A Legionella control plan almost never fails on the day it is signed off. It fails quietly, months later — when a flush gets skipped, a sensor drifts a few degrees, a contractor’s remedial action sits open, and nobody notices until a sample comes back positive or an inspector asks to see the records.
So the useful question is not “was the plan any good?” but “where did control drift, who could have caught it, and what stops it coming back?” Treat each failure — a missed task, an odd reading, a complaint about a smelly outlet — as a fault to diagnose rather than a box to re-tick.
Plans drift, they don’t snap
Most plan failure causes are dull and repeatable: no current risk assessment, temperature control that slips out of range, flushing that gets missed, contractor work that nobody checks, records that don’t actually prove anything, and remedial actions that get raised but never closed. None of these is dramatic. That is exactly why they survive — each one looks small in isolation, and the logbook keeps saying “done”.
The trap is reading the plan as a document instead of a live system. A scheme that was sound for the building two years ago can be quietly wrong today: a new tenant, a decommissioned wing, a refurbished shower block, a change of contractor. The paper didn’t fail. The building moved and the plan didn’t follow.
Working back from the symptom
Fault-finding beats re-auditing. Start with what you can actually see — a reading, a result, a complaint, a gap in the log — and trace it back to the control that lapsed. The table below maps the symptoms that turn up most often to their usual root cause, the check that confirms it, and the fix.
| What you’re seeing | Likely root cause | The check that confirms it | What to do about it |
|---|---|---|---|
| Temperature logs that are always comfortably in range | Readings copied forward, not actually taken | Re-measure an outlet yourself and compare it to the logged figure; check the sensor’s calibration date | Recalibrate, re-measure independently, and make sure whoever logs knows what an out-of-range reading should trigger |
| A flush ticked off for weeks, yet the outlet still tests positive | The flush is nominal — wrong outlet, too brief, or a dead leg it never reaches | Walk the pipe run and compare the asset register to what is actually plumbed in | Correct the asset register, relocate or extend the flush, and remove the dead leg where you can |
| A risk assessment on file but no recent review | It predates a refurbishment, change of use, or occupancy change | Compare the assessment date with the last change to the building or how it is used | Commission a review against the current system, not the one on paper |
| Contractor reports all green, but the same actions reappear | Nobody owns closing actions; oversight stops at filing the report | Pull every remedial action from the last 12 months and count how many are genuinely closed | Give the action list a named owner and review open items at management level |
| An outlet sat unused for weeks before anyone noticed | No escalation path — a missed task vanishes into the logbook | Check whether a missed task actually triggers anything | Build escalation into the written scheme: missed, then flagged, then reviewed |
The pattern worth spotting: if the same weakness shows up in more than one place — two sites with copied temperature logs, three outlets with no real flush — it is a system failure, not a one-off defect. Fix the system, not just the symptom in front of you.
The failure behind most of the failures
Strip the list back and one cause sits behind most of the others: nobody with authority actually reads the evidence. Risk assessments, monitoring records and contractor reports get filed, not interrogated. As long as paperwork exists, everyone assumes control exists.
In my view this is the single biggest fix available. Put a competent person in front of the evidence on a set cadence and ask three blunt questions of each control: why does it exist, what result is acceptable, and what happens when the result is out of limits. A flush logged on a dead leg, or a flawless temperature record from an uncalibrated probe, looks fine on file and fails in reality — and only a real review catches the difference. UK guidance frames competent Legionella management as exactly this loop: assess foreseeable risk, apply proportionate controls, monitor the evidence, and review when people, plant or use patterns change [1][2].
It also helps to record the decision, not just the task. “This outlet is flushed weekly because use is intermittent; a missed flush escalates to the responsible person; repeated misses trigger a use-pattern review” tells the next person why the control exists. A bare tick does not. Many of the assessment-level mistakes that feed these failures are covered in risk assessment errors that lead to Legionella growth.
When to stop diagnosing and escalate
Some symptoms are past the point of working through a table. A positive result at an outlet used by vulnerable people, repeated systemic gaps across a site, or any suspected case linked to your building should pull in competent specialist help and your senior management at once — not wait for the next scheduled review. Accountability for control stays with the duty holder and does not transfer to a contractor along with the tasks [3]. Sampling can support an investigation, but how often you test and what you do with the result should follow the system and the risk assessment, not a fixed calendar [4].
Before you rely on any of this
These failure modes are common, not universal. Your system, your users and your control strategy decide which ones apply and what an acceptable result looks like, so treat the above as a prompt for a competent, site-specific assessment rather than a substitute for one. Where a symptom hints at possible exposure or a health concern, get qualified advice quickly instead of finishing the checklist first.
FAQ
What’s the most common reason a control plan fails an HSE inspection?
Rarely a single dramatic gap. It is usually a chain: a risk assessment that no longer matches the building, records that log tasks without proving they controlled anything, and remedial actions raised but never closed. Inspectors look for whether foreseeable risk was assessed, controlled, monitored and reviewed [3].
If our records look complete, does that mean the plan is working?
Not on its own. Complete records prove tasks were logged, not that they did their job. A flush recorded on a dead leg, or a tidy temperature log from a drifting sensor, both look fine on paper. Spot-check a sample of records against the physical system before you trust them.
Should one positive Legionella result mean the whole plan has failed?
No. A single positive is a signal to investigate, not a verdict on the system. The real failure is being unable to explain why it happened or which control lapsed — that blind spot, not the count itself, is what needs fixing [4].
Sources
[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm