TL;DR — Legionella Risk Assessment in Six Steps
- Map every water system on site — including the ones nobody remembers, like emergency showers, expansion vessels, and dead legs behind wall modifications.
- Assess the five growth conditions — temperature (20–45°C danger zone), stagnation, biofilm/nutrient sources, aerosol generation potential, and system design flaws.
- Identify who faces exposure — especially vulnerable groups (over-50s, immunocompromised) and maintenance workers who contact concentrated aerosols directly.
- Evaluate risk with honest, site-specific judgement — not a box-ticking matrix that defaults every parameter to “low.”
- Implement a written scheme or water management program — with temperature controls, flushing regimes, and treatment proportionate to the risk level identified.
- Monitor, record, and review on a defined cycle — because the assessment is a living document, not a filed-and-forgotten compliance artefact.
A Legionella risk assessment is a systematic evaluation of a building’s water systems to identify whether conditions allow Legionella bacteria to grow and spread, posing a risk of Legionnaires’ disease. The assessment identifies hazards, evaluates who is at risk, and determines what control measures are needed. It is a legal requirement for employers and landlords in the UK under ACOP L8, and an OSHA-referenced best practice in the US under ASHRAE Standard 188-2021.
Reported Legionnaires’ disease cases in the US increased approximately 900% between 2000 and 2018 (The Lancet Microbe, 2024). That is not a gradual uptick — it is a ninefold increase in a disease that kills between 7 and 10 percent of those it infects in the general population, and up to 25% in healthcare-associated cases (NCBI, 2023). In 2024 alone, a global surge of major outbreaks — 114 cases in Melbourne, 53 in Lombardy, 30 in London — prompted The Lancet Microbe to characterize the year as requiring urgent heightened awareness. These are not obscure tropical infections. They are building water system failures.
The Legionella risk assessment exists to prevent exactly this. It is the foundational step in managing the microbiological safety of water systems — the process that determines whether a building’s plumbing, cooling, and water storage infrastructure can harbour and disperse a potentially fatal pathogen. This guide covers the full procedural sequence: who must conduct the assessment, what each step involves, how the process differs across UK and US regulatory frameworks, and where assessments consistently fail in practice. Whether you manage a single rental property or oversee water systems across a healthcare campus, the steps are the same in principle — what changes is the depth, the complexity, and the consequences of getting it wrong.
What Is a Legionella Risk Assessment and Why Does It Matter?
A Legionella risk assessment is, at its core, a structured examination of every water system in a building to determine whether conditions exist that allow Legionella pneumophila to colonise, multiply, and reach people as an aerosol. The outcome is not a certificate. It is a set of findings that drive a control programme — what needs fixing, what needs monitoring, and what needs ongoing management.
The assessment sits at the start of a cyclical process: assess, control, monitor, review. Each stage feeds the next. The assessment identifies what the risks are. The written scheme (UK) or water management program (US) specifies how those risks are controlled. Monitoring verifies the controls are working. Review catches the drift — the slow changes in system condition, building use, or occupancy that shift the risk profile over time.
Where this goes wrong, in practice, is when organisations treat the assessment as a one-time compliance exercise. A document gets produced, filed, and forgotten. The building changes — a wing gets mothballed, a plumbing modification creates a new dead leg, a seasonal shutdown leaves water standing for weeks — and the assessment gathers dust without reflecting any of it. That gap between the documented assessment and the real state of the water system is where outbreaks begin.
Who Is Legally Required to Conduct a Legionella Risk Assessment?
The answer depends on jurisdiction, but the principle is consistent: whoever controls the premises and the water systems bears the duty.
UK — The Duty Holder Framework
Under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations 2002 (COSHH), employers and those in control of premises must assess and control risks from biological agents — including Legionella. ACOP L8 (4th edition, HSE UK) translates this into specific obligations: duty holders must identify and assess sources of Legionella risk, appoint a competent Responsible Person, prepare a written scheme to prevent or control risk, implement precautions, and keep records.
The duty holder is typically the employer, landlord, or managing agent — whoever has operational control of the water system. The Responsible Person they appoint must have sufficient authority, competence, and knowledge of the water systems to implement the assessment’s findings. ACOP L8 carries a specific legal weight: courts can use failure to follow it as evidence of non-compliance, even though it is not statute law.
A pattern that appears repeatedly in enforcement actions: organisations appoint a Responsible Person who holds the title on paper but lacks either the authority to approve expenditure on remedial work or the time to oversee monitoring programmes. The assessment gets done; the findings never translate into action because the person designated to act cannot.
US — OSHA, ASHRAE, and CMS
The US has no Legionella-specific OSHA standard. Enforcement relies on the General Duty Clause — Section 5(a)(1) of the OSH Act (29 USC 654(a)(1)) — which requires employers to provide workplaces free from recognized hazards likely to cause death or serious harm. OSHA references ASHRAE Standard 188-2021 and the CDC toolkit as the industry best practice for water management programs.
ANSI/ASHRAE Standard 188-2021 applies to buildings with cooling towers, whirlpool spas, decorative fountains, or centralized hot water systems, and to any buildings serving occupants over 65 or those with compromised immune systems. The 2021 revision strengthened the language from permissive guidance to enforceable, code-intended requirements. For US healthcare facilities specifically, CMS Memo 17-30 requires compliance with the CDC toolkit as a condition of participation in Medicare and Medicaid programmes.
Competent Person Requirements
Both frameworks require that whoever carries out the assessment is competent. In the UK, ACOP L8 does not mandate a specific qualification — competence is defined by knowledge of Legionella ecology, water system design, sampling methodology, and applicable regulations. In practice, auditors look for documented evidence that the assessor understands the specific systems they are evaluating.
In the US, the ASSE/IAPMO/ANSI 12080 standard provides a professional qualification framework for Legionella Water Safety and Management Personnel. While not universally required, it establishes a benchmark for demonstrating competence.
The proportionality principle matters here. A landlord with a simple domestic property — mains-fed, no stored water, regularly occupied — may be competent to self-assess after reviewing the relevant guidance. A facilities manager responsible for a hospital campus with cooling towers, complex recirculation systems, and immunocompromised patients should engage specialist water hygiene consultants. Matching the assessor’s competence to the system’s complexity is itself a risk-management decision.
Step 1 — Identify and Map All Water Systems
The first procedural step is to build a complete inventory of every water system on the premises. Every system — not just the obvious ones.
This means documenting domestic hot and cold water distribution, cooling towers, evaporative condensers, spa pools and hot tubs, decorative fountains, misting systems, humidifiers, fire sprinkler systems with standing water, emergency showers, eyewash stations, and any other system that stores, heats, cools, or distributes water. For each system, record its storage capacity, materials of construction, age, normal operating temperatures, water source, and any treatment methods already in place.
Create a schematic that shows water flow direction, storage points, distribution routes, and the location of every outlet. This schematic is the assessment’s reference map — without it, every subsequent step is guesswork.
The most common gap at this stage is missing systems. Emergency showers in remote parts of a facility that have not been flushed in months. Expansion vessels hidden in plant rooms that nobody includes in the monitoring schedule. Dead legs created by past plumbing modifications — a capped-off branch line behind a wall that does not appear on any current drawing but still holds stagnant water connected to the live system. If the system inventory is incomplete, the risk assessment is incomplete by definition, regardless of how thorough the rest of the process is.
Watch For: Dead legs are not always visible. Any plumbing modification — relocating a sink, removing a washroom, capping off a branch line — can create one. Cross-reference the current schematic against historical modification records, and physically inspect areas where work has been done.
Step 2 — Assess Conditions That Promote Legionella Growth
With the system inventory complete, the next step is to evaluate whether conditions within those systems support Legionella proliferation. Five factors govern this, and each must be assessed for every system identified in Step 1.
Temperature
Legionella pneumophila proliferates between 20°C and 45°C, with optimal growth between 25°C and 42°C. Above 60°C, the bacteria are killed — rapidly at 70°C, within minutes at 60°C. Below 20°C, they become dormant but are not eliminated. The practical implication: any part of a water system that sits within the 20–45°C range for extended periods is a potential colonisation site.
HSG274 (HSE UK) specifies hot water should be stored at 60°C or above and distributed so that it reaches outlets at 50°C or above within one minute of running. Cold water should be maintained below 20°C. ASHRAE Guideline 12-2023 provides comparable temperature management recommendations for US-context buildings, though ASHRAE 188-2021 itself does not prescribe exact temperature values.
Stagnation
Standing water is the single most reliable predictor of Legionella risk. Dead legs, seldom-used outlets, capped-off pipework, seasonal usage patterns, and building areas that sit unoccupied for extended periods all create stagnation. Water that does not move does not maintain temperature, does not receive fresh treatment, and provides a stable environment for biofilm to develop.
Nutrient Sources
Legionella does not grow in sterile water. It requires nutrients — and building water systems provide them. Scale, sludge, corrosion products, rubber gasket degradation, and organic debris all feed bacterial colonies. Biofilm — the slimy layer that forms on internal pipe surfaces — is particularly significant because it shelters bacteria from both thermal and chemical disinfection, allowing colonisation to persist even in systems that appear to be at correct temperatures.
Aerosol Generation
The exposure pathway for Legionnaires’ disease is inhalation, not ingestion. Systems that generate fine aerosols — showers, cooling tower drift, misting systems, taps fitted with aerators, spa pool jets — are the transmission mechanism. A contaminated hot water cylinder with no aerosol-generating outlet downstream is a reservoir, but not a delivery mechanism. The risk assessment must identify where aerosol generation occurs relative to contaminated water sources.
System Design Features
Certain design features amplify risk: oversized calorifiers that cycle infrequently, poor recirculation leaving remote parts of a distribution loop at lower temperatures, incompatible materials that accelerate biofilm formation, and thermostatic mixing valves (TMVs) that blend hot and cold water into the growth range downstream of the storage point.
Field Test: Temperature alone is an insufficient risk indicator. A system maintaining correct storage and distribution temperatures but harbouring extensive biofilm in dead legs presents a different — and often underestimated — risk profile compared to a clean system with occasional temperature drift. The assessment must consider system condition alongside thermal compliance.
Step 3 — Identify Who Is at Risk of Exposure
The third step shifts focus from the water system to the people. The question is not just whether Legionella can grow — it is whether anyone is positioned to inhale contaminated aerosols if it does.
Start with the obvious categories: employees working in or near the building, residents (for residential settings), visitors, contractors, and — for systems like cooling towers that discharge aerosol into the ambient environment — members of the public in the vicinity. Then consider the less obvious: maintenance workers who service water systems directly are often the most intensively exposed population, contacting concentrated aerosols during tasks like cleaning cooling tower basins, descaling showerheads, or opening storage vessels for inspection. Their exposure may be brief but highly concentrated.
Vulnerable groups require specific identification because they face disproportionately severe outcomes. These include individuals over 50, current or former heavy smokers, people with chronic respiratory disease, chronic kidney disease, diabetes, or immunosuppression (whether from medical treatment or underlying condition), and neonates in healthcare settings. The elevated susceptibility is physiological — impaired immune response and reduced mucociliary clearance reduce the body’s ability to fight pulmonary infection.
Frequency and duration of exposure act as risk multipliers. A worker who spends eight hours daily in a building with a poorly maintained system faces a fundamentally different exposure profile than a visitor passing through for twenty minutes. The assessment should document exposure patterns — who is present, for how long, and how close to aerosol-generating outlets.
| Population Group | Why Higher Risk | Common Exposure Points |
|---|---|---|
| Over-50s | Age-related immune decline | Showers, residential taps |
| Immunocompromised | Reduced pathogen clearance | Healthcare water outlets |
| Smokers / chronic lung disease | Impaired mucociliary function | Any aerosol source |
| Maintenance workers | Direct, concentrated aerosol contact | Cooling towers, tanks, descaling |
| Neonates | Immature immune system | Hospital water systems |
Step 4 — Evaluate the Level of Risk
This step synthesises everything gathered in Steps 1–3 into a risk judgement. It combines the likelihood that Legionella can proliferate and reach a susceptible person with the severity of harm that would follow.
Likelihood depends on whether the growth conditions identified in Step 2 are present and whether an aerosol pathway exists between a contaminated source and an exposed person. Severity depends on who is exposed — a healthy adult in their thirties faces a different outcome probability than an immunocompromised hospital patient.
Low-risk scenarios typically involve simple, mains-fed cold water systems with no storage, regular use, and no vulnerable occupants. Medium-risk systems may include stored hot water with some stagnation potential, mixed-age building populations, and older infrastructure where biofilm accumulation is plausible. High-risk settings involve cooling towers, healthcare facilities, buildings serving vulnerable populations, complex distribution systems with long pipe runs, or systems with a documented history of temperature or microbiological non-compliance.
Current control measures — if already in place — factor into the residual risk evaluation. A cooling tower with a robust biocide treatment programme and routine microbiological monitoring presents a different residual risk than an identical tower with no treatment in place. The key word is verified: controls claimed on paper count only if monitoring data confirms they are actually working.
The judgement call here is between a formulaic scoring approach and a narrative, competence-based evaluation. Risk matrices provide structure, but they can generate misleadingly low scores when an assessor defaults every parameter to the lowest category without genuine site-specific evaluation. The most reliable assessments combine a structured framework with documented narrative justification for each rating — explaining why the assessor reached a particular conclusion, not just the number they assigned.
Audit Point: Reviewers and auditors look for evidence that risk ratings are supported by site observations, not assumptions. An assessment that rates every system as “low risk” without documenting the temperature readings, system condition observations, and usage patterns behind each rating will not survive scrutiny.
Step 5 — Implement Control Measures and a Written Scheme
Risk evaluation without control implementation is an academic exercise. Step 5 translates findings into operational action — the specific measures that prevent Legionella proliferation and reduce exposure.
Temperature Control
Temperature management is the primary control for hot and cold water systems. HSG274 (HSE UK) establishes the thresholds: hot water stored at 60°C or above, distributed to reach 50°C at outlets within one minute of running, and cold water maintained below 20°C. These thresholds represent the boundaries outside the Legionella growth range.
For US-context facilities, ASHRAE Guideline 12-2023 provides comparable temperature management recommendations, though the specific values and measurement protocols differ in format. The practical outcome is the same: keep hot water hot, cold water cold, and eliminate the conditions where water sits in the 20–45°C growth range.
Flushing Regimes
Outlets that are not used regularly must be flushed at least weekly. This includes guest rooms in hotels during low-occupancy periods, washrooms in seldom-used building areas, emergency showers, and eyewash stations. The flushing duration should be sufficient to replace the standing water volume in the branch line — typically a minimum of two minutes, though longer runs may be needed for outlets at the end of extended dead legs.
Dead Leg Removal
Where dead legs are identified in Step 1, the preferred control is physical removal — cutting back the redundant pipework to the live flow. Where removal is not immediately feasible, regular purging of the dead leg and inclusion in the monitoring programme is the interim measure, with removal scheduled at the next planned system modification.
Water Treatment
Treatment methods vary by system type and risk level. The HSE guidance on managing Legionella risk and OSHA guidance on Legionella control and prevention both address system-specific treatment selection.
| Treatment Method | Application | Key Consideration |
|---|---|---|
| Thermal control (pasteurisation) | Hot water systems, outbreak response | Scald risk requires careful management at outlets |
| Chlorination / chlorine dioxide | Cooling towers, hot/cold water | Requires dosing control and residual monitoring |
| Copper-silver ionisation | Hot water systems (healthcare) | Long-lasting residual; higher capital cost |
| UV disinfection | Point-of-use supplementary treatment | No residual effect downstream |
| Filtration (0.2µm point-of-use) | High-risk outlets in healthcare | Filters require regular replacement |
The Written Scheme (UK) / Water Management Program (US)
The assessment’s findings must be translated into a formal operational document. In the UK, ACOP L8 requires a written scheme that specifies the control measures, monitoring frequencies, responsible persons, and corrective action procedures. In the US, ASHRAE 188-2021 structures this as a water management program (WMP) following a seven-step model: describe the building water systems, analyse the hazards, determine control measures, monitor controls, establish corrective actions, confirm effectiveness through verification and validation, and document.
In August 2025, ASHRAE highlighted Standard 188 and Guideline 12-2023 resources in direct response to ongoing outbreak risks, with the incoming ASHRAE President emphasizing that healthy buildings depend on comprehensive water management strategies — particularly following flooding events that mobilise biofilms within distribution systems.
Control measures degrade over time. A flushing regime that exists on a schedule posted in the plant room but is not actually performed weekly is a gap between the written scheme and operational reality. The written scheme is only as good as the monitoring data that verifies it.
Temperature Monitoring Requirements
Monitoring is not a single annual check — it is a continuous programme. Sentinel outlets (the nearest and furthest from the calorifier or water heater) and representative indicator outlets should be monitored monthly. Hot water storage temperatures should be checked at least monthly. Cold water temperatures at outlets should be verified at least monthly, with attention to seasonal variation — cold water systems that maintain 15°C in winter may exceed 20°C in summer when pipework runs through warm ceiling voids or plant rooms.
Records should document the date, outlet location, temperature reading, and the name of the person who took the measurement. Readings that fall outside target ranges trigger corrective action — not a note in the log and a plan to check again next month.
Step 6 — Record, Monitor, and Review
The assessment is not complete when the report is written. It enters a monitoring and review cycle that keeps it aligned with the real state of the building and its water systems.
What to Record
Records must include the full assessment findings, system schematics, control measures implemented, all monitoring results (temperature readings, treatment dosing records, microbiological sampling results where applicable), corrective actions taken, and the identity of responsible persons. In the UK, HSG274 recommends retaining monitoring records for at least five years. In the US, ASHRAE 188-2021 requires maintaining current records as an integral part of the water management program.
Ongoing Monitoring
Monitoring activities go beyond monthly temperature checks. They include visual inspections of water system components (calorifiers, cold water storage tanks, cooling tower basins), verification that treatment programmes are operating within target parameters, and — where indicated by the risk level — microbiological sampling.
The distinction between verification and validation matters here, particularly under the ASHRAE 188 framework. Verification confirms that control measures are being applied as specified (are we doing what we said we would?). Validation confirms that the control measures are effective at managing the risk (is what we’re doing actually working?). Both are required for a robust programme.
Review Triggers
The assessment must be reviewed when specific trigger events occur — and at regular intervals regardless.
ACOP L8 and HSG274 recommend review at least every two years, though HSE guidance notes that shorter intervals may be appropriate for higher-risk or more complex systems. Trigger events that require immediate reassessment include any modification to the water system, a change in building use or occupancy, a confirmed case or outbreak associated with the premises, a change in the population served (particularly introduction of vulnerable occupants), publication of new regulatory guidance, or results from monitoring that indicate control measures are failing.
The most valuable element of the review process is trend analysis. A single temperature reading of 58°C in a calorifier may fall within an acceptable tolerance. A slow drift from 62°C to 56°C over six months tells a different story — it indicates a system condition change that a single snapshot would miss. Organisations that analyse monitoring data as trends, rather than reviewing individual readings in isolation, catch problems earlier and at lower cost.
How Is a Legionella Risk Assessment Different for Landlords?
This section addresses a high-volume question directly: if you rent out residential property, the legal obligation to assess Legionella risk applies to you.
In the UK, landlords are duty holders under the Health and Safety at Work Act 1974 and COSHH Regulations 2002. HSE guidance is clear that the legal obligation exists regardless of property size or tenant type. However, HSE also acknowledges that for most standard domestic rental properties — mains-fed, combi-boiler heated, regularly occupied — the risk is typically low and the assessment can be straightforward.
A common misconception circulates in the lettings industry: that landlords need a “Legionella certificate.” HSE does not require, recognise, or endorse any such certificate. Providers who sell Legionella certificates are offering a commercial product, not a regulatory compliance document. What the law requires is that the risk has been assessed by a competent person, that the findings are recorded, and that any necessary control measures are implemented.
For a standard domestic property, proportionate control measures typically include maintaining hot water storage at 60°C (or ensuring the combi-boiler delivers at equivalent temperatures), keeping cold water below 20°C, flushing the system after void periods before new tenants move in, and advising tenants to clean showerheads periodically. These are not onerous measures — they are basic water hygiene.
When should a landlord escalate to professional assessment? When the property has communal or shared water systems, large cold water storage tanks, complex distribution infrastructure, or when tenants are in a vulnerable category (elderly residents, sheltered housing). Properties with header tanks in roof spaces or calorifiers serving multiple flats sit outside the “simple domestic” category and warrant specialist evaluation.
The biggest risk factor in residential lettings is not system complexity — it is vacancy. Properties standing empty during void periods allow water to stagnate throughout the entire system. The first tenant to run a shower after a three-week void may face the highest exposure risk of anyone in the tenancy cycle. A documented flushing procedure before each new occupancy addresses this directly.
Common Mistakes in Legionella Risk Assessments
A procedurally correct assessment can still fail operationally. Reviewing published enforcement actions and outbreak investigations reveals consistent failure patterns that separate assessments that genuinely manage risk from those that merely create the appearance of compliance.
The filed-and-forgotten assessment. The assessment is completed, the document is filed, and it is never referenced again. System modifications are made without updating the schematic. Control measures specified in the written scheme are never verified. Two years later, the assessment describes a building that no longer exists in its current form.
Missing systems. Assessors walk the main plant room and distribution routes but miss ancillary systems — expansion vessels, emergency showers tested quarterly but never flushed between tests, dead legs behind wall panels from previous renovations. If the inventory in Step 1 is incomplete, every subsequent step inherits that gap.
Responsible Person without authority. The Responsible Person is appointed, their name goes on the document, and they have no budget authority, no dedicated time allocation, and no direct line to the decision-makers who can approve remedial work. This is a compliance illusion — the governance structure exists on paper while the risk remains unmanaged in practice.
Template assessments without site-specific adaptation. Generic templates produce generic findings. An assessment that looks identical for a three-bedroom flat and a forty-outlet office building has not been adapted to either. The value of the assessment lies in its specificity to the actual systems, conditions, and populations at that site.
Temperature monitoring without system condition assessment. Temperature compliance is necessary but not sufficient. A system at correct temperatures but with extensive biofilm in dead legs, sediment accumulation in the base of a calorifier, or corroded pipework providing nutrient sources is not adequately controlled by temperature alone. The assessment must evaluate system condition alongside thermal performance.
Sampling confusion. Microbiological sampling — testing water for Legionella counts — is sometimes treated as a substitute for the risk assessment itself. Sampling is a verification tool. It confirms whether controls are working at a point in time. It does not replace the systematic evaluation of system design, condition, and operational management that the assessment provides. A negative sample result does not mean the system is safe; it means the system was not colonised above detectable limits at that specific sampling point on that specific day.
The Fix That Works: Before signing off any Legionella risk assessment, conduct a simple validation exercise: walk the building with the completed assessment in hand. Does the schematic match what is physically installed? Are the outlets listed as “regularly used” actually being used? Is the flushing regime documented in the written scheme actually happening? The gap between document and reality is where the real risk lives.
UK vs US Regulatory Framework Comparison
Readers managing water systems across jurisdictions — or simply trying to understand where their obligations fall — benefit from a direct comparison. The two dominant frameworks share the same objective but differ in structure, specificity, and enforcement mechanism.
| Element | UK (ACOP L8 / HSG274) | US (ASHRAE 188-2021 / OSHA) |
|---|---|---|
| Legal basis | HSWA 1974, COSHH 2002, ACOP L8 | OSHA General Duty Clause, state/local codes |
| Who must assess | Duty holders: employers, landlords, building controllers | Building owners/managers; healthcare per CMS 17-30 |
| Assessment trigger | All premises with water systems | Buildings with cooling towers, spas, fountains, or vulnerable occupants |
| Hot water storage | ≥60°C (HSG274) | Per ASHRAE Guideline 12-2023 recommendations |
| Hot water at outlets | ≥50°C within 1 minute (HSG274) | Not specified as a single threshold |
| Cold water | <20°C (HSG274) | Minimize stagnation; temperature management per WMP |
| Documentation | Written scheme required | Water management program required |
| Review frequency | At least every 2 years | Per WMP team determination; triggered by events |
| Enforcement | HSE prosecution, unlimited fines | OSHA General Duty Clause citations; CMS conditions of participation |
| Competence standard | ACOP L8 competence criteria (no mandated qualification) | ASSE 12080 (voluntary professional standard) |
Jurisdiction Note: Where a facility must comply with both frameworks — for example, a US subsidiary of a UK-headquartered organisation applying group standards — the stricter requirement at each decision point should govern. Maintaining hot water storage at 60°C satisfies both frameworks; maintaining cold water below 20°C exceeds what ASHRAE 188 explicitly requires but aligns with the risk-based intent of both.
Frequently Asked Questions
Conclusion
The pattern that defines most Legionella risk assessment failures is not a lack of process — it is a gap between what the document says and what the building’s water systems actually do. Assessments get completed, filed, and disconnected from the operational reality they were supposed to govern. Systems change without schematic updates. Flushing schedules exist on paper but not in practice. Responsible Persons hold the title without the authority to act.
The highest-impact change any organisation can make is to close that gap. Treat the Legionella risk assessment as the operational foundation it is meant to be — a document that drives weekly flushing, monthly temperature monitoring, corrective action when readings drift, and systematic reassessment when the building, the systems, or the people they serve change. In 2024, simultaneous outbreaks across Melbourne, Lombardy, and London demonstrated that Legionnaires’ disease remains an active and lethal threat when water management fails. The assessment is the first line of defence — but only if it reflects the building as it actually is, not as it was on the day someone last opened the file.
For HSE professionals and facilities managers, the question to carry away is uncomfortable but necessary: when was the last time someone walked the building with the risk assessment in hand and checked whether the two still match?