Is a commercial legionella risk assessment required for every business?

A commercial legionella risk assessment is not automatically required in an identical form for every business. The legal duty is to identify and control any reasonably foreseeable risk of exposure to Legionella bacteria arising from work activities, premises or water systems. Where the assessment identifies a meaningful risk, the responsible person should have a suitable, sufficient and properly documented assessment, supported by appropriate control measures.

The need for an assessment depends on how water is stored, heated, distributed and used, as well as who could be exposed. Factors that commonly increase risk include:

• stored hot or cold water, particularly where water can stagnate;
• large, complex or shared water systems;
• infrequently used outlets, dead legs or redundant pipework;
• showers, spa pools, cooling towers or other equipment that creates an aerosol;
• water temperatures that allow bacteria to multiply;
• poor system maintenance, scale, corrosion or debris;
• occupants or workers who may be more susceptible to serious illness; and
• activities involving cleaning, maintenance or other contact with contaminated water.

A small workplace with a simple, regularly used mains-fed water supply may present a relatively low risk. That does not mean the business can assume that no assessment is needed. It should still consider the relevant water systems, how they are used and whether conditions could change. The reasoning behind a low-risk conclusion should be recorded, particularly where the business has employees, contractors, visitors or other people who could be exposed.

For businesses that control premises or water systems, the assessment forms part of wider health and safety arrangements. The relevant duties can arise under health and safety legislation and the Control of Substances Hazardous to Health framework, where work activities could expose people to a biological agent such as Legionella. The Health and Safety Executive’s Approved Code of Practice and guidance on the control of legionella bacteria in water systems, commonly known as HSG274 and ACOP L8, are important references for businesses in Great Britain. Organisations in Northern Ireland should also consider the guidance and requirements applying in that jurisdiction.

The law does not prescribe one universal document called a “commercial legionella risk assessment”, nor does it require every business to use an external specialist. However, the assessment must be suitable for the premises and sufficiently detailed to demonstrate that relevant risks have been considered. A generic template that does not reflect the actual systems, outlets, equipment and users is unlikely to provide reliable evidence of adequate management.

A suitable assessment will normally identify:

• the person with day-to-day responsibility for legionella control;
• the water systems and equipment within the business’s control;
• the sources and routes of possible exposure;
• people who may be exposed, including employees, visitors, contractors and vulnerable individuals;
• existing precautions and monitoring arrangements;
• gaps, defects or conditions that could increase risk; and
• actions required, the person responsible for them and the intended timescale.

The assessment is only one part of compliance. Its findings should lead to a written control scheme proportionate to the identified risk. This may include temperature management, flushing of little-used outlets, cleaning and disinfection, inspection of tanks and associated equipment, sampling where justified, and records showing that planned controls have been completed. Staff or contractors carrying out relevant tasks should have suitable information, instruction and training.

Responsibility usually rests with the employer, landlord, facilities manager, building owner or other person who has control of the premises or water system. In multi-occupancy buildings, duties may be divided between several parties. Contracts should make clear who manages the system, who arranges maintenance, who keeps records and who acts when a defect or elevated result is identified. A business cannot reliably demonstrate control if responsibility is left undefined.

Even where an initial assessment concludes that the risk is low, it should be reviewed when circumstances change. Relevant triggers include alterations to plumbing, changes in occupancy or building use, periods of vacancy, installation of new water equipment, changes to maintenance arrangements, evidence of stagnation or contamination, and any suspected or confirmed case of legionellosis. A scheduled review is also sensible so that the document remains accurate rather than becoming a historical record.

Businesses may face enforcement action if they cannot show that foreseeable risks have been assessed and controlled, or if their arrangements are not being followed. The absence of an assessment is particularly problematic where the premises contain complex water systems, aerosol-generating equipment or people who may be especially vulnerable. A documented assessment also helps demonstrate why particular controls, monitoring frequencies and remedial actions have been selected.

Blue Fish Water Management can provide advice on the scope of a commercial legionella risk assessment, including the information needed to understand the site and its water systems. The appropriate level of investigation should be based on the actual risk rather than on a one-size-fits-all assumption that every business is either automatically exempt or automatically requires the same programme.