DEBA UK: when the risk assessor is the one in the dock
On this page
Key points
- £24,000 fine plus £17,276 costs for DEBA UK Ltd in August 2009 — a prosecution of the risk assessor, not the building operator.
- The contractor’s 2007 assessments wrongly rated two Welsh nursing homes as low risk when their legionella controls were in fact inadequate.
- No outbreak and no death resulted — the offence was the risk created by defective professional work.
- Charge: three counts under HSWA 1974 section 3(1) at Abertillery Magistrates’ Court, prosecuted by the HSE.
- The lesson runs both ways: assessors are accountable for their assessments, and duty holders are accountable for choosing competent ones.
DEBA UK Ltd, a water-treatment and risk-assessment contractor, was fined £24,000 in August 2009 for carrying out inadequate legionella risk assessments that wrongly rated two Welsh nursing homes as low risk. Nobody fell ill. The case is a landmark in UK legionella enforcement because the defendant was not the care-home operator — it was the professional paid to assess the risk.
It is recorded in our legionella enforcement tracker, and it changes how every duty holder should think about buying an assessment.
What happened
In 2007, DEBA UK carried out legionella risk assessments at two nursing homes in Wales operated under the Craegmoor Healthcare group. Nursing homes sit at the top of the vulnerability scale: elderly residents, many with underlying illness, exposed to hot and cold water systems every day. An assessment in that setting is not paperwork; it is the foundation the whole control regime is built on.
DEBA’s assessments rated both homes as low risk. The reality, when examined, was that the controls at the homes were inadequate. The assessments had missed what was actually there — and by stamping the homes “low risk”, they had told the operator that the existing state of affairs was acceptable when it was not.
No outbreak resulted and nobody died. The HSE prosecuted anyway, because the defective assessments had themselves exposed residents to risk. In August 2009, at Abertillery Magistrates’ Court, DEBA UK pleaded guilty to three charges under section 3(1) of the Health and Safety at Work etc. Act 1974 and was fined £24,000 with £17,276 costs.
The failings the inspectors found
The case turns on a single professional failure with wide consequences:
- Assessments that did not match the systems. A legionella risk assessment is supposed to describe the actual water system, examine the controls actually in place, and rate the risk that actually exists. BS 8580-1 sets out the standard. Rating a poorly controlled nursing-home system “low risk” means the assessment was done without seeing, or without understanding, what was there.
- False assurance passed to the client. The operator relied on a professional verdict and was told it was safe to carry on. That is the unique harm of a bad assessment: it does not just fail to find the risk, it actively suppresses the corrective action that a competent assessment would have triggered.
Compare the pattern with the Amey case at HMP Lincoln: there, a good assessment was ignored. Here, the assessment itself was the failure. Both end in court, from opposite directions.
The fine and costs
| Fine | £24,000 |
|---|---|
| Costs | £17,276 |
| Charge | Health and Safety at Work etc. Act 1974, section 3(1) — three charges |
| Prosecutor | Health and Safety Executive |
| Court | Abertillery Magistrates’ Court, August 2009 |
| Illness or death | None — risk exposure from defective assessments |
The costs figure is worth a glance: £17,276 against a £24,000 fine. Prosecution costs routinely rival or exceed the fine itself, which is why the total bill from a case is rarely the headline number.
The lesson for duty holders
The DEBA case teaches two audiences at once:
- If you sell assessments, you carry section 3 liability for them. Consultants, contractors and water-treatment firms are duty holders for their own work. An inadequate assessment is not poor customer service; it is a prosecutable exposure of the people in the building.
- If you buy assessments, competence is your problem too. Commissioning an assessment does not outsource your duty. Ask how the assessor works against BS 8580-1, whether they survey the physical system, and what a sample report looks like — our guide on doing your own assessment versus commissioning one covers the judgement call.
- Beware the cheap, fast, desktop report. An assessment produced without walking the system cannot rate the system. A wrong “low risk” is worse than no assessment, because it shuts down vigilance.
- Reassess on the triggers, whoever did the last one. Regular review of the assessment is how stale or defective work gets caught before an inspector catches it for you.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
The only UK legionella prosecution where the defendant was the assessor. DEBA’s mistake was not ignoring the risk — it was certifying the risk away, on paper, for two nursing homes. False assurance is itself the hazard.
Whether you assess your own system or commission it, the record of what was found and what was done about it is what protects both parties. The risk assessment builder is an indicative starting point for structuring an assessment; it records and organises what you find, and it never certifies a system as safe. For care settings specifically, see our care home guidance and the wider prosecutions landscape.
Source: Wired-Gov report on the DEBA UK prosecution. Figures are recorded as published in our legionella enforcement tracker dataset; check the linked source before relying on any figure.
Free legionella risk assessment template
A structured Word document following the five-step approach in ACOP L8. Covers risk identification, written scheme, monitoring, and records. If it isn't written down, you can't evidence it.
Follows ACoP L8 and HSG274 Part 2. Free. No spam.
Frequently asked questions
Can a legionella risk assessor be prosecuted for a bad assessment?
Yes. DEBA UK Ltd, a risk-assessment contractor, was prosecuted for carrying out inadequate legionella risk assessments in 2007 that wrongly rated two Welsh nursing homes as low risk when their controls were in fact inadequate. It pleaded guilty to three charges under section 3(1) of the Health and Safety at Work etc. Act 1974 and was fined £24,000 plus £17,276 costs at Abertillery Magistrates’ Court in August 2009. It remains a landmark because the defendant was the assessor, not the care-home operator.
Who is liable if a legionella risk assessment is wrong?
Liability can fall on both sides. The duty holder remains responsible for controlling the risk at their premises — commissioning an assessment does not transfer that duty. But the assessor also carries a section 3 duty for the quality of the service they provide, and where an assessment is so poor that it exposes people to risk, the assessor can be prosecuted directly, as DEBA UK was. Choosing a competent assessor, and checking their work against BS 8580-1, is part of the duty holder’s defence.
What makes a legionella risk assessment inadequate?
The hallmarks are a generic document that does not describe the actual water system, risks rated without examining the controls in place, missing schematic or asset survey, no review of management competence and records, and conclusions that do not match the conditions an inspector later finds. BS 8580-1 sets out what an assessment should contain. In the DEBA case, two nursing homes whose controls were inadequate were rated low risk — a conclusion that did not survive contact with the facts.
How do you check a legionella risk assessor is competent?
Ask how they work against BS 8580-1, what qualifications and experience the individual assessor holds, whether they survey the physical system rather than issue desktop reports, and for a sample report showing how risks are rated and actions prioritised. A competent assessor will name the monitoring points, the responsible people and the review triggers. Treat an unusually cheap, unusually fast assessment as a warning sign: the DEBA prosecution shows that a wrong low-risk rating is worse than no assessment, because it creates false assurance.
Related water hygiene products and services from trusted UK providers will appear here.