How often should legionella risk assessments be reviewed?
There is no single legally prescribed interval for reviewing a legionella risk assessment; it should be reviewed regularly in proportion to the level of risk and whenever circumstances change. A review is particularly important after alterations to the water system, changes in building use or occupancy, control failures, or a case of suspected or confirmed legionnaires’ disease.
A legionella risk assessment should normally be reviewed at least every two years, and sooner where the level or nature of risk requires it. The two-year point is a useful minimum benchmark from UK guidance, not a substitute for professional judgement: a higher-risk site may need more frequent review, while a low-risk system must still be reassessed if its circumstances change.
The review interval should reflect the risk profile. Factors that may justify a shorter interval include complex hot and cold water systems, stored water, cooling systems, spa pools, healthcare or care settings, vulnerable occupants, irregular use, and a history of control difficulties. The responsible person should be able to explain why the chosen interval is suitable and record that decision within the legionella control arrangements.
A review is more than checking whether the document is still in date. It should confirm that the assessment describes the system as it currently exists and that the identified control measures remain suitable. A competent reviewer will generally consider:
- the current water system design, including storage tanks, calorifiers, outlets, dead legs and little-used sections;
- how water is produced, stored, distributed and used throughout the premises;
- temperature control, flushing arrangements, cleaning, disinfection and other precautions;
- the findings from temperature checks, sampling, inspections, maintenance and remedial work;
- any parts of the system that are inaccessible, redundant, poorly labelled or insufficiently documented;
- changes in occupancy, building use, responsible personnel or the vulnerability of water users; and
- whether responsibilities, written procedures and escalation arrangements are clear and being followed.
Routine monitoring does not replace a formal review. Temperature records, flushing logs and laboratory results show how the system has performed over time, whereas the risk assessment explains why the controls are appropriate. These records should be examined together. Repeated temperature failures, incomplete logs, recurring positive results or overdue remedial actions may indicate that the assessment needs to be revisited before its planned review date.
The review should also test whether recommendations from the previous assessment were completed. An action that remains open may mean the risk has not been controlled as intended. The record should state what was checked, which findings were made, what actions are required, who is responsible for them and when they will be completed. Where no changes are needed, that conclusion should still be documented rather than relying on the age of the original assessment.
A competent person should carry out the assessment or review, with enough knowledge of legionella risks and the particular type of water system involved. Information from facilities staff, contractors and maintenance records can support the process, but a desktop exercise may not identify physical changes or defects that are not shown in existing documents. A site inspection is therefore important where the system has not been recently verified or the available information is incomplete.
After the review, the findings should be incorporated into the written scheme of control and communicated to the people who carry out monitoring, maintenance, cleaning, flushing and remedial work. Staff training may need updating if duties have changed or if the review identifies weaknesses in how controls are applied. Testing can provide useful evidence where the risk assessment indicates that sampling is appropriate, but sampling alone cannot demonstrate that every aspect of legionella control is effective.
In practical terms, businesses should set a planned review date of no more than two years, monitor the system continuously between reviews, and bring the assessment forward whenever evidence shows that the existing arrangements may no longer control the risk. Keeping the assessment, monitoring records, test results, action logs and review decisions together provides a clearer audit trail for internal governance and compliance checks.
A legionella risk assessment should be treated as a controlled working document rather than a report that simply expires. Each review should have a recorded date, assessor, scope and outcome, with the current version clearly identified and previous versions retained. This creates a traceable record of how the business’s understanding of the risk has developed.
Where the review changes the required controls, the revised assessment should be linked to the relevant written procedures, action plan and staff responsibilities. If the review concludes that no amendment is necessary, the reason should still be recorded. This evidence helps demonstrate that the review frequency has been considered deliberately and remains appropriate for the premises.
Discuss your legionella risk assessment review
Discuss your next legionella risk assessment review with Blue Fish Water Management Ltd to clarify the appropriate scope, evidence and review arrangements for your premises.