Most Legionella risk assessments go wrong in the same handful of ways. The assessor rarely misses some exotic hazard. Far more often the report describes a building that has since changed, lists controls that nobody owns, or buries the three findings that matter under thirty that don’t.

A risk assessment is supposed to be the document that tells you what to do next. When it doesn’t, that is the real defect — bigger than any single dead leg it might have recorded. L8 treats the assessment and the review of your control measures as a legal duty, not an optional survey [1], and BS 8580-1 sets out what a competent one should actually contain [2]. The gap between those expectations and what lands on a duty holder’s desk is where the recurring problems live.

What follows is the set that keeps turning up: what each fault looks like on the page, why it happens, and how to fix it. Read your own assessment against the list and you will usually find at least two.

The report describes a building that no longer exists

What it looks like: the schematic shows a plant room that was stripped out in a refurbishment, the new shower block in the extension isn’t mentioned, or a floor that became a gym is still labelled as offices. The document is tidy and completely out of date.

Why it happens: the assessment got filed and forgotten, and nobody told the assessor that building work had taken place. Reviews are treated as a calendar event rather than a response to change.

The fix: treat material change as a review trigger in its own right. A refurbishment, new outlets, a change in who uses the building, or a long shutdown should each prompt a look at the assessment, not wait for the next scheduled visit [1][3]. When to review your Legionella risk assessment under UK guidance sets out the triggers in detail.

It is a template with someone else’s building in it

What it looks like: generic wording, occasionally the wrong site address left in a header, controls that don’t match your plant, and no photographs or schematic drawn from an actual walk-round. The dead giveaway is a “survey” the assessor could have written without leaving the car park.

Why it happens: cheap desktop assessments sold as the real thing, or an assessor who ticked boxes without opening the cupboards and feeling whether the cold tank was genuinely cold.

The fix: an assessment that isn’t grounded in a physical survey of your system isn’t worth filing. BS 8580-1: what a good Legionella risk assessment should include walks through what BS 8580-1 expects a competent assessment to cover [2]; if your report is missing most of it, that is your headline finding.

There is no asset register or schematic you can use

What it looks like: no clear list of tanks, calorifiers, TMVs and outlets, no up-to-date schematic, and no identification of dead legs or blind ends. The report discusses risk in the abstract without ever pinning it to a specific bit of pipework.

Why it happens: mapping a system properly is slow, unglamorous work, and it is the first thing that gets skipped under time pressure.

The fix: you cannot control what you have not mapped. The asset register and schematic are the spine of everything else — flushing schedules, temperature monitoring points and any sampling regime all hang off them. Dead legs and little-used outlets are among the conditions most likely to let bacteria multiply [4], so an assessment that never locates them has left the main job undone.

The findings are a list, not a ranked plan

What it looks like: thirty observations, no priorities, no named owners, no target dates. A redundant pipe feeding a rarely-used shower sits in the same flat list as a missing signature on a logbook.

Why it happens: the assessor’s job felt complete at “here are the issues”, and translating findings into decisions was quietly left to the reader.

The fix: every finding needs a risk ranking, an owner and a date. Separate an immediate hazard from a paperwork gap so that finance funds the genuine exposure first rather than the cheapest items on the list. A report that doesn’t help you decide what to do on Monday hasn’t finished the work.

Recommendations get raised and never closed

What it looks like: this year’s report repeats last year’s actions almost word for word. The same dead leg, the same descaling job, the same outstanding training — carried forward indefinitely.

Why it happens: the actions live inside a PDF that nobody revisits between annual visits, with no tracking and no evidence of close-out.

The fix: lift the actions out of the report and into a live log, each with a date and proof it was done. To an enforcing officer, an action you cannot show you closed is an action you didn’t [5]. Closing the loop is also the cheapest way to demonstrate that your control measures are actually being managed.

A clean sample is treated as a clean bill of health

What it looks like: “samples negative” used to justify relaxing temperature checks or standing down flushing. The number on the certificate quietly becomes the whole control strategy.

Why it happens: a lab result feels like hard proof in a way that a flushing record never quite does.

The fix: a sample describes the outlets tested at one moment, nothing more. It does not replace control of temperature, stagnation and cleanliness. HSE is clear that testing and monitoring frequency should follow the system and the risk assessment, rather than the assessment being shaped to fit a sampling result [6]. Use sampling to verify or investigate, not to excuse skipping the basics.

If you only change one habit

Turn the assessment’s findings into a live, owned action log on the day the report arrives. The survey finds the risk; the written scheme of control and the action log are what actually control it day to day. A polished assessment that changes nothing on site is the most common issue of all, and it is the one entirely within your gift to fix.

A practical first move this week: pull your current risk assessment and check three things. Is the schematic still accurate? Does every open finding have a name and a date against it? Can you produce close-out evidence for last year’s actions? Any “no” is your starting point. If the schematic itself is wrong, start there — Reviewing and updating your Legionella risk assessment regularly covers keeping the document current.

Reading your assessment without over-reaching

Use this as a way to read your assessment critically, not to mark it yourself. Whether a particular control is adequate for your building is a competent person’s judgement, made against your specific system and the people it serves. Acceptable temperatures, monitoring intervals and remedial priorities all sit inside that judgement, and any figure in published guidance is a starting point for it rather than a substitute. If a review turns up something you genuinely can’t resolve, that uncertainty is itself a finding worth raising with your assessor.

Common questions

Is an out-of-date Legionella risk assessment still valid?

There is no certificate that simply expires, but an assessment that no longer reflects your system has stopped doing its job. If the building, its use, the people exposed or the control evidence have changed and the assessment hasn’t caught up, it should be reviewed and updated rather than relied on [1][3].

What is the difference between the risk assessment and the written scheme of control?

The risk assessment identifies where Legionella could grow or spread and who could be exposed. The written scheme of control says how you will manage that risk in practice — the tasks, who does them, how often and to what standard. One finds the problem; the other is how you control it. Plenty of assessments produce the first and never trigger the second.

Who is responsible for acting on the issues a risk assessment finds?

The duty holder and the responsible person carry that responsibility, including oversight of the work and the records that prove it. Bringing in a contractor or assessor spreads the workload but does not move the accountability [5].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [3] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [4] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [5] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [6] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm