Skip to content
Legionella.io
47 articles

Legionella Risk Assessment

Doing, reading and acting on a risk assessment that reflects your building rather than a template.

A Legionella risk assessment is a structured examination of a building's water systems to identify where Legionella could grow and spread, who could be exposed, and what needs to be done to control the risk. It is the foundation of the whole control regime: under HSE's ACoP L8, carrying out a suitable and sufficient assessment is a legal expectation for almost every employer, landlord and person in control of premises with a water system. Everything else, from temperature checks and flushing to cleaning and record keeping, should flow from what the assessment finds.

A good assessment is specific to your building, not a template with the address changed. It maps the actual system: incoming supply, cold water storage, calorifiers and water heaters, the pipework, every outlet, and any risk systems such as cooling towers, spa pools, humidifiers or sprinklers. It looks for the conditions Legionella favours, including water held in the growth range, stagnation in dead legs and little-used outlets, scale, sediment and biofilm, and it considers who uses the building, including any particularly vulnerable people. The output is not just a hazard list; it is a written assessment with a prioritised, actionable set of recommendations, usually supported by a schematic and an asset register of the system.

The standard most assessors work to is BS 8580-1, which describes how a competent assessment should be scoped and conducted. Competence matters here: the person doing the assessment needs genuine knowledge of water systems and of Legionella, whether they are in-house or a contractor. A cheap assessment that misses a hidden dead leg or an unmanaged calorifier is worse than none, because it creates false confidence.

Two questions come up constantly. How often should it be reviewed? There is no fixed interval in law. The common expectation is that an assessment is reviewed regularly and, crucially, whenever something changes: alterations to the system, a change of use, new vulnerable occupants, or results suggesting the controls are not working. A frequently cited rule of thumb is a review at least every two years, but your own assessment should set the figure for your site. And does a 'no significant risk' finding end the matter? It can, but it must be justified, recorded, and revisited if circumstances change.

This section covers what a risk assessment contains, when to commission or review one, how to read and act on the report you are handed, and how to tell a thorough assessment from a tick-box exercise. Treat what follows as general guidance to be applied through a competent, site-specific assessment, with the detail confirmed against current HSE and BSI sources.

All 47 articles in risk assessment