---
title: "In-house vs professional Legionella risk assessments"
source_url: https://legionella.io/articles/in-house-vs-professional-legionella-risk-assessments/
canonical_url: https://legionella.io/articles/in-house-vs-professional-legionella-risk-assessments/
pillar: "Legionella Risk Assessment"
summary: "UK law asks for a competent assessor, not a consultant. Compare in-house and professional Legionella risk assessments by complexity, independence and cost."
primary_keyword: "DIY vs professional assessment"
date_published: 2025-08-04
date_reviewed: 2026-06-26
author: "Legionella.io editorial team (REMOTE TECH LTD)"
reviewed_against: "HSE L8 and HSG274 guidance"
region: "United Kingdom"
license: "(c) REMOTE TECH LTD. Quote freely with attribution and a link to source_url."
---

# In-house vs professional Legionella risk assessments

Nothing in UK law tells you to hire a consultant. The Approved Code of Practice behind Legionella control asks for one thing: that whoever carries out the risk assessment is competent to do it [1]. So the genuine question is not "do it ourselves or pay someone" — it is whether your in-house competence actually matches the water system in front of you, and whether you could stand behind that judgement if an inspector, an insurer or a coroner ever asked.

Get the match right and an in-house assessment is perfectly legitimate. Get it wrong and a cheap assessment becomes the most expensive document in the building.

## What "competent" actually means

A duty holder may appoint someone from their own organisation or bring in an external provider. Both routes are allowed [3]. What is not optional is competence: the assessor needs enough knowledge to understand how the water system is built and used, to recognise where Legionella could grow and spread, and to judge what control is proportionate to the real exposure.

BS 8580-1 sets out what a thorough Legionella risk assessment should cover, and it works as a yardstick for either route [5]. The test is blunt. If your in-house assessment would not hold up against that code of practice — the asset register, the schematic, the temperature evidence, the assessment of who is exposed — then the question has answered itself.

Competence is also system-specific, which is the part people miss. Someone perfectly capable of assessing a small office's hot-and-cold system can be well out of their depth on a calorifier installation, a cooling tower, or a care setting full of susceptible residents. The DIY-versus-professional decision is rarely about the person's general ability. It is about this person against this system. [Who is qualified to perform a Legionella risk assessment?](https://legionella.io/articles/who-is-qualified-to-perform-a-legionella-risk-assessment/) digs into what "qualified" looks like in practice.

## The criteria that should decide it

Cost and convenience shout the loudest and help the least. Four quieter criteria do the real work.

**System complexity.** The more storage, the longer the pipe runs, the more dead legs and the more specialist plant — calorifiers, cooling towers, spa pools — the more the balance tips towards a specialist. A single compact system used every day is a different proposition from a multi-building estate.

**Competence and capacity in-house.** Not just whether someone holds a training certificate, but whether they have the time to do the survey properly, the standing to chase remedial work, and a successor if they leave. An assessment that lives in one person's head is a fragile control.

**Independence and defensibility.** An external assessor brings outside eyes that notice the faults a site has quietly normalised — the tank that has run warm for years, the basin nobody uses. Independence also makes the assessment easier to defend later, because the person who judged the risk is not the same person being judged on the controls.

**Cost and ongoing effort.** In-house looks cheaper on paper, but it spends real staff hours. A specialist charges a fee yet absorbs the survey time and arrives with the method already proven. Neither is free; they just bill you in different currencies.

## How the two routes compare

| What you're weighing | In-house assessment | External specialist |
| --- | --- | --- |
| Best suited to | Small, stable, low-complexity systems — a single office's hot-and-cold — with a trained, available responsible person | Complex or higher-risk systems: calorifiers, cooling towers, multi-site estates, healthcare and other vulnerable occupants |
| How competence is shown | You evidence it yourself through training records and demonstrable knowledge | Carried by a registered provider's accreditation and a written, repeatable method [4] |
| Independence | Fast, but the team that assesses may also run the controls — harder to call impartial | Outside view; tends to catch faults the site stopped noticing |
| Real cost | Lower cash outlay, genuine staff time, gaps if the role changes hands | A fee per visit, less internal time — but the scope must be pinned down |
| Biggest watch-out | Not knowing what you don't know | A provider who assesses the risk and then sells you the remedial work |

## Which to choose, and when

For a small, stable site with a competent and properly resourced responsible person, an in-house assessment is defensible and often the sensible call. You still owe it a real review when the system, the people exposed, or the use pattern changes, and sooner if controls start slipping [2].

For complex, high-turnover or higher-risk premises — cooling towers, healthcare, a portfolio of buildings — bring in a specialist. The cost of getting the assessment wrong on those systems dwarfs the fee.

Most organisations land in the middle, and the hybrid is usually the strongest position: an external specialist performs and reviews the risk assessment, while in-house staff run the day-to-day controls the assessment specifies — the temperature checks, the flushing of low-use outlets, the logbook. The expert sets the bar; the site keeps it. That split plays to both strengths and tends to produce the cleanest evidence trail. If the assessment then has to be turned into something a maintenance team can act on, [Writing a Legionella risk assessment report](https://legionella.io/articles/writing-a-legionella-risk-assessment-report/) covers writing it up so it actually changes site behaviour.

## The conflict of interest nobody flags

Here is the part the brochures skip. A provider who both assesses the risk and quotes for all the resulting remedial work has a quiet incentive to find plenty of it. That is not automatically dishonest — most are straight — but the incentive is real and worth handling deliberately.

Two practical checks help. First, look for a provider registered with the Legionella Control Association, whose Code of Conduct for service providers sets out what registered firms are expected to do and disclose [4]. Second, ask for the risk findings and the remedial quote to be presented separately, so you can read the diagnosis without the upsell stapled to it. The same caution applies in reverse to an in-house assessment: a team grading its own homework can be just as tempted to mark the controls it already runs as adequate.

## A caveat worth reading before you decide

This is general guidance, not a verdict on your team or your building. Whether your in-house people are competent for your particular system, how often the assessment needs reviewing, and what counts as adequate evidence are all site-specific judgements — the kind L8 and HSG274 expect a competent assessment to make, not a web page [1][2]. And if you genuinely cannot tell which side of the in-house line you sit on, that uncertainty is itself the signal to get a second opinion before committing.

## FAQ

### Is an in-house Legionella risk assessment legal in the UK?
Yes, provided the person carrying it out is competent for that specific system. The duty rests on competence, not on a job title or an external badge, so a suitably trained and resourced in-house assessor is a valid route [1][3].

### Do we have to use an LCA-registered company?
No — there is no legal requirement to use a Legionella Control Association member. Registration is a recognised marker that a provider works to a published Code of Conduct, which makes it a useful filter when you do go external, rather than a box the law forces you to tick [4].

### If we pay a consultant, does the responsibility move to them?
No. You can contract out the work but not the duty. The duty holder and responsible person stay accountable for control and for the records that prove it; the consultant performs a task under that duty [3].

## Related reading

- [Who is qualified to perform a Legionella risk assessment?](https://legionella.io/articles/who-is-qualified-to-perform-a-legionella-risk-assessment/)
- [Writing a Legionella risk assessment report](https://legionella.io/articles/writing-a-legionella-risk-assessment-report/)
- [Legionella in healthcare: HTM 04-01 and NHS guidance](https://legionella.io/articles/legionella-in-healthcare-htm-04-01-and-nhs-guidance/)

## Sources

[1] HSE, "Legionnaires' disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)". https://www.hse.gov.uk/pubns/books/l8.htm
[2] HSE, "Legionnaires' disease: Technical guidance (HSG274)". https://www.hse.gov.uk/pubns/books/hsg274.htm
[3] HSE, "Legionnaires' disease - what you must do". https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm
[4] Legionella Control Association, "Code of Conduct for Service Providers". https://www.legionellacontrol.org.uk/
[5] BSI, "BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice". https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1