A Legionella risk assessment is the legal and operational foundation of every Legionella control programme. Without one, a business has no reliable basis for its control measures, no defensible record of having considered the risk, and no meaningful compliance with the Health and Safety Executive’s Approved Code of Practice ACoP L8.
Yet in practice, risk assessments vary enormously in quality. A thorough, UKAS-accredited assessment conducted by a competent specialist will identify every significant risk factor across a building’s water systems and produce a clear, prioritised action plan. An inadequate assessment carried out by someone without the necessary skills, or using a generic template, can create a false sense of security while leaving significant risks unaddressed.
This guide explains exactly what an effective Legionella risk assessment involves, who is qualified to carry one out, what the process looks like in practice, and what should happen once the assessment is complete.
What is a Legionella Risk Assessment?
A Legionella risk assessment is a systematic, documented evaluation of all water systems within a premises to determine whether conditions exist or could develop that would allow Legionella bacteria to proliferate to levels dangerous to human health. It identifies the specific risk factors present in the building, evaluates the likelihood and potential severity of exposure, and recommends the control measures needed to manage those risks.
The legal obligation to carry out a Legionella risk assessment stems from the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH), and is given practical expression in HSE’s Approved Code of Practice ACoP L8 and Technical Guidance HSG274. Under health and safety law and related safety legislation, organisations and landlords have a legal duty to assess water systems and manage Legionella risks, helping ensure compliance with UK health requirements; for landlords, non-compliance can increase liability if a tenant contracts Legionnaires’ disease. For organisations with five or more employees, the assessment must be recorded in writing. Landlords do not need a formal certificate and generally do not have to record findings unless they employ five or more people, though keeping records helps demonstrate compliance.
The risk assessment is not a one-time exercise. ACoP L8 requires it to be reviewed whenever there is reason to believe it is no longer valid for example, following a change to the building or water systems, a significant alteration in occupancy, a positive Legionella test result, or an outbreak. As a minimum, a full review is recommended every two years for most premises. For guidance, consult the UK Health and Safety Executive and BS 8580-1:2019 on the control of Legionella bacteria.
Who Is Legally Required to Have a Legionella Risk Assessment?
The requirement applies to any employer or person in control of premises where water is used or stored in connection with a trade, business or other undertaking, and where there is a reasonable possibility that Legionella bacteria could proliferate and be released as breathable aerosol droplets; that includes landlords, property managers and a business owner where they control premises and water systems, and the duty of care to protect occupants and staff is a legal obligation for employers, building owners and landlords.
In practice, this means virtually every commercial, industrial, healthcare, hospitality, educational and public sector building in the UK. The scale and complexity of the assessment will vary a small office with a simple cold water supply and an electric water heater will require a far less extensive assessment than a large hotel with a cooling tower and spa pool but the obligation is universal. Domestic properties are often simpler, but complex water systems need a more detailed assessment and may justify a professional Legionella risk assessment. Landlords can carry out the assessment themselves if they have the necessary skills, but for larger or more complex sites it is sensible to bring in a specialist.
Who Can Carry Out a Legionella Risk Assessment?
ACoP L8 requires the risk assessment to be carried out by a competent person. Competence in this context means having the knowledge, skills, training and experience to identify Legionella risk factors accurately, evaluate their significance, and recommend appropriate control measures. It is not enough to be generally knowledgeable about health and safety Legionella risk assessment requires specific, demonstrable expertise.
Internal Assessment
A risk assessment can be carried out by an internal member of staff, a landlord, or another responsible person, provided they have the necessary competence. In practice, this requires specific Legionella training (typically City & Guilds Level 3), practical experience of water system inspection, and a sound understanding of ACoP L8 and HSG274. If they do not feel competent, they should appoint a qualified assessor instead. Landlords can assess smaller, straightforward systems themselves, but hiring a professional is advisable for larger or more complex sites. For most organisations, particularly those without dedicated water hygiene expertise, internal assessment carries significant risk of oversight.
External UKAS-Accredited Assessment
The most robust and widely recommended approach is to commission a UKAS-accredited inspection body to carry out the assessment. A professional inspection is especially advisable for larger, higher-risk, or more complex sites. UKAS accreditation (to ISO/IEC 17020) is the UK’s national accreditation standard for inspection bodies and provides independent assurance that the assessor has been evaluated against rigorous technical and quality criteria. For the HSE, a UKAS-accredited assessment is the gold standard and in the healthcare sector, it is effectively mandatory.
What Does a Legionella Risk Assessment Cover?
An effective risk assessment conducted by a UKAS-accredited specialist will systematically cover the following areas:
1. Building and System Survey
The assessor will carry out a physical inspection of the entire premises, mapping all hot and cold water systems, including the incoming mains supply, cold water storage tanks, calorifiers and hot water cylinders, all pipe runs and distribution networks, every outlet (taps, showers, hose points, irrigation systems, etc.), any ancillary systems (cooling towers, spa pools, humidifiers, fire suppression systems, emergency safety showers) and any identified dead legs or infrequently used sections of pipework.
The result is a detailed schematic either a plan or a formal Asset Register of all water systems and their components. A formal independent Legionella risk assessment should also cover the risk to tenants, descriptions of water systems, and records of water outlet temperatures. This schematic becomes the backbone of the subsequent Water Safety Plan, and the survey should also identify water tanks and any redundant pipework.
2. Temperature Assessment
Water temperatures are recorded throughout the distribution system at the storage vessel, along the distribution network, at representative sentinel outlets (the furthest and closest outlets from the storage vessel, and any outlets identified as higher risk), and across domestic hot and cold water systems. The assessor will evaluate whether temperatures fall within the Legionella growth range (20–45°C), where bacteria thrive, at any point in the system, and whether hot water is being stored and distributed at the temperatures required by ACoP L8 (stored at 60°C or above; distributed at 50°C or above, reaching 50°C at the outlet within one minute). Temperature control is one of the simple control measures used to keep systems properly managed, with hot water above 60°C and cold water below 20°C.
Regular water usage and turnover are also important in domestic hot systems and cold water systems, because stagnant water increases Legionella risks.
3. Identification of Risk Factors
Beyond temperature, the assessor will evaluate the full range of conditions that can contribute to Legionella proliferation:
- Stagnation: Dead legs, infrequently used outlets, oversized tanks or vessels with poor turnover.
- Scale, corrosion and biofilm: Deposits that provide nutrients and harbour Legionella bacteria.
- Inadequate insulation: Cold water pipework running adjacent to hot water pipes or heat sources, raising temperatures into the growth range.
- Materials: Legacy materials such as copper, rubber seals and certain plastics can support Legionella growth.
- Aerosol-generating equipment: Any system that creates breathable small droplets of water contaminated with Legionella that can be inhaled, helping the assessor focus on the real risks of exposure.
- Population at risk: The presence of vulnerable individuals elderly residents, immunocompromised patients, young children significantly elevates the risk rating, as Legionnaires’ disease is a potentially fatal form of pneumonia caused by Legionella bacteria, with symptoms including cough, shortness of breath and fever.
4. Risk Rating and Prioritisation
Each identified risk factor is assessed and assigned a risk rating, typically using a likelihood/severity matrix, with the assessor also reviewing current control measures before prioritising actions. High-rated risks require immediate action; medium-rated risks should be addressed within a defined timeframe; low-rated issues are treated as potential risks and managed through proportionate control and ongoing monitoring, while keeping the focus on real risks.
5. Sampling Recommendations
Where the assessment identifies elevated risk, the assessor may recommend Legionella testing, including the collection of water samples for laboratory analysis in accordance with BS 7592:2022. Sampling is not always required following an initial assessment for low-risk premises or typical domestic properties, but routine testing is more relevant where vulnerabilities persist or systems are more complex, and it should form part of an ongoing monitoring and maintenance routine that includes regular checks and water sampling.
6. The Written Risk Assessment Report
The completed assessment is documented in a formal written report. A high-quality risk assessment report will include: an executive summary of findings and risk ratings, including an assessment of risk to tenants where relevant; the full system schematic and Asset Register; temperature data for all monitored points; a record of all identified risk factors with risk ratings; a prioritised action plan with recommended timescales; and a clear statement of the recommended control measures and monitoring programme going forward, with documentation sufficient to maintain records of findings, temperatures, and recommended actions.
What Happens After a Legionella Risk Assessment?
The risk assessment is the starting point, not the end point. Once the assessment is complete, the duty holder must act on its findings. This involves:
- Addressing any immediate or high-priority actions identified in the report for example, flushing and disinfecting systems where stagnation risk is high, or adjusting water temperatures; in properties left vacant for long periods, water systems should be flushed regularly to help control stagnant water.
- Commissioning the development of a written Water Safety Plan (Legionella control scheme) based on the assessment findings.
- Implementing the recommended monitoring programme including temperature checks, visual inspections and (where required) Legionella sampling, with regular assessments built into an ongoing monitoring and maintenance routine where vulnerabilities persist.
- Ensuring the Responsible Person is in place, trained and has the authority to manage the programme.
- Establishing a record-keeping system to maintain records of monitoring, inspections and remedial actions.
- Scheduling the next review of the risk assessment typically within two years, or sooner if any significant changes occur.
How Much Does a Legionella Risk Assessment Cost?
The cost of a Legionella risk assessment varies significantly depending on the size and complexity of the premises, the number of water systems present, and whether ancillary systems such as cooling towers or spa pools are included. For a straightforward small commercial premises, an assessment may be completed in a few hours; for a large hospital or hotel complex, the assessment and reporting process may take several days.
It is important not to select a provider on the basis of price alone. An inadequate assessment one that misses significant risk factors or produces a generic report with insufficient site-specific detail offers little protection in legal terms and may leave genuine risks unmanaged. The investment in a thorough, UKAS-accredited assessment is modest relative to the potential cost of a Legionella outbreak, which can trigger immediate site shutdowns, corporate fines, litigation, and permanent brand damage, and if a landlord fails to act on legal obligations, enforcement action can also include heavy fines or even imprisonment.
How Marlowe Environmental Services Can Help
Marlowe Environmental Services is a UKAS-accredited inspection body for Legionella risk assessment, and one of the UK’s most experienced providers of water hygiene compliance services. Our assessors hold City & Guilds Level 3 qualifications and have extensive practical experience across all building types and sectors.
Our Legionella risk assessment service includes a full physical survey of all water systems, with specialist support for complex water systems and wider control of waterborne pathogens where needed, detailed temperature profiling, identification and risk rating of all significant risk factors, a comprehensive written report with schematic, and a prioritised action plan. We also offer an ongoing compliance support service, helping duty holders implement the recommended control measures, develop their Water Safety Plan, and maintain the records required by ACoP L8.
Contact our team today to arrange a Legionella risk assessment for your premises. Call 01454 299 310 or email hello@marlowe-es.com
Frequently Asked Questions About Legionella Risk Assessments
Q: Is a Legionella risk assessment a legal requirement?
Yes. Under the Health and Safety at Work etc. Act 1974 and COSHH 2002, as given practical effect by ACoP L8, all employers and persons in control of premises with a water system must carry out or commission a Legionella risk assessment. This sits under the Health and Safety at work act and other relevant health and safety law, as well as wider work regulations, and landlords may be prosecuted even where exposure creates risk without anyone becoming ill. For organisations with five or more employees, the assessment must be recorded in writing.
Q: How often does a Legionella risk assessment need to be repeated?
The risk assessment must be reviewed whenever there is reason to believe it is no longer valid following a system change, building alteration, positive Legionella result, change of use or an outbreak. Industry best practice recommends a full review every two years for most premises, with annual interim checks for higher-risk sites such as healthcare facilities and hotels.
Q: Can I carry out my own Legionella risk assessment?
Technically yes, provided you are competent to do so, whether you are an employer, duty holder or landlord, meaning you have specific Legionella training, practical experience and a sound understanding of ACoP L8 and HSG274. A legionella risk assessment template may help structure the process, but it does not replace competence or site-specific judgement. In practice, most organisations benefit significantly from commissioning a UKAS-accredited specialist, whose assessment carries greater legal weight and is less likely to miss risks that an in-house assessor might overlook.
Q: What is UKAS accreditation and why does it matter for Legionella risk assessment?
UKAS (United Kingdom Accreditation Service) is the UK’s national accreditation body. UKAS accreditation for inspection bodies (to ISO/IEC 17020) provides independent assurance that the inspection organisation meets rigorous technical competence and quality management standards. For Legionella risk assessment, UKAS accreditation is the strongest available indicator that the assessment has been carried out to the required standard and is effectively mandatory in the healthcare sector.
Q: What is the difference between a Legionella risk assessment and Legionella sampling?
A Legionella risk assessment is a systematic evaluation of water systems to identify risk factors it is primarily observational and analytical. Legionella sampling involves the collection of water samples for laboratory analysis to detect the presence and concentration of Legionella bacteria. Sampling is a verification tool that complements the risk assessment and ongoing monitoring programme; it does not replace the risk assessment.
Q: What should I do if my Legionella risk assessment identifies a high-priority action?
High-priority actions identified in a risk assessment should be addressed immediately or within the shortest practicable timeframe. Typical immediate actions include emergency flushing and disinfection of systems where stagnation risk is severe, temperature adjustments, and guidance for tenants to regularly clean showerheads or other outlets, as well as the isolation of equipment that cannot be immediately brought into compliance, particularly after vacancy or low use. Your assessor should provide clear guidance on appropriate timescales and remedial measures.