Embedding Legionella control into facilities management

Legionella control rarely fails because nobody knows the temperatures. It fails because the controls live in a different world from how the building is actually run. The water log sits in a binder by the plant room, while everything else — the boiler service, the lift inspection, the fire-door checks — runs through the facilities team’s planned maintenance system, its procurement, its mobilisation and handover routines. Park water safety outside all of that and it survives only as long as the one person who cares about it stays in post.

Embedding it means the reverse: water safety becomes a normal part of how the estate is planned, assigned and audited, so it keeps working through staff turnover, a new contractor and the next refurbishment. The CDC treats a managed water programme as the primary way to keep Legionella under control; UK guidance pins the same idea to risk assessment, control, monitoring, records and review [5][3]. Below is the order that holds on a busy site.

Before you start

You cannot embed what you have not defined. Two things need to exist first: a current, competent risk assessment of the water systems, and a written scheme of control that states what is monitored, to what limit, and by whom. Those are the backbone of UK practice and the documents L8 and HSG274 expect a duty holder to hold [1][2]. If either is missing or out of date, fix that before wiring anything into your systems — otherwise you are just scheduling guesses.

Step 1 — Put a name against it, not a function

Assign one accountable responsible person and make the reporting line visible on the org chart. “The FM team owns water safety” is a polite way of saying nobody does. Accountability stays with the duty holder even when the practical work is contracted out, so the named person has to sit inside your organisation, not at the far end of a service agreement [3].

Done when: an out-of-range reading reaches a named individual the same day, and that person can tell you what they did about it.

Step 2 — Move the tasks into the system you already run

Migrate the written scheme’s monitoring and maintenance tasks into your CAFM or planned-maintenance system, so they are raised, assigned, chased and closed exactly like every other job. A standalone water binder is the first thing to lapse when its keeper moves on — see Legionella logbooks on why record-keeping is so often the weak point. The aim is not a prettier folder; it is that water safety stops being special and starts being routine.

Done when: temperature checks, outlet flushing, tank inspections and descales appear as scheduled, assignable, auditable jobs sitting next to the boiler service — not in a separate book somebody has to remember to open.

Step 3 — Make every task carry its own threshold and escalation

A task that only says “take the temperature” is half a control. Each one should state the acceptable result and what to do when the result falls outside it, so a technician acts without ringing round for advice. Keep the figures cautious and tied to your assessment rather than hard-coding numbers from memory; monitoring intervals and limits belong to the risk assessment, not to habit.

Done when: the job sheet reads, in effect, “record the reading; if it is outside the range the risk assessment sets, carry out action X and notify Y” — and the technician can do that without a phone call.

Step 4 — Wire water safety into how the building changes

Most new dead legs and stagnation are not created by the water system. They are created by projects nobody told the water-safety owner about. Add a water-safety checkpoint to the change processes the FM team already runs: refurbishments, void rooms and reoccupation, occupancy changes, plant replacement, and contractor mobilisation and demobilisation.

Done when: a capped-but-not-removed branch from a stripped-out tea point gets flagged at design stage, rather than turning up in a sample two years later.

Step 5 — Review on triggers, not just the anniversary

Set the review cadence the risk assessment requires, then add event triggers on top: a system change, a refurbishment, a run of out-of-range readings, or a change of contractor. An annual review on a fixed date quietly misses the alteration that happened in March [3]. Where the organisation runs a water safety group, this is the standing item it should actually look at — the open actions and exceptions, not a green dashboard. BS 8680 offers a recognised water safety plan structure to hang that governance on [6].

Deciding what to do with an out-of-range reading

The moment that tests whether control is genuinely embedded is not the annual audit. It is the ordinary Tuesday when a temperature check comes back wrong. Map that decision once and write it into the task, and the right call gets made on site at 9am instead of three days later by whoever happens to read the log.

• Is the reading genuinely outside the limit the risk assessment sets?
  • If you are not certain the limit on the sheet is right, the task wording has failed — escalate to confirm it before acting.
• One-off on a single outlet, or a pattern?
  • One-off: carry out the immediate action the scheme specifies, re-check, and record both.
  • Repeated, or showing up across several outlets: treat it as a control failure, not a stray reading — escalate and hold the result open until it is resolved.
• Does the cause point to a system change — a new void room, a recent refurbishment, a plant fault?
  • If so, trigger a review of the written scheme for that asset, not just a repair [3].
• Could anyone be exposed in the meantime?
  • If yes, the decision sits above the technician: it goes to the responsible person straight away, recorded against the asset.

Step 6 — Prove it is actually embedded

The real test is not a full logbook; it is whether someone who is not the water-safety lead can walk an auditor through it. Ask a colleague to explain why a particular outlet is flushed and what happens when a check fails. If they can, control lives in the system. If only you can, it lives in your head, and it leaves when you do.

Two things keep it durable. Verification has to stay honest: sampling can confirm or investigate, but HSE is clear that how often you sample follows the system and the risk assessment, not a calendar picked for tidiness [4]. And specialist help should be held to a standard — Legionella Control Association registration is a reasonable starting filter [7] — and its findings challenged rather than just filed. Treating embedding as a maturity step in its own right runs through Beyond compliance.

Where this stops being generic advice

None of the limits, frequencies or escalation routes above are yours until a competent, site-specific risk assessment makes them so. A single-let office, a care home and a hospital ward need different schemes, and a step that is sensible in one can be wrong in another. Treat this as a way to organise control, not as the control itself — and never let a tidy CAFM dashboard stand in for someone competent actually reading the numbers and acting on them.

Common questions

Should the in-house FM manager or the water-treatment contractor own water safety?

The responsible person should be in-house. A contractor performs tasks and supplies expertise, but the duty — oversight, decisions and the records that prove control — stays with the organisation operating the building [3]. Outsourcing the work never outsources the accountability.

Should Legionella tasks live in our CAFM system or stay in a dedicated water logbook?

Put them where the rest of your maintenance lives, which for most teams is the CAFM or planned-maintenance system. A separate logbook tends to drift out of sight; folding the tasks in means they are scheduled, assigned and audited like everything else. Keep the records the scheme requires either way — the question is one of system, not of dropping evidence.

How do we stop control slipping when the FM contract or provider changes?

Make water safety an explicit part of mobilisation and demobilisation. Hand over the risk assessment, the written scheme, the open actions and the recent records as a defined package, name the incoming responsible person before the old one leaves, and treat the changeover itself as a review trigger rather than waiting for the next annual date [3].

Do this next

Open your CAFM or planned-maintenance system and look for the water-safety tasks. If they are there with thresholds and escalation attached, you are most of the way to embedded. If they are sitting in a binder by the plant room, that binder is your first migration — start with the routine temperature checks, because those are the ones that fail quietly when a person leaves.

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [5] CDC, “Controlling Legionella”. https://www.cdc.gov/control-legionella/index.html [6] BSI, “BS 8680:2020 - Water quality. Water safety plans. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-water-safety-plans-code-of-practice [7] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/