A survey lands on your desk with two dozen recommendations and a budget that stretches to maybe half of them this year. The reflex is to start with the cheapest fixes, or the ones easiest to slot into next month’s schedule. That reflex is how the wrong things get done first.
Cost versus risk is not an argument about whether to control Legionella — that duty is fixed. It is about order. Of the actions your risk assessment recommends, which buy the most risk reduction per pound, which can wait, and which are you choosing to carry as a documented, monitored residual? Get the sequence right and a modest budget goes a long way. Get it wrong and you can spend the whole pot polishing outlets that were never the problem.
The decision is sequencing, not whether to control
Start from what is not negotiable. Under L8, assessing the risk and applying proportionate control measures carries Approved Code of Practice status — a duty, not a discretionary survey you can shelve on cost grounds [1]. So the cost-versus-risk question never reaches “should we control this at all”. It stops at “in what order, and to what depth”.
That distinction changes the spreadsheet you build. “Can we afford it?” invites a line-by-line cull of the cheapest-looking items. “Where does each pound remove the most risk?” produces a ranked plan you can actually defend. The second is the Legionella risk cost-benefit calculation worth making.
What “cost” and “risk” really mean here
Both sides of the ledger are usually mis-measured.
Cost is rarely the headline price on the quote. A small weekly flush of a cluster of low-use outlets looks cheap next to a one-off pipework alteration — until you notice the flush runs for the next decade and depends on someone never forgetting it. Separate three layers: the one-off spend, the recurring operational effort it locks in, and the management cost of proving it happened. A control that creates a permanent task carries a long tail; a control that removes the hazard carries none.
Risk is exposure multiplied by likelihood. Exposure is who could breathe the aerosol and how vulnerable they are. Likelihood is whether the water is warm, still and growing biofilm. HSE singles out aerosol-generating and stagnant systems as those most likely to create risk [2], and that is precisely where spend earns the most. A pound aimed at a high-exposure, high-likelihood outlet does more than ten aimed at a busy outlet that already flushes itself through constant use.
Comparing control actions pound for pound
Put the common remedial actions side by side on the axes that decide the case — what drives their cost, how much risk they actually remove, and what they leave behind as proof:
| Control action | What drives the cost | Risk it removes | Evidence it leaves | Earns its place when |
|---|---|---|---|---|
| Remove a redundant outlet or dead leg | One-off plumbing and making good | Eliminates a permanent stagnation reservoir for good | Updated schematic and asset register; one fewer recurring task | The outlet is genuinely no longer needed |
| Weekly flush of a low-use outlet that must stay | Recurring labour, indefinitely | Limits stagnation between uses; does not fix the cause | Flush records — only as strong as the compliance behind them | Removal isn’t possible but use is intermittent |
| Correct hot-water generation or distribution temperature | Repair, possibly plant spend | Restores the primary thermal control across many outlets at once | Temperature logs trending back into the expected range | Stored or delivered temperatures are drifting |
| Routine Legionella sampling | Per-sample lab fee plus sampler time, recurring | None directly — it verifies, it does not control | Lab results for the sampled points at a single moment | The assessment calls for verification, or you’re investigating |
| Continuous or remote temperature monitoring | Hardware install plus ongoing subscription | None directly; shortens time-to-detect a control failure | A continuous audit trail with exception alerts | The estate is large or manual readings keep slipping |
Read down the “risk it removes” column and a pattern appears. Actions that remove the cause — pulling a dead leg, restoring temperature — tend to beat actions that manage the symptom (flushing) or only watch it (sampling, monitoring). Verification has real value, but it controls nothing on its own. A clean sample from a system you do not actually manage is comforting and meaningless.
Which to fund first
The ranking that falls out is fairly blunt, and that is the point.
Fund first the permanent removals of high-exposure hazards. Sealing or stripping out a genuinely redundant outlet, or fixing a calorifier that has let stored temperature slide, gives you the biggest single risk cut and quietly deletes a recurring cost at the same time. In my view that is the most defensible pound you can spend: the one that turns a forever-task into a one-off. The reason stagnation keeps topping these lists is set out in on neglected water systems.
Fund next the recurring controls you cannot design away — flushing the outlet that genuinely has to stay, servicing the TMVs that protect vulnerable users. These cost more over time, which also makes them the first candidates for automation once an estate is large enough to justify it.
Treat verification last in the budget queue but not least in value. Sampling and continuous monitoring prove the first two layers are working; they do not replace them. Monitoring earns its keep when it shortens the gap between a control failing and someone noticing — a genuine risk reduction, even though the sensor itself controls nothing.
What a cost-vs-risk ranking can’t excuse
A ranking orders discretionary sequencing. It is not a licence to write off a known hazard because the arithmetic looked unfavourable. If your assessment flags a real risk to an identifiable vulnerable user, “it wasn’t cost-effective” is no defence — the duty to control reasonably foreseeable risk does not bend to a budget line [3]. The acceptable result for any control, the monitoring frequency and the remedial timescales come from your competent, site-specific risk assessment, not from a comparison table; sampling frequency in particular follows the system and the assessment rather than a fixed calendar [4]. Use the ranking to order the genuinely optional, record why each deferral is low risk, and revisit it the moment people, plant or use patterns change.
Turn the ranking into a written funding case
The ranking is only worth as much as your ability to explain it later. For every action you defer, write the decision, not just the omission: the residual risk you are accepting, why it is tolerable for now, and the trigger that would move it up the list. “This wing’s redundant showers are isolated and capped this year, signed off as low risk, with capital removal scheduled into next year’s works” reads very differently from a blank line on a survey.
That written reasoning is also what makes a budget request persuasive. When you take the plan upstairs, lead with risk removed per pound rather than the total, and keep the deferral logic to hand — because that is what an inspector, an insurer or, in the worst case, a court will ask to see. If the argument has to land with people who do not live in plant rooms, on communicating Legionella risk to stakeholders covers the framing.
So before the next budget round, take your most recent risk-assessment action list and add three columns: risk removed, true cost over five years, and evidence value. Re-sort by the first. The order will almost certainly differ from the surveyor’s numbering — and that re-sorted list, with a one-line reason against every deferral, is your funding case.
FAQ
Can a cost-benefit case ever justify skipping a recommended control?
Not for a genuine hazard. Cost-benefit reasoning can defend the order you tackle things in, and it can support carrying a low-risk item as a documented residual, but it cannot waive the duty to control a reasonably foreseeable risk. If a recommendation addresses real exposure for vulnerable users, a tight budget is a reason to find the money, not a reason to drop it [3].
How do you value the risk side when you can’t predict an outbreak?
You don’t price the outbreak; you rank relative exposure and likelihood. Score each finding by who is exposed and how vulnerable they are, set against how warm, still and aerosol-prone that part of the system is. That gives a defensible ordering without inventing a probability or a pound figure for a worst case no one can forecast.
Is cutting sampling or monitoring frequency a real saving?
Only if your risk assessment says the lower frequency is still appropriate. Sampling and monitoring intervals are set by the system and the assessment, not chosen to hit a price point [4]. Trimming them below that line isn’t a saving — it is accepting an unmeasured increase in how long a control failure could run before anyone notices.
Sources
[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm