through the Division of Water under city code chapter 1113 and its department rules, which require devices to be tested at least every 12 months, failed devices to be repaired within a set time, and test results to be reported to the city. Other Ohio systems follow similar state rules but have their own procedures and forms.

Surveys and hazard classification

A program begins with knowing which customers are a risk. Utilities survey industrial, commercial and institutional properties, often starting with those that are obviously high hazard, such as hospitals, laboratories, plating shops and car washes. A survey may be done by utility staff or by a qualified person hired by the owner, and the result is a hazard classification that sets the containment device. Properties are resurveyed when their use changes, when a building permit shows new equipment, or on a cycle set by the program. A restaurant that becomes a dental office, or a warehouse that adds a chemical process, needs a new look.

The survey cycle matters because buildings change. Kingsway Tower's first survey, done when the building was designed, classified it based on residential floors and a few retail units. When the clinic, the café and the rooftop cooling equipment were added, the hazard rose, and the utility required a reduced pressure assembly at the service entrance instead of a double check.

Who may test

Only certified testers may test backflow prevention assemblies for a program. In Ohio, testers must hold a state backflow prevention certification, which requires a training course and examination and must be renewed on a set cycle. Columbus also requires testers to be on its approved list, which means registering with the city and showing current certification and gauge accuracy records. Many testers also hold a professional qualification under ASSE's 5000 series standards, which some utilities accept or require.

A certified tester is personally accountable for every report they sign. Grace explained to Maya that she would not sign a report for a test she had not seen, and that an apprentice may help with a test but the certified tester must perform or directly supervise it and sign the form.

The test report

The test report is the core record of the program. Utilities usually provide their own form or online submission system, and most reports include the same information.

Reports must be accurate and submitted on time, usually within a set number of days of the test. A report that is incomplete, such as one missing a gauge verification date, may be rejected and the test may have to be repeated. Owners should keep their own copies, and contractors should too. A good binder or electronic file on site lets the next tester see the history of each device, which helps diagnose recurring problems.

Scheduling and tracking

Every device has a due date, usually 12 months from its last passing test. Utilities send reminders, but the owner is responsible for having the test done. Large buildings with many devices often schedule all their tests at once to save on call-out costs and make tracking simpler. A tracking spreadsheet or database lists each device, its location, type, last test date and next due date.

# Annual test scheduler: due dates and a combined test date
from datetime import date

devices = {
    "service RP": date(2026, 3, 14),
    "fire DCDA": date(2026, 4, 2),
    "boiler fill RP": date(2026, 5, 20),
    "cafe DC": date(2026, 6, 6),
}

def due(last):
    return last.replace(year=last.year + 1)

cutoff = date(2027, 4, 30)
for name, last in devices.items():
    d = due(last)
    flag = "DUE by cutoff" if d <= cutoff else ""
    print(f"{name:15s} last {last}  due {d}  {flag}")

combined = min(due(d) for d in devices.values())
print("combined test date (earliest due):", combined)

service RP      last 2026-03-14  due 2027-03-14  DUE by cutoff
fire DCDA       last 2026-04-02  due 2027-04-02  DUE by cutoff
boiler fill RP  last 2026-05-20  due 2027-05-20  
cafe DC         last 2026-06-06  due 2027-06-06  
combined test date (earliest due): 2027-03-14

A scheduler like this is the simplest version of the systems utilities and building managers use. Testing all devices on the earliest due date keeps every device in compliance and makes one visit cover the whole building.

Enforcement

When an owner does not install a required device, does not test it on time, or does not repair a failed device, the utility follows a series of steps. It usually sends a notice with a deadline, then a final notice, and if the owner still does not comply, it may charge fees or terminate the water service until the problem is fixed. Columbus's rules allow termination of service for non-compliance, and state rules require water systems to take action. Shutting off water is a serious step, especially for residential buildings, so utilities use it only after other steps fail, but the authority exists because an unprotected cross-connection is a risk to the whole system.

Plumbers are part of enforcement in a practical way. When you find an unprotected cross-connection on a job, you tell the owner, explain the risk, and offer to correct it. If the building's containment device is missing or failed, the owner must deal with it, and in many programs the plumber or tester must report a failed device to the utility.

Bringing Kingsway Tower together

Looking back over the job, Maya could trace each lesson in the building. The hydraulics of backsiphonage and backpressure explained why the rooftop booster pumps and boiler needed protection. The survey found the cross-connections: the hose bibbs, the chemical feeder on the cooling tower, the dental suction, the café's carbonator and dish machine. The hazard classification set the level of protection: the highest hazards at the clinic and the boiler, lower ones at the café. The device selection matched each hazard: air gaps at the cooling tower makeup, RPs at the boiler and clinic, a double check at the café, vacuum breakers on hose bibbs and irrigation. The installation rules put each RP above the floor with drains sized for its relief flow. The tests proved that each device worked. The records made sure the utility knew.

Raj closed the binder. "Next year someone else will test these," he said. "If the reports are good, they'll know exactly what they're looking at."

Electronic records and data quality

Many utilities now take test reports through an online system rather than paper forms. The tester logs in, selects the device from a list, enters readings and repair details, and submits the report. Online systems reduce errors because they check that every field is filled in and that readings are within possible ranges, and they let the utility see at once which devices are overdue. They also let owners see their own devices' history.

Data quality still depends on the people entering it. A serial number typed wrongly creates a new device in the system and leaves the real one looking overdue. A device that is replaced but not updated in the system shows the old model's history. Testers should check the device details against the nameplate at every test and correct the record if needed. At Kingsway Tower, Raj had Maya photograph each nameplate and attach the photo to the record, so that the next tester would see exactly what was installed.

Owners benefit from keeping their own register as well. A simple list of devices, their locations, types and due dates, kept with the building's maintenance records, lets a property manager book tests before reminders arrive and helps a new manager understand the building quickly. For a large building with many devices, it can save a lot of time and money.

Good records also help when something goes wrong. If a contamination incident is reported in an area, the utility can quickly see which properties have current protection, which devices failed recently, and which have overdue tests. That information guides the investigation and can show where the contamination came from.

For Maya, the records were the last lesson of the job and the one she least expected to matter. By the time she left the site, she understood that the binder on the office table was as much a part of the protection as the brass and rubber in the mechanical room. A device that works but has no record cannot be trusted by the utility, and a record that is wrong can hide a device that has stopped working. Both halves have to be right for the water to be safe, and the plumber who installs and tests the devices is responsible for both.