A Legionella risk assessment is not a survey of faults. It is the document that decides where your attention, your budget and your monitoring effort go for the next couple of years. BS 8580-1 exists largely because too many assessments read like a neat list of defects and tell the responsible person nothing about what to actually do.

If you are the one turning a thick report into a ranked set of actions, the only question that matters is whether the report gives you the raw material to make those calls. BS 8580-1:2019, the code of practice for Legionella risk assessments, sets out what that raw material should look like [1]. It sits alongside the legal backbone — the Approved Code of Practice and guidance in L8, and the technical detail in HSG274 — rather than replacing either [2][3].

What BS 8580-1 adds on top of L8

L8 tells you that you must assess the risk and review it, and it gives risk assessment ACoP status — which in plain terms means a court can treat a failure to do it properly as evidence against you [2]. What L8 does not do is spell out, line by line, what a competent assessment should contain. That is the gap BS 8580-1 is written to fill.

In practice the standard pushes four things that weak assessments skip:

  • A genuine system description, written from your pipework, not a generic paragraph about hot and cold water.
  • Competence: who carried out the assessment, and the basis on which they were qualified to judge a system like yours.
  • A risk rating that separates the urgent from the merely noted.
  • Named ownership and clear review triggers, so the document keeps working after it is filed.

Miss any one of these and you have a report that looks thorough and changes nothing.

The part of the report you actually want

The centrepiece of a strong assessment is a single annotated schematic with an asset register hanging off it. If you can picture that pairing clearly, you can sketch it yourself and check any report against it.

Start the schematic at the incoming main. Follow the water to the cold water storage tank or tanks, then out through cold distribution. Branch off to hot generation — the calorifier or water heater — and trace both the hot flow and the return loop back. Run the lines all the way to the furthest outlets. Now annotate it: give every tank, heater, pump and significant outlet an asset reference; mark every dead leg, blind end and infrequently used outlet; flag the thermostatic mixing valves; note where temperatures are taken.

The asset register is the “so what” beside that “where”. Each row carries the asset reference, its location, what it is, its condition, when it was last inspected, its individual risk rating, and the action it needs. The schematic shows you the system; the register turns each part of it into a decision.

Here is the test. If you cannot trace a single drop of water from the main to the most remote tap using the drawing in front of you, the assessment has not described your building. It has described a building like yours. That distinction is where real risk hides — see Using water system schematics and asset registers in risk assessments for how to build and maintain those drawings rather than inherit a stale one.

Where assessments quietly fail

Most poor assessments are not wrong so much as inert. A few recurring patterns:

The template tell. Generic wording, the same phrasing you have seen on three other sites, no mention of your actual plant. If the report would read identically for a different building, treat it as a starting point, not a finished assessment. Common issues found in Legionella risk assessments collects the defects that show up most often.

A schematic that is missing, partial or out of date. A drawing that omits the very sections where water sits still — the capped spur, the decommissioned shower, the oversized tank — leaves out the highest-risk parts of the system by definition.

Risk ratings nobody can act on. When every finding comes back “medium”, the rating has done no work. A useful rating forces an order: this first, that next, this one when the budget allows.

No review trigger. Treating the assessment as a fixed two-yearly event is a classic error. It should be reviewed when the assessment itself says so, and sooner after any change to the system, its use, the people exposed, or the control evidence [2].

Competence left blank. If the report does not say who assessed the system and why they were competent to, you cannot defend it later, and neither can they.

Turning findings into ranked actions

Your job is not to admire the report; it is to convert it. Re-sort the findings by exposure and likelihood rather than by the order they appear on the page — a rarely-used shower feeding an occupied floor outranks a cosmetic note on a busy outlet that flushes itself through constant use.

Then push each prioritised finding into the written scheme of control, with an owner, a deadline and a plain description of what “done” looks like. The assessment names the risk; the scheme is where the control actually lives, which is why the two documents have to talk to each other (Documenting a written scheme of control for Legionella compliance covers that hand-off). An action without an owner and a date is a hope, not a control.

What BS 8580-1 is, and what it isn’t

BS 8580-1 is a code of practice, not a statute. Following it does not on its own discharge your legal duty, and departing from it does not automatically put you in breach — but because it is recognised good practice, any departure is something you would have to be able to justify. The figures that govern your site — control temperatures, sampling regimes, review intervals — come from the assessment and the assessor’s reading of your system, not from a number lifted off a template; testing in particular should follow the system and the risk assessment rather than a fixed calendar [4]. And a report that follows the standard’s structure to the letter but was produced by someone who never understood your pipework is a compliance ornament. Run any specifics through a competent, site-specific assessment before you act on them.

FAQ

The legal duty is to assess and control the risk under health and safety law, and L8 gives that duty ACoP status [2]. BS 8580-1 is not itself a law; it is the code of practice describing how to carry out the assessment well [1]. Following it is the practical way to show your assessment was competent if anyone ever asks.

How is BS 8580-1 different from ACoP L8 and HSG274?

L8 sets the legal expectation and HSG274 carries the technical control detail [2][3]. BS 8580-1 concentrates on the assessment itself — how to scope it, what to record, and how to rate the risk [1]. They are complementary references, not alternatives, and a good assessor uses all three.

How detailed does the water system schematic need to be?

Detailed enough to trace water from the incoming main to every outlet, with storage, hot generation, return loops, dead legs and infrequently used outlets all marked and referenced. A drawing that leaves out the spots where water stagnates is the part of the assessment most likely to let you down.

What to do next

Open your current assessment and run it past the four points above: a real system description, recorded competence, an actionable risk rating, and a review trigger. Then take the single highest-risk finding it contains, give it an owner and a date today, and write it into your scheme of control. That one move does more for control than re-reading the whole report.

Sources

[1] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [2] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [3] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [4] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm