A monitoring plan is not a form your contractor hands over. It is your risk assessment turned into a schedule: the checks this building actually needs, on the assets it actually has, at a frequency the risk justifies — with a written limit for every result and a named action when a result falls outside it.

The word doing the work is “site-specific”. A schedule copied from another property will tell you to check sentinel temperatures monthly and flush low-use outlets weekly. What it cannot tell you is which points on your floor plan are the sentinels, which store-cupboard taps genuinely sit idle, or what counts as a pass on the long run feeding the top floor. That mapping is the plan. Everything else is stationery.

A plan is the risk assessment, scheduled

The starting point is always the current Legionella risk assessment and its asset register — the schematic, the list of tanks, calorifiers, outlets, thermostatic mixing valves and anything that throws a spray or aerosol. BS 8580-1 sets out what a competent risk assessment should contain [4], and the duty to assess and control the risk sits in the Approved Code of Practice, L8 [1]. The monitoring plan inherits those findings directly. If the assessment flagged a dead leg behind a decommissioned kitchen, the plan has to say who checks or removes it, and when.

Two ideas keep a plan honest. The first is the split between control and verification. Flushing, temperature management, cleaning and any water treatment are the controls — they are what stops the bacteria multiplying. Routine temperature monitoring and sampling are verification — evidence that the controls are holding. A clean sample never cancels out a known temperature failure, and HSE is explicit that testing frequency follows the system and the risk assessment rather than a fixed calendar [2][3].

The second is that frequency is a risk decision, not a default. HSG274 points to routine patterns — checks at sentinel outlets, periodic tank and calorifier inspection, flushing of little-used points — but how often each applies on your site depends on the asset, its use pattern and who is exposed [2]. A care home and a lightly occupied office can run the same headings on very different timetables.

What a site-specific plan has to nail down

Work through the building, not the template. A defensible site-specific monitoring plan answers all of the following before anyone signs it off.

Anchor every task to a real asset

  • Pull the asset register and schematic from the current risk assessment, and list every outlet, storage tank, calorifier, mixing valve and aerosol-producing fitting by location.
  • Mark why each item is on the list: how it is used, the temperature it reaches, and who would be exposed if control slipped.
  • Identify the sentinel outlets — the nearest and furthest points from each hot and cold source — that stand in for the system in routine checks.

Define each routine check in full

  • For every check (temperature, flushing low-use outlets, tank and calorifier inspection, mixing-valve servicing, showerhead descale and clean), set a frequency justified by the risk assessment, not by habit.
  • Write the acceptable limit beside each check — the figure or condition the result is judged against — so a reading lands as a pass or a fail, not a number floating on a sheet.
  • Flag where risk-based sampling is required, what it is meant to confirm or investigate, and which points it draws from.

Decide the response before you need it

  • For each check, name the out-of-range action and the person it escalates to.
  • State the close-out evidence that proves a remedial worked, not merely that someone attended.

Make it ownable and reviewable

  • Put a named competent person against each task — “the contractor” is not a name.
  • Set the record format and where the log lives, so the evidence is retrievable months later.
  • Set the triggers that force a review of the plan itself: changes to the system, the use pattern, the people exposed, or the control results.

That list is the plan in miniature. If any line is blank, the blank is exactly where an inspector — or an incident — will find you.

Turning the checklist into a working schedule

Two habits separate a plan that holds up from one that merely exists.

Record the decision, not only the task. “Outlet 3F-12 flushed weekly because the room lets fewer than two nights a fortnight; a missed flush escalates to the responsible person; three misses trigger a use-pattern review.” That sentence survives a staff change in a way a tick in a box never does. Where keeping this by hand across a large estate becomes heavy, digital logging earns its place — see Automation in record keeping — but the discipline matters more than the tool.

Capture the exceptions as carefully as the passes. A run of in-range readings tells you the system behaved. The out-of-range entry, and how fast someone closed it, tells you whether your organisation actually responds — which is the thing a regulator looks for.

The parts people leave out

The same gaps recur from site to site.

  • Low-use outlets coming back into service. A plan that flushes idle outlets but says nothing about the shower in a room returning from a void period misses the highest-risk moment: the first use after stagnation. Tie that flush to whatever brings the asset back into use. Low-flow and aerated fittings change how an outlet behaves here too — The impact of low-flow fixtures on water temperature covers why.
  • The response side. Plenty of plans specify the checks in detail and the escalation route not at all. An out-of-range result with no named owner is a finding waiting to happen.
  • Sampling standing in for control. Sampling has a genuine place — verifying treatment, investigating after a temperature problem — but it is evidence, not a control measure. If you do sample, send it to a UKAS-accredited laboratory (see Choosing a UKAS-accredited lab for Legionella testing) and use BS 7592 to choose the points [5].
  • The contractor’s template adopted whole. A service provider’s standard schedule is a useful structure, not a site plan, until every task has been mapped onto your assets and tied back to your risk assessment.

A word on the numbers

Treat any figure you have read — a temperature target, a monthly interval, a flushing frequency — as guidance to confirm, not a rule to copy across. The limits and intervals in your plan should come from your own risk assessment and a competent person who knows the building; the same heading can carry a different number from one property to the next. This is general background, not legal, engineering or clinical advice, and it does not set the values for your system.

Your next step

Open the current risk assessment and the existing monitoring records side by side, and trace a single routine check end to end — say, the cold-water sentinel temperature. Which asset is it? What frequency, what limit, what was the last result, who owns it, and what happens on a fail? If you cannot follow that thread cleanly for one check, you have just found where the plan needs writing. Start there.

FAQ

Is a monitoring plan the same as the written scheme of control?

They overlap but are not identical. The written scheme of control describes the controls and how the whole system is managed; the monitoring plan is the operational schedule that verifies those controls are working — what gets checked, where, how often, and against what limit. The plan should sit inside the scheme and refer back to it.

Can we adopt our water treatment contractor’s standard schedule as our plan?

Use it as a structure, not as the finished article. A generic schedule lists the right activities but does not know your floor plan, your idle outlets or your occupants. It becomes your plan only once each task is mapped to your assets and justified against your risk assessment [1].

Do sentinel-outlet temperature checks cover the whole system?

No. Sentinel outlets — the nearest and furthest points from each source — are a representative sample, not the entire system. A fuller plan also rotates checks across other outlets over time, inspects tanks and calorifiers, and watches the low-use points that sentinels can miss [2].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [4] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [5] BSI, “BS 7592:2022 - Sampling for Legionella bacteria in water systems. Code of practice”. https://knowledge.bsigroup.com/products/bs-7592-sampling-for-i-legionella-i-bacteria-in-water-systems-code-of-practice-1