A Legionella result lands as a PDF with a number on it: “<100 cfu/L”, say, or “4,200 cfu/L”. That single figure is where most of the panic, and most of the false comfort, come from. It counts how many Legionella bacteria the laboratory managed to grow from the water you sent, scaled to a litre. It is evidence about a sample in a bottle, not a verdict on your building.
The number only means something once you know what was sampled, which system it came from, and what your risk assessment expects of that system. Get those three straight and reading the report is a short, repeatable job.
What a CFU count actually measures
CFU stands for colony-forming units. The lab cultures your water on a growth medium, counts the visible colonies that appear, and scales that to a figure per litre. So the count reflects viable bacteria that were able to grow under laboratory conditions, reported as cfu per litre. It is not a tally of every organism in the pipe, and it is not the cell count you might picture.
Two consequences follow, and both bite on site.
First, the standard culture method is slow. Colonies take days to develop before anyone can count them [3]. By the time you read “4,200”, that water has long gone down the drain. Every culture result is historic; it describes the water on the day you sampled, not the day the report arrives.
Second, “not detected” is not the same as zero. It means nothing grew above the laboratory’s detection limit from the volume tested. That is reassuring evidence for one outlet at one moment. It is not a clean bill of health for the system, and it does not override what your temperature and flushing records are telling you [2].
Before you read the number
Three things change what the count means, so settle them before you open any band table.
- What was sampled, and how. A sentinel outlet, a random check, or a low-use room coming back into service? Pre-flush samples describe water that has been standing; post-flush samples describe the incoming supply. They answer different questions, so the sampling plan matters as much as the result. BS 7592 covers how sampling points are chosen and how samples are handled [4], and Pre-flush vs post-flush sampling digs into which to use when.
- Which system it came from. Action levels for hot and cold water systems are not the same as those for cooling towers or spa pools. Read the figure against the right system, not against a number you half-remember.
- Who ran the analysis. Use a laboratory holding UKAS accreditation for the Legionella method, and check the report names the organism. Legionella pneumophila serogroup 1 carries more clinical weight than some other species, and a good report says which it found.
Reading the report, step by step
- Confirm the sample details. Check the outlet reference, the date, and whether it was pre- or post-flush match what you meant to test. Done when the report clearly describes the sample you think you took.
- Read the count with its units. Water results come as cfu per litre. Note the exact figure, and whether it reads “not detected” or gives a number above the detection limit. Done when you have a clean cfu/L value and the named organism written down.
- Place it against the action band for that system. For hot and cold water, compare the figure to the response bands below. Done when you know which band the result falls into.
- Decide, then record the response. Use the decision logic that follows and write down what you chose and why. Done when the action and its reason are in the logbook, not just in your head.
What to do at each result band
For hot and cold water systems, HSG274 sets out broadly three response bands [1]. Treat the figures as widely used guidance; the limits that bind your site come from your own risk assessment and the system in front of you.
- Up to about 100 cfu/L → treat the system as under control. Keep your normal regime running and file the CFU result as routine evidence. No remedial action on the strength of the number alone.
- Above ~100 and up to ~1,000 cfu/L →
- if it is a single positive among otherwise clean samples → resample, and review the temperatures, flushing and cleaning for that outlet.
- if two or more samples are positive → treat the system as outside expected control: review the risk assessment and written scheme, find the cause, and consider disinfection.
- Above ~1,000 cfu/L → act now. Review and act on the control measures, resample to confirm, and arrange disinfection where the assessment calls for it. Check who could be exposed in the meantime, especially at showers and other aerosol-producing outlets.
The branch people skip is the middle one. A single moderate positive is a prompt to look at the cause, not a reason to either shrug the result off or disinfect the whole building. Most CFU results never need a dramatic response; the skill is telling the few that do from the many that don’t.
Record the decision, then fix the cause
The most useful thing you can write after a result is the reasoning, not just the number. “Outlet 3B returned 600 cfu/L pre-flush, single positive; resampled and reviewed flush frequency because the room had been void for three weeks” is worth ten entries that say “result received”. It shows a competent person looked, decided, and acted.
And act on the cause, not the count. A high figure is a symptom of something upstream: stagnation, tepid water, scale, or weak disinfection. Chasing it with a one-off shock disinfection while the cause sits untouched just buys you the same result next quarter. If your samples keep landing in the middle band, that is usually a monitoring-design problem, not bad luck; Proactive vs reactive monitoring is the better lens for that.
One caveat worth keeping in front of you. A CFU report is laboratory evidence about water that left the tap and sat in a bottle for over a week before anyone counted anything. It is not a medical diagnosis and not a legal sign-off. The bands above are general guidance; what counts as acceptable for your system is decided by a competent, site-specific risk assessment, with sampling treated as verification of control rather than a substitute for it [2].
Common questions
Does “not detected” mean the water is safe?
No. It means nothing grew above the lab’s detection limit from the sample tested, on the day it was taken. It is good evidence for that outlet at that moment, but it says nothing about temperatures, stagnation or cleanliness elsewhere, and the culture method can miss bacteria that are present but slow to grow.
Why does a Legionella result take so long to come back?
Because the standard method grows the bacteria as colonies before anyone can count them, which takes days [3]. The practical effect is that the figure is always historic. Keep controlling and recording the system day to day rather than treating the lab report as a live readout.
A result came back high but our temperatures are fine, so which do I believe?
Both, and investigate the gap. Temperatures are a control measure; the sample is verification. A clash usually points to something the temperature log cannot see: a dead leg, a low-use outlet the flushing rota misses, or a sample drawn before flushing. Find the cause rather than dismissing either reading.
Sources
[1] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [2] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm [3] CDC, “Laboratory Testing for Legionella”. https://www.cdc.gov/legionella/php/laboratories/index.html [4] BSI, “BS 7592:2022 - Sampling for Legionella bacteria in water systems. Code of practice”. https://knowledge.bsigroup.com/products/bs-7592-sampling-for-i-legionella-i-bacteria-in-water-systems-code-of-practice-1