What records should be kept to demonstrate HSG274 compliance?

A defensible HSG274 record set is an auditable trail showing how water-system risks were identified, controlled, checked and addressed. Each entry should be dated, attributable to a named person or organisation, linked to the relevant outlet or system, and detailed enough for another competent person to understand what was done and what the result meant.

Record the detail behind each activity. A brief tick or statement such as “temperature checked” may not provide sufficient evidence. Suitable records should identify:

• the building, system, plant or outlet inspected;
• the date and, where relevant, time of the activity;
• the person who carried it out and their role or competence;
• the method used and the equipment involved;
• the actual readings, observations or sample results, rather than only a pass or fail outcome;
• any access restrictions, areas not checked or information that could not be obtained; and
• the required action, responsible person and completion status where a result is outside the expected control range.

For temperature monitoring, for example, retain the individual temperature readings and identify the outlets or parts of the system to which they relate. For sampling, retain the laboratory report, sample locations, collection details and interpretation of any adverse result. This allows results to be compared over time and helps establish whether an isolated result or a developing loss of control is involved.

Keep evidence of decisions and follow-up. HSG274 compliance is not demonstrated by recording problems without showing how they were managed. Where a control measure is missed or a result is unsatisfactory, the file should show the risk considered, the interim precautions applied, the corrective work authorised and the evidence that the issue was closed. If an action remains outstanding, the record should explain why, identify its priority and set out the next review point.

Supporting evidence can include contractor service reports, laboratory correspondence, photographs of defects or completed work, purchase orders, invoices for remedial activity and meeting or review notes where they record a water-safety decision. These documents should be connected to the relevant action rather than stored as unrelated attachments.

Maintain document control. Keep dated versions of the risk assessment, written scheme and associated procedures so that it is clear which version was in force when an inspection or monitoring result was produced. Superseded documents should not be deleted if they are needed to explain historical decisions, but they should be clearly marked as obsolete. Electronic systems should restrict unauthorised changes and preserve an audit trail where practicable. Paper records should be legible, signed or otherwise attributable, and protected from loss or damage.

Retain records for an appropriate period. HSE’s Approved Code of Practice L8 states that records of monitoring, inspections, tests and checks, together with their results, should generally be retained for at least five years. A responsible person should also consider longer retention where it is needed to show the history of a higher-risk system, support contractual requirements, meet another legal duty or explain an unresolved issue. The retention policy should specify who stores the records, where they are held and how they can be retrieved.

Records should be available to the people responsible for managing the premises and to those carrying out inspections, audits or technical reviews. If an external water hygiene provider performs part of the programme, the duty holder should still retain sufficient underlying information to understand the findings and demonstrate that recommendations have been considered. A contractor’s report alone may not show how the organisation responded to an identified risk.

Review the record system itself. Periodic checks should confirm that required entries are present, results are being recorded consistently, overdue actions are visible and trends are escalated. Repeated low temperatures, recurring outlet failures, missing samples or repeated remedial recommendations may indicate that the control scheme needs reconsideration. The review should be documented, including any change made to procedures, monitoring frequency, responsibilities or system management.

In practice, the strongest HSG274 evidence is a coherent record trail rather than a collection of isolated certificates. Someone reviewing the file should be able to follow the link between the risk assessment, the control arrangements, the recorded findings, the response to exceptions and the subsequent review without relying on informal explanations.