What Happens During a Legionella Risk Assessment, and What Should You Do With the Results?

Many business owners commission a Legionella risk assessment because the law requires it but the real value lies in what comes next. Understanding the process and acting on the findings is where lives are protected and liabilities are managed.

The phrase “Legionella risk assessment” appears frequently in health and safety discussions, yet many of the employers and building managers who commission them have limited visibility of what the process actually involves and, crucially, what their obligations are once the report is in their hands.

This Blog post sets out what a thorough assessment covers, what the findings should lead to, and how to ensure that the work you invest in translates into genuine, demonstrable compliance.

Stage one: Appointment of a competent assessor

Before any site work begins, the duty holder must appoint a competent person to carry out the assessment. Competence in this context is not merely a matter of holding a qualification requires appropriate training, relevant experience with the type of water systems present on your premises, and familiarity with the requirements of ACoP L8 and HSG274.

WHAT “COMPETENT” MEANS IN PRACTICE For commercial premises, cooling towers, or complex hot and cold water systems, the HSE’s guidance makes clear that a specialist water treatment or water hygiene consultant is the appropriate choice. Relying on a general contractor or facilities operative without water-specific training is unlikely to satisfy the “suitable and sufficient” legal standard.

The duty holder remains legally accountable even when an external specialist is appointed. It is your responsibility to verify the credentials and experience of the assessor before they begin work.

Stage two: The site survey

The physical survey is the core of the assessment process. A thorough assessment will examine every element of your water system that could provide conditions for Legionella growth. This typically includes:

• Cold water storage tanks — assessed for capacity, condition, security of lids and overflow screening, temperature of stored water, and evidence of sedimentation or biological growth.

• Calorifiers and hot water cylinders — storage and flow temperatures recorded, heat exchanger condition assessed, and any signs of scale or corrosion noted.

• Distribution pipework — the assessor will identify any dead legs (sections of pipework that do not circulate), areas of low flow, and any sections that may present a heat loss or heat gain risk.

• Outlets and terminal fittings — showers, spray taps, thermostatic mixing valves, and any infrequently used outlets are all assessed. Seldom-used outlets are a particular risk factor, as water can stagnate in supply lines.

• Cooling towers and evaporative condensers — where present, these require specific assessment under HSG274 Part 1 and must be registered with the local authority. They represent the highest category of Legionella risk.

Temperature readings are taken at key points throughout the system. Hot water should be stored at 60°C and reach outlets at no less than 50°C. Cold water should be stored and distributed below 20°C. Any deviation from these parameters is a finding that must be addressed.

Stage three: Risk evaluation and scoring

Once the physical survey is complete, the assessor will evaluate the likelihood that Legionella bacteria could grow and proliferate within each part of the system, and the potential for human exposure if they did. Risk is typically scored and categorised from low-risk systems that require standard monitoring through to high-risk situations that demand immediate remedial action.

The assessment must consider all foreseeable conditions, including normal operation, periods of low building occupancy, maintenance shutdowns, and any planned changes to the building or its systems.

Stage four: The written report and recommendations

The output of a compliant risk assessment is a written report, a formal requirement for employers with five or more staff, and best practice for all duty holders regardless of size. The report should be comprehensive, site-specific, and actionable. Be cautious of generic assessments that lack the detail to demonstrate a genuine evaluation of your premises.

WHAT A COMPLIANT REPORT MUST CONTAIN A schematic or written description of the water system; identified risk areas and their associated risk rating; the control measures already in place and any gaps; specific recommended actions, including any immediate remedial works required; a proposed monitoring and inspection schedule; and clear identification of the responsible person accountable for implementing the control scheme.

What you must do with the results

Receiving a risk assessment report is not the end of your obligation, it is the beginning of an ongoing management programme. The findings must lead to a written water safety plan (sometimes called a written scheme of control) that sets out precisely how identified risks will be managed, monitored, and reviewed.

• Implement all remedial actions identified, prioritising any high or urgent risk findings without delay.

• Formally appoint a responsible person to manage the ongoing control programme this must be someone with adequate training and authority to act.

• Establish a monitoring schedule including regular temperature checks, outlet flushing for infrequently used points, showerhead descaling and disinfection, and tank inspections.

• Maintain complete and contemporaneous records of all monitoring results, remedial actions, and inspections. Under ACoP L8, these records must be retained for a minimum of five years.

• Review the risk assessment whenever the water system changes, building use changes, or monitoring results indicate that controls are not performing as intended and at least annually as a matter of routine.

A note on microbiological testing

Legionella sampling taking water samples for laboratory analysis, is a separate activity from the risk assessment itself, and one that is frequently misunderstood. Routine microbiological testing is not a substitute for a risk assessment, nor is it required in all circumstances. However, it is an important verification tool for higher-risk systems, and may be required following remedial works, system changes, or where monitoring results give cause for concern.

For cooling towers, quarterly sampling is generally considered the minimum standard. For complex hot and cold water systems, the frequency will be determined by the risk assessment findings and the specific guidance within HSG274 Part 2.

The investment case for getting it right

A professionally conducted Legionella risk assessment, followed by a properly implemented control programme, represents a manageable and entirely predictable cost for any business. The alternative? An uncontrolled outbreak, an HSE investigation, or a prosecution, is neither manageable nor predictable. The human cost of Legionnaires’ disease, a potentially fatal pneumonia, is, of course, beyond any financial calculation.

The most effective approach is to work with an experienced water treatment partner who can manage the full process, from initial risk assessment through to ongoing monitoring, sampling, and record-keeping, so that your duty is continuously and demonstrably met.

Take the next step towards full compliance

Speak with one of our water safety specialists about your premises. We will assess your systems, explain your obligations in plain terms, and provide the support you need to remain compliant.

REQUEST A CONSULTATION  →