How often should a legionella risk assessment be reviewed?

A legionella risk assessment should be reviewed regularly, and immediately whenever there is reason to believe it is no longer valid. There is no fixed interval written into law: ACOP L8 requires the review to happen and to be recorded, but leaves the timing to the duty holder. In practice, most duty holders and water hygiene professionals work to a review at least every two years, with an earlier review whenever something changes.

That two-year figure is a convention, not a statute. What the framework actually demands is that the assessment is a living document that reflects the system as it is today, not as it was when the last assessor visited. A two-year-old assessment of a system that has not changed is usually still valid; a six-month-old assessment of a system that has been replumbed is already out of date.

The trigger events that force an early review

The circumstances that should prompt a review ahead of any routine date are well established in the guidance:

• a change to the water system, such as new pipework, a replaced calorifier, added outlets, or removed sections that may have created dead legs;
• a change in the use of the building, including a change of occupancy, a conversion, or a long closure followed by reoccupation;
• new information about risks or control measures, for example updated HSE guidance;
• checks or monitoring showing the controls may no longer be effective, such as repeated temperature failures in the monitoring schedule;
• a change in the responsible person or in the people carrying out the control measures;
• a case of Legionnaires' disease or legionellosis associated with the system.

Any one of these is a reason to pick up the assessment and check it against reality, whatever the calendar says.

What a review actually involves

A review is not a ceremonial re-reading. It means walking the water system with the existing assessment in hand and checking that what the document describes still exists: the outlets it lists, the little-used outlets on the flushing regime, the temperatures it quotes, the controls it relies on. You examine the monitoring and flushing records to see whether the controls have actually been carried out and whether they are working. Then you conclude, in writing, either that the assessment remains valid or that it needs updating.

Where the review finds the system or the building's use has changed materially, the review becomes a partial or full reassessment of the affected parts. The distinction matters because it keeps the assessment honest: a light-touch review confirms validity, while real changes get properly re-examined rather than rubber-stamped.

Record the review, especially when nothing changed

The most commonly missed step is the written record of a review that concluded "no change needed". Without it, there is no evidence the review happened at all. Log the date, who carried out the review, what was inspected, and the conclusion, and file it alongside the assessment itself. ACOP L8 expects records of the assessment and its reviews to be kept for at least five years.

For the companion question of how often an assessment should be done in the first place, see how often a legionella risk assessment should be done. If your assessment is out of date or missing entirely, the risk assessment builder produces an indicative starting point structured around ACOP L8 and HSG274; it records and structures what you find, and like any template it never certifies the system itself. The background on what an assessment must contain is in what a legionella risk assessment is.