Amey at HMP Lincoln: the ignored risk assessment that cost £600,000

Amey Community Limited, the facilities management company responsible for the water systems at HMP Lincoln, was fined £600,000 in 2024 after a 71-year-old prisoner died of Legionnaires’ disease in 2017. The company had a legionella risk assessment from 2016 sitting unactioned, no written scheme of control, and no temperature monitoring at all.

This is the case to show anyone who believes that paying for a risk assessment is the finish line. It is recorded in our legionella enforcement tracker, and it is the clearest example in the dataset of an assessment that became the prosecution’s best evidence.

What happened

In 2017, a 71-year-old prisoner at HMP Lincoln died of Legionnaires’ disease. The prison’s hot and cold water systems were managed by Amey Community Limited under a facilities management contract, which made the company the duty holder for day-to-day control of those systems.

The Health and Safety Executive investigated. What it found was not an absence of paperwork in general — it was the wrong kind of paperwork. A legionella risk assessment had been carried out in 2016, a year before the death. Its findings had not been acted on. There was no written scheme of control setting out how the prison’s water would be kept safe, and water temperatures were not being monitored, so nobody could show hot water was reaching 50°C at outlets or that cold water stayed below 20°C.

In 2024 the company pleaded guilty to breaching section 3(1) of the Health and Safety at Work etc. Act 1974 — failing to protect people other than its employees, here the prisoners in its care as facilities manager. The court imposed a fine of £600,000 with £15,186.85 in costs.

The failings the inspectors found

Three failures, each one a document that should have existed and did not, or that existed and was ignored:

• A risk assessment that was never actioned. The 2016 assessment identified the risks. Nothing was done about them. In court, that document proved the company had been told what was wrong.
• No written scheme of control. ACOP L8 expects a written scheme wherever there is a reasonably foreseeable risk. The scheme is the document that turns assessment findings into named tasks, frequencies and responsibilities. It did not exist.
• No temperature monitoring. Temperature is the primary control for legionella in hot and cold water systems. With no monitoring there was no control, and no record — the two failures that appear in almost every case in the prosecutions record.

Notice what is not on that list: there was no claim that the company did not know about legionella, or that the risk was unforeseeable. The assessment fixed that in 2016.

The fine and costs

The fatality pushed the case to the serious end of the sentencing guideline, but the fine was built on the three management failures. A duty holder that had acted on its assessment, run a written scheme, and kept monitoring records would have been in an entirely different position even facing the same tragic outcome.

The lesson for duty holders

The Amey case speaks directly to two groups: contractors who manage water systems for clients, and organisations that outsource that management:

• An assessment is a to-do list, not a certificate. Every action in it needs an owner and a date, and the completion of each action needs recording. An unactioned assessment is worse than none at all in front of a court.
• Contractors are duty holders too. If you hold the facilities contract for a building’s water system, the HSWA duty sits with you for the systems you manage, and you can be prosecuted directly — as Amey was.
• Clients cannot file and forget. If you outsource water hygiene, the contract should say who does what, and you should be asking for the monitoring records, not assuming they exist.
• Temperature monitoring is the floor, not the ceiling. It is the cheapest, most routine control there is, and its absence is the first thing an inspector looks for. The temperature checker lets you test your own readings against the HSG274 thresholds.

The control cycle — assess, write the scheme, monitor, record — is set out in our guides to the written scheme of control and the responsible person. If you manage buildings for others, or commission someone who does, the risk assessment builder is an indicative starting point for structuring that cycle. It records and organises what you find; it never certifies a system as safe. For the premises types we cover in detail, see our guidance for managed office and workplace premises.

Source: IOSH Magazine report on the Amey Community sentencing. Figures are recorded as published in our legionella enforcement tracker dataset; check the linked source before relying on any figure.