---
title: "Case study: a model Legionella control programme"
source_url: https://legionella.io/articles/case-study-a-model-legionella-control-programme/
canonical_url: https://legionella.io/articles/case-study-a-model-legionella-control-programme/
pillar: "Best Practice & Future of Legionella Control"
summary: "A composite UK case study: what turns a compliant-on-paper Legionella programme into a resilient one. Named ownership, recorded reasoning, drift caught early."
primary_keyword: "model programme case study"
date_published: 2026-01-08
date_reviewed: 2026-06-26
author: "Legionella.io editorial team (REMOTE TECH LTD)"
reviewed_against: "HSE L8 and HSG274 guidance"
region: "United Kingdom"
license: "(c) REMOTE TECH LTD. Quote freely with attribution and a link to source_url."
---

# Case study: a model Legionella control programme

Ask two estates teams to show you their Legionella records and you can usually tell within ten minutes which one is actually in control. Both have a risk assessment, a written scheme, a logbook full of temperatures. The difference is rarely the paperwork. It is whether anyone can explain why each control exists, what result is acceptable, and what happens the day a result drifts.

A model programme is a governance story, not a sampling story. What follows is a model-programme case study: a composite drawn from common UK estates situations, not a real named site or incident. The point of the composite is the chain of decisions, because that chain is what transfers to your building.

## Where it started: compliant, and fragile

Picture a mid-sized university estate. Halls that empty for the long vacation. A sports centre with banks of showers and a small pool. Catering kitchens, and a scatter of older science buildings with pipework nobody has fully mapped since the 1980s.

On paper, it was compliant. Risk assessments existed. A contractor visited on a schedule. The logbook was rarely blank. It was also fragile, in the way "compliant on paper" usually is.

Temperatures were recorded but not read: people checked that the box was filled, not what the trend was doing. Empty halls were flushed, but late — every time the campus reopened. When a sample came back with a count higher than expected, an email went round, someone re-sampled, the second result was fine, and the file closed. No decision was written down, and nobody asked why the first count had happened. The L8 and HSG274 framework was all there in name [1][2]; what was missing was anyone using it to think.

## The pattern nobody had joined up

The change began when a new responsible person did something unglamorous. Instead of signing the records off page by page, they read three months of them end to end.

Three signals lined up, none dramatic on its own. The same low-use wing was flushed late after every vacation. The pool-plant readings clustered right at the edge of their limits in August, when the building was quietest. And two of the previous year's "one-off" high sample results had come from the same dead-leg-heavy corridor. Each had been closed as a blip. Read together, they described a predictable management gap: the programme handled normal weeks and quietly struggled during quiet ones — exactly when stagnation risk climbs.

The fix was not another reminder email. It was a defined reduced-occupancy mode for the estate: a vacation task list with named cover, a restart inspection before any building reopened, and a standing instruction that the dead-leg corridor was dealt with before the next sampling round, not explained away after it.

## The decisions that made it a model

Four choices did most of the work. None of them was a new technology or a bigger sampling budget.

**They gave it an owner with a name.** A small water safety group met quarterly — estates, health and safety, a catering representative, and the external consultant — with one named responsible person accountable between meetings. This is the structure a water safety plan assumes: a defined team that owns the system in the sense BS 8680 sets out [4], and that WHO describes for water safety in buildings — a plan owned by people, not a folder owned by nobody [6]. If you have not formalised this yet, [Developing a comprehensive Water Safety Plan](https://legionella.io/articles/developing-a-comprehensive-water-safety-plan/) covers how the plan and the group fit together.

**They recorded the decision, not just the task.** A logbook line that says "43°C, initialled" proves a reading was taken. It does not prove anyone judged it. The model version reads more like: "Outlet flushed weekly because use is intermittent; missed flushes escalate to the responsible person; three misses trigger a use-pattern review." That single habit turns a compliance record into evidence of management — and it is what a useful [logbook](https://legionella.io/articles/legionella-logbooks-an-introduction-to-record-keeping/) should actually contain.

**They built a loop that caught drift.** Someone reviewed trends rather than boxes, and there were written thresholds for when a control was escalated. This is the difference CDC draws when it frames a water management programme — monitor, verify, act, review — as the primary strategy for controlling Legionella growth, rather than a set of disconnected tasks [5]. That link from operational evidence to action is also what a public health investigation depends on if a case is ever suspected [8].

**They treated the contractor as a supplier to challenge.** Outsourcing the work never outsourced the duty; the duty holder stays accountable for control whoever holds the hose [3]. So they asked the consultant to justify recommendations, checked them against the risk assessment, and used the Legionella Control Association's expectations of a competent service provider as the benchmark [7]. The good contractors welcomed the scrutiny.

## What transfers to your site

You do not need a university estate for any of this to apply. Strip it back and the model is portable: name the owner, write down the reasoning behind each control, review trends rather than tick-boxes, and design explicitly for your quiet periods, because that is when most systems fail.

The most useful first move is also the cheapest. Take your last three months of records and read them as a story, not a stack. Look for the signal that only appears when you line entries up — the outlet always flushed late, the reading always near the edge in one season, the "blip" that keeps recurring in the same place. That read-through is how a maturing programme finds the gap before an outbreak does.

## One caveat before you copy it

This is an illustrative composite, and a tidy governance model is still only as good as the competent, site-specific judgement behind it. Nothing here sets a temperature, a flushing interval, a sample limit or a remedial trigger for your building — those come from your own risk assessment and the people qualified to own it. Sampling can verify control or investigate a problem, but how often you sample follows the system and the risk assessment, not a calendar borrowed from someone else's case study [9]. Use the decisions above to organise judgement, not to replace it.

## FAQ

### What separates a model programme from one that just passes an audit?
An audit confirms that controls exist and records are present. A model programme can also show the reasoning behind each control and prove the organisation acts when evidence drifts. Same paperwork, very different resilience.

### Who should sit on a water safety group?
Enough authority and knowledge to actually decide: typically estates or facilities, health and safety, anyone running higher-risk assets such as catering or a pool, and competent external support — with one named responsible person accountable between meetings. Clear ownership matters more than the size of the group.

### How do we know the programme is improving and not just busy?
Track whether problems are caught earlier and closed with a recorded decision, not whether more tasks are logged. A maturing programme tends to do fewer reactive things and more anticipatory ones: designing for quiet periods, retiring dead legs, and acting on trends before a sample forces the issue.

## Related reading

- [Developing a comprehensive water safety plan](https://legionella.io/articles/developing-a-comprehensive-water-safety-plan/)
- [Legionella control in smart buildings](https://legionella.io/articles/legionella-control-in-smart-buildings/)
- [Long-term vision: can we eradicate Legionnaires' disease?](https://legionella.io/articles/long-term-vision-can-we-eradicate-legionnaires-disease/)
- [The next decade of Legionella control technology and policy](https://legionella.io/articles/the-next-decade-of-legionella-control-technology-and-policy/)

## Sources

[1] HSE, "Legionnaires' disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)". https://www.hse.gov.uk/pubns/books/l8.htm
[2] HSE, "Legionnaires' disease: Technical guidance (HSG274)". https://www.hse.gov.uk/pubns/books/hsg274.htm
[3] HSE, "Legionnaires' disease - what you must do". https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm
[4] BSI, "BS 8680:2020 - Water quality. Water safety plans. Code of practice". https://knowledge.bsigroup.com/products/water-quality-water-safety-plans-code-of-practice
[5] CDC, "Controlling Legionella". https://www.cdc.gov/control-legionella/index.html
[6] WHO, "Water safety in buildings". https://iris.who.int/server/api/core/bitstreams/2c302ce4-bca9-42bc-97b4-ddbe95f0c7f2/content
[7] Legionella Control Association, "Code of Conduct for Service Providers". https://www.legionellacontrol.org.uk/
[8] UKHSA, "Investigation of Legionnaires' disease: cases, clusters and outbreaks". https://www.gov.uk/government/publications/investigation-of-legionnaires-disease-cases-clusters-and-outbreaks
[9] HSE, "Testing and monitoring your water system for legionella". https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm