How Often Should a Legionella Risk Assessment Be Done?

There is no fixed legal interval. HSE guidance under ACOP L8 means reviewing a legionella risk assessment regularly, commonly taken as at least every two years, and immediately whenever the water system, its use, the building's occupancy or your monitoring results change.

The date on the calendar matters less than the trigger. A change to the pipework, the people responsible or the results of your checks ends the currency of an assessment long before any two-year mark, and the legal duty is to review the moment you have reason to believe it no longer fits your system.

How often should a legionella risk assessment be reviewed?

The starting point catches most people out: the law sets no fixed frequency. The Approved Code of Practice, ACOP L8, requires the assessment to be reviewed regularly and whenever there is reason to believe it may no longer be valid. It does not name a number.

The widely-used benchmark of "at least every two years" comes from custom and guidance, not from a statutory deadline. HSE states plainly that the law does not prescribe an annual or biennial review. Two years is a sensible default for a stable, lower-risk building, but treat it as a floor to work from rather than a line that keeps you covered.

The initial assessment is a one-off. You carry it out when a water system is first installed or a building is newly occupied. Everything after that is a review, either confirming the existing risk assessment still holds or updating it.

The six triggers that force an earlier review

ACOP L8 lists the circumstances that mean your assessment may no longer be valid. Any one of them can bring a review forward, whatever the calendar says:

• Changes to the water system or its use - new pipework, a replaced calorifier, a removed or added outlet, or a length of pipe left redundant as a dead leg.
• Changes to the use of the building - a wing taken out of service, a change of occupancy, or a rise in the number of vulnerable users.
• New information about risks or control measures - updated guidance, a manufacturer notice, or a newly recognised hazard.
• Checks showing control measures are no longer effective - hot water below 50°C, cold water above 20°C, or a sample over the action level of 100 or 1,000 CFU/litre.
• Changes to key personnel - a new responsible person or duty holder, or a contractor handover.
• A case of Legionnaires' disease associated with the system.

None of these is optional. A change to the plumbing, the people or the results outranks any date in the diary.

HSE ACOP L8, HSG274 Parts 1 and 2, HTM 04-01

Review, reassessment and re-testing are not the same thing

A common misconception is that "reviewing the risk assessment" means paying for a full new survey every time. It does not. A review can legitimately conclude that nothing has changed and the existing assessment still stands, provided you record that judgement and who made it.

Three separate cycles get muddled here:

• Reviewing the risk assessment - checking that the assessment still reflects reality. Regularly, around every two years, and on any trigger.
• Routine monitoring - the recurring tasks the assessment sets, such as weekly flushing of little-used outlets and monthly temperature checks. These run on their own schedule (see the monitoring schedule).
• Water sampling - laboratory testing for legionella. Not routinely required for most domestic hot and cold water systems, but for open systems such as cooling towers HSE advises sampling at least quarterly.

Confusing the review interval with the sampling interval is where a lot of over-spending and under-protection both come from.

How review frequency changes by building type

The higher the risk and the more the system changes, the more often you review. The table below sets out typical review points, but every one of them is overridden by a trigger event.

For healthcare, HTM 04-01 expects the assessment to be kept under ongoing review by the water safety group rather than dusted off every two years, because occupants are more vulnerable and delivered hot water is held at 55°C at the point of use. For a simple, stable, lower-risk building at the other end of the scale, a two-year review with nothing changing in between can be entirely reasonable.

Landlords: how often for a rented property?

For domestic rentals there is no set testing frequency and, in most cases, no need for a commercial contractor or routine sampling. HSE is explicit that the risk in typical rented housing is low and that a straightforward assessment is usually enough.

Review the assessment at reasonable intervals, often taken as around every two years, and sooner if you alter the system, if the property sits empty for a period so water stagnates, or at a change of tenancy. In a let home the legal duty sits with the landlord, as set out in who is responsible for legionella in rented property. Whether you need one in the first place is covered in do I need a legionella risk assessment.

What to record at each review

A review is only worth anything if it is written down. Whatever the outcome, record it so the currency of the assessment is clear to anyone who checks:

• the date of the review and the name of the person who carried it out;
• what prompted it, whether the routine cycle or a specific trigger;
• the finding: no change needed, an update made, or a full reassessment required;
• any actions raised and their target dates.

Recording the review does not make a system safe, and it is not a certificate of compliance. It is the evidence that you checked, when you checked, and what you decided. A structured template keeps that trail consistent from one review to the next.