A CQC inspector will not crawl under your calorifier with a thermometer. They inspect your evidence. So the question that decides a care home’s Legionella outcome at inspection is not “is the water safe?” but “can you prove, on paper, that you knew the risk and controlled it?”

That distinction matters because the Care Quality Commission does not run a separate Legionella regime. It folds water safety into the regulated-activities framework — broadly Regulation 12 (safe care and treatment) and Regulation 15 (premises and equipment) — and tests whether a provider has identified and mitigated foreseeable risks to people who use the service [Verify against CQC]. Legionella is one of those foreseeable risks. The underlying technical duty still comes from HSE: a suitable and sufficient risk assessment, a written scheme of control, monitoring, and a competent person to own it [1][2].

The core principle, then: CQC checks whether your existing HSE water-safety duties have produced records an inspector can read and trust. Get the HSE side right and document it well, and the CQC side largely follows.

What an inspector is really testing

Three things, in order. First, that you understand your risk — meaning a current, site-specific Legionella risk assessment exists and reflects the building as it is today. Second, that you are doing something about it — a written scheme with named controls and dated records showing they happen. Third, that when something goes wrong, you notice and act.

Care homes sit at the sharp end of this. Residents are disproportionately the people most likely to develop severe Legionnaires’ disease — older adults, smokers, and those with weakened immunity or existing lung conditions [3]. Add stored hot and cold water, long pipe runs to far en-suites, low-use rooms during voids, and showers that aerosolise — exactly the conditions HSE flags as creating foreseeable risk [4] — and you have a setting where an inspector expects the paperwork to be live, not a binder last opened two years ago.

How it plays out across realistic situations

The current risk assessment. This is the document everything hangs from. An inspector wants to see it is specific to your premises, signed and dated, and reviewed when things change — commonly on a roughly two-yearly cycle, or sooner after a refurbishment, a change of use, or new evidence such as a positive sample [Verify against HSE]. A generic template with another home’s address in the footer is the fastest way to lose credibility.

The written scheme, actually running. The risk assessment names the controls; the scheme proves they happen. Hot water stored at around 60C and distributed so it reaches outlets hot, cold water held below about 20C, sentinel temperature checks often run monthly, plus showerhead descaling and flushing of little-used outlets [1][2][Verify against HSE]. What turns this from intention into evidence is the log: dates, readings, initials, and out-of-range results that were chased down. Gaps in the log are where inspections come unstuck — not because the water was unsafe, but because nobody can show it was safe.

Closing the loop. A reading of 48C at a sentinel tap is not a failure. Recording it, raising a remedial action, and never closing it out is. Inspectors look for the trail from finding to fix: who was told, what was done, when it was verified clear. For a home delivering nursing or clinical care, where HTM 04-01 expectations may also bear on how water safety is governed, that loop wants to be visibly managed through a water safety group rather than left to one busy maintenance lead [5].

Competence and contractors. You can outsource the work but not the duty. Name your responsible person, and keep the evidence that whoever samples or services your systems is genuinely competent — membership of a recognised scheme and a clear service-provider record helps here [6]. An inspector reasonably asks: who holds this, and how do you know they are any good?

For the broader scald-versus-control balance unique to frail residents, see Legionella management in care homes and assisted living; for nursing settings, Legionella in healthcare: HTM 04-01 and NHS guidance sets the higher bar.

The field checklist: assemble this before they arrive

Group your evidence so a stranger can follow it in ten minutes. Pull each item into one place, recordable and dated.

  • Assessment — current Legionella risk assessment, site-specific, signed, with its last review date and the schematic or asset list it references.
  • Scheme — written scheme of control naming each system, the control method, and the monitoring frequency.
  • Temperature records — sentinel hot and cold readings, calorifier checks, with out-of-range entries shown as actioned.
  • Routine tasks — flushing logs for low-use and void rooms, showerhead and TMV cleaning/descaling, tank inspections.
  • Remedials — open and closed action log linking each finding to its fix and verification.
  • Sampling — any Legionella sample results and the rationale for sampling (or for not sampling).
  • People — named responsible person, deputy, and contractor competence evidence.
  • Governance — meeting notes or water safety group minutes for clinical/nursing homes.
  • Policy — your water safety policy and how staff report a fault.

The items people skip are the boring ones that prove continuity: the void-room flushing record, and the closed-out remedials. Those are exactly where an inspector probes.

The trade-off worth naming

In my view, the real failure mode is not a non-compliant system but a non-evidenced one. Plenty of homes control Legionella perfectly well and still struggle at inspection because the proof lives in three places — a wall clipboard, a contractor’s PDF, and someone’s memory. The pragmatic call is to stop treating records as an afterthought. A single, time-stamped log where every check, exception and fix is captured as it happens is what converts “we do this” into “here, read it.”

A caveat that matters here: a tidy folder is not the same as a controlled system, and no checklist replaces the judgement of a competent person assessing your specific building. Use this to organise evidence, not to self-certify safety — the risk assessment, applied to your premises, remains the document that decides what you actually need to do.

FAQ

Does CQC issue Legionella certificates or set the temperatures?

No. CQC does not certify water systems or publish Legionella temperature limits. The control parameters come from HSE’s ACoP L8 and HSG274, applied through your risk assessment [1][2]. CQC assesses whether you have met that duty and can evidence it [Verify against CQC].

What if our last risk assessment is over two years old?

Age alone is not automatically a breach, but it invites the question of whether it still reflects the building. If you have refurbished, changed occupancy patterns, or had a positive sample since, treat it as overdue and commission a review before the inspection rather than after [Verify against HSE].

Who is the responsible person an inspector will ask for?

The named individual with day-to-day responsibility for managing Legionella risk and the records — your duty holder’s appointee. It should be a real person with the competence and authority to act, not a job title with nobody behind it [1].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - ACoP and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] NHS, “Legionnaires’ disease”. https://www.nhs.uk/conditions/legionnaires-disease/ [4] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [5] NHS England, “Health Technical Memorandum 04-01: Safe water in healthcare premises”. https://www.england.nhs.uk/publication/safe-water-in-healthcare-premises-htm-04-01/ [6] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/