A Legionella action plan template is one live register that lifts every significant finding out of your risk assessment and tracks it from “raised” to “verified closed” — each line carrying a named owner, a target date, a current status and the evidence that proves the work actually happened. The risk assessment says what is wrong. This register is what tells you, on any given day, what you have fixed and what is still open.
Most assessments land as a PDF with a recommendations table stapled to the back. That table is a snapshot taken on survey day. The moment you start booking contractors, ordering parts and signing off works, it drifts out of date. What an auditor, an HSE inspector or your own board wants to see is not the original wish-list — it is the trail proving you acted on the significant findings and closed them out [1][2].
Why a tracker, not a tick on the PDF
Some assessors call this a significant findings register or a risk assessment follow-up template; the name matters less than the columns. A recommendations table buried inside a report cannot tell you whether the dead leg on the third floor was removed in March or is still sitting open eight months later. A separate tracker can. Pulling the findings into their own document does three things a static report cannot: it gives each action an accountable owner, it makes the status visible at a glance, and it forces you to decide what “done” looks like before you start. That last point is where most plans quietly fail — work gets carried out, but nobody records the evidence, so the line can never be honestly closed.
The template: what each column has to carry
Build it as a single table — a spreadsheet row per finding is plenty. These are the columns that make it defensible:
| Column | What goes in it |
|---|---|
| Ref | A unique ID per finding (RA-01, RA-02…) so you can cite it in minutes and emails |
| Finding & location | The hazard exactly as the assessor wrote it, plus the asset/outlet and floor |
| RA risk rating | The risk category the assessor assigned — carried across unchanged |
| Recommended action | The specific remedial work the assessment asks for |
| Priority | Risk-based order agreed with your competent person (see below) |
| Owner | One named person — never a team or a department |
| Target date | The agreed completion date for that priority band |
| Status | Open / In progress / Done — awaiting verification / Verified closed |
| Close-out evidence | What will prove it: a re-sample result, a photo, a commissioning sheet, a scheme update |
| Closed by / date | Who verified completion and when |
A worked line makes the shape obvious:
| Ref | Finding & location | RA rating | Action | Owner | Status | Evidence |
|---|---|---|---|---|---|---|
| RA-04 | Capped dead leg at former sink, Block B kitchenette | High | Remove redundant pipework back to the live tee | J. Okafor (M&E) | Verified closed | Photo + updated schematic |
Building the register: a step-by-step sequence
Work through these in order. Each step has a “done when” line so you know it is finished before you move on.
-
Transcribe every finding verbatim. Copy each recommendation out of the RA report into its own numbered row — do not merge two findings or quietly drop the ones that look minor. Done when every recommendation in the report appears as one row and the counts match.
-
Carry across the assessor’s risk rating. Put the RA’s own categorisation against each line, so priority is anchored to the assessment rather than to your gut feel. Done when each row shows the rating the assessor gave it.
-
Set risk-based priorities and target dates with your competent person. Higher-risk findings — a scalding-or-stagnation hazard on a system serving vulnerable users — are scheduled ahead of low-risk housekeeping. The competent person, not a default field, decides the timescale [2][3]. Done when each row has an agreed priority and date signed off by the responsible person.
-
Assign one named owner per line. “Facilities” cannot be chased; a person can. Done when no row reads as a team or department name.
-
Define the close-out evidence up front. Decide now what document or reading will prove each action complete, so nobody finishes the work and only then realises they cannot evidence it. Done when every row states its proof.
-
Run it as a live status review. Put the register on a fixed cadence — a standing item in your water safety meeting — and move statuses as work progresses. Done when statuses change between reviews and overdue lines are visibly flagged.
-
Verify, then close. A line only becomes “verified closed” when the agreed evidence is attached and a reviewer signs it off. For anything triggered by a positive sample, close-out means a clear re-test, not just the remedial visit. Done when status reads verified closed, with evidence and a reviewer name against it.
Prioritising without inventing a legal deadline
There is no single statutory clock that says “fix every finding within X days”. The duty is to act on the significant findings of your assessment, and to do so in a risk-proportionate way, with the competent person deciding the order and pace [1][2]. BS 8580-1’s risk categorisation is what informs that order — it lets you defend why a high-category hazard was scheduled this week and a low one next quarter. Record the reasoning. “Prioritised per assessor risk category, agreed at the water safety group on [date]” is a far stronger position than a blank timescale column. For more on ranking the work itself, see Acting on your risk assessment: setting priorities.
Where the register connects
The action plan is not a standalone island. The findings come straight out of your assessment — if you are still building that, the Legionella risk assessment template: a worked UK example you can copy gives you the source document. Once an action changes how a system is operated or maintained, that change should be reflected in your Written scheme of control template and worked example (Regulation 8 / ACoP L8), so the control becomes routine rather than a one-off fix. And when a remedial action does not hold — the familiar case of a positive result that keeps returning — the register is where you spot it, as covered in Failed remedial action close-out: why positive results keep returning.
A note on scope
This is general guidance on structuring and tracking remedial work, not legal advice and not a substitute for your own assessment. Which findings are significant, what counts as adequate close-out evidence, and how fast each action should be completed are judgements for a competent person who knows your building. Use the template to organise those decisions, not to replace them.
FAQ
Is there a legal deadline to complete Legionella remedial actions?
No fixed statutory deadline applies to every action. You are expected to act on the significant findings without undue delay and in proportion to risk, with the competent person setting timescales by risk category [1][2]. Record the reasoning so the order is defensible.
What counts as a remedial action being “closed”?
The work being done, plus evidence that proves it. For a removed dead leg that might be a photo and an updated schematic; for a TMV service, the service record; for a positive sample, a satisfactory re-test rather than just the disinfection visit.
Who should own the remedial action plan?
The responsible person typically holds the register as a whole, while each individual line has its own named owner. The duty holder remains accountable for the system being acted on [1].
Can I keep this in a spreadsheet, or do I need software?
A spreadsheet is fine for a single small site. Across multiple buildings, or where you want overdue alerts and a tamper-evident audit trail, a digital logbook that links each action to its evidence saves the chasing.
Your next step
Open your most recent risk assessment, scroll to the recommendations table, and create row RA-01 right now — one finding, one owner, one target date, one evidence requirement. Get the first five lines down today; the discipline of finishing the rest follows from there.
Sources
[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [3] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm