Legionella risk assessment and testing
What the L8 code asks a legionella risk assessment to cover, who can carry it out, the written control scheme, when water needs testing and which records to keep.
What is a legionella risk assessment?
A legionella risk assessment identifies whether a water system could let legionella bacteria grow and be breathed in, and sets out how that risk is prevented or controlled. HSE’s L8 guidance says all water systems need one, though many need only a simple one.
Legionella is a biological agent, so COSHH treats it as a substance hazardous to health. The assessment is the one COSHH regulation 6 and the Management Regulations require, applied to water systems. HSE’s Approved Code of Practice L8 sets out how, and HSG274 gives the technical detail.
Where the assessment finds a reasonably foreseeable risk that cannot be avoided, the dutyholder appoints a competent responsible person and puts a written control scheme in place. Hot and cold water is most often controlled by temperature, checked and recorded. Sampling for legionella is routine for cooling towers, but HSE says it is not usually required for hot and cold water systems.
This page covers the assessment, the scheme, testing and records. What legionella is, where it grows and who it harms is on the legionella page.
What a legionella risk assessment must cover
ACOP L8L8 gives the risk assessment Approved Code of Practice status. Each row says whether it is law, the L8 Approved Code of Practice or HSE guidance.
Who must make sure it is done
The ACOP says a suitable and sufficient assessment must be carried out, and the dutyholder is responsible for it. The dutyholder is the employer, a self-employed person, or whoever controls the premises or systems in connection with work. A landlord who keeps responsibility for maintenance is an example.
L8 Approved Code of Practice, paragraph 28The whole system, on a schematic
The ACOP says to consider each site and the system as a whole, not the cooling tower or calorifier in isolation. Complex systems need a site survey, an asset register and an up-to-date schematic diagram, including parts temporarily out of use.
L8 Approved Code of Practice, paragraph 38Conditions for growth
L8 guidance lists the risk factors: water between 20 and 45°C, water stored or recirculated, and deposits such as rust, sludge, scale, organic matter and biofilms. Deadlegs and parts used only now and then belong in the assessment, because growth there can go unnoticed.
L8 guidance, paragraphs 13, 39 and 41Spray, and who could breathe it
The assessment looks for anything that creates and spreads breathable droplets, such as showers, spray taps, cooling towers and spa pools. It also considers who could be exposed and how susceptible they are. L8 names people over 45, smokers, heavy drinkers, and people with chronic respiratory or kidney disease, diabetes, lung or heart disease, or impaired immunity.
L8 guidance, paragraphs 10 and 41How the system really runs
L8 guidance adds the source of the supply water and possible contamination before storage. It also lists normal operation, unusual but foreseeable conditions such as breakdowns, disinfection in use, current controls and the local environment.
L8 guidance, paragraph 42Controls, monitoring and limits
HSG274 summarises the contents. They include management responsibilities, the competence and training of key people, a description and schematic of the system, and an evaluation of the risk. They also include the controls, monitoring and inspection, results, the limitations of the assessment and review arrangements.
HSE HSG274 Part 2, introduction, paragraph 13The conclusion
Where the assessment shows no reasonably foreseeable risk, or risks that are insignificant, unlikely to increase and properly managed, the ACOP says no further assessment or measures are needed. Existing controls must still be kept up, and the assessment reviewed.
L8 Approved Code of Practice, paragraph 31; HSG274 Part 2, paragraph 14L8 gives an example of a low risk situation. It is a small building with no one especially at risk, and daily use that turns over the whole system. Cold water comes straight from the mains with no stored tanks, and hot water from instantaneous or low volume heaters at 50°C. The only outlets are toilets and wash hand basins. HSG274 adds that the survey itself carries risks, such as work at height and in confined spaces, which need planning in their own right.
Who can carry it out, and the responsible person
L8 asks for competence, not a particular certificate. Where the assessment finds a risk to control, two roles need filling: someone competent to assess, and a named responsible person to run the controls day to day.
A competent assessor
The ACOP says the dutyholder must ensure whoever carries out the assessment and advises on controls is competent to do so. The Management Regulations define a competent person as one with sufficient training and experience or knowledge and other qualities to assist properly.
L8 Approved Code of Practice, paragraph 29; Management Regulations, regulation 7(5)Inside or outside the business
HSE says you may be competent to carry out the assessment yourself. If not, help can come from someone in your own organisation or from outside, such as a consultancy or water treatment company. The dutyholder makes reasonable enquiries to confirm their competence.
HSE, identify and assess sources of risk; L8 guidance, paragraphs 35 and 36Appoint a competent person to manage the risk
Where there is a reasonably foreseeable risk, the ACOP says the dutyholder should appoint one or more competent people with enough authority, competence and knowledge of the installation. They should know the sources of risk, the precautions and how to keep the controls effective.
L8 Approved Code of Practice, paragraphs 48 and 49The responsible person
L8 guidance calls the person with day-to-day responsibility for controlling the risk the “responsible person”. They need training and regular refresher training, with records kept of both. A competent self-employed person or partner may appoint themselves.
L8 guidance, paragraph 51Contractors do not take the duty away
Using contractors or consultants does not absolve the dutyholder of responsibility for the controls. L8 guidance says to check their competence before contracting, and to set out responsibilities and lines of communication in writing.
L8 guidance, paragraphs 56 and 57If you are the contractor
Firms supplying water treatment, monitoring or consultancy must, so far as is reasonably practicable, make the limits of their expertise known. They must also tell the dutyholder or responsible person about deficiencies they find in the system or the written scheme.
L8 Approved Code of Practice, paragraph 76If you install the system
Designers, installers and suppliers must, so far as is reasonably practicable, make water systems safe in use and easy to clean and maintain. For hot and cold water that means limiting deadlegs, keeping stored cold water to a minimum and insulating pipes and tanks.
L8 Approved Code of Practice, paragraphs 75, 77, 78 and 80HSG274 points to BS 8580-1:2019, the British Standard code of practice for legionella risk assessments, for more detail on carrying one out.
The written control scheme
ACOP L8Where the risk cannot be avoided, the ACOP says there should be a written scheme for controlling it, properly implemented and managed. It turns the assessment into what is done, by whom and how often.
Avoid the risk first
Where there is a reasonably foreseeable risk, the use of systems or ways of working that lead to exposure must be avoided so far as is reasonably practicable. HSE’s example is replacing a wet cooling tower with a dry air-cooled system.
L8 Approved Code of Practice, paragraph 58; HSE, preventing or controlling the riskWhat the scheme contains
The ACOP lists an up-to-date plan of the system, a schematic being enough, and how to operate it correctly and safely. It adds the precautions, the checks with their frequency, and the remedial action if the scheme is not working.
L8 Approved Code of Practice, paragraph 60The precautions
The ACOP precautions include avoiding 20 to 45°C and stagnation, avoiding materials that feed bacteria, and controlling spray. They also cover keeping the system and water clean, water treatment, and correct operation and maintenance.
L8 Approved Code of Practice, paragraph 59Treatment and control details
L8 guidance says the scheme should give the temperature or chemical treatment programme, chemical safety information, and control limits with tolerances. It should also give sampling points and test frequencies, remedial and emergency procedures, and cleaning and disinfection procedures.
L8 guidance, paragraph 62Running the plant
The scheme should also describe commissioning and recommissioning, shutdown, checks of warning and diagnostic systems, maintenance and its frequency, and when plant is in use or idle.
L8 guidance, paragraph 63Monitoring the controls
The ACOP says the responsible person should oversee monitoring of the system’s condition and performance, or an external contractor or independent third party can do it. That means checking operation, inspecting accessible parts for damage and contamination, and checking the treatment still works.
L8 Approved Code of Practice, paragraph 65Water treatment chemicals are hazardous substances in their own right. HSE’s review questions ask whether COSHH assessments exist for handling them, and the scheme carries their storage, handling and disposal information. The COSHH assessment template covers those.
Routine checks on hot and cold water systems
From HSG274 Part 2Temperature is the usual control for hot and cold water. HSG274 says hot water should be stored at 60°C or above and reach 50°C at outlets within one minute, or 55°C in healthcare premises. Cold water should be kept below 20°C where possible.
| Check | What it should show | Frequency HSG274 indicates |
|---|---|---|
| Calorifier flow and return | Flow as close to 60°C as practicable without going below it; return not below 50°C | Monthly |
| Calorifiers, inside | Inspected internally and cleaned by draining, or debris purged from the base where there is no inspection hatch | Annually, or as the rate of fouling or the risk assessment indicates |
| Hot water sentinel outlets | At least 50°C within one minute of running (55°C in healthcare premises). On circulating systems, return legs of the principal loops at least 50°C | Monthly |
| Subordinate loop returns | On circulating systems, at least 50°C at the return leg, or at the last outlet within one minute (55°C in healthcare premises) | Quarterly, ideally on a rolling monthly rota |
| Cold water sentinel outlets | Below 20°C within two minutes of running | Monthly |
| Other outlets, on a rota | Hot and cold temperatures across a representative selection, building a profile of the whole system | On a rotation that covers the whole system |
| Cold water storage tanks | Condition inside and out, lid, insect screens, insulation and a clean water surface; remedial work where needed. Stored and incoming water temperatures checked too | Annually (temperatures in summer) |
| Showerheads, spray taps and hoses | Dismantled, cleaned and descaled | Quarterly, or as the rate of fouling indicates |
| Little-used outlets | Removal considered first. Any outlet unused for seven days or more is flushed until the temperature stabilises, and the flushing is logged | Weekly, or as the risk assessment indicates |
| Thermostatic mixing valves | Whether each is needed at all; strainers and filters inspected, cleaned, descaled and disinfected | Annually, or as the risk assessment defines |
| Point of use heaters up to 15 litres | Operating at 50 to 60°C, or a high turnover | Monthly to six-monthly, as the risk assessment indicates |
Sentinel outlets are typically the nearest and furthest outlets from the tank or heater on each part of the system. Table 2.1 also covers combination heaters, softeners, filters and expansion vessels. HSG274 says every inspection and measurement is recorded with the name of the person, the date, and enough detail of the location to repeat it. Blended water downstream of a thermostatic mixing valve, typically 38 to 46°C, can let legionella multiply. HSG274 asks for the scalding risk and the legionella risk to be weighed before one is fitted.
Legionella testing: when it is needed
Temperature checks and legionella testing are different things. HSE says testing for legionella should not be confused with temperature monitoring, which is a reliable way of confirming the system is under control.
Hot and cold water systems
HSE says microbiological monitoring is not usually required for mains-fed hot and cold water, unless the assessment or monitoring shows a problem. Systems on private water supplies need specific consideration.
HSE HSG274 Part 2, paragraph 2.119; HSE, testing and monitoringWhen hot and cold water should be tested
HSG274 lists doubt about the control regime, and temperatures or disinfectant levels not consistently achieved. It adds biocide-treated systems with stored or reduced-temperature water, populations at higher risk, and systems suspected in an outbreak. HSG274 suggests monthly testing at first for biocide-treated systems, and frequent testing, such as weekly, where control levels are not being met.
HSE HSG274 Part 2, paragraph 2.120Cooling towers and evaporative condensers
HSG274 Part 1 says microbial activity should be checked weekly, usually with dip slides, and legionella sampled at least quarterly. Dip slides measure general bacteria: the agar they carry does not grow legionella.
HSE HSG274 Part 1, paragraphs 1.60, 1.127, 1.129 and 1.133Taking the samples
Sampling follows BS 7592, with any biocide neutralised where possible. Samples come from separate hot and cold outlets, not through mixer taps or downstream of mixing valves or showers. Each is labelled with its location and whether it was taken before or after flushing.
HSE HSG274 Part 2, paragraph 2.121; HSE, testing and monitoringWhere samples are taken
HSG274 points to parts of the system that miss their temperature or disinfectant targets, and to low use, stagnation, dead legs and excess storage. It adds near and far sentinel outlets and, for hot water, the calorifier outlet and base where safe.
HSE HSG274 Part 2, paragraphs 2.122 to 2.124The laboratory
HSE says samples should go to a UKAS-accredited laboratory taking part in a water microbiology proficiency testing scheme. For culture methods, the detection limit should be no more than 100 legionella bacteria per litre.
HSE, testing and monitoring your water systemReading the results
For hot and cold water, HSG274 gives two bands in colony-forming units per litre. Over 100 and up to 1,000: if a minority of samples are positive, resample; if most are, review the controls at once and consider disinfection. Over 1,000: resample, review at once and consider disinfection, then retest.
HSE HSG274 Part 2, Table 2.2What a result does not prove
L8 guidance warns that a negative result is no guarantee legionella is absent, and a positive one may not mean the controls have failed. A suitably experienced and competent person should interpret the results.
L8 guidance, paragraphs 68 and 69Water quality testing may be done by a service provider or by the operator, if trained and properly supervised. Cooling towers and evaporative condensers must also be notified in writing to the local authority under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, regulation 3. Cooling tower action levels are in HSG274 Part 1, and healthcare premises with vulnerable patients use Part 2, Table 2.3.
Reviewing the assessment and keeping records
COSHH regulation 6The assessment is a living document. HSG274 calls it an ongoing process, not merely a paper exercise.
When to review
The law requires the assessment to be reviewed regularly. It must be reviewed at once if there is reason to suspect it is no longer valid, the work has changed significantly, or monitoring results show a review is needed. The L8 ACOP says the same.
COSHH regulation 6(3); L8 Approved Code of Practice, paragraph 32What prompts a review
L8 guidance lists changes to the system or its use, changes to the building’s use, and new information about risks or controls. It adds checks showing controls no longer work, changes to key people, and a case of legionellosis linked to the system.
L8 guidance, paragraph 47No fixed interval
Neither COSHH nor L8 sets a fixed review period such as two years. L8 guidance asks for an indication of when to review to be recorded. HSE’s landlord guidance says the law does not prescribe an annual or biennial review.
L8 guidance, paragraph 47; HSE, landlordsRecording the findings
An employer with 5 or more employees must record the significant findings and the steps taken to control the risk. The ACOP adds any groups of employees found to be particularly at risk. Below 5 there is no statutory duty, but a record can show the work was done.
COSHH regulation 6(4); L8 Approved Code of Practice, paragraph 70What the records include
The ACOP lists the responsible people, the significant findings, the written scheme and its implementation, and whether the system is in use. It also lists the results and dates of every monitoring inspection, test or check.
L8 Approved Code of Practice, paragraph 71How long to keep them
Records are kept while they are current and for at least two years afterwards. Records of monitoring inspections, tests and checks, with their dates, are kept for at least five years.
L8 Approved Code of Practice, paragraph 72Signed and traceable
L8 guidance says all records should be signed, verified or otherwise authenticated by the people doing the work. It also lists schematics, remedial work, contractor visits, cleaning and disinfection reports, training records and any cooling tower notification.
L8 guidance, paragraphs 73 and 74Landlords and simple domestic systems
HSE has its own guidance for landlords of residential property. The duty to assess is the same, but HSE says it does not require an in-depth, detailed assessment.
The duty
HSE says a landlord who rents out a property, or even a room in their own home, has legal responsibilities for the tenant’s health and safety. Those include assessing and controlling the legionella risk. HSE grounds this in section 3 of the Health and Safety at Work etc Act 1974, the duty owed to people who are not your employees.
HSE, legionella and landlords’ responsibilities; HSWA 1974, section 3Usually low risk
HSE says the risk in most homes is low because water is used and turned over regularly. Combi boilers and electric showers lower it further, as there is no stored hot water. A simple assessment may show no further action is needed.
HSE, legionella and landlords’ responsibilitiesWho can assess
HSE says most landlords can assess the risk themselves and do not need to be professionally trained or accredited. Those who do not feel competent can arrange for someone else to do it.
HSE, legionella and landlords’ responsibilitiesNo test certificate
HSE says testing for legionella is not usually required for domestic hot and cold water systems. Health and safety law does not require landlords to obtain or produce a “legionella test certificate”.
HSE, legionella and landlords’ responsibilitiesSimple controls
HSE lists flushing the system before letting, a tight-fitting lid on any cold water tank, hot water stored at 60°C and removing redundant pipework. Tenants are told not to adjust the cylinder temperature, to clean showerheads, and to report hot water problems.
HSE, legionella and landlords’ responsibilities; HSG274 Part 2, paragraphs 2.142 and 2.143Empty properties
As a general principle, HSE says outlets should be used at least once a week to keep water moving. For long empty periods, a flushing regime or draining the system should be considered.
HSE HSG274 Part 2, paragraph 2.144Access and agents
Where access is difficult, HSE says checks can be made during visits such as gas safety checks or routine maintenance. Where a managing agent is used, the contract should say who manages the legionella risk.
HSE HSG274 Part 2, paragraphs 2.139 and 2.145In shared commercial buildings the duty follows control. HSG274 says that where no contract or tenancy agreement settles it, the duty falls on whoever controls the premises or that part of them. Employers sharing a building must co-operate, for example by passing on monitoring results that point to a problem.
Written, signed and kept,
tied to the job that uses it.
In Unibuild, a COSHH assessment is written once and operatives read and sign it on their phone, the same way as a RAMS. The AI builds a draft from the supplier’s safety data sheet and checks an assessment before it goes out. A person reviews and finalises every one.
Each substance holds its data sheet and supplier, linked to the jobs, materials and purchase orders that use it. Review dates are tracked and every version is kept. When an auditor or a principal contractor asks for the COSHH register, it is a search, not a spreadsheet.
- Signed on the phone by every operative, the same way as a RAMS
- Drafted by AI from the safety data sheet, and checked before issue
- A data sheet for every substance, tied to the job through materials and purchase orders
- Review dates tracked and every version kept
- COSHH e-learning, with the certificate on the training matrix
Free COSHH templates
Free to use and reuse, no sign-upLegionella risk assessment: common questions
Is a legionella risk assessment a legal requirement?
Who can carry out a legionella risk assessment?
How often should a legionella risk assessment be reviewed?
What is a written scheme of control for legionella?
Do I need legionella testing?
What is the difference between legionella testing and temperature checks?
What temperature controls legionella?
Do landlords need a legionella risk assessment or certificate?
How long should legionella records be kept?
What is the responsible person for legionella?
Substances and diseases
Read in any orderSources
Great Britain law and HSE guidance, read on the dates above. Northern Ireland has its own COSHH Regulations.
- HSE L8, Legionnaires’ disease: the control of legionella bacteria in water systems, ACOP and guidance, fourth edition 2013 (PDF)
- HSE HSG274 Part 2, the control of legionella bacteria in hot and cold water systems (PDF)
- HSE HSG274 Part 1, the control of legionella bacteria in evaporative cooling systems, second edition 2024 (PDF)
- HSE, Legionnaires’ disease: identify and assess sources of risk
- HSE, Legionnaires’ disease: managing the risk
- HSE, Legionnaires’ disease: preventing or controlling the risk
- HSE, Legionnaires’ disease: monitoring and keeping records
- HSE, Legionnaires’ disease: reviewing what you do
- HSE, Testing and monitoring your water system for legionella
- HSE, Legionella and landlords’ responsibilities
- HSE, Hot and cold water systems: things to consider
- The Control of Substances Hazardous to Health Regulations 2002, regulation 6, legislation.gov.uk
- The Control of Substances Hazardous to Health Regulations 2002, regulation 2, legislation.gov.uk
- The Management of Health and Safety at Work Regulations 1999, regulation 7, legislation.gov.uk
- The Notification of Cooling Towers and Evaporative Condensers Regulations 1992, regulation 3, legislation.gov.uk
- Health and Safety at Work etc. Act 1974, section 3, legislation.gov.uk
The COSHH register,
tied to the job.
Unibuild keeps each substance’s data sheet and supplier against the jobs, materials and purchase orders that use it, with review dates tracked and every version kept.