Is a legionella risk assessment a legal requirement for businesses?

In practice, a business must identify and control legionella risks where its water systems could create exposure. The law does not require every organisation to purchase a document called a “legionella risk assessment” from an external provider, nor does it prescribe one standard report format. It does require the responsible organisation to assess the risks properly, implement suitable controls and demonstrate that those controls are being managed.

The main legal framework is the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). COSHH treats legionella bacteria as a biological agent. Where employees or other people may be exposed through work activities, the organisation must assess the exposure risk and take appropriate steps to prevent or control it. The Management of Health and Safety at Work Regulations also require employers to make a suitable and sufficient assessment of risks to employees and others affected by their activities.

The Health and Safety Executive’s Approved Code of Practice L8, Legionnaires’ disease: The control of legionella bacteria in water systems, explains how to comply with these duties. Its associated guidance, including HSG274, provides practical advice on assessing and controlling risks in hot and cold water systems, evaporative cooling systems and other higher-risk plant. Following an Approved Code of Practice is not an absolute legal requirement, but a business that chooses another approach must be able to show that it provides an equivalent level of health and safety control.

Responsibility normally rests with the person or organisation with control of the premises or water system. Depending on the site, this may be an employer, building owner, landlord, managing agent, facilities team or another duty holder. Contracts can allocate operational tasks, but they do not automatically remove the underlying responsibility to ensure that risks are properly managed. Where several organisations share a building, their responsibilities should be clearly defined and coordinated.

A suitable assessment should examine the factors that can allow legionella to grow or spread. These commonly include:

• water temperatures that encourage bacterial growth;
• stagnant or infrequently used outlets, dead legs and redundant pipework;
• the design, condition and complexity of the water system;
• storage tanks, calorifiers, showers, spa facilities, cooling systems and other aerosol-generating equipment;
• maintenance, cleaning, disinfection and temperature-control arrangements; and
• the susceptibility of people who may be exposed, including those in healthcare or care settings.

The assessment should identify the responsible person or persons, the systems covered, the significant hazards, existing safeguards and any further action required. It should also state who will complete each action and how control measures will be checked. A generic template that does not reflect the actual premises, water systems or users is unlikely to provide a suitable and sufficient assessment.

Businesses must then operate a written control scheme appropriate to the risks identified. This may include routine temperature checks, inspection and cleaning, monitoring of infrequently used outlets, maintenance of plant, management of changes and arrangements for responding to abnormal results or suspected cases. The control scheme should be practical for the site and supported by records that show whether the required checks and remedial actions have been completed.

The assessment must be reviewed when it is no longer valid or when there has been a significant change. Review may be necessary after alterations to the water system, changes in occupancy or use, extended periods of low use, changes to management arrangements, control failures, evidence of contamination or a suspected case of legionnaires’ disease. It should also be reconsidered if monitoring shows that existing measures are not effective.

Businesses with five or more employees generally need to record the significant findings of their health and safety risk assessments and the arrangements for controlling them. Even where this specific recording threshold does not apply, retaining the assessment and supporting monitoring records is important evidence that the duty holder has taken reasonable steps to manage the risk. Records should be accessible to the people responsible for managing the system and should be kept for an appropriate period in line with the organisation’s procedures and relevant guidance.

There is no general legal requirement for the assessment to be completed by a particular type of contractor, and there is no universal statutory renewal interval that applies to every premises. However, the person carrying out the assessment must be competent, with suitable knowledge, training and experience of the relevant water systems and legionella controls. The required review frequency depends on the complexity and risk profile of the site rather than on an automatic certificate-expiry date.

Enforcement authorities may ask to see the assessment, control scheme, monitoring records, training information and evidence that identified defects have been addressed. Failure to assess or control a foreseeable risk can lead to enforcement action, particularly where the organisation cannot show who had responsibility or how controls were being checked.

For a business, the most useful compliance approach is to establish ownership of the water systems, appoint a competent responsible person, obtain a site-specific assessment, implement the resulting control scheme and keep it under review. Blue Fish Water Management can support this process through legionella risk assessments, water testing, compliance audits, system monitoring, training and remedial works, with the precise scope determined by the premises and its identified risks.