What does legionella compliance require from a duty holder?

A duty holder must be able to show that the risk of Legionella has been identified, assessed and controlled through a suitable management system. This means understanding who may be exposed, how the water systems operate, which control measures are necessary, who is responsible for them and how their effectiveness will be demonstrated.

Identify the duty holder and responsibilities

The duty holder is usually the employer, owner, landlord or person with control of premises and water systems. In larger organisations, responsibility may be shared between an overall duty holder, a nominated responsible person, facilities teams, contractors and site managers. Those arrangements should be explicit rather than assumed. Each person needs defined authority, suitable competence and enough resources to carry out the tasks assigned to them.

Where a business uses managing agents, maintenance contractors or specialist water hygiene providers, appointing them does not automatically remove the duty holder’s legal responsibility. The duty holder should check that contractors understand the system, work to an appropriate method and provide evidence of completed work. Interfaces between different organisations should also be clear, particularly where one party controls the building and another controls the water services.

Maintain a suitable risk assessment

The assessment should cover the entire relevant water system, not just outlets where exposure is most obvious. It should consider system design, storage, distribution, temperatures, stagnation, dead legs, low-use outlets, equipment that generates aerosols and any activities that could release contaminated droplets. It should also identify people who could be exposed and those who may be more susceptible to serious illness, including older people, smokers and anyone with impaired immunity or underlying respiratory conditions.

A competent assessor needs access to accurate system information and the practical ability to recognise conditions that may encourage Legionella growth. The assessment should distinguish between hazards that are present and controls that are actually working. A generic document that does not reflect the installation, building use or current operating arrangements is unlikely to provide an adequate basis for compliance.

Put a written control scheme into practice

The risk assessment should lead to a written scheme describing the precautions required for the specific premises. Depending on the installation, this may include managing hot and cold water temperatures, preventing stagnation, maintaining tanks and calorifiers, controlling contamination, cleaning and disinfecting relevant equipment, and managing outlets or devices that create aerosols. The scheme should state what is checked, how it is checked, acceptable results, the action required when results are outside the control limits, and who must act.

Controls must be practical for the way the building is used. Periods of low occupancy, changes in room use, alterations to pipework, new equipment, water interruptions and recommissioning can all affect the risk. Water systems should not be treated as static assets: the control scheme needs to remain aligned with their design, condition and operation.

Provide competent management and training

People carrying out risk assessments, temperature checks, sampling, cleaning, disinfection, maintenance or remedial work must have the knowledge and practical competence appropriate to those tasks. Training should cover the relevant water systems, the control scheme, safe working methods, escalation procedures and the limits of the individual’s authority. Competence is not established solely by attending a course; it also depends on experience, supervision and the ability to interpret findings correctly.

Staff who operate or occupy the premises should know how their actions affect water safety. For example, a change to occupancy, an isolated outlet or a maintenance intervention may need to be reported because it can alter the risk profile. Contractors should receive the information needed to work safely and should return clear documentation when tasks are complete.

Monitor, maintain and act on deviations

Monitoring should test whether the specified controls are being maintained, rather than becoming a routine exercise with no follow-up. Results that indicate loss of control need investigation and proportionate corrective action. This may involve checking equipment, increasing monitoring, restoring circulation, removing stagnation, cleaning or disinfecting components, repairing defects or obtaining specialist advice.

Corrective action should have an owner and a completion trail. If a problem cannot be resolved immediately, the duty holder should assess the interim risk and apply suitable precautions until permanent work is completed. Where there is a suspected exposure, confirmed contamination or a significant control failure, the response should follow the site’s escalation arrangements and relevant public health or regulatory guidance.

Keep evidence that the system is controlled

Compliance depends on more than having a risk assessment on file. The duty holder should retain the documents needed to demonstrate how the system is managed, such as the current assessment and written scheme, responsibilities, monitoring results, maintenance and cleaning records, sampling reports, training evidence, remedial actions and review decisions. Records should be attributable, legible and sufficiently detailed to show what was checked, when, by whom and what happened when a result was unsatisfactory.

Documentation should be available to the people who need it, including those responsible for day-to-day operation and those reviewing the arrangements. It should also be protected from uncontrolled alteration. Poor records can conceal repeated failures, make trends difficult to identify and prevent an incoming manager or contractor from understanding the system.

Review arrangements when circumstances change

A review is required when the water system, building use, occupancy, equipment, management responsibility or control results change in a way that could affect Legionella risk. Significant alterations, refurbishment, long periods of disuse, changes to vulnerable occupants or repeated monitoring failures should prompt a structured review rather than reliance on the previous assessment.

The practical test is whether the duty holder can demonstrate informed control: a suitable assessment, appropriate precautions, competent implementation, evidence of monitoring and a defined response when conditions are not acceptable. Blue Fish Water Management Ltd supports this process through legionella risk assessments, water hygiene monitoring, UKAS-accredited testing, compliance audits, training and remedial works, where specialist input is needed to verify or improve a water safety regime.