Legionella control rarely fails in a single dramatic moment. It erodes. The site that has “been fine for years” is often the one sitting closest to the edge, because a long, quiet run is exactly the thing that stops people looking hard. Nobody questions a system that has never caused trouble, and that absence of questions is the risk.

Complacency is difficult to spot precisely because it looks like success. The temperatures are logged. The contractor visits. The folder is thick. On paper, control is happening. The uncomfortable question a duty holder should keep asking is whether the paperwork describes a system that is genuinely under control, or just one that nobody has examined closely enough to find the gap.

Why “no news is good news” is the wrong instinct

The default thinking on a settled site is that an absence of incidents proves the controls work. It does not. An unbroken run of clean samples and green readings can mean the regime is sound, or it can mean the conditions never happened to align against you, or that whoever signs off the records stopped reading them some time ago.

Absence of evidence of harm is not evidence of control. Legionella thrives on the conditions complacency creates: water sitting still in a part of the building everyone forgot, a temperature that crept out of range months ago, a flushing task that quietly stopped when the contract changed. None of those announce themselves. They surface in the records only if someone is actually looking, and the whole nature of complacency is that, by definition, nobody is.

So the operating assumption worth adopting is the opposite of the comfortable one: treat any control regime that has run smoothly for a long time as drifting until you can prove otherwise. That sounds pessimistic. It is just realistic about how settled systems behave.

The four drifts: where complacency actually creeps in

Complacency is a vague word, which makes it easy to nod along with and impossible to act on. It is more useful to name the specific ways a working regime decays. In practice there are four, and most quiet failures are one or more of them.

Reading drift

Readings are recorded but no longer read. The number goes in the logbook; nobody compares it to the acceptable range; nobody acts when it strays. The monitoring still happens, it has just stopped meaning anything. This is the most common drift because it is invisible: the task gets ticked, so it looks done.

Scope drift

The building changed and the assessment did not. A wing was mothballed, a new shower block went in, a tenant moved out and occupancy halved, an outlet was capped but the dead leg behind it was left in place. Each change alters the real risk picture, yet the assessment still describes the building as it was. HSE guidance is clear that the risk assessment must be reviewed when there is reason to believe it is no longer valid, including changes to the system or its use [1].

Ownership drift

The person who genuinely understood the system left, and the role passed by email rather than by handover. The new responsible person inherits a folder, not the reasoning behind it. They can see that an outlet is flushed weekly; they cannot say why, what result would worry them, or who to escalate to. Responsibility on paper without understanding in practice is its own hazard, and unclear duties are a well-trodden route to failure (see Communication gaps).

Evidence drift

Tasks are marked complete without proof they happened. “Ditto” entries run down a column. Last month’s temperatures reappear suspiciously unchanged. Sometimes this is honest shorthand under time pressure; sometimes it is a sign the work stopped and the record-keeping carried on by habit. Either way, the monitoring records no longer demonstrate control. They merely assert it.

What a too-perfect logbook is actually telling you

Here is the part that runs against instinct. Most people assume the dangerous logbook is the messy one, full of gaps, missed weeks and scribbled corrections. Often the more worrying one is the immaculate logbook: identical temperatures week after week, never an out-of-range entry, never an exception, never a remedial action.

Real water systems wobble. Cold supplies warm up in a heatwave; a calorifier underperforms after a busy morning; an outlet on a long run reads low until it has been drawn off. A monitoring record that shows none of that variation, ever, is not describing a perfectly controlled system. It usually describes one where the readings are being copied, estimated, or taken in the same convenient spot at the same convenient time, or simply not taken at all. The smoothness is the warning sign.

This is the thing a generic compliance post leaves out: when you review records, the occasional out-of-range reading followed by a recorded action is a sign of health, not of failure. It means someone is genuinely measuring and genuinely responding. A flawless run deserves more scrutiny, not less. Variation, caught and dealt with, is what real control looks like on paper.

Putting the framework to work

You do not need a new system to apply this. You need to point existing management review at the four drifts and ask awkward questions of your own evidence.

  • Pull a handful of recent readings and ask what happened to any that fell out of range. If you cannot find a single out-of-range reading across months, ask why not (reading drift, evidence drift).
  • Walk the building against the asset list in the risk assessment and check it still matches reality: new outlets, capped pipes, changed occupancy, decommissioned plant (scope drift).
  • Ask whoever is now named as responsible to explain, without opening the folder, why one specific control exists and what result would make them act (ownership drift).

Treat this as a deliberate piece of duty holder oversight, not a contractor visit. The contractor performs tasks; the duty holder’s job is the review that confirms those tasks still add up to control. Monitoring and sampling frequencies follow the risk assessment rather than a fixed calendar [2], so part of the review is checking the schedule still fits the building you have today, not the one you had when the assessment was written. If cost pressure is quietly thinning the regime, that is its own failure mode worth naming early (see Cutting corners).

Where this framework stops

The four drifts are a lens for spotting decay, not a control scheme in their own right. They will not tell you what temperature is acceptable at a given outlet, how often to monitor, or what remedial action a result should trigger; those come from a competent, site-specific risk assessment applied through L8 [3] and HSG274 [4]. This is general guidance, not legal, engineering or medical advice. And there is a neat trap to avoid: running the complacency check once, filing it and feeling reassured is simply complacency in a more sophisticated form. The whole point of the lens is that you keep looking through it.

FAQ

Isn’t a long run of clean Legionella samples a good sign?

It is reassuring, but it is not proof the system is controlled. A clean sample describes one outlet at one moment, and a long unbroken run can reflect favourable conditions or shallow sampling as readily as genuine control. Treat it as one piece of evidence alongside temperatures, stagnation control, cleanliness and a current assessment, not a reason to ease off.

How do we tell genuine control from complacency on a settled site?

Look at how the system handles exceptions. A regime under real control produces occasional out-of-range readings followed by recorded actions, an asset list that matches the building, and a responsible person who can explain the reasoning rather than just point at the folder. Flawless records with no variation, vague ownership, or a risk assessment that predates obvious building changes are the cues to dig deeper.

How often should we actively check for complacency?

Build it into scheduled management review and trigger an extra look after anything that disturbs the status quo: a change of contractor, a new responsible person, building work, or a shift in how the premises are used. The risk assessment sets the formal review timing; the complacency check is the informal habit that keeps the formal process honest.

Sources

[1] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [2] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [3] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [4] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm