A Legionella risk assessment report earns its keep only if it changes what someone does on site next week. Plenty of reports describe a water system in immaculate detail, then leave the reader with no idea what to fix first. That gap — between a thorough survey and a usable document — is where most of them fail.

The craft is not writing more. It is writing so that a maintenance supervisor, a duty holder and an auditor each find what they need without having to decode it. A report that manages that tends to be short on adjectives and long on decisions.

Treat the report as a decision document, not a survey record

Under UK practice a Legionella risk assessment has to do four things: describe the water system, identify where the bacteria could grow or spread, work out who could be exposed, and set out the precautions needed to control the risk. The Approved Code of Practice (L8) gives that duty real weight, and BS 8580-1 sets out the code of practice for how the assessment itself should be carried out and recorded [1][2].

Meeting that brief on paper is not the same as writing something that drives control. The test is whether every finding ends in a decision — who does what, by when, and how anyone will know it worked. A duty holder keeps responsibility for acting on the report and for the records that prove control is happening; the document exists to make those obligations easy to discharge, not to park them in a binder [3].

Write the finding so it gets fixed

The single most useful habit is to write the decision, not just the observation. “Dead leg noted on the third-floor washroom supply” is an observation. It tells a maintenance team nothing about whether to act this week or next quarter.

Compare it with this. “Capped spur to a removed basin on the third-floor cold supply forms a dead leg of roughly two metres. Stagnant water here can seed the wider branch. Recommended action: cut back the redundant pipework to the live tee. Owner: building maintenance. Priority: high — complete at the next planned shutdown.” Same defect, but now it is a task with a reason, an owner and a deadline.

Do that for everything that matters — a thermostatic mixing valve overdue a service, a cold water storage tank sitting in a warm loft, an outlet nobody uses. Each one becomes a line a busy reader can act on. The risk rating is what tells them the order, so it has to be reasoned rather than asserted; acting on your risk assessment covers turning that ranking into a work plan, and Key components of a Legionella risk assessment sets out the components every report is built from.

What a usable report actually contains

Run a finished draft against this before it leaves your desk. Grouped, the test is short.

Describe the system once, clearly

  • Map every hot and cold water system with a current schematic and an asset register; flag anything you could not access or trace.
  • Name and locate the higher-risk parts — showers and spray taps, calorifiers, cold water storage tanks, any cooling tower or spa pool.

Reason the risk, don’t just rate it

  • State who could be exposed and which of those people are more vulnerable.
  • For each significant finding, give the reason it matters, not only a colour or a number.

Make every action owned and dated

  • Turn each deficiency into a specific recommendation with a named owner and a timescale.
  • Separate immediate defects from longer-term management weaknesses, and put the priority order where a reader sees it first, not in an appendix.

Leave proof the next person can check

  • Reference the written scheme of control and the records that show day-to-day controls are running.
  • Date the report, state the assessor’s competence, and set the trigger for the next review.

Where report writers go wrong

Everything rated “medium”

A risk matrix where most lines come out amber is a matrix doing no work. If the report cannot tell the reader what to tackle first, it has not finished the job. Force a genuine order, even among findings of similar severity.

”Satisfactory” with nothing behind it

Recording that a system is satisfactory only helps if the report shows why — the temperatures taken, the inspection done, the records seen. A bare “no issues found” is unverifiable, and it ages badly the moment conditions change.

Guessing past your competence

If a finding needs expertise you do not have — a sampling strategy, a design question, a scald-risk trade-off — say so and recommend the right specialist rather than inventing a figure. Sampling especially is not a routine box-tick: HSE guidance is clear that testing should follow the system and the risk assessment rather than a fixed calendar [4][5].

Length is not the same as usefulness

A forty-page report is not safer than a twelve-page one; it is just harder to act on. Photographs of the actual defects, the full asset register and the schematics belong in appendices. The body should carry the findings and the actions and little else. If the duty holder has to read to page thirty to learn what to fix, the report has buried its own point.

Before you put your name to it

A report is a record of judgement, not a substitute for it. The risk ratings, timescales and remedial actions in any assessment depend on the specific system, who uses it and how — and they belong to a competent assessor working to recognised guidance, not to a template’s defaults. Treat the advice here as a way to make your own report clearer and more usable, then let site-specific findings set the actual figures and priorities. Where a recommendation touches sampling, scald risk or system design, get the relevant specialist input before you write it down as fact.

If you are drafting or commissioning a report right now, do one thing first: write the action list before you write the narrative. Decide what a reader must do, in what order, and who owns each item — then build the description and the ratings around that. A report written action-first almost always lands better than one where the actions are an afterthought.

FAQ

What should a Legionella risk assessment report actually include?

At minimum: a description of the water systems with a current schematic and asset register, identification of where Legionella could grow or spread, who could be exposed, the control measures in place and how adequate they are, and a risk-ranked list of recommended actions with owners and timescales. BS 8580-1 sets out the recognised structure for this [2].

Who has to act on the report once it’s written?

The duty holder or responsible person. An assessor produces the findings, but acting on them — assigning the work, funding it and keeping the records that prove control — stays with the organisation running the building [3]. Outsourcing the survey does not outsource the accountability.

How often should the report be reviewed or redone?

Review it whenever the risk assessment says to, and sooner if the system, its use, the people exposed, the water treatment regime or the control evidence change. A report that no longer matches the building it describes has stopped being a control and become a liability.

Sources

[1] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [2] BSI, “BS 8580-1:2019 - Risk assessments for Legionella control. Code of practice”. https://knowledge.bsigroup.com/products/water-quality-risk-assessments-for-legionella-control-code-of-practice-1 [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm [4] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [5] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm