A Legionella risk assessment answers one question: where could Legionella grow or spread in your water system, and how bad is it? A water safety plan answers a bigger one: how will the whole site keep all of its water safe, year after year, across every change to the building? One is a survey. The other is a management system. The assessment is an input to the plan, not a rival to it.
That single relationship clears up most of the confusion. You do not choose between them as if they were two products on a shelf. The real questions are whether your building needs only the survey, or the survey plus the management framework wrapped around it.
Two different jobs
The Legionella risk assessment is a point-in-time evaluation. A competent person surveys your hot and cold water systems, cooling systems and any other relevant plant, maps the pipework, finds the dead legs, the rarely-used outlets, the calorifiers running cool, the TMVs that warm the cold supply. They rate the risk and recommend controls. BS 8580-1 is the code of practice for how that assessment is carried out and what a good one contains [1]. It is scoped to Legionella, and it produces a document you act on and then review.
A water safety plan is not a survey at all. It is the living framework that decides who does what, to which standard, on what schedule, and what happens when something goes wrong. BS 8680 sets it out, drawing on the World Health Organization’s water-safety-in-buildings approach [2][3]. It covers the whole water system over its life — design, commissioning, operation, maintenance, alteration — and it looks past Legionella to other waterborne hazards such as Pseudomonas and scalding. Where the assessment asks “what’s wrong here?”, the plan asks “how do we stay on top of all of it, permanently?”
How they nest together
Here is the part the SERP usually fluffs. These two documents are layered, not parallel.
Your written scheme of control — the operational instructions for keeping temperatures right, flushing little-used outlets, servicing calorifiers, monitoring — flows out of the risk assessment. The risk assessment, in turn, is one of the core inputs to a water safety plan. The plan then adds the governance: a water safety group, defined roles, escalation routes, and a standing review of whether the controls are actually working [2].
So a building can have a perfectly good risk assessment and no water safety plan. That is normal, legal, and often proportionate. What a building should not have is a water safety plan resting on a stale or absent risk assessment — that is a folder with no foundation.
Side by side
The two are easiest to place when you compare them on the axes that distinguish documents, not just their titles.
| Decision axis | Legionella risk assessment | Water safety plan |
|---|---|---|
| Question it answers | Where is the Legionella risk, and how severe? | How will the whole site keep all its water safe over time? |
| Standard it follows | BS 8580-1 code of practice [1] | BS 8680 / WHO water-safety approach [2][3] |
| Scope | Legionella across your water systems | Whole water system plus other hazards (e.g. Pseudomonas, scalding) across its life cycle [2] |
| Nature | A point-in-time survey and evaluation | A living management framework |
| Typical owner | A competent assessor; findings actioned by the responsible person | A water safety group with defined roles and escalation [2] |
| What it produces | Findings, risk ratings, a written scheme of control | Policy, accountability, review cycle, links to all controls |
| Lifespan | Valid until your system or use changes, then reviewed | Ongoing; reviewed continuously |
Which does your building need?
Every duty holder needs the assessment. Under health and safety law you must identify and assess the risk from Legionella, prevent or control it, and keep the right records — and ACoP L8 sets out how to do that competently [4][5]. A current, suitable risk assessment is the spine of all of it. There is no version of compliance that skips it.
Whether you also need a formal water safety plan depends on complexity and consequence. A single small office, a low-risk let, a simple building with healthy users and few outlets is usually well served by a good risk assessment, a written scheme someone actually follows, and an honest logbook. Bolting a 40-page plan onto that often produces paperwork nobody maintains.
The picture flips as risk rises. Hospitals, care homes and premises with clinically vulnerable people are expected to run a documented water safety plan and a water safety group, and in healthcare that is the operating standard rather than going the extra mile. Large non-clinical estates — a university, a hotel group, a council’s stock — sit in between. The pragmatic call there is to keep the risk assessment and written scheme as the spine and borrow the governance from BS 8680: name a small group, give it a standing review of the evidence, define what triggers escalation.
In my view the most common real-world failure is not choosing the wrong document. It is having both on paper while neither is current. A risk assessment from four refurbishments ago, and a plan that names a water safety group which has not met, fail in exactly the same way: the controls drift, the records thin out, and nobody notices until a temperature log goes blank for three months. Where each control was checked, by whom, and when — that is what an inspector and your own assurance both rest on, and it is where moving off scattered spreadsheets onto a digital logbook tends to earn its place.
A caveat worth stating plainly
Neither document is a substitute for judgement, and neither is proof on its own. Whether you have discharged your legal duty turns on whether the risk is genuinely controlled and evidenced for your specific systems and users — a question for a competent person, not for the page count. The standards named here are codes of practice and frameworks; they inform that judgement rather than replace it. Every temperature, dwell time and monitoring frequency that matters comes from your own risk assessment for your own site, and HSE treats sampling as verification of control rather than as the thing that sets your schedule [6]. This is general guidance, not legal or design advice — if a control limit is being missed or your situation is genuinely uncertain, get competent help.
What to do today
Open your risk assessment and check the date and the system description against the building as it stands now. If outlets, occupancy or plant have changed since it was written, the assessment is the thing to fix first — before any talk of a plan. If it is current and your building is low-risk, you are likely well placed and a formal water safety plan would be overkill. If your site carries vulnerable users, multiple buildings or real complexity, take the next step up: name who would own a water safety group, and use the current assessment as its first input. Either way, make sure the records that prove your controls are running live somewhere you can actually retrieve them on the day you are asked.
FAQ
Can a water safety plan replace a Legionella risk assessment?
No. The risk assessment is an input the plan depends on, not something it makes redundant. The law requires you to assess and control Legionella risk regardless of whether you keep a formal plan [4][5]. A plan without a current assessment underneath it has no foundation.
Is a Legionella risk assessment legally required but a water safety plan not?
For most buildings, broadly yes. Health and safety law and ACoP L8 require you to assess and control the risk and keep records, which means a suitable risk assessment [4][5]. A water safety plan is a best-practice framework under BS 8680 — expected in healthcare, optional but valuable for complex estates [2].
Do small landlords need a water safety plan?
Usually not. A small, low-risk let is normally well covered by a proportionate Legionella risk assessment and any simple controls it identifies. A formal water safety plan and water safety group add value where systems are complex, occupants are vulnerable, or you manage many properties at once.
Sources
[1] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [2] BSI, “BS 8680:2020 - Water quality. Water safety plans. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-water-safety-plans-code-of-practice [3] WHO, “Water safety in buildings”. https://iris.who.int/server/api/core/bitstreams/2c302ce4-bca9-42bc-97b4-ddbe95f0c7f2/content [4] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [5] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - ACoP and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [6] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm