How often should a legionella risk assessment be reviewed?

A legionella risk assessment should be treated as a live management document rather than a report that can be filed and forgotten. Its review date should be determined by the risk profile of the premises, the complexity of the water systems and the reliability of the information on which the assessment was based. The assessment remains suitable only while its findings, assumptions and control arrangements accurately reflect the site.

In practice, a review should confirm that:

• the responsible person and other duty holders are correctly identified;
• the description and schematic drawings of the water systems remain accurate;
• all relevant outlets, storage vessels, plant rooms and little-used assets are included;
• the people who may be exposed have been identified, including anyone who may be more susceptible to illness;
• the sources of risk and existing control measures have been assessed correctly;
• control limits, monitoring arrangements and corrective actions remain appropriate; and
• recommendations from the previous assessment have been completed, prioritised or formally carried forward with a reason.

A review is not necessarily the same as commissioning a completely new assessment. Where the system, building use and control arrangements are unchanged, a competent person may be able to examine the existing assessment, verify the supporting evidence and record that it remains suitable. If information is missing, conditions have altered substantially or the original assessment no longer provides a reliable basis for control, a new or significantly revised assessment is more appropriate.

The review should be evidence-led. Useful evidence may include monitoring records, temperature checks, disinfection or cleaning records, water test results where testing is part of the control strategy, maintenance reports, incident or complaint records, and records showing that remedial actions have been closed. Reviewing these documents can identify a difference between the controls described on paper and the way the system is actually operated.

Any limitations should be recorded clearly. For example, an inaccessible tank, an unidentified pipe run or an outlet that could not be inspected may affect the confidence that can be placed in the assessment. The review should state what remains uncertain, what action is required, who is responsible and how completion will be verified.

The outcome should include a dated review record and, where necessary, an updated assessment, schematic, written control scheme or action plan. The record should explain why the assessment remains valid or why it has been revised. It should also identify the next planned review point and the circumstances that would require the assessment to be considered again before that date.

Responsibility for arranging the review normally rests with the person who has overall responsibility for the premises or water system. The technical work should be carried out by someone with suitable competence for the complexity and risk of the system. A responsible person should not rely solely on the existence of a signed report; they need to understand its findings and ensure that the recommended controls are implemented and maintained.

This approach reflects the principles in the UK Health and Safety Executive’s guidance, including the importance of keeping the assessment suitable and sufficient and maintaining effective control of the risk. A recorded review provides evidence that the assessment is being actively managed and supports a defensible compliance process.