How often should a commercial legionella risk assessment be reviewed?

The review frequency for a commercial legionella risk assessment should be determined by the level of risk and whether the assessment still accurately describes the premises, water systems and management arrangements. There is no single interval that is suitable for every business. A low-complexity system with stable use may need less frequent formal reassessment than a large, complex or heavily occupied site, but the assessment should never be treated as a permanent document.

A review is more than checking the date on the front page. The responsible person should confirm that the assessment remains an accurate representation of the site and that its recommendations are still being applied. This normally involves checking:

• the description and schematic of the hot and cold water systems;
• the asset register, including tanks, calorifiers, showers, taps and other relevant outlets;
• the identification of areas where water may stagnate or become subject to favourable legionella growth conditions;
• the temperature control, disinfection and maintenance arrangements in place;
• the monitoring records and evidence that required checks have been completed;
• the allocation of duties between the responsible person, contractors, maintenance staff and other relevant personnel; and
• the progress and effectiveness of actions raised by earlier assessments, audits or investigations.

This review should establish whether the existing control scheme remains suitable, rather than simply confirming that paperwork exists. For example, a written procedure may appear adequate while records show repeated temperature failures, incomplete outlet flushing or unresolved maintenance issues. In that situation, the assessment should be reconsidered and the control measures strengthened. A review can also identify where the original assessment was based on incomplete information or where the system has not been described in sufficient detail.

It is useful to distinguish a legionella risk assessment review from routine water hygiene monitoring. Monitoring measures whether specified controls are operating as intended. A review considers what those results mean for the overall risk and whether the assessment, control scheme and responsibilities remain appropriate. Routine temperature checks, sampling, flushing and inspection do not replace a formal review, and a satisfactory monitoring record does not automatically make an outdated assessment suitable.

The depth of the review should be proportionate to the premises. A straightforward office system may require a focused examination of the existing assessment and supporting records. A healthcare, care, residential, industrial or multi-building site may require more detailed verification, particularly where there are multiple systems, vulnerable occupants, cooling equipment, stored water or difficult-to-manage outlets. The person carrying out the work should have suitable knowledge, experience and competence for the complexity of the site.

Where the review identifies deficiencies, the findings should be recorded in a clear action plan. Each action should state what needs to be done, who is responsible, the required priority and how completion will be verified. Merely recording a recommendation without following up its implementation leaves uncertainty about whether the risk has actually been controlled.

Businesses should retain the current assessment alongside previous versions, monitoring records, sampling results, maintenance information and evidence of completed corrective work. Keeping an audit trail makes it possible to demonstrate how the assessment has developed and why the chosen review approach remains reasonable. It also helps a new responsible person or contractor understand the history of the system without relying on informal knowledge.

A review should lead to a clearly recorded conclusion, such as:

• the assessment remains suitable and no amendments are required;
• the assessment remains broadly suitable but specific control measures or records must be updated; or
• a new or substantially revised assessment is required.

When deciding whether the document remains current, the responsible person should consider the findings of internal checks, external audits, laboratory results, maintenance reports and any concerns raised by building users or contractors. Patterns are particularly important: an isolated administrative error may require a record correction, whereas repeated control failures may indicate that the underlying risk assessment no longer reflects the way the system is operated.

Following a review, the document should show the date, scope, reviewer, findings, actions and next planned review point. The outcome should be communicated to everyone with a role in water safety, with relevant procedures and training updated where necessary. This creates a practical link between the assessment and day-to-day management, which is essential for maintaining legionella controls over time.