Two buildings can run exactly the same tasks — the same temperature checks, the same weekly flush, the same annual sample — and only one of them is genuinely in control. The difference is almost never the task list. It is whether anyone notices when a reading drifts, whether the records would survive a hard question from an inspector or an insurer, and whether anything actually changes after a near miss. That gap is what “best practice” really describes.

Minimum compliance keeps you inside the law on a good day. Best practice keeps you in control on a bad one — when a floor is closed for refurbishment, a contractor is swapped mid-contract, or a sample comes back over the action level on a Friday afternoon. What follows is a working checklist for closing that gap, grouped the way a water system actually behaves, with the high-value steps most sites skip pulled out at the end.

Compliance gets you to the line; best practice keeps you over it

UK duty rests on a chain that does not change from site to site: understand your system, assess the foreseeable risk, write a scheme of control, apply the controls, monitor the evidence, keep records, and review when something changes [1]. L8 and HSG274 are the reference points for what “competent” looks like at each of those steps [2][3].

Best practice is doing that chain as one managed system instead of a drawer full of disconnected jobs. The CDC makes the same point from the other direction: an effective water management programme is the primary strategy for controlling Legionella growth and spread, not any single check [4]. BS 8680 sets out the water safety plan as the structured way to pull assessment, control and review into one owned document [5]. The mature version of compliance is a system that can explain itself.

A best-practice checklist you can record against

Group the work the way the building presents it, and make every line something you could initial with a date. Vague aspirations do not survive an audit; recordable actions do.

Know the system you are actually controlling

  • Keep a current schematic and asset register covering every tank, calorifier, TMV, dead leg and outlet, and update it whenever pipework changes.
  • Flag which outlets are low-use, and write down why (seasonal room, decommissioned lab, spare changing block).
  • Identify the sentinel outlets your risk assessment names, so monitoring measures the points that matter rather than the ones that are convenient.

Run the control measures, do not just list them

  • Keep hot water hot and cold water cold, and confirm it at the points your assessment specifies rather than assuming the plant-room reading reaches the far tap.
  • Flush low-use outlets on a defined schedule tied to genuine use patterns, not a blanket weekly habit applied unevenly.
  • Keep cold tanks lidded, screened and clean; descale and disinfect shower heads and flexible hoses on a set cycle.

Build evidence that survives a hard question

  • Record the reading and the decision, not just a tick: what the result was, whether it was acceptable, and what you did if it was not.
  • Log every out-of-range result with the action taken, who took it, and the date it was confirmed closed.
  • Keep contractor reports, sampling certificates and remedial actions in one place a deputy could find without you.

Govern it and improve it

  • Name one accountable responsible person and a trained deputy, so cover never depends on a single individual being in the building.
  • Review the risk assessment when people, plant or use patterns change, not only on the annual calendar [1].
  • Use competent service providers and check that competence rather than assuming it; the Legionella Control Association code of conduct is a reasonable benchmark to hold a contractor to [7].

How to make the checklist mean something

The habit that separates a managed system from a tidy logbook is writing down the reason, not only the result. “Outlet flushed” is a task. “This outlet is flushed weekly because the room lets fewer than once a fortnight; a missed flush escalates to the responsible person; three misses trigger a use-pattern review” is a control someone can run, defend, and improve after you have moved on.

Do the same with limits. The point of recording an acceptable range next to each reading is that an out-of-range result becomes obvious and actionable on the day, instead of being noticed months later by whoever finally reviews the file.

The best practices sites quietly skip

Most sites pass their audits on the visible work and come unstuck on these:

  • Closing the loop on out-of-range readings. Logs are full of recorded problems and empty of recorded fixes. The reading that triggered an action is only useful if the action, and its confirmation, is written down beside it.
  • Reviewing after low occupancy, not just on the calendar. A wing that sat empty over a quiet summer is exactly when stagnation builds, yet the review is often left until the annual date. Best practice treats a void period as its own trigger.
  • Decommissioning dead legs instead of flushing them forever. Removing a redundant length of pipe once removes the risk and the recurring flush. Flushing it weekly for a decade does neither.
  • Treating sampling as verification, not control. A clean sample describes one outlet at one moment; HSE is clear that testing frequency follows the system and the risk assessment, not a fixed calendar [6]. Sampling supports your control regime; it is not a substitute for temperature, movement and cleanliness.
  • Capturing the “why” behind each control. When the only person who understands the scheme leaves, an undocumented system reverts to box-ticking within months.

For the wider system this checklist feeds into, see Developing a comprehensive Water Safety Plan; for the failure modes it is designed to prevent, Common Legionella control mistakes to avoid is the companion read.

One caveat before you adopt it

A checklist borrowed from another building is not a control scheme. The figures, the frequencies, and which outlets count as sentinels all come from your own risk assessment and your own system — not from this page or a neighbour’s logbook. Treat everything here as the shape of good practice, then let a competent, site-specific assessment set the actual numbers. A list copied without that assessment behind it is just a longer to-do list, and it will not prove control if anyone asks.

Where to start this week

Do not try to adopt the whole list at once. Take one group — start with evidence — and walk this week’s records against it for a single building. Pick one out-of-range reading from the last quarter and check whether the fix, and its sign-off, is actually written down. If it is not, you have found your first real gap, and the rest of the list is simply the order in which you close the others.

FAQ

No. Compliance is the floor — the duties you must meet. Best practice is the management system that keeps you meeting them when conditions change: clear ownership, recorded decisions, and a habit of improving after problems. You can be compliant on paper and still be one staff change away from losing control.

We already pass our audits. Why do more?

An audit samples a moment; risk runs continuously. A pass tells you the visible work was in order on the day — not that out-of-range results get closed, that low-use outlets get attention, or that a new responsible person could run the scheme. The extra work is what makes the pass repeatable.

Who should own water safety best practice in a small organisation?

One named, competent responsible person with the authority to act, plus a trained deputy for cover. You can contract out the tasks, but accountability and oversight stay in-house, which is why checking your provider’s competence is itself a best practice [7].

Sources

[1] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [2] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [3] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [4] CDC, “Controlling Legionella”. https://www.cdc.gov/control-legionella/index.html [5] BSI, “BS 8680:2020 - Water quality. Water safety plans. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-water-safety-plans-code-of-practice [6] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [7] Legionella Control Association, “Code of Conduct for Service Providers”. https://www.legionellacontrol.org.uk/