A legionella risk assessment is a systematic examination of your water systems to identify where legionella bacteria could grow and how people might be exposed. In the UK, it's a legal requirement for most employers, landlords, and anyone who controls premises where legionella poses a risk.
The assessment forms the foundation of your water safety management, documenting hazards, evaluating risks, and prescribing control measures to prevent Legionnaires' disease.
Have you completed a legionella risk assessment?
Let's work out what you need to do.
What is a legionella risk assessment?
A legionella risk assessment is a written document that:
- Identifies all water systems and potential sources of legionella
- Evaluates the likelihood of legionella growth and human exposure
- Assesses who might be at risk and the severity of that risk
- Prescribes control measures to prevent or minimize risk
- Documents findings and recommendations in a clear, actionable format
- Establishes a framework for ongoing monitoring and review
It's not just a one-time paper exercise. The assessment should be a living document that drives your day-to-day water safety management.
The purpose of a legionella risk assessment is not to eliminate all legionella bacteria (which is impossible), but to identify where risks exist and implement practical controls to reduce them to an acceptable level.
Legal requirements under UK law
Health and Safety at Work Act 1974
Section 2 places a general duty on employers to ensure, so far as is reasonably practicable, the health, safety, and welfare of employees. Section 3 extends this duty to others who may be affected, including visitors, tenants, and members of the public.
Control of Substances Hazardous to Health Regulations 2002 (COSHH)
Legionella bacteria are classified as a biological agent under COSHH. Regulation 6 requires duty holders to:
- Assess the risk from exposure to substances hazardous to health
- Prevent exposure or, where not reasonably practicable, adequately control it
- Ensure control measures are used and maintained
- Monitor exposure where necessary
- Carry out health surveillance where appropriate
- Provide information, instruction, and training
ACOP L8: Legionnaires' disease
The Health and Safety Executive's Approved Code of Practice L8 provides practical guidance on compliance. While not law itself, ACOPs have special legal status - courts will consider you to have met the law if you follow the ACOP, or you must demonstrate an alternative approach that achieves the same standard.
L8 specifies that duty holders must:
- Conduct a suitable and sufficient risk assessment
- Appoint a competent person to manage legionella risks
- Implement a written scheme of control
- Maintain water systems in a safe condition
- Keep records for at least 5 years
- Review the assessment regularly
Failure to conduct a legionella risk assessment when required is a breach of COSHH regulations and can result in HSE enforcement action, including improvement notices, prohibition notices, prosecution, and unlimited fines.
Who must carry out a legionella risk assessment?
Under COSHH, the duty falls on the "duty holder" - the person or organisation with responsibility for the premises or water systems.
Employers and business owners
Any employer with premises must assess legionella risks to protect employees and others who might be affected (customers, visitors, contractors).
This includes:
- Offices and commercial premises
- Factories and industrial sites
- Retail shops and hospitality venues
- Leisure facilities and gyms
- Schools and colleges
- Churches and community centres
Landlords
All landlords have duties under COSHH, regardless of property type:
- Residential landlords (houses, flats, HMOs)
- Commercial landlords (offices, shops, warehouses)
- Social housing providers
- Holiday let operators
- Student accommodation providers
Even if you rent out a single residential property, you control the water system and tenants are "others who might be affected."
Care providers and healthcare facilities
Care homes, nursing homes, hospitals, and GP surgeries face heightened responsibilities due to vulnerable occupants:
- Residents are typically in high-risk groups
- CQC explicitly checks water safety management during inspections
- Enhanced monitoring and control measures are expected
- Professional assessments strongly recommended
Property and facility managers
If you manage premises or water systems on behalf of others, you likely have control responsibilities:
- Managing agents for blocks of flats
- Facility management companies
- Maintenance contractors with control of water systems
- Building managers and caretakers
Self-employed and contractors
If you're self-employed with business premises, or a contractor who provides accommodation or facilities for workers, you must assess legionella risks.
The duty falls on whoever has control. In some cases, multiple parties may share responsibility (e.g., landlord for structure, tenant for maintenance). The key question is: "Who has control over the water systems?"
What does the assessment involve?
A comprehensive legionella risk assessment follows a structured methodology:
1. Identify and map water systems
The assessor documents all water systems in the premises:
Hot water systems:
- Storage tanks (calorifiers)
- Water heaters and boilers
- Hot water distribution pipework
- Heating circuits
- Temperature control devices (thermostatic mixing valves)
Cold water systems:
- Water supply entry points
- Storage tanks
- Cold water distribution
- Drinking water outlets
Specific systems:
- Showers and spray taps
- Cooling towers and evaporative condensers
- Spa pools, hot tubs, hydrotherapy pools
- Water features and fountains
- Humidifiers and air washers
- Emergency showers and eye-wash stations
Documentation includes:
- Schematic diagrams showing water flow
- Locations of tanks, pumps, and key equipment
- Pipe routes and materials
- Dead legs (unused pipe sections)
- Sentinel taps (representative monitoring points)
2. Identify hazards
The assessment identifies conditions that could allow legionella to proliferate:
Temperature hazards:
- Water stored or distributed in the 20-45°C growth range
- Cold water systems that could warm up
- Hot water systems that don't reach safe temperatures
- Inadequate insulation
Stagnation hazards:
- Little-used outlets or pipe sections
- Oversized water storage tanks
- Dead legs and unused pipework
- Long pipe runs with low flow
- Buildings with irregular occupancy
Nutrient sources:
- Biofilm buildup in pipes and tanks
- Scale deposits from hard water
- Rust and corrosion
- Sludge accumulation
- Organic matter contamination
System defects:
- Damaged or poorly maintained equipment
- Inadequate cleaning regimes
- Lack of water treatment
- Tanks without covers or insect screens
3. Assess who is at risk
The assessment identifies who could be exposed and their vulnerability:
High-risk groups:
- People over 50 years of age
- Smokers and heavy drinkers
- Those with chronic respiratory conditions
- Immunocompromised individuals
- People with diabetes or chronic diseases
Exposure routes:
- Shower use (most common)
- Spray taps and mixer taps
- Aerosols from cooling towers or water features
- Work activities involving water sprays
Frequency and duration:
- How often people are exposed
- Duration of exposure
- Distance from aerosol sources
4. Evaluate risk levels
For each identified hazard, the assessor rates the risk using a combination of:
Likelihood: How probable is legionella growth and exposure?
- High: Multiple risk factors, vulnerable users, ideal conditions
- Medium: Some risk factors present, typical building use
- Low: Minimal risk factors, good controls already in place
Severity: What would be the consequences?
- High: Vulnerable populations, high exposure, potential for outbreak
- Medium: Mixed population, moderate exposure
- Low: Healthy adults, occasional exposure, low concentrations
Overall risk rating:
- High risk: Immediate action required
- Medium risk: Action needed within specified timeframe
- Low risk: Monitor and maintain current controls
5. Recommend control measures
Based on identified risks, the assessment prescribes specific controls:
Temperature control (primary defence):
- Hot water storage at 60°C minimum
- Hot water delivery at 50°C minimum at outlets (within 1 minute)
- Cold water storage and distribution below 20°C
- Insulation to maintain temperatures
- TMV installation where scalding is a risk
Water turnover and flushing:
- Removal of dead legs where possible
- Weekly flushing of little-used outlets
- Regular use of all outlets
- Tank sizing to prevent stagnation
- Seasonal shutdown procedures
Cleaning and maintenance:
- Annual tank cleaning and disinfection
- Quarterly descaling of showerheads
- Inspection schedules
- Repair of defects
- Replacement of damaged components
Monitoring programme:
- Temperature checks at sentinel taps (weekly or monthly)
- Visual inspections
- Water sampling (if risk assessment indicates)
- Record-keeping requirements
Training and responsibilities:
- Appointment of responsible person
- Staff training requirements
- Emergency procedures
- Communication protocols
6. Create a written scheme of control
The assessment must result in a written control scheme that documents:
- Who is responsible for legionella management
- What control measures must be implemented
- How often each measure must be carried out
- What records must be kept
- When the assessment should be reviewed
Comparison: Simple vs Complex Risk Assessment
Simple System (Small Office/Single Rental)
- •Basic site plan and water system diagram
- •Straightforward identification of outlets
- •Simple temperature management
- •Monthly or quarterly temperature checks
- •Basic flushing regime for unused outlets
- •May be conducted by duty holder with training
Complex System (Care Home/Large Building)
Recommended- •Detailed CAD drawings and schematics
- •Comprehensive equipment inventory
- •Multiple sentinel points
- •Weekly temperature monitoring and recording
- •Professional water sampling programme
- •Requires qualified specialist assessor
Bottom line: The complexity of your legionella risk assessment should be proportionate to the complexity of your water systems and the level of risk. Simple systems may only need basic assessments, while complex or high-risk systems require professional expertise.
Competency requirements for assessors
The person conducting the assessment must be "competent" - possessing adequate training, knowledge, and experience.
What competency means
A competent assessor should:
- Understand legionella bacteria - how it grows, spreads, and causes disease
- Know water systems - types, components, operation, and maintenance
- Understand risk assessment - methodology for identifying and evaluating hazards
- Know legal requirements - COSHH, L8, HSG274, relevant standards
- Have practical experience - exposure to different premises types and water systems
- Stay current - keep up with guidance updates and industry best practice
Qualifications and training
While there's no single mandatory qualification, recognized credentials include:
Professional certifications:
- Legionella Control Association (LCA) membership
- City & Guilds Level 3 Award in Legionella Risk Assessment (8030-02)
- RSPH Level 3 Award in Managing Legionella in Water Systems
- BOHS P901 Managing Legionella Risks in Building Water Systems
Industry memberships:
- Water Management Society (WMSoc)
- Institute of Water
- Legionella Control Association
Experience requirements:
- Practical experience with water system assessments
- Portfolio of completed assessments
- Understanding of premises-specific considerations
Can you assess your own premises?
For simple systems, you may be able to conduct your own assessment if you:
- Have undertaken appropriate training (e.g., half-day legionella awareness course)
- Understand your water systems
- Can interpret L8 and HSG274 guidance
- Are willing to take responsibility for the assessment
Simple systems suitable for self-assessment:
- Small offices with straightforward plumbing
- Single rental properties with standard domestic systems
- Small shops or workshops
- Buildings with mains-fed water and minimal storage
Systems requiring professional assessment:
- Cooling towers or evaporative condensers
- Spa pools and hot tubs
- Complex multi-story buildings
- Healthcare and care facilities
- Hotels and large accommodation premises
- Buildings with multiple tanks or complex distribution
The HSE has clarified that landlords of simple residential properties can conduct their own assessments using HSE guidance and templates, provided the system is straightforward. However, many landlords choose professional assessments for liability protection and peace of mind.
What systems and elements are assessed?
Water temperature
Temperature is the primary control for legionella:
Hot water measurements:
- Storage temperature in calorifiers (target: 60°C minimum)
- Flow temperature at the top of the cylinder
- Return temperature at the bottom of the cylinder
- Outlet temperatures at sentinel taps (target: 50°C within 1 minute)
Cold water measurements:
- Storage temperature in tanks (target: below 20°C)
- Temperature at sentinel taps
- Temperature in vulnerable locations (high ambient temperature areas)
TMV checks:
- Outlet temperature (typically 43-44°C for hand washing)
- Verification that storage temperatures remain safe upstream
Water storage
Hot water storage (calorifiers):
- Type and capacity
- Age and condition
- Heating method (direct/indirect)
- Insulation adequacy
- Access for inspection and cleaning
- Thermometers and temperature controls
Cold water storage tanks:
- Location (loft, basement, plant room)
- Size and capacity
- Construction material
- Lid/cover security (to prevent contamination and insects)
- Insulation to prevent warming
- Cleaning history
- Inspection hatches
Tank considerations:
- Are tanks oversized relative to usage?
- Is water turning over regularly?
- Are multiple tanks interconnected?
- Is there redundant capacity that could be removed?
Distribution systems
Pipework assessment:
- Length and complexity of pipe runs
- Insulation (hot pipes insulated to stay hot, cold pipes to stay cold)
- Materials (copper, plastic, galvanized steel)
- Age and condition
- Evidence of corrosion or scaling
Dead legs:
- Unused pipe sections that don't serve active outlets
- Capped-off pipes from removed equipment
- Pipe sections rarely used (e.g., to seasonal areas)
- Recommendation: Remove dead legs or keep to absolute minimum (less than 2 meters)
Cross-connections:
- Backflow prevention devices
- Potential for cold/hot water mixing
- Connections to other systems
Outlets and aerosol sources
Showers:
- Frequency of use
- Type (mixer, thermostatic, electric)
- Showerhead condition (descaling needed?)
- Hose condition
- Temperature delivered
Taps:
- Spray taps that could create aerosols
- Little-used taps (cleaners' cupboards, unused offices)
- Outside taps for gardens or vehicle washing
- Temperature at outlets
High-risk systems:
- Cooling towers and evaporative condensers
- Spa pools and hot tubs
- Water features, fountains, and ornamental ponds
- Humidifiers and air conditioning systems
- Emergency showers and eye-wash stations
Occupancy and use patterns
Building usage:
- Continuous occupancy vs. intermittent use
- Seasonal variations
- Areas of the building used infrequently
- Vacant rooms or floors
User vulnerability:
- Elderly residents
- Healthcare patients
- Immunocompromised individuals
- General public vs. employees only
Exposure scenarios:
- How often showers are used
- Who uses water systems and how
- Duration of exposure
Typical Legionella Control Schedule
Run rarely-used taps and showers for 2 minutes to prevent stagnation
Monitor sentinel taps in care homes and vulnerable settings
Check and record temperatures at sentinel taps throughout the building
Descale and disinfect showerheads and spray taps
Inspect, clean, and disinfect water storage tanks
Full review of legionella risk assessment and control measures
Frequency of reviews
The legionella risk assessment is not a one-time exercise. It must be reviewed regularly to ensure it remains valid and effective.
Standard review intervals
At least every 2 years:
- This is the HSE's recommended minimum for routine reviews
- Applies to most offices, commercial premises, and standard buildings
Annually:
- Healthcare facilities and hospitals
- Care homes for vulnerable residents
- Hotels and guest accommodation
- High-risk premises with cooling towers or complex systems
Sooner if circumstances change:
- Alterations to water systems (new equipment, changed pipework)
- Building extensions or refurbishments
- Changes in building use or occupancy
- After long periods of shutdown (e.g., COVID-19 closure)
- After a case of Legionnaires' disease linked to the premises
- If monitoring shows control measures are failing
Triggers for immediate review
Certain events require urgent reassessment:
System changes:
- Installation of new boilers, calorifiers, or tanks
- Replacement of cooling tower components
- Addition of new outlets or plumbing
- Removal of equipment leaving dead legs
Building changes:
- Change of building use (office to residential, etc.)
- New tenants with different usage patterns
- Renovation work affecting plumbing
Control failures:
- Water temperatures consistently out of range
- Positive legionella test results above action levels
- Equipment failures (boiler breakdown, TMV failure)
- Discovery of previously unknown dead legs or tanks
Health incidents:
- Suspected or confirmed Legionnaires' disease case
- HSE investigation or enforcement notice
- Public Health England notification
Many organizations conduct an assessment and then forget about it. The assessment is only useful if it's kept current, control measures are implemented, and monitoring is maintained. Out-of-date assessments provide no protection and won't stand up to HSE scrutiny.
Documentation and records
What the assessment document must include
A compliant legionella risk assessment should contain:
Cover page:
- Premises name and address
- Date of assessment
- Assessor name and qualifications
- Date of previous assessment (if applicable)
- Review date
Executive summary:
- Overview of findings
- Overall risk rating
- Key recommendations and priority actions
Site information:
- Building description and use
- Occupancy details and vulnerable groups
- Water supply information
- Site plan
Water system description:
- Schematic diagrams of hot and cold water systems
- Equipment inventory (tanks, calorifiers, pumps, TMVs)
- Photographs of key equipment
- Tank capacities and locations
Risk assessment matrix:
- Each identified hazard
- Location and description
- Likelihood and severity ratings
- Existing control measures
- Additional controls recommended
- Risk rating (high/medium/low)
- Priority for action
Temperature survey results:
- Readings taken during the assessment
- Sentinel tap locations and temperatures
- Storage tank temperatures
- Comparison to target ranges
Findings and recommendations:
- Detailed observations
- Defects identified
- System improvements needed
- Monitoring schedule
- Sampling requirements (if applicable)
Written scheme of control:
- Responsible person details
- Control measure schedule
- Monitoring frequency
- Record-keeping requirements
- Training needs
- Review procedures
Records to maintain
In addition to the risk assessment, you must keep ongoing records:
Temperature monitoring logs:
- Date and time of checks
- Location (sentinel tap identification)
- Hot and cold water temperatures
- Name of person conducting check
- Any out-of-range readings and actions taken
Flushing records:
- Little-used outlets flushed
- Date and duration of flushing
- Any issues identified
Maintenance records:
- Tank cleaning and disinfection
- Showerhead descaling
- TMV servicing
- System repairs and modifications
Water sampling results (if applicable):
- Sample location and date
- Laboratory results
- CFU/litre counts
- Actions taken in response
Training records:
- Staff trained in water safety
- Training dates and content
- Competency assessments
Review and audit records:
- Assessment review dates
- Changes made to systems or controls
- Audit findings
Records must be kept for at least 5 years. In the event of a Legionnaires' disease case or HSE investigation, your records demonstrate due diligence and compliance with legal duties.
Written scheme of control
The legionella risk assessment must produce a written scheme of control - a practical document that translates assessment findings into day-to-day management actions.
What the scheme must include
1. Responsibilities:
- Named responsible person (legionella manager)
- Deputy in their absence
- Authority and resources provided
- Escalation procedures
2. Control measures:
- Specific actions required (temperature checks, flushing, cleaning)
- Frequency of each measure
- Method and procedure for each task
- Target parameters (e.g., hot water >50°C at outlets)
3. Monitoring programme:
- What to monitor (temperatures, visual inspections, etc.)
- Where to monitor (sentinel tap locations)
- How often to monitor
- What to record
- Action levels that trigger further investigation
4. Maintenance schedule:
- Routine maintenance tasks
- Frequency (weekly, monthly, quarterly, annually)
- Who conducts each task
- Checklist or procedure documents
5. Emergency procedures:
- What to do if temperatures are out of range
- Response to positive water samples
- Procedure if Legionnaires' disease is suspected
- Contact details for specialists
6. Record-keeping:
- What records to keep
- Format (logbooks, electronic systems)
- Where records are stored
- Who reviews records and how often
7. Training requirements:
- Who needs training
- Content of training
- Frequency of refresher training
- Competency assessment
8. Review and audit:
- Assessment review schedule
- Internal audit frequency
- Who conducts audits
- Corrective action procedures
Making the scheme practical
The written scheme should be a working document, not just filed away:
- Accessible: Available to those who need it (responsible person, maintenance staff)
- Clear: Written in plain language, not technical jargon
- Specific: Precise instructions, not vague statements
- Achievable: Realistic given available resources and competence
- Integrated: Fits into existing maintenance systems
Example of a practical control measure:
Instead of: "Hot water temperature should be monitored regularly"
Write: "Every Monday, John Smith (Maintenance Manager) will use the digital thermometer to check hot water temperature at the three sentinel taps (Ground Floor WC, 1st Floor Kitchen, 2nd Floor Shower Room). Temperatures will be recorded in the Water Safety Logbook. If any outlet is below 50°C, investigate cause immediately and notify Building Manager."
Care home prosecution - failure to implement controls
A care home had a professional legionella risk assessment conducted and received a detailed written scheme of control. However, staff were not trained, temperature checks were inconsistent, and records were incomplete. An 82-year-old resident contracted Legionnaires' disease and died.
- ✗Risk assessment conducted but recommendations not implemented
- ✗No staff training on water safety or control measures
- ✗Temperature monitoring inconsistent and poorly recorded
- ✗Showerheads not cleaned as recommended
- ✗Responsible person lacked time and authority to enforce controls
- ✗Management treated assessment as 'box-ticking' exercise
The care home operator was prosecuted by the HSE. The court imposed a fine of £300,000 plus costs, and the managing director received a suspended prison sentence. CQC issued a requirement notice and threatened closure unless water safety was urgently improved.
An assessment is worthless without implementation. Courts and regulators expect to see evidence that control measures are actively followed, not just documented. The written scheme must be a living document integrated into daily operations.
Link to regulatory guidance
HSE ACOP L8
The Health and Safety Executive's Approved Code of Practice L8 is the primary guidance document:
Key sections:
- Legal framework and duty holders
- Risk assessment requirements
- Control measures and monitoring
- Record-keeping and review
- Competence and training
Access: Available from HSE Books or free online.
HSG274 Parts 1, 2, and 3
HSE Guidance 274 provides detailed technical guidance in three parts:
Part 1: Evaporative cooling systems
- Cooling towers
- Evaporative condensers
- Adiabatic coolers
- Detailed monitoring and maintenance requirements
Part 2: Hot and cold water systems
- Domestic water systems in commercial premises
- Temperature control strategies
- Flushing regimes
- Tank design and maintenance
Part 3: Other risk systems
- Spa pools and hot tubs
- Humidifiers
- Water features
- Car washes
- Dental chair units
Industry standards
BS 8558:2015: Guide to the design, installation, testing, and maintenance of services supplying water for domestic use in buildings and their curtilages
BS 7592:2008: Sampling for Legionella bacteria in water systems
HTM 04-01 (NHS): Specialized guidance for healthcare water systems
While L8 is an Approved Code of Practice with special legal status, HSG274 is guidance. Following HSG274 is considered good practice and demonstrates compliance with L8, but alternative approaches may be acceptable if you can demonstrate they achieve the same standard of control.
Common misconceptions about risk assessments
"We had an assessment done 5 years ago, so we're covered"
Wrong. Risk assessments must be reviewed at least every 2 years and whenever circumstances change. An outdated assessment provides no protection and won't satisfy HSE requirements.
"We need water testing every year"
Not necessarily. The law requires a risk assessment and control measures. Water sampling is only required if your risk assessment identifies it as necessary. Many systems never need routine testing if temperature control is effective.
"Our plumber can do the risk assessment"
Maybe, but probably not. Plumbers understand pipework but may lack specific knowledge of legionella risks, L8 requirements, and risk assessment methodology. Use a qualified water hygiene specialist for anything beyond simple systems.
"The assessment is just a document for HSE"
Wrong. The assessment should drive your day-to-day water safety management. If you're not using it to guide control measures and monitoring, it's not fit for purpose.
"Small premises don't need an assessment"
Wrong. Size doesn't determine legal requirement - control does. Even a single rental property or small office needs an assessment if you control the water systems.
"We have TMVs, so we're safe"
Dangerous misconception. TMVs prevent scalding by mixing hot and cold water at outlets, but they don't eliminate legionella risk. You still need to store hot water at 60°C and ensure the cold supply is below 20°C.
DIY assessment vs. professional assessment
When you might assess yourself
Suitable for simple, low-risk systems:
Premises types:
- Small office with basic plumbing
- Single rental house with standard domestic system
- Small shop or workshop
- Simple flat with no special features
Requirements:
- You must undertake appropriate training
- Understand L8 and HSG274 guidance
- Can map your water systems
- Are confident taking responsibility
- Have time to maintain ongoing controls
Resources:
- HSE provides guidance for landlords
- LCA offers training courses
- Online templates available (but ensure they're comprehensive)
When to use a professional
Essential for complex or high-risk systems:
Premises types:
- Cooling towers or evaporative condensers (always use specialist)
- Spa pools, hot tubs, hydrotherapy pools
- Care homes, hospitals, healthcare facilities
- Hotels, guest houses, B&Bs
- Large offices or multi-story buildings
- Blocks of flats with complex plumbing
- Schools, leisure centers, public buildings
Benefits:
- Expertise in legionella risks and control
- Liability protection
- Detailed technical recommendations
- Credibility with regulators
- Training and support included
- Ongoing monitoring services often available
What to look for:
- LCA membership or equivalent professional body
- Relevant qualifications (City & Guilds, RSPH, BOHS)
- Experience with your type of premises
- Comprehensive report format
- Clear written scheme of control
- Support with implementation
DIY vs Professional Assessment
DIY Assessment
- •Lower cost (but time investment required)
- •Direct understanding of your systems
- •Suitable for simple, low-risk premises
- •Requires training and competence
- •You take full responsibility
- •May lack technical depth
Professional Assessment
Recommended- •Higher cost but comprehensive
- •Expert knowledge and experience
- •Required for complex/high-risk systems
- •Detailed technical recommendations
- •Liability protection and credibility
- •Support with implementation and monitoring
Bottom line: For simple systems with low risk, a DIY approach may be acceptable if you're competent. For anything complex, high-risk, or involving vulnerable people, professional assessment is strongly recommended and often essential to meet legal requirements.
Frequently asked questions
Costs vary widely depending on the size and complexity of the premises. Simple assessments for small rental properties might cost £150-£300. Medium-sized commercial premises typically £300-£800. Large or complex buildings with multiple systems could be £1,000-£5,000+. DIY assessment costs only your time, but requires training and competence.
A simple property might take 1-2 hours. A medium office building 2-4 hours. Large or complex premises could take a full day or multiple visits. Report writing typically takes several additional hours. Total turnaround from site visit to final report is usually 5-10 working days.
There's no such thing as a 'legionella certificate' like a gas safety certificate. What you need is a written legionella risk assessment. Some assessors provide a cover sheet or summary that looks like a certificate, but the actual assessment document is what matters legally.
Templates can help structure your assessment, but simply filling in boxes isn't sufficient. The assessment must be specific to your premises, address actual risks, and provide actionable recommendations. Generic templates often lack the detail required for compliance. They're suitable only for very simple systems where you're competent to interpret and apply them.
The responsible person should be someone with authority to implement controls and allocate resources. In small organizations, it might be the owner or manager. In larger premises, a facility manager or health and safety officer. They must be competent (trained in legionella control) and have time to fulfill the duties.
The assessment will prioritize actions. High risks typically require immediate action - you may need to shut down certain systems, implement emergency controls, or bring in specialists urgently. Medium risks require action within specified timeframes. Low risks need monitoring and routine maintenance. Don't panic, but do act on the recommendations promptly.
Not always. Sampling is only required if your risk assessment identifies it as necessary to verify control measures. Many well-controlled systems never need routine sampling. High-risk systems or those with control failures may need quarterly or annual sampling. Testing tells you if bacteria are present, but doesn't replace temperature control and maintenance.
Keep the risk assessment and written scheme of control, plus ongoing records of temperature checks, flushing activities, maintenance, cleaning, any water samples, training, and assessment reviews. Records must be kept for at least 5 years. They demonstrate compliance and due diligence.
Tenancy agreements should include provisions for access for safety inspections. Give proper notice (usually 24 hours). If a tenant refuses, you cannot fulfill your legal duties. Document all attempts to gain access and seek legal advice if refusal continues - you may need to obtain a court order.
You're in breach of COSHH regulations. If HSE inspects or investigates, you could receive an improvement notice requiring immediate assessment, a prohibition notice stopping operations, or prosecution with unlimited fines. If someone contracts Legionnaires' disease and you have no assessment, you face serious legal consequences including potential imprisonment.
Getting started with your risk assessment
Step 1: Appoint a responsible person
Identify someone to oversee water safety:
- Someone with authority to implement changes
- Sufficient time to carry out duties
- Willing to undertake training
- Can coordinate with contractors and specialists
Step 2: Gather information
Before the assessment (or to conduct your own):
- Locate all water tanks and storage
- Understand hot and cold water distribution
- Identify all outlets (taps, showers, outside taps)
- Note any special systems (cooling towers, spa pools)
- Collect any existing building plans or plumbing diagrams
Step 3: Arrange the assessment
If using a professional:
- Get quotes from at least 2-3 specialists
- Check qualifications and experience
- Ensure they'll provide a written scheme of control
- Clarify what's included (ongoing support, training)
If assessing yourself:
- Undertake appropriate training first
- Use HSE guidance and HSG274
- Be thorough and systematic
- Don't cut corners to save time
Step 4: Implement the controls
Don't let the assessment gather dust:
- Read it thoroughly and understand all recommendations
- Prioritize actions based on risk levels
- Allocate budget and resources
- Assign tasks to specific people
- Set deadlines for implementation
Step 5: Establish monitoring
Set up your ongoing programme:
- Create temperature monitoring logs
- Schedule flushing of little-used outlets
- Plan maintenance activities (tank cleaning, showerhead descaling)
- Train staff on procedures
- Set up record-keeping systems
Step 6: Review regularly
Don't forget the assessment:
- Review at least every 2 years
- Review sooner if systems or usage changes
- Use monitoring data to inform reviews
- Update the written scheme as needed
- Keep competence current through training
Need expert help with your legionella risk assessment? A qualified water hygiene specialist can assess your systems, provide detailed recommendations, and support you with implementation to ensure full compliance with L8 requirements.
Related articles
Useful tools
Disclaimer: This guidance is for general information and is based on UK law and HSE guidance. It does not constitute legal or professional advice. For specific situations, consult a qualified water hygiene specialist or health and safety advisor. Laws and guidance may change.