---
title: "BS 8680 water safety plans: turning controls into a management system"
source_url: https://legionella.io/articles/bs-8680-water-safety-plans-turning-controls-into-a-management-system/
canonical_url: https://legionella.io/articles/bs-8680-water-safety-plans-turning-controls-into-a-management-system/
pillar: "Best Practice & Future of Legionella Control"
summary: "Your Legionella controls already work. BS 8680 turns them into a management system: ownership, control limits, escalation and review that hold up under audit."
primary_keyword: "BS 8680 water safety plan"
date_published: 2025-11-29
date_reviewed: 2026-06-26
author: "Legionella.io editorial team (REMOTE TECH LTD)"
reviewed_against: "HSE L8 and HSG274 guidance"
region: "United Kingdom"
license: "(c) REMOTE TECH LTD. Quote freely with attribution and a link to source_url."
---

# BS 8680 water safety plans: turning controls into a management system

Most buildings that struggle in a Legionella audit are not failing on the controls themselves. The hot water is roughly hot, the low-use outlets get flushed, the tanks get cleaned. What gives way is the layer above the tasks — the part that names who owns the outcome, says what happens the day a temperature reading drifts out of range, and shows that someone with authority actually read the evidence. A water safety plan is that layer.

BS 8680 is the British Standard code of practice for building water safety plans [1]. It does not replace the law. The duty to control Legionella still runs through the HSE's Approved Code of Practice, L8, and the technical detail in HSG274 [2][3]. What BS 8680 does — building on the water safety plan approach the World Health Organization set out for buildings [4] — is take the controls you are already required to run and wrap them in a management system: ownership, control limits, escalation, verification and review, with records that prove each one.

For a duty holder moving past minimum compliance, that distinction is the whole job. You are not bolting on tasks; you are adding the structure that lets the existing ones survive a staff change and an inspector's questions.

## The shift: from a pile of tasks to a managed loop

A typical Legionella regime is a list. Risk assessment in a folder, a written scheme of control, a monitoring schedule, a stack of temperature readings, a contractor who turns up. Each item is fine on its own. The weakness is that nothing connects them, so when a reading comes back wrong it lands in a logbook and stops there.

A water safety plan turns that list into a loop. The same controls now sit inside a cycle that describes the system, sets what "in control" looks like for each part, watches it, checks that the watching is honest, and feeds what it learns back into the assessment. The CDC frames the same idea as a water management programme — a continuous, owned process rather than a periodic survey [5]. It bolts straight onto the L8 duties you already hold.

## What the plan adds that a risk assessment alone does not

A good Legionella risk assessment tells you where the danger is — a snapshot, reviewed when something changes. The water safety plan runs between those reviews, and three additions do most of the work.

First, named ownership with teeth: not "the FM team" in the abstract, but a person who can authorise spend, take a system out of use, and explain the evidence when asked. On larger or higher-risk estates this is formalised as a water safety group — a small standing team that meets, reviews and decides rather than a name on a policy. [Forming a Water Safety Group: roles and benefits](https://legionella.io/articles/forming-a-water-safety-group-roles-and-benefits/) covers how to assemble one without it becoming a talking shop.

Second, control limits with a pre-agreed response. The plan states, for each control, the value that means "running normally", the value that triggers a correction, and who gets told when it does. A sentinel outlet running cool stops being a note for next quarter and becomes a defined action with a name attached.

Third, verification kept separate from the doing. The person who flushes the outlets should not be the only one confirming that flushing works. The plan builds in an independent check — audit, inspection, and sampling where the risk assessment justifies it [3] — so the system catches its own drift.

## Sketch the plan before you write the document

The fastest way to find the holes is to draw the system on one sheet of A4 before you write a word of policy. Put the physical water system in the centre — source and cold storage, hot generation and distribution, the outlets, and the controls you already run on them. That centre is your current regime; it does not change.

Now draw a ring of four stations around it, joined by arrows into a clockwise loop:

- **Describe and assess** — the asset register, the schematic, and the current risk assessment to BS 8580-1 [6].
- **Control and monitor** — the written scheme of control, each control limit, the monitoring task, and the name against it.
- **Verify** — the independent checks that confirm the controls are real: audit, inspection, sampling where justified.
- **Review and improve** — the water safety group reads the evidence, captures lessons and updates the plan.

Then add the person. Put the responsible owner in the middle, with a line to every station — accountable for all four, not just the doing.

Finally, draw the two arrows that prove the system is alive. One is the escalation arrow: a breach at "monitor" jumps straight to the owner, not the long way round through the next scheduled review. The other is the learning arrow: "review and improve" feeds back into "describe and assess", so a near-miss this month changes the assessment next month.

Any station with no name against it, any control with no defined limit, any breach with no escalation arrow — that blank is your real risk. A glossy policy can hide a gap for years. This drawing cannot.

## Where these plans actually fail

The classic failure is a beautiful document nobody runs. A consultant delivers a thick water safety plan, it goes in the same folder as the risk assessment, and the building keeps running on habit. The plan exists; the system does not.

The second failure is control limits set to be passed rather than to mean something — a temperature band so wide that nothing ever breaches it, so the escalation arrow never fires and the group has nothing to review. A limit that never triggers a response is decoration.

The third is verification done by the same people who do the work, signing off their own homework. Without an independent check, the plan records what should be happening, not what is.

## Right-sizing it for your building

A water safety plan should be proportionate to the system and the people exposed [2]. A small office with a couple of taps and a point-of-use heater needs a clear owner, a sensible written scheme and honest records — not a standing committee. A hospital, a care home, or a multi-site estate with cooling towers or spa systems needs the full governance, because consequences and complexity both scale up. The trap is copying a healthcare-grade plan onto a corner shop, or running a hospital on a landlord's checklist; let a competent, site-specific assessment — not a template — decide where you sit.

## What a water safety plan can't do for you

A plan organises your duties — it is not a new set of them, and not a defence on its own. The legal obligation to control Legionella sits in the L8 Approved Code of Practice and the wider health-and-safety framework; BS 8680 is best practice that helps you meet it in an auditable way [1][2]. The control limits, frequencies and corrective actions sketched above show how a plan is built; the real figures for your building come from your risk assessment, and a thick document nobody runs changes nothing in the plant room.

## Where to start this week

You do not need to commission a new document to begin. Take one control — the cold-water sentinel, say — and trace it round the loop: who owns it, what reading means "act", what happened the last time it was missed, and where that decision is recorded. The first blank you hit is your first job. Do that for three controls and within an hour you will know whether you have a management system or a folder. If you are still weighing whether a formal plan is warranted for your site at all, [Water Safety Plans: best practice vs legal requirement](https://legionella.io/articles/water-safety-plans-best-practice-vs-legal-requirement/) separates the best-practice case from the legal duty.

## FAQ

### Is a water safety plan a legal requirement in the UK?
The legal duty is to control the risk, set out in the L8 Approved Code of Practice and supporting HSE guidance [2][3]. A formal BS 8680 water safety plan is recognised best practice rather than a standalone legal requirement, but in complex or higher-risk premises it is increasingly the expected way to show you are meeting that duty.

### How is a water safety plan different from a Legionella risk assessment?
The risk assessment identifies where the risk is and is reviewed periodically. The water safety plan is the management system that runs continuously between reviews — ownership, control limits, monitoring, verification and the feedback loop that pushes lessons back into the assessment [1].

### Does a small building need a full BS 8680 plan?
Proportionality is the rule [2]. A small, low-risk system needs a clear owner, a written scheme and honest records, not a committee. The full governance structure earns its place in larger, multi-site or higher-risk estates.

## Related reading

- [Developing a comprehensive water safety plan](https://legionella.io/articles/developing-a-comprehensive-water-safety-plan/)
- [Forming a water safety group: roles and benefits](https://legionella.io/articles/forming-a-water-safety-group-roles-and-benefits/)
- [Continuous improvement: auditing your Legionella controls](https://legionella.io/articles/continuous-improvement-auditing-your-legionella-controls/)
- [Water safety plans: best practice vs legal requirement](https://legionella.io/articles/water-safety-plans-best-practice-vs-legal-requirement/)

## Sources

[1] BSI, "BS 8680:2020 - Water quality. Water safety plans. Code of practice". https://knowledge.bsigroup.com/products/water-quality-water-safety-plans-code-of-practice
[2] HSE, "Legionnaires' disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)". https://www.hse.gov.uk/pubns/books/l8.htm
[3] HSE, "Legionnaires' disease: Technical guidance (HSG274)". https://www.hse.gov.uk/pubns/books/hsg274.htm
[4] WHO, "Water safety in buildings". https://iris.who.int/server/api/core/bitstreams/2c302ce4-bca9-42bc-97b4-ddbe95f0c7f2/content
[5] CDC, "Controlling Legionella". https://www.cdc.gov/control-legionella/index.html
[6] BSI, "BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice". https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1