A written scheme of control is the document that turns your risk assessment into a working routine: what gets checked, by whom, how often, what result is acceptable, and what happens when it isn’t. ACoP L8 expects one wherever the assessment shows a foreseeable risk that needs managing [1]. Most premises have a scheme on file. Far fewer have one that would survive a close read.

The weakness is rarely the template. It is that the scheme reads like a description of Legionella control in the abstract, instead of a description of how this particular building’s water system is kept safe. An inspector does not ask whether you own a scheme. They ask whether it fits your site, and whether you actually followed it.

So the useful exercise is to look at the failure modes — the documentation habits that quietly hollow out an otherwise tidy-looking Legionella control scheme, and what to write in their place.

What a good scheme is supposed to do

Before the mistakes, the bar to measure them against. A written scheme of control — sometimes called a written control scheme — should describe the system you are actually managing, name who is responsible, set out the safe operating regime and the precautions, list the checks with their frequency, and state what to do when a result falls outside the expected range [1]. HSG274 carries the technical detail sitting behind each of those controls [2]. The scheme is where all of it becomes one coherent, followable plan rather than a drawer full of unconnected readings.

Held against that standard, here is where schemes come apart.

The documentation habits that hollow out a scheme

Mistake 1: it describes a generic building, not yours

The tell is a polished document that mentions a calorifier you don’t have, says nothing about the loft cold water storage tank you do, and carries no current schematic. It happens because the scheme began life as a supplier’s template and was never walked round the real plant room. The correction is to anchor it to a labelled system schematic and an outlet and asset register that match what is on site today. If a reader cannot trace a named outlet in the scheme to a real tap on the wall, the document is not yet describing your building.

Mistake 2: responsibility lands on a department, not a person

“The FM team monitors temperatures” reads fine until someone is on leave and the readings simply stop. Naming individuals feels fragile — people move on, so ownership gets left deliberately vague. But vague ownership is the most common reason a control quietly lapses: everyone assumed someone else had it. Name the duty holder and the responsible person as roles held by identified people, each with a named deputy, and make sure those people know the appointment exists. Competence matters as much as the name; see on what staff training for Legionella compliance is expected to cover.

Mistake 3: checks with no pass mark and no “if it fails”

“Monitor sentinel outlet temperatures monthly” records that you measure something. It does not say what counts as a pass, or what to do on a fail. A scheme written as a task list rather than a control system stops here. Fix it by stating, for each check, the acceptable result — the figure your own risk assessment sets, not one copied from another site — the action to take when the reading falls outside that range, and the person it escalates to. A check with no defined response is not a control. It is data collection that makes you feel busy.

Mistake 4: a scheme nobody can prove was followed

This is the big one. The scheme is immaculate; the evidence that it ran is thin. Logbooks have gaps, remedial actions are recorded as “done” with no detail, and nothing connects a missed flush to who noticed it and what they did next. It happens because writing the policy feels like the job, when the policy is only the start of it. Close the gap by tying every documented control to dated implementation evidence: the reading, the inspection, the clean, the exception, and the action that followed. The question that matters is not “do we have a scheme?” but “can we show it was followed last month?”

Mistake 5: the contractor’s folder stands in for your scheme

A water treatment contractor leaves behind a neat file of visit reports, and the duty holder treats that file as the scheme. Outsourcing the work, though, does not outsource the duty — the responsible person still has to appoint, brief, challenge and review the contractor, and that oversight is itself part of the scheme [3]. Use a service provider registered to a recognised standard such as the Legionella Control Association code [4], keep your own scheme as the controlling document, and treat the contractor’s reports as evidence feeding into it rather than a substitute for it.

Mistake 6: it only gets reviewed when something forces it

A scheme written once and filed will drift out of date the first time a wing is refurbished, occupancy shifts, or the plant is altered. People assume the document is static because the building feels static — until it isn’t. Build review triggers into the scheme itself: a change of plant, use pattern, occupancy, contractor or responsible person should each prompt a look, alongside the periodic review the risk assessment sets. covers when to review the underlying risk assessment, and the scheme should move with it.

If you only fix one thing

Tie the scheme to live evidence and a named owner. Of all the corrections above, that pairing does the most work: a scheme that states who is accountable and is backed by dated proof it was followed answers almost every question an auditor, insurer or enforcing officer can ask. The most useful discipline is to write down the decision, not just the task — “this outlet is flushed weekly because use is intermittent; a missed flush escalates to the responsible person; repeated misses trigger a review of the use pattern.” That one sentence turns a routine chore into a managed, defensible control.

A caveat worth stating plainly: a written scheme is general guidance made specific through a competent, site-by-site assessment, not a form to fill in once. The thresholds, frequencies and remedial actions in yours should come from your own risk assessment and, where the system is complex, from a competent person — not from this page or any off-the-shelf template. Treat anything here as a prompt to check your scheme against your building, not as design or legal advice.

FAQ

Where a risk assessment identifies a foreseeable Legionella risk that needs managing, ACoP L8 expects you to prepare and implement a written scheme to prevent or control it [1]. A very low-risk system assessed as needing no further action may not need a full scheme, but that conclusion has to come from a competent assessment and be recorded — not assumed.

What is the difference between the risk assessment and the written scheme of control?

The risk assessment identifies where the risk is and how serious it is. The written scheme of control is what you do about it day to day — the controls, responsibilities, checks and responses. The assessment diagnoses; the scheme treats and proves. A good scheme reads as the direct answer to the findings in the risk assessment.

Who should write it — us or our contractor?

Either can draft it, but the duty holder owns it. A competent contractor often writes the first version because they hold the technical detail, yet the responsible person has to understand it well enough to run, question and update it. If your team cannot explain why each control exists and what an out-of-range result means, the scheme is not yet usable, whoever typed it [3].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems — Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease — what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/