Legionella risk assessment: a complete guide for UK contractors and facilities managers

What is a legionella risk assessment?

A legionella risk assessment checks a building's water systems for the conditions that let Legionella bacteria grow and spread: how the system is designed, where risk areas exist, and whether current safety measures are enough to control them.

Legionella bacteria cause Legionnaires' disease, a serious form of pneumonia, and the milder Pontiac fever. The bacteria thrive in water held between 20°C and 45°C, particularly where water sits still or where scale, rust, or biofilm are present.

The assessment ends with a formal written report. That report sets out each risk found, recommends control measures, and gives you a prioritised action plan to work through.

Is a legionella risk assessment mandatory for commercial properties?

Yes. The legal requirements relate to the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health (COSHH) Regulations 2002, concerning risks from exposure to Legionella bacteria. The Health and Safety Executive (HSE) sets out how to meet those requirements through two key documents: Approved Code of Practice L8 (ACOP L8) is the main standard covering Legionella management. HSG274 provides the practical technical guidance supporting ACOP L8.

Responsibility sits with the duty holder, usually the person or organisation with control over the premises or water systems. In practice, this covers:

• Employers: responsible for any water system on their premises
• Landlords: responsible for communal water systems in rental properties
• Building owners or occupiers: responsible where no employer relationship exists
• Facilities Manager: often appointed as the responsible person on the duty holder's behalf

If a duty holder fails to follow ACOP L8 and a breach of health and safety law occurs, this can be used as evidence in legal proceedings unless equivalent control measures can be demonstrated. For organisations managing multiple sites, this duty applies to every property in the portfolio.

Who can carry out a legionella risk assessment?

The HSE requires the assessment to be completed by a "competent person." This means someone with the right training, practical experience, and a sound understanding of ACOP L8 and HSG274 to evaluate legionella risks accurately.

The most robust and widely recommended approach is to commission a UKAS-accredited inspection body to carry out the assessment, and this is especially advisable for larger, higher-risk, or more complex sites. UKAS accreditation is what an Operations Director is actually paying for when they choose this route: an independent declaration that the organisation has the resources, technical expertise, management systems, and controls to carry out the activity professionally and competently.

Whoever carries out the assessment must produce a formal written report and recommend remedial actions.

What a commercial legionella risk assessment covers

A thorough assessment follows three stages: a physical survey of the water system, a check for conditions that support bacterial growth, and the production of a formal legionella report. Each stage builds directly on the last.

Surveying the water system and identifying assets

The assessor starts by mapping all water system components that could harbour or spread bacteria. This includes domestic hot and cold water services, cold water storage tanks, calorifiers, plate heat exchangers, distribution pipework, outlets, taps, showers, and thermostatic mixing valves (TMVs).

Two types of asset need particular attention:

• Little-used outlets: taps or showers that are rarely run, allowing water to sit and warm to dangerous temperatures
• Dead legs: sections of pipework with no regular flow, creating ideal conditions for stagnation and bacterial growth

Accurate records from this survey form the foundation for all compliance monitoring that follows, especially across a multi-site estate.

Checking temperatures, stagnation, and other risk factors

The assessor takes temperature readings at key points across the system. Hot water must be stored at or above 60°C and delivered above 50°C within one minute at the outlet. Cold water temperatures must be checked and recorded regularly, as Legionella bacteria thrive between 20°C and 45°C.

Alongside temperatures, the assessor checks for:

• Biofilm, scale, or corrosion inside tanks and pipework
• Missing or deteriorating insulation on cold water pipes
• Gaps in existing controls such as flushing schedules or dosing records

Any condition outside safe parameters is recorded and flagged for remedial action.

Producing the legionella report and action plan

The assessment concludes with a written legionella report. It records all findings, assigns a risk rating to each hazard, and sets out remedial actions with priority levels. The report also includes a schematic of the water system and a schedule of ongoing monitoring tasks.

Without a thorough report, a business has no reliable basis for its control measures and no defensible record of having considered the risk. Keeping that report current is a legal obligation.

How often should a legionella risk assessment be reviewed?

ACOP L8 requires risk assessments to be reviewed regularly. The 2013 edition removed the previous two-year fixed interval in favour of a risk-based approach. In practice, every two years is the accepted baseline, but a review must also happen immediately after any significant change.

Common triggers for reassessment include:

• Changes to the water system layout or pipework
• Building refurbishment or a change of use
• A change in occupancy, particularly where vulnerable people are present
• A positive legionella test result
• Evidence that existing control measures have failed

Typical ongoing monitoring requirements include monthly temperature checks at sentinel outlets. Little-used outlets need flushing weekly, not quarterly, since stagnant water is exactly the condition that lets Legionella take hold. Quarterly checks apply to a different task, testing the return temperature on subordinate loops, so it's worth not conflating the two when setting up a monitoring schedule.

Keeping track of these dates and trigger events across a portfolio requires a consistent system: one that holds each task at its own frequency, so weekly flushing, monthly checks, and quarterly loop testing don't all collapse into a single interval someone has to remember manually.

How to reduce legionella risk across your sites

The assessment identifies the risks. Reducing them depends on consistent controls and clear evidence across every site you manage.

Control temperature and reduce stagnation

The two most effective ongoing controls are keeping water temperatures within safe ranges and preventing water from sitting unused. This means scheduling regular flushing of little-used outlets, maintaining calorifier setpoints, and insulating cold water pipework.

These tasks must sit inside a planned preventative maintenance (PPM) programme. Without that structure, tasks drift and compliance gaps build quietly without anyone noticing. A PPM contract gives you a structured schedule of visits, clear task lists tied to specific assets, and a consistent record of completed work. All of which matter when an HSE inspection arrives.

Track remedial actions and compliance records

Every action in the legionella report must be assigned, completed, and evidenced. For multi-site portfolios, this means logging works and storing completion records in one place, not across separate inboxes or spreadsheets.

When a remedial action comes in as an ad-hoc job, such as a failed temperature reading, a dead leg that needs flushing, or a TMV that requires attention, the job record needs to capture the right asset, the correct site details, and any relevant compliance documents before the engineer arrives. Missing that information at the point of job creation leads to unprepared engineers, repeat visits, and gaps in your audit trail. Audit readiness depends on a clear trail from assessment findings through to completed actions.

Managing legionella risk actions in Joblogic

Turning a legionella report into scheduled, trackable work is where many organisations lose control. Joblogic's water treatment software stores your Legionella risk assessments alongside remedial actions logged against specific water system assets, scheduled as part of a PPM contract and assigned to engineers with the relevant qualifications.

For planned work, the PPM engine holds your asset lists, visit schedules, and task frequencies in one place. An Office Manager can set billing rules, track SLA performance, and produce evidence of completed visits without chasing engineers for paperwork. For reactive work, structured job forms make sure that every ad-hoc callout captures the right site, asset, and compliance information upfront. Engineers arrive prepared and records are complete from the start.

Engineers using Joblogic capture evidence on site through the mobile app, including temperature readings and photographs via digital compliance forms, all stored against the job record. Compliance dashboards give managers real-time visibility of outstanding actions, upcoming review dates, and overdue tasks across all sites, without extra admin back in the office.

If you want to see how Joblogic supports your legionella compliance workflow, book a demo and speak to one of our specialists.

Frequently asked questions

How much does a legionella risk assessment cost in the UK?

Costs vary based on the size and complexity of your water systems. A basic single-site assessment can start from a few hundred pounds, a useful comparison point for an SMB Business Owner weighing up quotes, while a large or multi-site estate will cost more. A UKAS-accredited assessor will give you an accurate quote based on the scope of your specific site.

Do I need a separate legionella risk assessment for each property I manage?

Yes. Each property must be assessed individually because water system layouts, risk factors, and occupancy types differ by site. A single assessment cannot cover multiple buildings.

Is there a legionella risk assessment certificate I need to display?

There is no formal government-issued certificate. The written report produced by your competent assessor serves as your compliance evidence. Keep it on file, up to date, and ready to produce during any HSE inspection.

Can I download a legionella risk assessment template and complete it myself?

A legionella risk assessment template may help structure the process, but it does not replace competence or site-specific judgement. For any commercial property with a complex water system, a template alone will not meet your legal obligations under ACOP L8.

What is the difference between a legionella risk assessment and a water hygiene risk assessment?

A water hygiene risk assessment covers a broader range of waterborne hazards beyond Legionella. In practice, the two assessments are often carried out together by the same specialist, particularly for buildings with cooling towers, spa pools, or other higher-risk water systems.