Most Legionella risk scoring runs on a borrowed grid: likelihood down one side, severity across the top, lifted straight from general health and safety. Every survey finding becomes a number between 1 and 25, the report looks objective, and almost nothing useful has happened. The number is only ever as good as the two judgements feeding it, and on a water system both are easy to fudge.

A score earns its keep only if it changes the order you fix things in. If your matrix hands you a page of amber and no obvious first job, it has cost you an afternoon and ranked nothing.

Why the borrowed matrix lets you down

The generic five-by-five grid asks you to collapse two very different judgements into single digits, and on a water system that collapse hides the things that matter.

Take likelihood. For Legionella, “likely” really means: are the conditions right for the bacteria to multiply here? Water sitting in the broad 20–45°C band where growth is fastest, low turnover and stagnation, scale and sediment, biofilm, dead legs, oversized or complicated pipework [1][2]. A flat “3 out of 5” tells you none of that. It treats a warm, forgotten dead leg and a cold, constantly used outlet as the same animal.

Severity is worse. People score it as a generic harm scale, when for Legionella it is two things multiplied: does this point throw a breathable aerosol, and who is standing in it? Inhaling contaminated droplets is the route that makes people ill [4], so a spray tap, shower or cooling tower is a different order of concern from a tap that fills a bucket [5]. And an aerosolising outlet on a renal ward is not the same severity as an identical one behind a locked plant-room door.

The predictable result is amber drift. Faced with uncertainty across a couple of hundred outlets, assessors reach for the middle box, and the matrix flattens into one colour exactly when you need it to discriminate.

A scoring method that actually ranks

Replace the single 1–25 cell with three columns on your asset register. The first two give you a risk rating; the third gives you the order of work. Keeping them apart is the whole point.

Column 1 — growth potential (your likelihood). Score how favourable conditions are for the bacteria at that specific point: temperature in the danger band, stagnation and poor turnover, scale and sediment, biofilm, dead legs, system age and complexity [1][2]. Be concrete. “Warm dead leg off a riser, no recorded use” scores high; “cold outlet used every shift” scores low, and you can say why.

Column 2 — exposure and who is exposed (your consequence). Two sub-judgements. Does this point create a breathable aerosol — showers, spray taps, cooling towers, some hoses and washers [5]? And who is downstream: a fit office worker, or someone older, immunosuppressed, or receiving care? Multiply those, not a vague harm number.

Band columns 1 and 2 together and you have your risk rating. Nothing exotic so far — except the inputs are specific to water rather than imported from a generic template.

Column 3 — effort to remove (the ranking lever most matrices omit). How far is the current state from controlled, and how cheaply can you close that gap? A dead leg you can cut out in an afternoon is a different proposition from a design flaw that needs a refurbishment. This column does not change how dangerous something is; it changes what you sensibly touch first.

Across a portfolio the same discipline lets you compare buildings on like terms instead of trusting whichever assessor was strictest — useful when you are ranking risk across multiple sites.

Working it through

Take two findings from one survey. A shower in a void guest room: warm, near-stagnant leg (high growth), aerosol straight into the next guest’s face (high exposure) — high risk, and a low-effort fix, because it joins the void-room flush list or comes out if it is genuinely redundant. A calorifier running a shade below its target return temperature and feeding the whole building: high growth, broad exposure — also high risk, but the fix is a plant job and may sit inside an energy-versus-risk trade-off.

Same risk band, different first move. The shower gets done this week; the calorifier gets a planned works order with an interim control in the meantime. The rating told you both were serious. The effort column told you what to put your hands on first.

What the matrix won’t tell you

A few things experience teaches that no scoring template prints on the page:

  • The score is a record of your judgement, not a measurement. Hand the same site to two competent assessors and you will get two different grids. That is normal — but it means a number is only trustworthy with the reasoning written beside it. A bare “15” ages into noise; “15 — warm dead leg, no use logged, feeds an aerosolising tap” survives a handover.
  • Force a tie-break. When two findings both land on amber, do not leave them tied. Ask which you would fix first and why, and write that down. The act of breaking the tie is where the real ranking happens.
  • Scores rot. A busy outlet that goes void, a ward that changes use, a wing mothballed for refurbishment — the risk migrates while the spreadsheet sits still. The date on a score matters as much as the figure, which is why review triggers belong in the written scheme, not in someone’s memory.
  • The dangerous outlet is often a low number. A single rarely-used spray tap near vulnerable people can carry more real risk than a “high score” plant-room asset nobody breathes near. Generic severity scales miss that; an honest exposure-and-susceptibility judgement catches it.

Where scoring stops

A risk score is a way of summarising and prioritising what an assessment found. It is not the assessment, and it is certainly not a control. The numbers lower nobody’s risk; the dated actions they trigger do. Your method has to be suitable and sufficient for the actual system and defensible to an inspector — L8 and HSG274 set the duty, and BS 8580-1 is the code of practice for how a Legionella risk assessment should be carried out [1][2][3]. There is no official national matrix you are obliged to adopt; what matters is that the rating is justifiable, the reasoning is recorded, and the ranking leads to owners and dates. And if a finding is an immediate danger, you act on it now rather than waiting for it to climb a priority list.

Where to start this week

Open your current risk assessment and pull the ten outlets or systems sitting on the same rating. For each, add the column that is probably missing: how far it is from controlled, and how cheaply you could close the gap. Re-sort by that column. You will usually find two or three quick, high-value jobs hiding inside an undifferentiated block of amber. Book those first, and put a review date against everything else so the ranking does not quietly go stale.

FAQ

Is there an official Legionella risk scoring matrix I have to use?

No. L8 and HSG274 require a suitable and sufficient assessment but do not mandate a particular scoring grid, and BS 8580-1 sets out a code of practice for how the assessment is carried out [1][2][3]. You choose the method; you have to be able to justify it.

What is the difference between a risk rating and a priority?

The rating estimates how serious a risk is. The priority is the order you tackle things in. They usually track together, but not always — a moderate risk you can remove this morning can sensibly outrank a severe one that needs months of capital works, provided the severe one has an interim control in place.

Can risk scoring replace the risk assessment itself?

No. Scoring summarises and ranks what the assessment found. A tidy matrix sitting on top of a thin or out-of-date survey just manufactures false confidence; the system understanding, the inspection findings and the written scheme still have to be there underneath.

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [4] CDC, “How Legionella Spreads”. https://www.cdc.gov/legionella/causes/index.html [5] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm