Legionella Risk Assessment: A Guide for FM and Landlords

The school reopens after the summer holidays. The caretaker walks round turning on taps, and the showers in the sports block haven't been run since July. The cold tank in the roof void has been sitting in a warm loft for six weeks. Nobody's thought about legionella, because nobody's asked about it since the last legionella risk assessment was done three years ago by a firm that's since gone bust.

That's the sort of situation a legionella risk assessment is there to catch. A legionella risk assessment is a check of a building's hot and cold water systems (and any cooling towers, spa pools or other risky equipment) to find where legionella bacteria could grow and spread, and to decide what controls are needed. Under UK law, employers and anyone in control of premises, including landlords, must assess and manage this risk. HSE's Approved Code of Practice L8 and its technical guidance HSG274 explain how. This guide covers who's responsible, what the assessment should include, the temperatures and checks HSE sets out, and how FM teams and contractors plan the maintenance work that follows.

What is legionella and why does it matter?

Legionella bacteria live naturally in rivers and ponds. The problem starts when they get into man-made water systems where they can multiply. According to HSE, the risk goes up where:

• water sits between 20°C and 45°C, the range where legionella grows
• water is stored or recirculated
• there's rust, sludge, scale, organic matter or biofilm for the bacteria to feed on
• water droplets (aerosols) are created and can be breathed in, from showers, spray taps or cooling towers

Legionnaires' disease is a potentially fatal form of pneumonia. People catch it by breathing in contaminated droplets, not by drinking the water, and it isn't known to spread from person to person. Everyone is susceptible, but HSE lists people over 45, smokers and heavy drinkers, and people with chronic respiratory or kidney disease, diabetes, lung or heart disease or a weakened immune system as being at higher risk. That matters a lot in care homes, hospitals and sheltered housing.

The law behind a legionella risk assessment

There isn't a single "legionella regulation". The duties come from general health and safety law:

• The Health and Safety at Work etc. Act 1974 covers risks to employees and to others, such as tenants, residents and visitors. HSE's landlord guidance points to section 3(2) as the basis for landlords' duties to tenants.
• The Control of Substances Hazardous to Health Regulations 2002 (COSHH) treat legionella as a biological agent. You have to assess the risk and prevent or control exposure. Our COSHH risk assessment guide covers the wider COSHH process.
• The Management of Health and Safety at Work Regulations 1999 require a suitable and sufficient risk assessment and the appointment of competent help.

The practical detail sits in two HSE documents. ACOP L8 (fourth edition, 2013) is the Approved Code of Practice. It has special legal status: if you're prosecuted and you didn't follow it, you'll need to show you complied with the law in some other way. HSG274 is the technical guidance, split into three parts: evaporative cooling systems, hot and cold water systems, and other risk systems. Part 1 was updated in a second edition in March 2024.

A few other duties sit alongside the assessment:

• Under RIDDOR, you must report cases of legionellosis in an employee who has worked on cooling towers or hot and cold water systems likely to be contaminated. See our RIDDOR reporting guide.
• Under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, you must tell your local authority in writing if you have a cooling tower or evaporative condenser on site, and tell them when it's no longer in use.

Duty holder and responsible person: who does what?

The duty holder is the employer or the person in control of the premises. In a managed office block that might be the landlord or managing agent. For social housing it's the housing association or council. The duty holder carries the legal responsibility and can't hand it off to a contractor.

The responsible person is the competent person the duty holder appoints to manage the day-to-day control of legionella risk. HSE describes them as someone with sufficient authority, competence, necessary skills, knowledge of the system and experience. It can be the duty holder, one or more members of staff, someone from outside, or a combination. If several people share the job, perhaps because of shift patterns, everyone needs to know exactly what they're responsible for.

If you bring in a water treatment contractor, the responsible person still has to make sure the work is done to the right standard. Before appointing one, you should be satisfied they can do the job. HSE points to the Legionella Control Association's code of conduct for service providers, and BSI publishes a code of practice for legionella risk assessments (BS 8580-1).

Who can carry out a legionella risk assessment?

Carrying out the assessment is the duty holder's responsibility. HSE says you may be competent to do it yourself, but if not, you should get help from a competent person, either in-house or from outside, such as a consultancy.

In practice, this depends on the building:

• Small domestic lets. HSE says most landlords can assess the risk themselves and don't need to be professionally trained or accredited. A flat with a combi boiler and mains-fed cold water is usually low risk.
• Offices, schools, care homes, hotels and blocks with stored water. These usually have cold water tanks, calorifiers, long pipe runs, TMVs and showers. Many duty holders bring in a specialist legionella risk assessor here, because whoever does it needs to understand the whole system.
• Cooling towers, evaporative condensers and spa pools. These are higher risk and usually need specialist knowledge. HSG274 Parts 1 and 3 cover them.

What should a legionella risk assessment include?

HSE's guidance on what you must do lists what the assessment should cover:

• management responsibilities, including the name of the competent person and a description of the system
• the competence and training of key staff
• any potential risk sources identified
• the controls in place, or the means of preventing the risk
• monitoring, inspection and maintenance procedures
• records of monitoring results, inspections and checks
• arrangements to review the assessment regularly, particularly when there's reason to suspect it's no longer valid

For a commercial building, expect an up-to-date schematic of the system (including parts out of use), the sentinel outlets, dead legs and little-used outlets, and notes on anyone more vulnerable.

If the assessment finds a risk you can't prevent, you need a written control scheme. This describes the system, who's responsible, how the system should be operated safely, what controls and precautions you're using, and what checks will be done and how often.

If the assessment finds no reasonably foreseeable risk, or the risks are low and properly managed, it's complete. You still have to keep existing controls in place and review it if anything changes.

Temperatures and routine checks from HSE guidance

Temperature control is the traditional way of controlling legionella in hot and cold water systems. HSE's guidance on hot and cold water systems sets out these figures:

• Cold water should be kept below 20°C where possible. At sentinel outlets, it should be below 20°C after running for 2 minutes.
• Hot water should be stored at 60°C or above, and distributed so it reaches at least 50°C at outlets within 1 minute (55°C in healthcare premises).
• TMVs: the hot supply to a thermostatic mixing valve should reach at least 50°C within 1 minute. HSE advises pipe runs downstream of TMVs shouldn't exceed 2 metres.

HSE's "things to consider" guidance for hot and cold water systems then gives typical check frequencies:

• sentinel outlet temperatures checked monthly
• cold water storage tank temperature (usually at the ball valve outlet) checked every 6 months
• cold water tanks and hot water cylinders checked for cleanliness at least annually
• little-used outlets flushed weekly, purging to drain without creating aerosols
• showerheads and hoses cleaned and descaled quarterly, or as the risk assessment decides

Hot water brings its own risk. HSE warns of scalding from water above 44°C, and where vulnerable people use baths or showers and the scald risk is significant, a Type 3 TMV must be fitted to stop water coming out above 44°C. That's why TMV servicing matters so much in care settings.

Legionella risk assessment for landlords

Landlords, including councils, housing associations and private landlords, must assess and control legionella risk for their tenants. For most homes the job is simple. HSE's landlord guidance says:

• keep hot water hot, cold water cold and keep it moving
• flush the system before letting the property, keep tank lids tight-fitting, store hot water at 60°C and remove any redundant pipework
• tell tenants not to adjust the calorifier temperature, to clean showerheads regularly and to report hot water problems
• testing or sampling for legionella isn't usually needed in domestic systems
• the law doesn't require a "legionella test certificate"
• there's no fixed annual or two-yearly review, but you should review it periodically in case anything changes

Empty properties need extra care. HSE advises that outlets should be used at least once a week, and that a flushing regime or draining the system should be considered for long voids, such as student accommodation over the summer.

Records: what to keep and for how long

If you have 5 or more employees, you must record the significant findings of the assessment. HSE says records should include the people responsible for the assessment and the written scheme, the significant findings, the control scheme and how it's being carried out, whether the system is in use, and the results of monitoring, inspections and checks with dates.

Those records should be kept for as long as they're current and for at least 2 years after that. Records of monitoring and inspection results should be kept for at least 5 years.

Planning the work that follows the assessment

A legionella risk assessment usually produces a list of actions, and many of them involve someone working on the water system. HSE's own review checklist asks whether you've done COSHH assessments for water treatment chemicals and assessed working at height, confined spaces, electrical safety and access to the system.

Typical tasks and the risks they bring:

• Cold water tank cleaning and disinfection. Access to roof voids and plant rooms, ladders and work at height, lifting lids, chlorine-based disinfectants, and sometimes confined space entry for larger tanks. Our guide to confined space entry RAMS covers that side.
• Calorifier inspection and pasteurisation. Hot water and scald risk, isolations, pressure systems and draining down.
• Flushing little-used outlets. Low risk, but it still needs a method that avoids aerosols and a record of which outlets were done.
• TMV servicing and fail-safe testing. Isolation, scald risk during testing, and making sure the valve is re-set correctly before handover.
• Removing dead legs and redundant pipework. Plumbing work, hot works if soldering, isolations and disruption to occupied buildings.

This is where plumbers, HVAC contractors and in-house FM teams need a RAMS for the task, separate from the legionella risk assessment itself.

If something does go wrong on a water hygiene job, like a tank lid dropping through a ceiling or a colleague catching a blast of hot water during a TMV test, record it. Our guide to near miss reporting explains why those close calls are worth writing down.

How swiftRMS helps

swiftRMS isn't a legionella risk assessment service, and it doesn't replace one. The legionella risk assessment needs a competent person who understands the water system. For anything beyond a simple domestic property, that's often a specialist assessor.

What swiftRMS does is draft the RAMS for the maintenance work the assessment leads to. Describe the task, say cleaning and disinfecting a 1,000-litre cold water tank in a school roof void, and swiftRMS drafts a risk assessment and method statement built around the relevant legislation: COSHH for the disinfectant, the Work at Height Regulations 2005 for loft access, and so on. You can also draft COSHH assessments for the water treatment chemicals your team uses.

Every draft is ready for review, not ready to use. A competent person must check it against the site, edit it and approve it before work starts, as the Management Regulations expect. It's built for facilities management teams and contractors who'd rather spend their time on the review than on retyping the same method statement.

To see what a draft looks like for your task, try a free RAMS preview with no signup. If it fits the way you work, there's a 14-day free trial with no card needed.

Frequently Asked Questions

Is a legionella risk assessment a legal requirement?

Yes, in the sense that employers and people in control of premises, including landlords, must assess the risk from legionella under the Health and Safety at Work etc. Act 1974 and COSHH. For a simple domestic property it can be short, while a hospital or hotel needs a detailed one. Whether an assessment is suitable and sufficient depends on the building and the system, so it needs to be done or checked by a competent person.

How often should a legionella risk assessment be reviewed?

The law doesn't set a fixed interval such as every one or two years. HSE says it should be reviewed regularly, and particularly when there's reason to think it's no longer valid. Common triggers include changes to the water system, a change in who uses the building, a long period out of use, a failed temperature check or a case of Legionnaires' disease.

What temperature kills legionella?

HSE guidance says hot water should be stored at 60°C or above to kill legionella bacteria, and distributed so it reaches at least 50°C at outlets within 1 minute (55°C in healthcare premises). Legionella grows between 20°C and 45°C, so cold water should be kept below 20°C. Watch the scald risk above 44°C where vulnerable people use baths or showers.

Do landlords need a legionella certificate?

No. HSE states that health and safety law doesn't require landlords to obtain or produce a "legionella test certificate". Landlords do need to assess and control the risk, but testing or sampling for legionella isn't usually required for domestic hot and cold water systems.

What's the difference between the duty holder and the responsible person?

The duty holder is the employer or person in control of the premises, and carries the legal duty. The responsible person is the competent person the duty holder appoints to manage legionella control day to day. They need enough authority, knowledge of the system and experience to do the job. The duty holder stays legally responsible even if the day-to-day work is done by a contractor.

Can swiftRMS write my legionella risk assessment?

No. swiftRMS drafts RAMS and COSHH-style assessments for the maintenance tasks, such as tank cleaning, flushing and TMV servicing. The legionella risk assessment itself should be carried out by a competent person, often a specialist. Any swiftRMS draft also needs reviewing, editing and approving by a competent person before use.

Official Resources

• HSE: Legionnaires' disease – what you must do
• HSE: ACOP L8 – The control of legionella bacteria in water systems
• HSE: Legionnaires' disease technical guidance (HSG274)
• HSE: Legionella and landlords' responsibilities
• HSE: Hot and cold water systems – things to consider
• legislation.gov.uk: The Control of Substances Hazardous to Health Regulations 2002