Legionnaires’ disease is a form of pneumonia caused by inhaling aerosols containing Legionella bacteria. In the UK, control is driven by the general duties in the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH), which require employers and those in control of premises to assess and control risks from hazardous substances, including biological agents in water systems.

For practical purposes, most dutyholders and consultants work to HSE L8 (the Approved Code of Practice on legionella control) and the accompanying HSG274 technical guidance. L8 is not statute, but following it is strong evidence of compliance. BS 8580-1 sets out a recognised methodology for carrying out the risk assessment itself.

Who is responsible

The dutyholder is whoever has control of the premises in connection with work: the employer in a workplace, or the person with maintenance and repair obligations in other premises. In a let building that may be the landlord, the managing agent and the tenant at the same time. Each must cooperate.

A water hygiene consultant writing the legionella risk assessment is not the dutyholder. They are a competent person appointed to assess and advise. The duty to implement control measures, maintain records and keep the assessment under review stays with the client. That distinction should be explicit on the report cover.

What the written assessment must cover

L8 expects a suitable and sufficient risk assessment of all water systems that may create a reasonably foreseeable risk of exposure to legionella. A defensible written record typically includes:

  • Scope and description of the premises, water systems present and sources of information (drawings, previous reports, maintenance records).
  • Identification of systems that could harbour legionella: hot and cold domestic water, calorifiers, cold water storage tanks, cooling towers, spa pools, humidifiers, adiabatic systems and any infrequently used outlets.
  • Evaluation of risk for each system, including susceptibility of occupants (healthcare, elderly care, immunocompromised groups).
  • Existing control measures and whether they are adequate.
  • Recommendations with priorities and target dates.
  • Management arrangements: named responsible person for water hygiene, training, contractor oversight, incident procedures.

A narrative-only report with no action list, no monitoring plan and no named responsible person is difficult to defend in enforcement or insurance review.

COTE and system evaluation

For domestic hot and cold water systems, many UK consultants structure the evaluation using COTE: Contamination, Amplification, Transmission, Exposure and Host susceptibility. Each block is rated (for example Low, Moderate, High or N/A) with a short justification. The overall conclusion should follow logically from those ratings, not contradict them.

Separately, system-specific checklists (operation of calorifiers, tank condition, turnover, TMVs, deadlegs, flushing of infrequently used outlets) provide the evidence that the assessor has inspected management controls, not only described the building.

Temperature monitoring and the visit log

Temperature is the primary routine control for domestic systems. HSG274 Part 2 sets practical targets:

  • Hot water stored and distributed at 60°C where practicable, with sentinel outlets reaching at least 50°C within one minute.
  • Cold water below 20°C at outlets after running to waste at sentinel locations.

The risk assessment should define which outlets are sentinels, how often they are checked, who records the readings and what happens when readings are out of range. That schedule becomes part of the scheme of control, not an optional extra.

Where cold water storage tanks are in scope, tank inspection criteria (access, cover, turnover, cleanliness, temperature of stored water) should be recorded when a tank visit is carried out.

The scheme of control

The scheme of control is how the dutyholder implements the assessment in practice. It is not the same document as the assessment, but it must be consistent with it. Typical contents:

  • Monthly sentinel temperature monitoring (hot and cold).
  • Quarterly calorifier and tank checks where applicable.
  • Shower head and spray outlet descaling on a defined frequency.
  • Flushing of infrequently used outlets.
  • Cleaning and disinfection after shutdowns or positive samples.
  • Annual review of the risk assessment (or sooner after change).

A single laboratory test report from a contractor does not discharge the duty. The dutyholder needs the ongoing records that show the scheme is running.

When to review

Review the risk assessment regularly and immediately when:

  • New water plant is installed or removed.
  • Building use or occupancy changes (especially increased susceptibility).
  • Control failures or out-of-range temperatures persist.
  • Legionella is detected in a sample.
  • Major refurbishment alters the hydraulic system.

Record the review even when the conclusion is “no change required”.

Five things that commonly fail audit

  1. No named responsible person for water hygiene in the written assessment.
  2. Temperature records exist but are not linked to a defined sentinel list or corrective action procedure.
  3. Infrequently used outlets identified in the survey but not on a flushing schedule.
  4. Actions from the last assessment still open with no update or extension recorded.
  5. Assessment and scheme of control contradict each other (for example survey says monthly monitoring; scheme says annual).

Frequently asked

Who is responsible for a legionella risk assessment?

The duty sits with whoever controls the premises in connection with work. They may appoint a competent consultant to assess, but implementation and record-keeping remain with the dutyholder.

How often should a legionella risk assessment be reviewed?

Regularly, and immediately when systems, use or control measures change. Annual review is a common default; earlier review after incidents, samples or building work.

What temperature should hot and cold water be?

HSG274 Part 2 targets 60°C storage, 50°C at hot sentinel outlets within one minute, and below 20°C at cold sentinel outlets after running to waste.

Is a legionella risk assessment required for all buildings?

Most non-domestic premises with hot and cold water are in scope. The assessment must be suitable and sufficient for the systems present.

What is the difference between a risk assessment and a scheme of control?

The assessment identifies risk and required controls. The scheme is the ongoing plan of monitoring, maintenance and review that implements those controls.