What does a commercial legionella risk assessment include?

A commercial legionella risk assessment is a structured review of a premises’ water systems, how they are used and managed, and the conditions that could allow Legionella bacteria to grow or spread. The assessment should produce a clear record of significant risks, the controls already in place, and actions needed to manage those risks in line with the principles of the Health and Safety Executive’s ACOP L8 and HSG274 guidance.

For a commercial property, the assessment commonly covers the following areas:

• Responsibility and management arrangements: The assessor identifies who has overall responsibility for water safety, who carries out routine monitoring and maintenance, and whether duties have been allocated to suitably competent people. Where several organisations occupy or maintain a building, the assessment should also consider how responsibilities are divided and communicated.
• System information and asset identification: The review records the relevant hot and cold-water services, storage vessels, calorifiers, distribution pipework, outlets, thermostatic mixing valves, showers, taps and other components. Any available schematics, asset registers and previous maintenance records are considered, with gaps identified where system information is incomplete.
• How the water systems operate: The assessor considers the system’s design, temperatures, flow patterns, storage arrangements and points of use. Areas with low or intermittent use, redundant pipework, poor circulation or difficult-to-access components may require particular attention because they can create conditions favourable to bacterial growth.
• Sources of risk: The assessment examines factors such as inadequate temperature control, stagnation, scale, sediment, corrosion, contamination, dead legs and infrequently used outlets. It also considers whether equipment such as showers, spray taps or spa-type features could generate aerosols, which are the main route by which contaminated water can present a legionella exposure risk.
• Higher-risk users and activities: The assessor takes account of the people who may be exposed, the way the premises is occupied and the activities undertaken there. Particular consideration may be needed where water systems serve healthcare settings, care environments, residential accommodation, industrial processes or people who may be more vulnerable to serious infection.
• Existing control measures: Current measures are checked against the risks identified. These may include temperature checks, flushing of seldom-used outlets, cleaning and disinfection, inspection of tanks, maintenance of water heaters, removal of redundant pipework and arrangements for managing changes in occupancy or system use. The assessment should consider whether controls are suitable, consistently applied and supported by reliable records.
• Monitoring, maintenance and competence: The assessor reviews monitoring schedules, maintenance procedures, escalation arrangements and staff or contractor competence. Records should demonstrate what has been checked, when it was checked, the result, any corrective action and who completed the task. A procedure that exists only on paper may not be sufficient if it is not being followed or reviewed.
• Sampling and testing, where justified: A risk assessment does not automatically require water samples in every building. Sampling may be recommended where the system history, conditions, symptoms, control failures or other findings indicate that microbiological investigation is appropriate. If samples are taken, they should be collected from representative locations and sent for suitable laboratory analysis; the results then need to be interpreted alongside the wider system findings.

The completed report normally explains the significant findings in a form that the responsible person can use. It should describe the systems assessed, record relevant limitations or inaccessible areas, identify deficiencies and assign practical remedial actions. Recommendations may include improving temperature control, removing dead legs, repairing insulation, revising flushing arrangements, cleaning storage tanks, updating schematics or arranging further investigation.

Good reporting distinguishes between immediate risk-control measures, planned improvements and routine management tasks. It should also make clear who is responsible for each action and whether specialist work, monitoring or verification is needed. This prevents the document becoming a general list of observations with no usable route to completion.

A commercial assessment is not a one-off substitute for ongoing control. The findings should be incorporated into the site’s written control scheme and reviewed when there are changes to the building, water services, occupancy, ownership, maintenance arrangements or use of outlets. It should also be revisited when monitoring identifies persistent problems or when the existing assessment no longer reflects the system.

For organisations commissioning an assessment, useful information to provide includes existing schematics, asset lists, temperature records, cleaning and disinfection certificates, maintenance logs, previous test results, details of known system changes and the names of responsible personnel. Providing this information helps the assessor compare documented arrangements with conditions found on site and identify where further evidence is required.