How often should legionella prevention controls be reviewed?

There is no single review interval that applies to every legionella prevention programme. The appropriate frequency depends on the complexity of the water system, the vulnerability of those exposed, the level of use, previous monitoring results and how well existing controls are performing. A stable, low-risk system may follow a longer formal review cycle, while a complex or higher-risk system may need more frequent evaluation.

A formal review is different from the regular checks carried out under the written scheme. Routine monitoring confirms that specified tasks are being completed and that conditions remain within the required limits. A formal review considers whether the overall approach is still suitable, whether the control measures are effective and whether the risk assessment, written scheme and management arrangements accurately reflect the premises.

For many organisations, reviewing the legionella risk assessment at least every two years provides a sensible baseline where the system and its use have remained stable. This should not be treated as a maximum period or as a substitute for ongoing monitoring. A review may be due sooner where the risk profile is greater, monitoring identifies weaknesses or the system has a history of control difficulties.

The review should examine the complete control programme, including:

• the current asset register, schematic diagram and identification of high-risk outlets;
• the responsibilities assigned to the duty holder, responsible person, contractors and other relevant staff;
• temperature monitoring, outlet usage, flushing arrangements and any other operational checks;
• inspection, cleaning and disinfection records for tanks, calorifiers, showers and other relevant components;
• microbiological sampling results and any trends, atypical findings or recurring areas of concern;
• maintenance records, remedial work and evidence that identified actions have been completed;
• the competence, supervision and training of people carrying out monitoring and control tasks; and
• whether the written scheme remains clear, workable and consistent with the system installed on site.

Monitoring results should be considered as a pattern rather than in isolation. Repeated temperature deviations, poor flow, persistent low-use outlets, failed corrective actions or recurring positive samples may indicate that the underlying control strategy needs reconsideration. The review should establish why the issue occurred, whether the response was effective and whether additional engineering or operational measures are necessary.

Some systems require a more cautious review approach. Healthcare premises, care settings, accommodation with vulnerable occupants and sites containing extensive hot and cold water networks may have greater consequences if controls fail. Systems with storage tanks, showers, spa facilities, cooling equipment or areas of infrequent use may also require closer scrutiny. The review frequency should reflect these characteristics rather than relying solely on a standard calendar reminder.

Changes to a building or its operation can alter the risk even when the plumbing itself appears unchanged. Examples include refurbishment, the installation or removal of water outlets, changes in occupancy, periods of reduced use, alterations to hot water generation, a change of landlord or facilities contractor, and modifications to cleaning or maintenance arrangements. These changes should prompt a review of the relevant parts of the risk assessment and written scheme before relying on previous controls.

Each review should be documented. The record should state the date, the information considered, the person completing the review, any findings and the corrective actions required. Actions should have clear ownership and a method of verification, so that completion does not simply mean that a task has been marked as done. Where the review identifies a material change in risk, the updated assessment and written scheme should be communicated to everyone with duties under them.

The assessment should be completed or reviewed by someone with suitable knowledge, experience and competence in legionella risk management. A responsible person can coordinate the process, but they should obtain specialist input where the water system is complex, the findings are unclear or remedial work may be required. Regular review, reliable records and prompt investigation of unfavourable results provide the evidence that legionella controls remain appropriate for the premises.