Almost everyone who asks how often a Legionella risk assessment is due wants a single number in reply. Two years is the figure most have heard somewhere. The honest answer is less tidy and far more useful: UK guidance sets no fixed interval. You assess the system once, properly, then keep that assessment under review and revisit it whenever the building, the water system, or the people using it change [1].

That second half — keeping an assessment under review, and knowing what should trigger a fresh look — is where most sites slip. Sort it out and the calendar question largely answers itself.

Initial, review, reassessment: three different jobs

Three activities get bundled under “doing the risk assessment”, and treating them as one thing is the root of most confusion.

The initial assessment is the full piece of work: surveying the system, identifying where Legionella could grow and spread, working out who could be exposed, and setting the controls. You need one whenever you take on a system that has none, or whose existing assessment no longer reflects reality. If you are starting from scratch, Legionella risk assessment basics: what it is and why you need it covers what a sound first assessment contains.

A review is lighter: a competent check of whether the existing assessment still holds. Does it still describe your building, its use and its occupants? Are the controls in the written scheme still being met? If yes, you record that the assessment remains valid and move on. HSE expects the duty holder to keep the assessment under regular review, and to act whenever there is reason to believe it is no longer valid [1].

A reassessment is what happens when that review returns a “no”. Something material has changed, so part — or all — of the original work is redone. The line items that make up a full assessment are set out in Key components of a Legionella risk assessment.

The myths that set the wrong schedule

Most bad scheduling decisions trace back to a handful of sticky beliefs.

Myth: “We did one two years ago, so we’re due another”

There is no statutory two-year cycle. What prompts revisiting an assessment is change, or genuine doubt about its validity — not a date in the diary. A stable site untouched for three years may still hold a perfectly valid assessment; a building mid-refurbishment may need its assessment revisited within weeks. Plenty of organisations adopt a regular review interval as good practice, and a period of around two years is often quoted, but that is a self-imposed prompt to check, not a legal deadline, and it never overrides a trigger that arrives sooner [1].

Myth: “A review means paying for the whole survey again”

A review is a check, not a re-survey. If nothing material has changed and the controls are working, a competent person can confirm the assessment still stands and record that — no full resurvey, no large invoice. The heavy reassessment is reserved for when the answer is “no longer valid”. Treating every review as a full reassessment wastes money and, worse, tempts people to skip the review altogether.

Myth: “Nothing’s broken, so nothing’s changed”

The changes that matter are rarely dramatic faults. A wing taken out of service, a change of tenant, a new resident with a weakened immune system, a long spell of partial occupancy — none of these arrive labelled as a Legionella problem, yet each can quietly invalidate the assumptions the original assessment rested on.

Myth: “The date is the duty; the rest is just monitoring”

Frequency and triggers are two halves of the same job. The diary prompt catches slow drift; the triggers catch step-changes. Review only on schedule and you will miss the refurbishment that happened in month four. React only to the obvious triggers and you will miss the gradual creep of new dead legs and tepid outlets. You need both running at once.

The triggers worth writing down

Beyond the periodic review, certain events should prompt a look at the assessment regardless of when it was last touched. The common ones [1] [3]:

  • Changes to the water system — new plant, altered pipework, added or removed outlets, a replaced calorifier or cold water storage tank.
  • Changes to how the building is used — higher or lower occupancy, a mothballed area brought back into service, a change of use for part of the site.
  • Changes to who is exposed, especially anyone more susceptible — for example a care setting taking on higher-dependency residents.
  • New information about the risk or the controls — updated guidance, manufacturer instructions, or findings from elsewhere in your estate.
  • Monitoring results outside the expected range, or repeated failures to hit a control parameter such as temperature [2].
  • A suspected or confirmed case of Legionnaires’ disease linked to the system — an immediate trigger, alongside any separate reporting duties.
  • Changes to key personnel, including a new responsible person who needs to understand and own the assessment.
  • Building work, refurbishment, or an extended period of low or no use — empty buildings and seasonal closures both let water sit and stagnate.

The list is not exhaustive, but if any of these has happened since your last assessment and you have not looked at it, that gap is your priority.

So what interval should you actually set?

Set a default review interval as a safety net — a standing prompt to confirm the assessment still holds — and treat every trigger above as a reason to bring that date forward. The default is yours to justify, not the law’s to dictate. Many UK organisations review at regular intervals, and a figure of around two years is commonly used as the prompt, but a high-turnover hospital or a sprawling mixed-use estate may justify reviewing more often, while a small, stable, low-risk system may not need it as frequently [1]. Whatever you pick, treat the interval as a floor you can always go below when something changes, never a ceiling that licenses ignoring a trigger. The written scheme that sits alongside the assessment should make the chosen interval and its rationale explicit; ACoP L8: understanding the UK Legionella Code of Practice explains where this fits under ACoP L8.

Why you can’t just copy someone else’s interval

None of this substitutes for a competent assessor looking at your actual system. The triggers above are the usual ones, not a complete list, and the right review frequency for your building is a judgement your risk assessment has to defend on its own evidence — not a number lifted from a neighbouring site or from this page. Susceptible occupants, complex pipework and patchy use all push toward shorter intervals; simplicity and steady, full use pull the other way. If you are ever unsure whether a particular change counts as a trigger, the safe and cheap move is to treat it as one and record why you did.

Make the triggers a standing rule

The most effective single change you can make is to stop relying on memory and an annual reminder, and instead wire the triggers into processes you already run. Add a line to your change-control or permit-to-work process: any work on the water system, any change of occupancy or tenant, any new vulnerable user gets flagged to the responsible person with one question attached — does this change the assessment? Record the answer either way. Pair that with a diary prompt for the periodic review and both halves of the duty are covered without anyone having to remember them.

If your current assessment predates your last refurbishment, change of use, or long void period, you already have your trigger. Get it revisited now rather than waiting for the calendar.

FAQ

No. UK guidance sets no fixed interval. The duty is to review the assessment regularly and whenever there is reason to believe it is no longer valid; the familiar two-year figure is a common self-imposed prompt, not a statutory deadline [1].

Does a change of tenant or a refurbishment mean a brand-new risk assessment?

It means you must revisit the existing one. Whether that ends in a minor update or a full reassessment depends on how much the work changed the water system and who uses it. Building work and changes of use are both classic triggers to review [1] [3].

After a long period of low or no use, do we need to reassess before reopening?

Treat an extended void as a trigger. Water standing still during a closure can undo the assumptions behind your controls, so review the assessment and plan the recommissioning before the building returns to normal use [2].

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm