19 October 2026

Legionella Risk Assessment: A Guide for Building Managers

Legionella assessment title card with water-system sketches

If you control a commercial building, you are responsible for assessing the risk of legionella in its water systems. That applies whether you own the building, manage it for a client or look after it for a housing association. The assessment is not a one-off certificate. It is a living document that describes your system, names who is responsible, identifies where bacteria could grow and sets out the checks that keep the risk under control. This guide explains who the duty falls on, what a sound assessment covers, which conditions raise the risk, which routine checks and records matter, and when to review it.

BW Building Maintenance

Keep Building Maintenance on Track

BW Building Maintenance coordinates planned and reactive maintenance for London commercial properties under one contract, with monthly reports and a dedicated contract manager.

Request a maintenance quote

TL;DR

The duty sits with the employer or the person in control of the premises, which includes landlords. You can use a competent contractor, but you stay accountable.
Legionella bacteria grow in water between 20°C and 45°C, so the assessment looks hard at temperatures, stored water and outlets that are rarely used.
A generic checklist is not an assessment. It has to describe your building’s own system, with a named responsible person and written monitoring arrangements.
Routine temperature checks, flushing of little-used outlets and written records are what show the risk is being controlled day to day.
Review the assessment whenever the system, its use or the occupants change significantly. The law does not set a fixed annual or biennial review.

Who is a duty holder?
What the assessment must cover
The risk factors to look for
Routine controls and monitoring
Keeping records
When to review the assessment
Our perspective: where compliance usually slips
Turning findings into repairs
FAQ
Sources

Who is a duty holder?

The Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations (COSHH) put the duty on employers and on people in control of premises. HSE states that employers, and anyone in control of premises including landlords, must identify and assess sources of risk and take precautions. In a London portfolio, that can mean several parties at once:

The freeholder or landlord, who controls the building and its shared plant.
The managing agent, who is often handed the day-to-day duty by contract.
The employer occupying a unit, who has duties to staff and visitors for the water systems they control.
The housing association, for communal blocks, voids and shared plant rooms.

HSE’s page on landlords’ responsibilities explains that landlords are treated as self-employed under section 53 of the Act and must run their undertaking so that tenants are not exposed to risk. For simple domestic-type systems it says the assessment need not be in-depth. A multi-storey office, a block with a central hot water plant or a building with a spa or cooling system is a different matter.

The responsible person

A sound assessment names a responsible person. HSE’s audit checklists in Control of legionella bacteria in water systems are written for that person, to audit the risk assessment process and the arrangements in the premises. The person needs enough authority, competence and knowledge of the systems to act on what they find.

The common mistake is to hand the whole thing to a third party and never look at it again. You can appoint a competent contractor, but the duty holder keeps ultimate responsibility. You should be able to read the report, understand the system it describes and challenge it.

What the assessment must cover

Carrying out the assessment is your responsibility. You may be competent to do it yourself, but if not, HSE says to call on a competent person. Its own guidance on legionella risk assessment is the reference page to work from. The Approved Code of Practice, L8, and the technical guidance in HSG274 give the detailed framework.

In practice, a useful assessment includes:

A description of the system. Tanks, calorifiers, pipework, outlets, showers, any spa or other aerosol-generating equipment, and how they connect. A schematic is the quickest way to show this.
Management responsibilities. The named responsible person, deputies and who is accountable for each task.
Competence and training. Who carries out the checks, and how you know they can do it.
Sources of risk. Temperature, stagnation, and nutrient sources such as scale, rust and sludge.
Control measures. What is monitored, inspected and maintained, and what the target readings are.
Records and review arrangements. Where the evidence is kept and what triggers a reassessment.

Why a generic checklist fails

A downloaded checklist can help you collect data. It cannot replace an assessment that is specific to your building. The risks that matter are often unique to a site: a dead leg left after a refit, a tank that is oversized for current occupancy, a calorifier that is not sized for demand. An assessor with knowledge of your own pipework spots these. A template does not.

The risk factors to look for

Water between 20°C and 45°C

HSE identifies 20°C to 45°C as the range where legionella bacteria multiply. Temperature control is the traditional strategy for hot and cold water systems, as set out on HSE’s hot and cold water systems page. The targets HSE gives are:

Part of the system	Target
Stored hot water	At least 60°C
Hot water at the outlet	At least 50°C (HSE’s guidance gives 55°C in healthcare settings)
Cold water	Below 20°C

These are the figures to check your own system against. They are not a substitute for your assessor’s view on what the right controls are for your building.

Stored water

Tanks, cylinders and calorifiers hold water for longer, which gives it time to drift into the growth range. Oversized storage is a classic cause, especially in buildings where occupancy has fallen since the system was designed. Look for tanks that no longer match demand, poorly insulated pipes running through warm risers, and cold water tanks in warm plant rooms or roof spaces.

Stored water conditions that increase Legionella risk

Scale, rust and sludge matter too. They give bacteria somewhere to live and something to feed on, which is why the assessment records the condition of tanks and heaters as well as their temperatures.

Little-used outlets

This is the one most often missed. A tap or shower that is not used regularly holds still water, and still water drifts toward room temperature whatever the main system is doing. Typical culprits in commercial and residential portfolios are:

Showers and basins in rarely used first-aid or cleaners’ rooms.
Outlets in vacant units and void flats.
Facilities in seasonal or partly occupied floors.
Capped or redundant pipework left after alterations, known as dead legs.

HSE’s things to consider page covers flow and temperature control in hot and cold systems. A recorded flushing routine for outlets that are not used regularly is the usual control, and it is one of the first things a competent reviewer will look for.

Features that raise the risk

Some building features need extra attention in the assessment. Spa pools and hot tubs in hotels, gyms or residential amenity areas are an example, because they combine warm water, aeration and a regular programme of cleaning and equipment checks. A leak or failing pump is a maintenance problem as well as a hygiene one, and this guide to hot tub leaks and when to stop using the equipment shows the kind of fault to watch for. It was written for an Australian audience, so rely on HSE and your assessor for UK requirements.

Routine controls and monitoring

The assessment sets out the scheme of control. The scheme is then carried out week by week. The frequency of inspection and maintenance tasks depends on the system’s risk profile. There is no single schedule that suits every building. HSE says the frequency should come from your risk assessment and the technical guidance in HSG274, as described on its page on reviewing what you do.

Typical tasks include:

Temperature monitoring at sentinel outlets, usually the nearest and furthest from the heat source. HSE publishes a video on checking a hot water sentinel outlet to confirm the 50°C target.
Flushing of infrequently used outlets, recorded each time.
Tank and calorifier inspection for condition, cleanliness and temperature.
Checks on showerheads and hoses, cleaned or replaced as the scheme requires.
Remedial work when a reading is out of range or a fault is found.

The last item is where the assessment meets maintenance. A reading below target does nothing unless someone corrects the cause: a failed mixing valve, a stuck thermostat, a leaking tap, insulation missing from pipework. This is why a clear route from finding to repair matters.

Do you need to sample the water?

Not always. HSE notes that for standard hot and cold systems routine microbiological testing is not necessarily required. Testing is mainly relevant when you doubt that your control regime is working or when you cannot consistently hit target temperatures. If you do sample, HSE says the laboratory should be UKAS accredited. Sampling is evidence about the control scheme, not a replacement for it.

Remote monitoring

Temperature loggers and building management system alerts can give you far more data points than a manual round. They are useful, but only if someone reviews the output and acts on it. Data collected and left unread does not demonstrate control. Build the alerts into the scheme of control from the assessment, and record what was done each time one triggers.

Keeping records

Records are how you prove the scheme is working. HSE’s page on keeping records says that if you have five or more employees you must record any significant findings, including those who are particularly at risk and the steps taken to prevent or control the risk. Even below that threshold, written records are the most practical way to show what you did.

A sound file for each building usually holds:

The current risk assessment and system schematic.
The named responsible person and deputies, with training evidence.
Temperature, flushing and inspection logs.
Remedial work records, with dates and who did them.
Any sampling results and the laboratory used.
Review dates and the reason for each review.

For managing agents, keep the file where a successor, an auditor or an inspector can find it. When a contract changes hands, the records should not leave with the previous contractor.

When to review the assessment

The law does not tell you to review on an annual or biennial basis, as HSE’s landlords’ responsibilities page makes clear. Some third-party guides quote a two-year rule. Treat that as a commercial convention, not a legal deadline. What HSE expects is that you review when something changes or when you have reason to think the assessment is no longer valid.

Typical triggers include:

Alterations to the water system, such as extensions, new risers, new plant or removal of tanks.
A change in how the building is used, or in the number or type of occupants. HSE gives changes in resident population as an example.
A change of contractor or responsible person.
Monitoring results that show the scheme is not controlling the risk.
A case of illness linked to the building.
Long periods of vacancy, followed by reoccupation.

HSE’s page on reviewing what you do explains that regular checking lets you assess performance before an incident or case of ill health. Record each review, even if the conclusion is that nothing needs to change.

Our perspective: where compliance usually slips

We maintain commercial buildings and residential blocks in London, and we are not the water hygiene assessor. The assessment itself belongs with a competent person who knows your system. From our side of the work, the failures we see described most often are not about the report. They are about what happens after it.

A report lists actions: insulate this pipe, remove this dead leg, replace this mixer valve, clear this tank. The risk only falls when someone does the work, records it and closes the action. Where plumbing is handled by one contractor, electrical by another and general repairs by a third, those actions can sit unowned between them. Our approach is to bring all trades under a single contract with a named contract manager for each portfolio, so that a finding from an assessment becomes a job with an owner and a record. Monthly reporting then shows the duty holder what was found and what was done.

Our perspective: where compliance usually slips — overview diagram

We also see the effect of voids. A flat or unit that stands empty for months is exactly where little-used outlets collect. Planning flushing and checks into the maintenance schedule for vacant units, and recording them, is easier when the same team is already attending the building.

Duty holders should keep oversight of the whole arrangement, whoever carries out the work. Ask to see the assessment, the schematic and the logs, and make sure you can follow them.

— BW Building Maintenance

Turning findings into repairs

Once you have an assessment, the remedial actions usually fall into plumbing, heating and drainage works, insulation and making good, and sometimes access or roofing work for tanks. We deliver planned preventative maintenance and reactive repairs across all trades under one contract for commercial properties in London, including plumbing, heating and drainage, and compliance-related remedial works. We do not carry out legionella risk assessments, so your assessor remains separate from the team doing the repairs.

Our article on commercial plumbing maintenance looks at how regular plumbing checks catch leaks early, and our guide to the permit to work system explains how work in plant rooms and other controlled areas is authorised.

FAQ

Is a legionella risk assessment a legal requirement for commercial buildings?

Yes, in the sense that employers and people in control of premises must identify and assess the risk from legionella under the Health and Safety at Work etc. Act 1974 and COSHH. HSE’s guidance and the L8 Approved Code of Practice explain how to do it. The level of detail should match the complexity of the system.

Can I carry out the assessment myself?

HSE says you may do so if you are competent. If you are not, you should get help from a competent person, either inside your organisation or from outside. Even if you use a contractor, you remain responsible and should be able to understand and audit what they produce.

How often must the assessment be reviewed?

The law does not set an annual or biennial interval. You should review it when the system, its use or its occupants change significantly, or when monitoring suggests the controls are not working. Record each review and its outcome.

Do I have to test the water for legionella?

Not as a matter of routine for standard hot and cold systems. HSE says testing is mainly needed when you doubt the control regime or cannot maintain target temperatures. Any sampling should go to a UKAS-accredited laboratory.

Why do little-used outlets matter so much?

Water that sits still in a rarely used tap or shower warms or cools toward room temperature, which can put it in the range where legionella grows. A recorded flushing routine is the usual control. Include vacant units and rarely used rooms in it.