What happens if a legionella risk assessment is overdue?

An overdue legionella risk assessment means the organisation may be unable to demonstrate that its current water systems, building use and control arrangements have been assessed at an appropriate point. There is no universal legal rule requiring every assessment to be renewed annually; the necessary review interval depends on the level of risk and whether relevant circumstances have changed. However, allowing a required review to pass without action can leave a significant gap in the dutyholder’s management arrangements.

It does not automatically mean that people have been exposed to legionella. An overdue assessment is an indication that the evidence supporting the control strategy may no longer be current. The risk may have changed because of alterations to pipework or plant, changes in occupancy, periods of low or intermittent use, changes to water temperatures, refurbishment, or a change in the people using the premises. Even where the physical system appears unchanged, management responsibilities, maintenance arrangements and monitoring records may need reassessment.

Potential consequences include:

• uncertainty about whether existing control measures remain suitable;
• failure to identify newly accessible outlets, redundant pipework, stagnation points or changes in water demand;
• inconsistent instructions for staff, contractors or anyone responsible for temperature checks, flushing and remedial work;
• difficulty demonstrating that the dutyholder has taken reasonably practicable steps to control a foreseeable health risk; and
• weaker evidence if an incident, complaint, inspection or investigation later requires the organisation to show how legionella risk was managed.

Under the Health and Safety at Work etc. Act and the Management of Health and Safety at Work Regulations, employers and other dutyholders must manage risks to health and safety. Legionella control is also addressed through the principles in the Health and Safety Executive’s Approved Code of Practice L8 and associated guidance. Where a business has control of premises or water systems, it should be able to identify who is responsible, assess the risk, implement suitable controls and keep management arrangements under review.

An overdue assessment is not, by itself, proof of a breach or proof that an outbreak will occur. The seriousness depends on the nature of the premises, the people exposed, the complexity of the water system, the effectiveness of existing controls and the length of time since the assessment ceased to reflect actual conditions. Nevertheless, a prolonged or unexplained gap can attract scrutiny from enforcing authorities. Depending on the circumstances, inadequate arrangements may contribute to enforcement action, including an improvement notice, and more serious breaches may lead to prosecution.

The appropriate response is to establish the current position and restore a defensible management record:

1. Confirm when the last assessment was completed, what systems and areas it covered, and why a further review was expected.
2. Identify changes since that assessment, including alterations, occupancy changes, periods of closure, changes to contractors and any incidents involving water quality or control failures.
3. Have the system and its management arrangements reviewed by a person with suitable competence and experience. The extent of the review should reflect the risk rather than being treated as a paperwork exercise.
4. Check relevant records, such as temperature monitoring, flushing, cleaning, disinfection, maintenance, sampling, remedial works and training.
5. Update the written assessment and associated control scheme where the findings require it, with named responsibilities and clear actions.
6. Prioritise and complete remedial measures, retaining evidence of decisions, completed work and any follow-up checks.

Where the overdue status is discovered during routine management, existing precautions should continue while the review is arranged. This may include maintaining established temperature controls, avoiding unnecessary stagnation, following outlet-flushing procedures and escalating any failed checks through the organisation’s responsible person. These measures support risk control but do not replace a suitable assessment when the previous one is no longer reliable.

Water sampling can provide useful evidence in some circumstances, but a test result is not a substitute for assessing the whole system and the way it is managed. Similarly, a clean result does not remove the need to understand system design, temperatures, use patterns and maintenance controls. The completed review should therefore explain the reasoning behind the control measures, not simply record a test outcome.

If there are signs of a possible legionnaires’ disease case, repeated control failures, major system changes or an immediate concern about exposure, the matter should be escalated through the organisation’s health and safety procedures and appropriate professional or public health channels. The priority is to establish whether additional precautions, investigation or remedial action are needed, while preserving relevant monitoring and maintenance records.

Once the review is complete, the next review point should be based on the findings and the factors that could alter the risk. A calendar reminder can help, but it should not be the only trigger: significant changes to the system, building use, occupancy, control arrangements or evidence of failure should prompt an earlier review.