You can keep a water system in perfect order and still fail a Legionella inspection. The water sits at the same temperature either way; the difference is whether you can prove it. When an HSE inspector or an incident investigator turns up, they do not test your good intentions — they ask to see the records. A logbook full of holes reads as a system out of control, even when it never was.

Doing the control work and documenting it are two separate jobs. The first keeps people safe. The second is the one that gets audited, handed over, and pulled apart after the fact. Most sites are far better at the first than the second, and that gap is where the trouble starts.

The Legionella record pitfalls below turn up on site after site. Each one is easy to fix once you can see it, and each one is the kind of thing an auditor finds in the first ten minutes.

Where the paper trail breaks down

The tick with no number

What it looks like: “Flush — done” or a bare tick against “monthly temperature check”, week after week, with no actual reading written down. Why it happens: the form was built to confirm a task occurred, not to capture a result, so whoever designed it treated the doing as the point. The fix: every monitoring entry needs the value — the temperature in degrees, the outlet it relates to, the date, and who took it — plus a note of whether it sat inside the expected range. A tick proves attendance. A number proves control, which is what L8 actually expects you to be able to show [1]. For what a complete set should contain, see Essential records for Legionella compliance.

Gaps nobody reconciles

What it looks like: entries that stop for three weeks in August and quietly resume in September, or a run of missing TMV checks straight after a maintenance handover. Why it happens: holidays, staff turnover, a contractor who did not show, and no single person whose job is to look across the whole record and ask what is missing. The fix: have a competent person review the logbook on a set rhythm — not to re-do the readings, but to spot the silence. A missing entry should trigger a question, not disappear into the binder.

The action that never closes

What it looks like: “TMV failed at outlet 12 — replace” logged in March, still open in November. Or a contractor’s report recommending a tank clean that nobody actioned, or even read. Why it happens: actions get raised in one place — a reading, a report — and closed somewhere else — a work order, a budget line — and the link between the two snaps. The fix: track every remedial action to closure, with an owner and a date, and treat an open action as a live risk rather than a note. An out-of-range reading with no recorded response is one of the first things an investigator goes looking for [3].

A risk assessment that describes a different building

What it looks like: an assessment dated four years ago that still lists a calorifier replaced two years ago, or says nothing about the shower block added last summer. Why it happens: the assessment was treated as a document you commission once, not a living description of the system. The fix: review it whenever the system, the use pattern, or the people exposed change — and record the review even when nothing needs changing, so the date itself proves the assessment is current [2].

Records too perfect to be true

What it looks like: the same temperature to the decimal every week, every box ticked, all in one pen, clearly filled in monthly in a single sitting. Why it happens: pressure to show flawless compliance, in a culture that punishes an honest blank more than a convenient invention. The fix: stop rewarding perfection and start rewarding honesty. Real readings vary. An inspector who sees suspiciously tidy data tends to trust none of it, whereas a logbook that shows the occasional missed flush followed by a recorded response is far more credible.

The records you cannot actually produce

What it looks like: the data is “somewhere” — a spreadsheet on a former manager’s laptop, a binder no one can locate, three competing versions held by facilities, the contractor, and head office. Why it happens: no single source of truth and no handover discipline. The fix: keep one authoritative record, accessible to the people who need it, that survives a change of staff or contractor. If you cannot put your hands on the last twelve months of readings within five minutes, you do not really have them. Moving off scattered spreadsheets is one of the better reasons to make the switch covered in Paper vs digital logbooks.

If you fix one thing, fix this

Run back through those six and one habit does the most work: record the exception, not just the routine. The single most valuable thing your documentation can demonstrate is that when a reading drifted out of range, someone noticed, decided what to do, and did it. Build every record format around three things — the result, whether it was in or out of range, and the action taken — and the rest of the discipline tends to follow.

The same idea applies to the controls themselves: write down the decision, not only the task. “This outlet is flushed weekly because use is intermittent; a missed flush escalates to the responsible person; repeated misses trigger a review of the use pattern.” That one line turns a routine tick into evidence of a managed control. Activity logs are cheap. A documented response to a problem is what proves the system is genuinely being run.

What “good enough” actually means here

There is no national template that guarantees an inspector will sign off your folder. What counts as adequate evidence depends on your system, who uses it, and the control scheme your risk assessment sets — so treat all of the above as general guidance on keeping a defensible trail, not legal advice on your particular case, and not a substitute for a competent assessment. If you are not sure your records would hold up, have a competent person review them against your assessment before someone external does it for you.

FAQ

How long do we need to keep Legionella records?

Guidance generally expects monitoring and inspection records to be retained for a number of years rather than cleared at the end of each cycle, so that trends and past decisions stay visible [2]. The exact period depends on the type of record and your sector, so confirm it against current HSE guidance and your own retention policy before you throw anything away.

What does an HSE inspector actually look at in our records?

Broadly, whether a foreseeable risk was assessed, controlled, monitored and reviewed — and whether you can demonstrate each of those [3]. In practice that means a current risk assessment, a written control scheme, monitoring results with real values, remedial actions closed out, and some sign that management reviews the data rather than just filing it. Gaps and orphaned actions draw the most attention.

We missed several weeks of flushing records — should we backfill them?

No. Never write up entries for tasks you cannot prove were carried out; that turns a record-keeping gap into a credibility and integrity problem, which is far worse. Record the gap honestly, note why it happened, and log what you did to bring things back under control. A missed flush followed by a flush and a temperature check is a managed exception, not a cover-up.

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm