The risk assessment is finished. It is thorough, it is correctly worded, and it is sitting in a shared drive that three people can find. Six months later the same defects are still open, because being right on paper and getting a building to act are two different jobs.

Most Legionella control that fails does not fail at the science. It fails at the sentence. A finding nobody understood, nobody owned, or nobody funded is a finding that did no work. So the skill worth building is not writing a better report. It is turning what the report found into something each stakeholder can actually act on.

That is a communication problem, and it has a structure.

Why forwarding the report changes nothing

The default move is to email the PDF, or to drop a red-amber-green register in front of a board and assume the colours speak for themselves. They do not. A director reading “Outlet 47, sentinel TMV, elevated rating, remedial recommended” has no idea whether that means a dripping tap or a closed wing. Hand the same document to a maintenance supervisor and you have given them a sixty-page reference work when what they needed was a job list. Both readers are technically informed and practically stuck.

Risk assessment carries weight here: under the Approved Code of Practice (L8), assessing the risk and reviewing your control measures is a legal expectation, not an optional survey [1]. But the law tells you to assess and control. It does not tell you how to make the findings land. A register describes the hazard accurately and rarely asks anyone for a decision. Accurate is not the same as communicated.

Write four lines for every finding

The rule I would argue for is blunt: stop communicating findings and start communicating decisions. For each thing the assessment flags, write four short lines in plain words.

  • Who is exposed, and when. Not “Outlet 47, elevated score” but “the rarely-used shower in the basement changing room throws a fine spray over whoever turns it on next.”
  • What is actually wrong, and whether it is broken now or weak underneath. Separate the immediate defect (a dead leg behind a capped-off sink) from the management gap (nobody owns the flushing rota that would have caught it). The two need different fixes and usually different audiences.
  • Who owns the fix, and by when. Every finding gets a named owner and a date. A finding with no owner is a finding that will still be open at the next review.
  • What proof will show it is controlled. The temperature reading, the flushing record, the photo of the removed pipe. Name the evidence that lets you close the item with confidence.

Exposure, fault, owner, proof. This is not more work than a good register; it is the same information arranged around the decision instead of around the asset. Presenting risk assessment findings this way also forces a useful discipline: if you cannot write the four lines for an item, you do not yet understand it well enough to ask anyone to act.

Same four lines, different altitude

The four lines scale up and down depending on who is reading.

Senior management want the realistic worst case, an honest read on how close the system is to controlled, and the specific decision they have to make, which is usually money or a priority call. Give them one page. Reporting Legionella risk to the board buried under fifty pages of TMV schedules earns a nod and no budget; the cost-versus-risk case belongs here, in their language, and Justifying Legionella control measures: cost vs risk sets out how to frame that.

The responsible person and the maintenance team need the opposite of brevity: the full action list, with owners, dates and acceptance criteria, plus enough of the “why” that nobody quietly skips a task that looks pointless. Occupants — tenants, staff, residents, patients — need almost none of the detail and most of the reassurance: what you are doing to keep the water safe, and the small part they play. Contractors need the scope, the edges of their duty, and a clear line on what comes back to you for a decision.

Same finding, four versions. A message pitched for the board drowns the maintenance team and frightens the tenant.

The catch with putting it clearly in writing

Here is the part the guidance skips. The moment you communicate a Legionella risk clearly, in writing, you have created a record and started a clock. A dated email that plainly states a known hazard is exactly the document an enforcing authority, an insurer or a court would read first if something went wrong.

The instinct that follows is to soften the wording so nothing sounds too definite. That is the wrong lesson, and a dangerous one. A vague warning that lets everyone off the hook is worse than a clear one, because the hazard is still there and now no one is accountable for it. The right lesson is narrower: never communicate a risk without communicating the decision and the date beside it. “We found X, here is who is fixing it and by when” is a managed risk on the record. “We found X” on its own is a documented, unaddressed hazard with your name attached — and that accountability sits with the duty holder, not the contractor you forwarded it to [2]. Where that can land on a named individual is the subject of Personal liability: can individuals be prosecuted for Legionella failures?.

So clarity is not the danger. Clarity without a funded, dated action is.

Where this approach stops helping

A clean brief cannot rescue a thin assessment. If the survey missed a dead leg, no amount of elegant framing will flag it; the four lines only work on findings you actually have. The competent, site-specific assessment underneath them still does the real work — describing the system, identifying where the bacteria could grow and who could be exposed, and setting the precautions, much as BS 8580-1 sets out [3]. Persuasion is not control.

Treat everything above as guidance on how to frame and route information, not as a verdict on what your duties require or what counts as adequate control. The figures that matter — acceptable temperatures, how often you monitor, which remedials come first — come from that assessment and the people competent to make the call, not from how confident the summary slide looks. A polished one-pager built on a weak survey is just a faster route to being wrong. Resist, too, the urge to imply more certainty than you hold: a negative sample describes the conditions sampled, but it does not prove the system is safe, and the HSE is clear that how often you test should follow the system and the risk assessment rather than a fixed calendar [4].

What to do before your next meeting

Do not rewrite the whole register tonight. Take your most recent risk assessment, pull the three highest-priority findings, and rewrite each one as the four lines — exposure, fault, owner, proof — in language a non-technical director would follow without a glossary. Put those three in front of your next management meeting and ask for a decision and a date on each. If that format lands, you have found the template for everything else in the report.

FAQ

What does a board actually need to see about Legionella risk?

One page, not the full assessment. Give them the realistic worst case in plain terms, an honest read on how close the system is to controlled, and the specific decisions you need from them — usually a budget or a priority call. Tie any spend to the consequence it prevents rather than to the activity it funds, and keep the technical schedules in an appendix for anyone who asks.

How do I explain Legionella risk to tenants or staff without causing alarm?

Lead with what you are already doing to keep the water safe, then give them the one or two actions that genuinely help: running taps and showers after a property or room has stood empty, and reporting any outlet that runs scalding hot or stubbornly lukewarm. Explaining water safety to tenants works best with plain language and no statistics — figures tend to raise anxiety without changing behaviour. Landlords also have specific duties worth being clear about in any tenant-facing note [5].

Should I share the whole risk assessment with everyone?

No. Route the right layer to the right reader: the full assessment to the responsible person and the appointed contractor, the one-page decision brief to the board, the action list to maintenance, and a short plain summary to occupants. Sending the entire document to every audience is not transparency; it is a way to ensure nobody reads the part meant for them.

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [3] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [4] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [5] HSE, “Legionella and landlords’ responsibilities”. https://www.hse.gov.uk/legionnaires/legionella-landlords-responsibilities.htm