What is a legionella risk assessment?

A legionella risk assessment checks a building's water systems for the conditions that let Legionella bacteria grow and spread: how the system is designed, where risk areas exist, and whether current safety measures are enough to control them.

Legionella bacteria cause Legionnaires' disease, a serious form of pneumonia, and the milder Pontiac fever. The bacteria thrive in water held between 20°C and 45°C, particularly where water sits still or where scale, rust, sludge, or biofilm are present.

In short, the assessment tells you whether your water systems could harbour and spread Legionella, what you need to do about it, and how you will prove it. Compliance is an ongoing management process, not an annual water test. The Health and Safety Executive (HSE) sets out the duty in ACOP L8, and the steps below follow that guidance.

A legionella risk assessment works in six steps:

1. Map the system: list every tank, calorifier, pipe run, outlet and dead leg, and draw a schematic diagram
2. Check the conditions: look for water between 20°C and 45°C, stagnation, deposits, and anything that creates a spray or aerosol
3. Identify who is at risk: consider the people who could breathe in contaminated droplets
4. Record the findings: write down each risk, its priority, and the action needed
5. Put controls in place: appoint a responsible person and set up a written scheme where the risk is significant
6. Monitor, record and review: carry out the checks, keep the records, and revisit the assessment when anything changes

The assessment usually ends with a formal written report. That report sets out each risk found, recommends control measures, and gives you a prioritised action plan to work through.

Is a legionella risk assessment mandatory for commercial properties?

Yes. The legal requirements come from the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health (COSHH) Regulations 2002, as they apply to the risk from exposure to Legionella bacteria. The HSE explains how to meet them through two key documents. Approved Code of Practice L8 (ACOP L8), now in its fourth edition (2013), is the main standard covering Legionella management. HSG274 provides the practical technical guidance that supports it.

Responsibility sits with the duty holder, usually the person or organisation with control over the premises or water systems. In practice, this covers:

• Employers: responsible for the risk to employees and others from the water systems on their premises
• Landlords: responsible where a building is let but the landlord keeps responsibility for maintaining its water systems
• Building owners or occupiers: responsible where no employer relationship exists
• Responsible person: the competent person the duty holder appoints to run day-to-day control, often a facilities manager

ACOP L8 has special legal status. If a duty holder is prosecuted for a breach of health and safety law and did not follow the relevant provisions of the code, they must show they complied with the law in some other way, or a court will find them at fault. For organisations managing multiple sites, the duty applies to every property in the portfolio.

Who is at risk from legionella?

Everyone is susceptible to Legionnaires' disease, and it is normally contracted by breathing in tiny droplets of water that contain the bacteria. Some people are at higher risk. ACOP L8 names people over 45, smokers and heavy drinkers, people with chronic respiratory or kidney disease, diabetes, lung or heart disease, and anyone with an impaired immune system.

The assessor also considers who is likely to be exposed and where. Premises with particularly vulnerable occupants, such as healthcare settings, residential homes and nursing homes, carry a higher level of concern, and healthcare premises also have their own NHS guidance in Health Technical Memorandum 04-01 on safe water. Showers, spa pools and cooling towers are the usual sources of the spray that carries bacteria into the air.

Who can carry out a legionella risk assessment?

The duty holder must make sure the person carrying out the assessment is competent. That means having the ability, experience, training and resources to understand the risks and the controls, including ACOP L8 and HSG274. A competent person can come from inside your organisation or from a consultancy or water treatment company.

When you appoint an outside contractor or consultant, HSE guidance says to check their competence, for example their experience, qualifications, training, and membership of a professional organisation or recognised trade body. The Legionella Control Association also publishes a Code of Conduct for service providers. It has no legal status, but it shows the standard of service you should expect.

Using a contractor does not pass your responsibility to them. The duty holder remains responsible for making sure the control procedures are carried out to the required standard. Whoever carries out the assessment must produce a written record of their findings and recommend remedial actions.

Competence applies to the people running the controls too. The responsible person should receive regular refresher training, and you should keep records of all initial and refresher training.

What a commercial legionella risk assessment covers

A thorough assessment follows three stages: a physical survey of the water system, a check for conditions that support bacterial growth, and the production of a formal legionella report. Each stage builds directly on the last.

Surveying the water system and identifying assets

The assessor starts by mapping all water system components that could harbour or spread bacteria. This includes domestic hot and cold water services, cold water storage tanks, calorifiers, plate heat exchangers, distribution pipework, outlets, taps, showers, and thermostatic mixing valves (TMVs). For complex systems, ACOP L8 expects a survey of all the water systems, an asset register of the plant, and an up-to-date schematic diagram that includes any parts temporarily out of use.

Two types of asset need particular attention:

• Little-used outlets: taps or showers that are rarely run, allowing water to sit and warm to dangerous temperatures
• Dead legs: sections of pipework with no regular flow, creating ideal conditions for stagnation and bacterial growth

Accurate records from this survey, kept in an asset register, form the foundation for all compliance monitoring that follows, especially across a multi-site estate.

Checking temperatures, stagnation, and other risk factors

The assessor takes temperature readings at key points across the system. Under HSE guidance, hot water should be stored at 60°C or above and reach at least 50°C within one minute of running the water at the outlet (55°C in healthcare premises). Cold water should stay below 20°C, so storage tanks should be kept cool and insulated.

Alongside temperatures, the assessor checks for:

• Biofilm, scale, sludge, or corrosion inside tanks and pipework
• Missing or deteriorating insulation on cold water pipes
• Gaps in existing controls such as flushing schedules or dosing records

Any condition outside safe parameters is recorded and flagged for remedial action.

Producing the legionella report and action plan

The assessment concludes with a written legionella report. It records all findings, typically assigns a risk rating to each hazard, and sets out remedial actions with priority levels. The report should also include a schematic of the water system and an indication of when the assessment should next be reviewed.

Without a thorough report, a business has no reliable basis for its control measures and no defensible record of having considered the risk. If you employ five or more people, you are legally required to record the significant findings. With fewer than five, there is no duty to write anything down, though HSE says it is useful to do so.

Writing the control scheme

Where the assessment shows a reasonably foreseeable risk, ACOP L8 says to avoid the exposure so far as is reasonably practicable. Where that is not possible, you need a written scheme for controlling the risk, and it must be properly implemented and managed. If the risk is insignificant and well managed, a written scheme may not be needed, though the assessment still has to be reviewed.

The written scheme should include, where appropriate:

• An up-to-date plan or schematic of the system, including parts temporarily out of use
• A description of the correct and safe operation of the system
• The precautions to take
• The checks to carry out to confirm the scheme is working, and how often
• The remedial action to take if it is not effective

How often should a legionella risk assessment be reviewed?

ACOP L8 does not set a fixed number of years. It requires you to review the assessment regularly, and specifically whenever there is reason to believe it may no longer be valid. The code describes the record as a "living document" and says an indication of when to review it should be written into the assessment itself.

HSE gives these examples of reasons to reassess:

• Changes to the water system or how it is used
• Changes to the use of the building, such as a refurbishment or change of use
• New information about risks or control measures
• Check results showing that control measures are no longer effective
• Changes to key personnel
• A case of Legionnaires' disease or legionellosis linked to the system

Setting a routine review date at the same time stops the assessment going unchecked. The right date depends on the risk, so agree it with your competent person and record it.

Ongoing monitoring and how often to do it

Between reviews, the water system needs regular checks. The frequencies below come from HSE guidance on hot and cold water systems. Your own risk assessment may call for different intervals, so treat them as a starting point.

You can find the full list in the HSE guidance on hot and cold water systems. Keeping track of these dates and trigger events across a portfolio takes a consistent system, one that holds each task at its own frequency so that weekly flushing, monthly checks and quarterly showerhead cleans do not collapse into a single interval someone has to remember manually.

How long to keep legionella records

Records should include who is responsible, the significant findings, the written control scheme, the state of operation of the system, and the results and dates of every check. HSE says to keep these for as long as they remain current and for at least two years afterwards. Records of monitoring inspections, tests and checks should be kept for at least five years. The HSE page on keeping records has the full list.

Common legionella risk assessment mistakes

Most compliance gaps trace back to a handful of avoidable habits:

• Treating the assessment as a one-off: the assessment must be reviewed regularly and whenever the system, its use, or the people running it change
• Missing dead legs and rarely used outlets: parts of the system used intermittently can let growth go unnoticed, then cause heavy contamination when they are brought back into use
• Leaning on a single test result: a negative sample does not guarantee that Legionella is absent, and a positive one does not always mean the controls have failed
• Assuming a contractor carries the duty: hiring specialists does not remove the duty holder's responsibility for the control procedures
• Keeping thin records: without dated monitoring results and completed actions, you cannot show the controls were applied

Legionella risk assessments for landlords and property managers

Landlords are duty holders where they let a building but keep responsibility for maintaining its water systems. ACOP L8 says all systems need a risk assessment, but not all need elaborate control measures. A simple assessment may show the risk is low and being managed, in which case no further action may be needed beyond regular review.

HSE describes a typical low-risk situation as a small building without particularly vulnerable people, with daily water use that turns over the whole system, mains cold water with no stored tanks, hot water from instantaneous or low-volume heaters, and no showers. Anything more complex, such as stored water, calorifiers, or shared outlets across a portfolio, needs a closer look from a competent person. The same rule applies to every property: each one is assessed on the individual nature of its own site.

How to reduce legionella risk across your sites

The assessment identifies the risks. Reducing them depends on consistent controls and clear evidence across every site you manage.

Control temperature and reduce stagnation

The two most effective ongoing controls are keeping water temperatures outside the 20°C to 45°C growth range and preventing water from sitting unused. HSE also lists keeping the system clean, avoiding materials that encourage bacterial growth, controlling the release of spray, and using water treatment where the risk assessment calls for it. In practice, this means scheduling regular flushing of little-used outlets, maintaining calorifier setpoints, and insulating cold water pipework.

These tasks must sit inside a planned preventative maintenance (PPM) programme. Without that structure, tasks drift and compliance gaps build without anyone noticing. A PPM contract gives you a structured schedule of visits, clear task lists tied to specific assets, and a consistent record of completed work. All of which matter when an HSE inspection arrives.

Track remedial actions and compliance records

Every action in the legionella report must be assigned, completed, and evidenced. For multi-site portfolios, this means logging works and storing completion records in one place, not across separate inboxes or spreadsheets.

When a remedial action comes in as an ad-hoc job, such as a failed temperature reading, a dead leg that needs flushing, or a TMV that requires attention, the job record needs to capture the right asset, the correct site details, and any relevant compliance documents before the engineer arrives. Missing that information at the point of job creation leads to unprepared engineers, repeat visits, and gaps in your audit trail. Audit readiness depends on a clear trail from assessment findings through to completed actions.

Software for managing water hygiene and legionella compliance

Spreadsheets and paper logs struggle once a portfolio grows, because every task has its own frequency and every check needs a dated record. If you are comparing field service management or maintenance management software, the questions below link what HSE expects to what a system should do for you. They apply to any provider, and the right-hand column shows how Joblogic answers each one.

Managing legionella risk actions in Joblogic

Turning a legionella report into scheduled, trackable work is where many organisations lose control. Joblogic's water treatment software gives water hygiene teams standard workflows for Legionella risk assessments, tank inspections, temperature monitoring and chlorination, with remedial actions logged against the right site and asset and scheduled as part of a PPM contract.

For planned work, the PPM engine holds your asset lists, visit schedules and task frequencies in one place, so contract billing and renewals can be managed from the same system. For reactive work, structured job forms help every ad-hoc callout capture the right site, asset and compliance information upfront, so the right engineers, booked through job scheduling, arrive prepared and records are complete from the start.

Engineers using Joblogic capture evidence on site through the mobile app, including temperature readings and photographs via digital compliance forms, all stored against the job record. Reporting and dashboards add a view of work in progress across sites. Businesses that want ready-made water hygiene reports and forms can also look at the Water Hygiene Industry Pack, a Marketplace add-on that you subscribe to separately.

If you want to see how Joblogic supports your legionella compliance workflow, book a demo and speak to one of our specialists.

Frequently asked questions

How much does a legionella risk assessment cost in the UK?

Costs vary with the size and complexity of your water systems, from a single small building to a large multi-site estate. Ask for written quotes from competent assessors, and make sure each quote states what is included, such as the survey, schematic and written report.

Do I need a separate legionella risk assessment for each property I manage?

Yes. ACOP L8 asks you to consider the individual nature of each site, because water system layouts, risk factors and occupancy differ from building to building. A single assessment cannot cover multiple buildings.

How often should a legionella risk assessment be reviewed?

ACOP L8 does not give a fixed number of years. You must review the assessment regularly and whenever there is reason to believe it may no longer be valid, for example after a change to the water system, a change of use, or a case of Legionnaires' disease linked to the system.

What temperature should hot and cold water be to control legionella?

HSE guidance says hot water should be stored at 60°C or above and reach at least 50°C within one minute of running the water (55°C in healthcare premises). Cold water should stay below 20°C. Legionella can grow between 20°C and 45°C.

How long do I need to keep legionella records?

Keep records for as long as they remain current and for at least two years afterwards. Records of monitoring inspections, tests and checks should be kept for at least five years.

Is there a legionella risk assessment certificate I need to display?

There is no formal certificate to display. What you need is the written assessment and the records that show your controls are applied. Keep them on file, up to date, and ready to produce during any HSE inspection.

Can I download a legionella risk assessment template and complete it myself?

A legionella risk assessment template may help structure the process, but it does not replace competence or site-specific judgement. For any commercial property with a complex water system, a template alone will not meet your obligations under ACOP L8.

What is the difference between a legionella risk assessment and a water hygiene risk assessment?

A water hygiene risk assessment covers a broader range of waterborne hazards beyond Legionella. In practice, the two are often carried out together by the same specialist, particularly for buildings with cooling towers, spa pools, or other higher-risk water systems. Joblogic's water treatment software is built for contractors who carry out this kind of water hygiene work.