Is an annual legionella risk assessment always required?

No, an annual legionella risk assessment is not automatically required for every premises. Under UK health and safety requirements, the assessment must be suitable and sufficient, kept valid, and reviewed when it may no longer reflect the risks. The appropriate interval therefore depends on the water system, the people exposed, the effectiveness of existing controls and any changes to the building or its use.

The main legal principles come from the Control of Substances Hazardous to Health Regulations and the associated HSE guidance in ACOP L8 and HSG274. These require dutyholders to assess the risk from exposure to legionella, appoint a competent person to help manage the risk, implement suitable controls and review the assessment regularly. They do not impose a universal annual assessment date for every type of organisation.

An annual review may nevertheless be appropriate where the consequences of exposure are significant or the conditions are liable to change. This can include premises accommodating people who may be more vulnerable to Legionnaires’ disease, complex domestic hot and cold water systems, healthcare-related settings, buildings with multiple outlets or storage tanks, and sites where control measures have previously been unreliable. Sector-specific guidance, client requirements, insurers, contracts or internal water safety policies may also set a shorter review interval.

A new or revised assessment should be considered when there has been a significant change, such as:

• alterations to the water system, including new outlets, tanks, calorifiers, showers or treatment equipment;
• changes to the building’s occupancy, operating arrangements or vulnerable population;
• extended periods of low occupancy or disuse;
• changes in water usage, temperature control or maintenance arrangements;
• repeated adverse monitoring results, evidence of stagnation or problems with disinfection;
• an incident, suspected case of Legionnaires’ disease or positive legionella result; or
• changes to the organisation responsible for managing the system or to the appointed competent person.

A review is not simply an administrative exercise. It should check whether the description of the system remains accurate, whether risks have changed, whether responsibilities are clear and whether control measures are being carried out as intended. It should also take account of monitoring records, temperature results, sampling findings, maintenance reports, training records and any remedial work completed since the previous assessment.

It is important to distinguish the risk assessment from routine control activity. A site may not need a completely new assessment every year, but it may still need regular temperature checks, inspection, cleaning, disinfection, flushing, monitoring and record-keeping. These controls provide evidence about whether the assessment remains reliable. A routine monitoring schedule must not be treated as a substitute for reviewing the underlying risk assessment when circumstances have changed.

For relatively straightforward premises with stable occupancy, a well-understood system and consistently effective controls, a competent person may conclude that an annual full assessment is unnecessary. That conclusion should be documented and supported by the available evidence, including the reasons for the chosen review interval and the events that would trigger an earlier review. A longer interval is not a permanent exemption from review.

Conversely, completing an assessment every year does not by itself demonstrate compliance. An assessment can be inadequate if it is based on outdated information, fails to identify dead legs or insufficiently used outlets, omits vulnerable occupants, or does not reflect how the water system is actually operated. Quality, accuracy and follow-through matter more than applying an identical calendar date to every site.

The dutyholder should retain the current assessment, previous versions where relevant, monitoring records and evidence of corrective actions. Where an assessment identifies deficiencies, the responsible person should record the action required, assign responsibility and confirm that the issue has been addressed. This creates a defensible audit trail and helps demonstrate that the review process is active rather than purely paper-based.

Blue Fish Water Management can help organisations determine an appropriate review schedule by examining the system risk, operating arrangements, monitoring history and any changes since the previous assessment. Its wider water hygiene services include legionella risk assessments, compliance audits, UKAS-accredited water testing, system monitoring, training and remedial works, allowing identified control issues to be considered alongside the assessment rather than in isolation.

In practice, the safest approach is to set a documented review frequency with a competent person, while requiring an earlier review whenever the system, building, occupancy or evidence of control changes. An annual assessment may be the right decision for a particular site, but it should be justified by the site-specific risk rather than assumed to be a universal legal requirement.