---
title: "Essential records for Legionella compliance"
source_url: https://legionella.io/articles/essential-records-for-legionella-compliance/
canonical_url: https://legionella.io/articles/essential-records-for-legionella-compliance/
pillar: "Digital Logbooks & Record Keeping"
summary: "The Legionella records that prove control: which documents to keep, how long to retain them, and the evidence gaps that fail a UK audit or incident review."
primary_keyword: "Legionella records"
date_published: 2025-05-19
date_reviewed: 2026-06-26
author: "Legionella.io editorial team (REMOTE TECH LTD)"
reviewed_against: "HSE L8 and HSG274 guidance"
region: "United Kingdom"
license: "(c) REMOTE TECH LTD. Quote freely with attribution and a link to source_url."
---

# Essential records for Legionella compliance

When an inspector, an insurer, or a solicitor asks about your water system, they rarely ask whether you control Legionella. They ask you to prove it. The proof is your records — and a control scheme that runs well on the ground but is recorded badly looks, on paper, like nothing ever happened.

That gap between what you did and what you can show is where most duty holders come unstuck. The monitoring got done. The flushing got done. But the reading that drifted out of range three months ago has no note beside it saying what anyone did, so on the page it reads as an ignored failure rather than a managed one.

Records are not the bureaucracy around Legionella control. Under the L8 Approved Code of Practice they are part of the control itself: duty holders are expected to keep records of the precautions taken, the monitoring carried out, and the management arrangements behind both [1]. Get the records right and you tend to get the control right too, because you cannot record a check you never made.

## The three moments your records have to survive

Most record sets are built for the easy day and fall apart on the hard one. Build yours for three moments instead.

An **audit or inspection** is the gentlest test: someone asks to see the last twelve months and forms a view of whether the system is being managed. A **handover** is harder — a new responsible person, a new contractor, or an incoming managing agent has to pick up the system cold and understand it from the paperwork alone. An **incident review** is the brutal one: a suspected case, a positive sample, or an HSE visit, where every entry gets read backwards to reconstruct exactly what was known, and when.

If your records would let a stranger rebuild the state of the system on any given week, they will survive all three. If they only make sense to the person who wrote them, they will not.

## The records that actually have to be there

Group them so nothing slips through the cracks. Every item below should be findable, dated, and tied to a named person.

**The foundation documents**
- The current Legionella risk assessment, with its date, its author, and a clear marker of which version is live.
- The written scheme of control — what is controlled, the safe limits, who owns each task, and the escalation route when a result lands outside the limit.
- A description or schematic of the water system: tanks, calorifiers, the asset register, and any dead legs or low-use outlets already identified.

**The people behind it**
- The named duty holder and appointed responsible person, with deputies for cover.
- Training records showing the responsible person and anyone taking readings are competent to do so.
- Evidence that contractors are competent — registration with a recognised scheme is one way duty holders demonstrate this [5].

**The routine evidence**
- Hot and cold water temperature readings at sentinel and representative outlets, on the frequency your risk assessment sets [2].
- Flushing records for low-use and infrequently used outlets.
- Cold water tank inspections, calorifier checks, TMV servicing, and shower head cleaning and descaling — each dated and signed.

**The exception trail**
- Out-of-range readings with the action taken, who took it, and when it was closed.
- Disinfection and remedial certificates, including any chlorination carried out after work on the system.
- Sampling results, where sampling forms part of your scheme, with the reason each sample was taken [4].

**The housekeeping**
- Review dates for the risk assessment and the scheme, plus a note of what triggered any out-of-cycle review.
- A retention policy, so records are not binned the moment a task is closed.

That last point catches people out. L8 guidance points to keeping records well beyond the task itself — commonly the period a record remains current plus around two years, and longer again for monitoring records [1]. Treat those figures as a floor to confirm against your own assessment, not a date to start shredding.

## Record the decision, not just the tick

The single habit that separates a record set that holds up from one that collapses: write down the reasoning, not only the result.

A temperature of 48°C logged against a hot outlet is just a number. "48°C at the far bedroom basin — below the expected range, isolating valve found half shut, reopened, retested at 56°C, responsible person notified" is a record of control. The first invites a question you may not be able to answer a year later. The second answers it in advance.

The same goes for the choices behind the routine. A line such as "this outlet is flushed weekly because the room is let intermittently; two missed flushes escalate to the responsible person" turns a tick-box into evidence that someone is genuinely thinking about the system. Whether you hold this on paper or in a [digital logbook](https://legionella.io/articles/paper-vs-digital-logbooks-making-the-switch/) matters far less than whether the reasoning is captured at all — though a digital system makes the out-of-range follow-through much harder to lose.

## What gets left out

The gaps are predictable, which is the good news.

The most common is the orphaned exception — a reading recorded as out of range with no visible close-out, so the record proves a problem and nothing else. Next is contractor competence taken on trust: the service done, but no evidence the provider was competent to do it. Then comes the silent system change — a new outlet, a refurbished wing, a decommissioned tank that never made it into the risk assessment or the monitoring schedule, so the records describe a building that no longer exists. And finally version drift: three copies of the risk assessment in circulation and no way to tell which one was current in the week that matters.

None of these are failures of effort. They are failures of the audit trail, and they are exactly the things an incident review pulls on first.

## A caveat worth keeping in mind

A tidy folder is not a controlled system. Records prove control; they do not create it, and an inspector who finds immaculate paperwork wrapped around a tepid, stagnant tank will not be reassured. None of the above is legal advice. What you record, how long you keep it, what an acceptable result looks like, and how often you check are all set by a competent, site-specific risk assessment for your building — not by a generic list. Use this to interrogate your evidence trail, then let the assessment decide the detail.

## Try this on your own records this week

Pull the last three months of monitoring for one building and read it as a stranger would. For every out-of-range reading, can you find the close-out without asking anyone? Can you tell which version of the risk assessment was current? Can you name the responsible person from the paperwork alone? Wherever the answer is no, you have found the gap an audit or an incident review would find first — and a fortnight's tidying now is far cheaper than reconstructing it under pressure later. If you are starting from a blank logbook rather than auditing an existing one, [Legionella logbooks: an introduction to record keeping](https://legionella.io/articles/legionella-logbooks-an-introduction-to-record-keeping/) covers the basics first.

## FAQ

### Which Legionella records do we legally have to keep?
There is no single tick-list in law, but the L8 ACoP expects records of the precautions taken, the monitoring carried out, and the management arrangements behind them — in practice the risk assessment, the written scheme, monitoring results, remedial actions, and who is responsible [1]. Your risk assessment sets the detail for your specific system.

### How long should we keep Legionella records?
Longer than most people assume. L8 guidance points to retaining records well past the moment a task is closed — commonly the period they remain current plus around two years, with monitoring records kept longer still [1]. Confirm the exact periods against current HSE guidance and your own policy before disposing of anything.

### If we use a contractor, do they keep the records or do we?
Both hold copies, but accountability stays with you. The duty holder remains responsible for the records and for oversight of the work, even when a contractor carries out the tasks and supplies the paperwork [3]. Keep your own master set — do not rely on retrieving it from a contractor you may one day part ways with.

## Related reading

- [Legionella logbooks: an introduction to record keeping](https://legionella.io/articles/legionella-logbooks-an-introduction-to-record-keeping/)
- [How to implement a flushing programme for Legionella control](https://legionella.io/articles/how-to-implement-a-flushing-programme-for-legionella-control/)
- [Paper vs digital logbooks: making the switch](https://legionella.io/articles/paper-vs-digital-logbooks-making-the-switch/)
- [Managing Legionella in schools and universities](https://legionella.io/articles/managing-legionella-in-schools-and-universities/)

## Sources

[1] HSE, "Legionnaires' disease. The control of legionella bacteria in water systems — Approved Code of Practice and guidance (L8)". https://www.hse.gov.uk/pubns/books/l8.htm
[2] HSE, "Legionnaires' disease: Technical guidance (HSG274)". https://www.hse.gov.uk/pubns/books/hsg274.htm
[3] HSE, "Legionnaires' disease — what you must do". https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm
[4] HSE, "Testing and monitoring your water system for legionella". https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm
[5] Legionella Control Association, "Code of Conduct for Service Providers". https://www.legionellacontrol.org.uk/