Legionella Risk Assessment: What It Covers, Who Needs One, and How to Comply

Legionella pneumophila killed 29 people in a single outbreak at a BBC building in London in 1988. The source was a cooling tower with no treatment programme and no documented risk assessment. Outbreaks have continued since — each one traceable to a failure of process, not a failure of technology. The knowledge of what Legionella needs to grow, and how to prevent it, has been in the public domain for decades.

A Legionella risk assessment is the first legal obligation under HSE's Approved Code of Practice L8 for any duty holder responsible for premises with water systems capable of creating and dispersing aerosols. This guide covers what the assessment must cover, who can carry it out, what the common failure modes are, and what has to happen after the document is signed off.

Quick Navigation

• What a Legionella risk assessment actually covers
• Which water systems require a Legionella risk assessment
• The L8 ACOP: what the law requires
• Conducting a Legionella risk assessment: the five-stage process
• High-risk water systems: cooling towers, hot and cold water, and spa pools
• Written scheme of control: what happens after the assessment
• How often should a Legionella risk assessment be reviewed?
• What a Legionella risk assessment costs
• Where Legionella risk assessments go wrong
• Selecting a Legionella risk assessment provider
• Frequently asked questions

What a Legionella Risk Assessment Actually Covers

A Legionella risk assessment is a systematic survey and evaluation of all water systems in a premises to determine whether conditions exist for Legionella bacteria to proliferate and whether people could be exposed to contaminated aerosols.

It is not a water quality test. A single water sample that comes back negative does not substitute for a risk assessment — it captures a moment in time, not the structural conditions that allow colonisation to develop. The assessment evaluates system design, water temperatures, stagnation points, aerosol generation, and the likely exposure of building occupants.

The HSE Approved Code of Practice L8 (Legionnaires' Disease: The Control of Legionella Bacteria in Water Systems) is the primary legal framework. L8 places a duty on anyone who has control of premises — employers, landlords, facilities managers, building owners — to manage the risk of Legionella. A risk assessment is how that duty is formally discharged.

The assessment must identify every potential source of Legionella risk, evaluate the likelihood and severity of exposure, and determine what control measures are needed. The findings become the basis for a written scheme of control — the live operational document that governs how the water systems are managed going forward.

Which Water Systems Require a Legionella Risk Assessment

Any water system in which conditions might support Legionella growth must be assessed. Legionella bacteria thrive in water between 20°C and 45°C, particularly in stagnant sections, sediment, and biofilm. The risk multiplies when that water can be aerosolised — broken into fine droplets that can be inhaled deep into the lungs.

Water systems typically requiring assessment:

• Cooling towers and evaporative condensers — highest risk, notifiable to the local authority
• Hot water calorifiers and distribution systems
• Cold water storage tanks and distribution pipework
• Spa pools, whirlpool baths, and hydrotherapy pools
• Humidifiers, air washers, and wet air scrubbers in HVAC systems
• Decorative water features in public or occupied spaces
• Emergency eye wash stations and tepid showers
• Any water system with dead legs, infrequently used outlets, or warm-water sections

Domestic-scale premises where water is heated and used immediately — a single-family home with a combi boiler and no storage — are generally exempt. Any premises with stored hot water above 20 litres, a cooling system, or a spa pool requires assessment.

The L8 ACOP: What the Law Requires

L8 is the statutory guidance that sits beneath the Health and Safety at Work Act 1974 and the Control of Substances Hazardous to Health (COSHH) Regulations 2002. Compliance with L8 is not optional — a duty holder who departs from its requirements must demonstrate they achieved the same standard of control by an alternative route.

Three things L8 requires of every duty holder:

1. A documented risk assessment carried out by a competent person. The assessment must be reviewed whenever there is reason to believe it is no longer valid — system changes, refurbishment, or a reported case of Legionnaires' disease.

2. A written scheme of control — the operational programme that specifies what monitoring, treatment, and maintenance must be done, by whom, and at what frequency.

3. Monitoring, record keeping, and management — implementation of the written scheme with documented evidence retained for a minimum of five years.

There is no exemption based on building age, tenancy type, or system size above the domestic threshold. Hotels, hospitals, care homes, offices, leisure facilities, and industrial premises all fall within scope.

Conducting a Legionella Risk Assessment: The Five-Stage Process

A competent Legionella risk assessment follows five sequential stages. Skipping any stage — especially the monitoring and review stages — is the most common reason assessments fail to prevent outbreaks.

Stage 1: Identify Hazards

The assessor surveys every water system on site: cold water storage tanks, hot water calorifiers, cooling towers, spa pools, humidifiers, and any outlet not used regularly. Flow diagrams are drawn showing water source, storage, distribution, and outlets. Potential sources of Legionella (stagnant sections, temperatures in the growth range, aerosol generation points) and populations at risk (building occupants, visitors, immune-compromised individuals) are documented.

Stage 2: Assess Risk

Each identified hazard is evaluated against two dimensions: the likelihood of Legionella colonisation given the current system condition, and the severity of consequence if an exposure event occurred. This produces a risk rating — typically high, medium, or low — that drives the priority of control measures.

Stage 3: Implement Controls

Based on the risk assessment, physical and chemical control measures are specified. For a cooling tower this means a biocide dosing programme, a cleaning and disinfection schedule, and temperature monitoring. For a hot water system it means maintaining distribution temperature above 50°C, conducting regular outlet temperature checks, and removing dead legs. A responsible person is appointed for each system.

Stage 4: Monitor and Record

Controls are only effective if they are consistently applied and documented. Temperature check records, chemical dosing logs, microbiological sampling results, and maintenance records must be maintained. Records are the evidence of compliance — without them, a duty holder cannot demonstrate the written scheme is being followed.

Stage 5: Review

The risk assessment is reviewed annually at minimum, and immediately after any significant change to the water system, a change in use of the building, or a suspected or confirmed Legionella case. A review is not just a document update — it requires physically re-inspecting the systems covered.

High-Risk Water Systems: Cooling Towers, Hot and Cold Water, and Spa Pools

Risk levels vary significantly across water system types. Cooling towers carry the highest risk because they combine ideal growth conditions (warm, circulating water) with active aerosol generation at scale. A cooling tower in a typical commercial HVAC installation can aerosolise thousands of litres per hour.

Cooling towers are the only water system notifiable to the local authority under The Notification of Cooling Towers and Evaporative Condensers Regulations 1992. Operating an unregistered cooling tower is a specific legal offence separate from the L8 obligations. Our article on cooling tower water treatment covers the treatment programme that sits alongside the Legionella risk assessment for evaporative systems.

Hot and cold water systems present a different risk profile. The critical hazard is temperature — hot water stored below 60°C and distributed below 50°C, and cold water warming above 20°C, both create the growth conditions Legionella requires. Dead legs in pipework — sections with no regular flow — concentrate this risk significantly.

The WHO Guidelines for the Prevention and Control of Legionella provide the epidemiological basis for the temperature and exposure thresholds used in L8. The science behind the control parameters — the 60°C storage target, the 50°C distribution target, the 20°C cold water maximum — is grounded in decades of outbreak investigations.

Written Scheme of Control: What Happens After the Assessment

The risk assessment identifies hazards and risks. The written scheme of control is the operational document that specifies exactly how those risks will be managed going forward.

A written scheme must contain:

• The physical description of the water systems covered
• The roles and responsibilities of the responsible person and any appointed contractors
• Specific control measures for each system — temperature targets, biocide types and dosing rates, cleaning intervals, disinfection procedures
• Monitoring frequencies and methods for each parameter
• Remedial action procedures if control limits are breached
• The format and retention requirements for records

The written scheme is a living document. It must be updated whenever the risk assessment is reviewed, whenever a system changes, or whenever monitoring reveals that the current programme is not achieving the specified targets. A written scheme produced three years ago and never updated does not constitute compliance — it demonstrates the opposite.

The most common misconception among duty holders is that commissioning a risk assessment completes the legal obligation. The assessment is the starting point. The written scheme, monitoring programme, and records are what compliance looks like operationally. A risk assessment without an active written scheme is a liability document, not a compliance programme.

How Often Should a Legionella Risk Assessment Be Reviewed?

L8 does not specify a fixed review interval. It requires review "when there is reason to believe it may no longer be valid." In practice, the industry standard for most commercial and industrial premises is annual review as a minimum.

A review is mandatory in the following circumstances, regardless of when the last review occurred:

• Any change to the water system — new pipework, tank replacement, additional outlets, changes to water treatment
• Change of use of the building or part of it
• Any planned or actual shutdown and recommissioning of a system
• A suspected or confirmed case of Legionnaires' disease associated with the premises
• Significant changes in water quality parameters (microbiological results above action level, persistent temperature non-compliances)

The review must be documented. "We checked and nothing has changed" is not sufficient — the review must demonstrate that the systems were physically inspected and that the risk assessment findings remain accurate.

What a Legionella Risk Assessment Costs

Cost depends primarily on site complexity — the number of water systems, the size of the distribution network, and whether the site has cooling towers or spa pools in addition to hot and cold water systems.

Typical cost ranges:

• Single-system domestic or small commercial (e.g. a small office with only hot and cold water, no cooling tower): $315–625 for the initial assessment
• Medium commercial premises (multiple water systems, no cooling tower): $625–1,900
• Large commercial or industrial site (cooling towers, multiple buildings, complex distribution): $2,500–7,500+
• Ongoing management contract (annual review, quarterly temperature monitoring, biocide dosing records review): $1,900–6,300 per year for a mid-size site

These figures cover assessment and documentation only. If the assessment identifies remedial work — removing dead legs, installing thermostatic mixing valves, cleaning tanks, installing automated dosing — that work is priced separately. A site with multiple historical non-compliances will carry higher remediation costs than the assessment itself.

The cost-benefit comparison is not subtle: a single Legionella outbreak investigation and enforcement action can cost a duty holder $63,000–625,000 in legal fees, fines, civil claims, and business disruption. Two people died and 175 were infected in the 2012 Edinburgh City Centre outbreak. The responsible company received significant fines and faced years of civil litigation.

Where Legionella Risk Assessments Go Wrong

Most Legionella compliance failures are not caused by ignorance of the law. They are caused by systems that looked compliant on paper but were not operational in practice.

Assessments by Incompetent Persons

L8 requires the assessment to be carried out by a "competent person" — someone with sufficient knowledge, training, and experience. The standard is not defined by a specific qualification, but City and Guilds 6084, BOHS P901, and equivalent credentials are the recognised benchmarks. A duty holder who commissions a risk assessment from someone without these credentials — or from a facilities management company where the assessor has no specific Legionella training — may be holding a document that does not satisfy the legal standard.

A manufacturing plant in the West Midlands commissioned a Legionella risk assessment as part of a general facilities management contract. The assessor had no Legionella-specific qualification. The assessment missed two dead legs in the hot water distribution system that had been created during a recent refurbishment. Three months later, a production worker developed Legionnaires' disease. The HSE investigation found the risk assessment inadequate. The company faced enforcement action and civil claims exceeding $250,000.

Written Schemes That Are Never Implemented

Producing a written scheme is not the same as operating one. A pattern that recurs across enforcement cases: the duty holder has a compliant written scheme in a folder, but the monitoring frequencies specified in it are not being met — temperature checks done quarterly instead of monthly, biocide dosing logs not maintained, no record of annual tank inspection.

The written scheme is only as good as the records that confirm it is being followed.

Assessments That Are Never Reviewed

Water systems change. Refurbishments add pipework, new outlets create dead legs, system reconfigurations change flow patterns. An assessment carried out five years ago and never updated does not reflect current system conditions. This is particularly common in long-term commercial leases where different tenants or facilities managers have managed the property at different times, each assuming the previous party maintained compliance.

Use Nepti to model your building's water systems and identify the highest-risk elements before engaging a risk assessor. Entering your system parameters — number of cooling towers, hot water storage volume, building occupancy profile — allows Nepti to produce a ranked risk profile that helps you brief a specialist accurately and verify that the scope of any proposed assessment covers the relevant systems.

Selecting a Legionella Risk Assessment Provider

The market for Legionella risk assessment ranges from sole-trader freelance consultants to specialist water hygiene companies and large FM contractors. Quality varies substantially.

Minimum requirements: the individual conducting the assessment should hold a recognised Legionella qualification (City and Guilds 6084, BOHS P901/P902, or equivalent). The provider should carry professional indemnity insurance specific to Legionella risk assessment. They should produce a written assessment report, not just a compliance checklist.

Good practice indicators: membership of the Legionella Control Association (LCA); willingness to provide references from similar premises; clear separation between assessment, written scheme, and remediation services (a provider who sells both the assessment and all remedial work without independent oversight creates a conflict of interest).

Warning signs: providers who produce assessments without attending site; single-page "compliant" certificates rather than detailed reports; assessors who cannot explain the basis for their risk ratings; unusually low prices that suggest templated rather than site-specific work.

Post your Legionella risk assessment requirement on Aguato to receive proposals from qualified specialists with verified credentials. Comparing independent proposals on the same scope is the fastest way to benchmark price and confirm that the proposed approach covers your specific water systems.

Related Articles

• Cooling Tower Water Treatment: Scale, Legionella, and Keeping Systems Efficient
• Boiler Water Treatment: Scale, Corrosion, and the Chemistry That Keeps Systems Running
• Browse qualified Legionella risk assessment providers

Frequently Asked Questions

Is a Legionella risk assessment a legal requirement?

Yes. Under the Health and Safety at Work Act 1974 and COSHH Regulations 2002, any employer or person in control of premises with water systems capable of creating and dispersing aerosols must assess and control the risk of Legionella. The HSE's Approved Code of Practice L8 provides the detailed requirements. Non-compliance can result in improvement notices, prohibition notices, unlimited fines, and — in cases of serious harm — prosecution of individual duty holders.

Who can carry out a Legionella risk assessment?

The assessment must be carried out by a "competent person" with sufficient knowledge, training, and experience to identify and assess Legionella risk. In practice, this means someone with a recognised qualification such as City and Guilds 6084, BOHS P901, or equivalent. An employer can carry out their own assessment if genuinely competent, but in most commercial premises, an external specialist is required. The Legionella Control Association maintains a list of accredited providers.

How long does a Legionella risk assessment take?

Duration depends on site complexity. A small commercial building with only hot and cold water systems might be assessed in 2–4 hours. A large industrial site with cooling towers, multiple buildings, and complex HVAC takes 1–3 days. The written report is typically produced within 1–2 weeks of the site visit. The HSE Legionella guidance portal provides a practical overview of what the process should include at each stage.

What happens if a Legionella risk assessment identifies non-compliance?

The assessment report will identify specific remedial actions required, usually categorised by urgency (immediate, short-term, planned). Immediate actions — a cooling tower without any treatment programme, hot water stored below 50°C — must be addressed before the written scheme is finalised. Short-term and planned actions are scheduled in the written scheme with target completion dates. The duty holder is responsible for ensuring remedial work is carried out and documented.

Do I need a Legionella risk assessment for a rented commercial property?

Yes. Under L8, the duty holder is whoever has control of the premises — which in a tenanted commercial property is typically the tenant, not the landlord, for the systems they manage. Lease agreements often attempt to allocate responsibility between landlord and tenant, but the legal duty under COSHH follows control, not ownership. Both parties may have obligations depending on what systems each party controls. Clarify this at lease inception, not after an incident.

How often do cooling towers need to be cleaned as part of Legionella control?

L8 requires cooling towers to be inspected and cleaned at least twice per year, with disinfection between cleaning cycles. Additionally, disinfection is required before a system is commissioned, after any period of shutdown, and after any outbreak investigation. Monthly microbiological monitoring is required for operational cooling towers, with action levels at 1,000 colony forming units (CFU) per litre and mandatory disinfection at 10,000 CFU/litre.

What is the responsible person's role in Legionella compliance?

The responsible person (RP) is the individual designated by the duty holder to manage Legionella compliance on a day-to-day basis. The RP must have sufficient authority and competence to implement the written scheme, arrange monitoring and maintenance, and escalate issues to the duty holder. They do not need to personally carry out all monitoring tasks, but they are accountable for ensuring tasks are completed and documented. In large organisations, this role is often held by a facilities manager or a specialist water hygiene contractor acting under a management contract.