How frequently should HSG274 risk controls be reviewed?

HSG274 risk controls should be reviewed through a planned process that confirms the control scheme remains suitable, is being followed and is supported by reliable evidence. The formal review is separate from the day-to-day checks carried out on the water system: routine monitoring identifies whether controls are working, while the review considers whether the overall approach is still appropriate.

There is no single review interval that suits every premises. The required level of review depends on the complexity of the water systems, the population potentially exposed, the condition and use of the building, the quality of monitoring data and the effectiveness of the responsible person’s arrangements. A higher-risk or more complex site may need more frequent management review than a straightforward system with stable operating conditions.

A proper review should examine the complete written control scheme rather than focusing only on temperature readings or sampling results. It should consider:

• whether the asset register and system descriptions still reflect the installation;
• whether all relevant outlets, storage vessels, distribution pipework and secondary systems are included;
• whether control limits, inspection frequencies and remedial actions remain suitable;
• whether monitoring records are complete, accurate and reviewed by someone with appropriate authority;
• whether identified failures have been investigated and corrected effectively;
• whether responsibilities are clearly allocated and understood by staff, contractors and duty holders; and
• whether training, competence and supervision remain appropriate for the tasks being undertaken.

The review should also test whether the written scheme reflects the way the premises actually operates. A document can appear complete while no longer matching occupancy patterns, operating procedures, access arrangements or the equipment in use. Comparing the scheme with a site inspection, current drawings, maintenance information and monitoring records can reveal gaps that a desk-based check may miss.

Routine monitoring does not replace formal review. Temperature checks, flushing records, inspection findings, cleaning records and laboratory results provide evidence about performance at particular points in time. The formal review interprets that evidence over time. Repeated marginal results, missed checks, recurring corrective actions or unexplained variation may indicate that the control strategy needs refinement, even where an individual result has not exceeded an action level.

Review findings should be recorded in a way that demonstrates what was examined, who carried out the review, when it took place and what decisions followed. Where changes are needed, the record should identify the action, responsible person, target date and completion evidence. Simply signing or dating an existing assessment does not demonstrate that the controls have been critically evaluated.

It is useful to distinguish between three related activities:

1. Operational checks: regular tasks such as temperature monitoring, flushing, inspection and maintenance.
2. Control-scheme review: an assessment of whether procedures, responsibilities and control measures remain suitable and are being implemented.
3. Risk-assessment review: a wider evaluation of foreseeable legionella risks, including whether the assessment remains valid for the system and its users.

These activities may take place at different times, but their results should inform one another. For example, a review of monitoring records may identify a weakness in the written scheme, while a revised risk assessment may require changes to inspection or sampling arrangements. Keeping the documents aligned prevents the risk assessment, written scheme and site records from becoming separate, inconsistent systems.

The person conducting the review should have sufficient knowledge of legionella risks, the relevant water systems and the organisation’s control arrangements. Where the installation is technically complex, specialist input may be appropriate. The duty holder remains responsible for ensuring that the review is acted upon, even where assessment, testing or auditing work is commissioned from an external provider.

Blue Fish Water Management supports businesses with legionella risk assessments, water testing, compliance audits, system monitoring and remedial advice across the UK. Its role can include examining whether existing controls are properly documented, practical to operate and supported by suitable evidence, helping organisations maintain a defensible approach to HSG274 compliance.