Legionella Management: Assess, Control, Monitor, Review

Legionella management is the continuing programme by which a duty holder assesses a water system, puts written controls in place, monitors and records them, and reviews the scheme. Under the Approved Code of Practice L8 it is an ongoing cycle, not a one-off test.

Most of the individual pieces have their own detail, the risk assessment, the written scheme, temperature control, monitoring, and this page is the map that shows how they connect. It walks the full cycle from first assessment to review, names who is responsible at each stage, and links to the page that covers each part in depth.

The legionella management cycle, stage by stage

Managing legionella is a loop, not a line. You assess, control, record, and review, then feed what the review finds back into the next round. The Approved Code of Practice L8 and the HSG274 technical guidance describe the same cycle in six practical stages.

1. Assess the risk. A legionella risk assessment surveys the water system and identifies where bacteria could grow, which outlets create a spray, and who is exposed. This is the foundation everything else is built on.
2. Appoint a responsible person. The duty holder names a competent responsible person to take day-to-day charge, with a deputy for cover.
3. Write the scheme of control. The findings become a written scheme of control, setting out the specific measures, who does them, and how often.
4. Carry out the controls. Temperature checks, flushing of little-used outlets, valve servicing and any sampling are the actual work of keeping water out of the growth range.
5. Record everything. Each task is logged with a date and a reading, so the work can be evidenced later.
6. Review. The scheme is checked regularly and whenever the system or its use changes, and the cycle begins again.

Miss any one stage and the programme has a gap. A perfect assessment with no controls is just a document, controls with no records cannot be evidenced, and records that are never reviewed drift out of date as the building changes.

Who manages legionella, and who carries the duty

Legionella management involves several roles, and it helps to keep them separate because they carry different weight.

• The duty holder is the employer, the landlord, or whoever is in control of the premises. The legal duty sits here.
• The responsible person is the competent individual the duty holder appoints to manage the work in practice, covered in full on the responsible person page.
• A deputy covers the responsible person's absence, so control does not lapse over holidays or sickness.
• A contractor may be brought in to do the assessment, the sampling, or the physical work, where the in-house team is not competent to.

The common and costly misunderstanding is to assume that hiring a contractor hands over the responsibility. It does not. Whether the work is done in-house or bought in, the duty holder keeps the legal duty to make sure the risk is assessed, controlled and recorded. Exactly who is responsible in a rented property is a common source of confusion in its own right.

HSE Approved Code of Practice L8 and HSG274 Part 2

What a legionella management plan contains

People search for a legionella management plan, a water safety plan and a written scheme of control as if they were three different things. In UK practice they are the same document under different names: the plan that sets out how the system is controlled. It is separate from the risk assessment, which identifies the risk, and from the log book, which records the work.

Under ACOP L8 a management plan should document:

• the management structure, naming the duty holder, the responsible person and any contractors;
• a description of the system, with an up-to-date schematic showing tanks, calorifiers, outlets and any dead legs;
• the control measures, such as temperature regimes and flushing;
• the monitoring and inspection schedule, setting what is checked and how often;
• the records to be kept and where they live;
• the review arrangements, including what triggers an early review.

The plan is only as good as the survey behind it. A schematic that no longer matches the pipework, or a plan that names a responsible person who has since left, is a plan that has stopped describing the real system.

The controls you manage day to day

Everything above exists to make the daily controls happen. These are the measures the responsible person actually runs, and the figures come from HSE guidance. Taken together, temperature, flushing, valve servicing and monitoring are the main levers for preventing legionella.

Temperature control is the backbone. Legionella grows between roughly 20°C and 45°C, so the aim is to keep water either below or above that band. HSG274 Part 2 sets out the regime, and the temperature control page covers it in detail. The key control figures are summarised in the table below.

Flushing keeps water moving through outlets used less than about weekly, so it does not stagnate. Dead legs, lengths of pipe that hold standing water, are a frequent finding and are managed either by removal or by a recorded flushing regime.

Thermostatic mixing valves blend hot and cold at the tap to prevent scalding, but they sit in the growth range by design, so they need servicing on schedule.

Monitoring and sampling. The monitoring schedule sets what is checked and when. Where water is sampled, results are read against the action levels in HSG274, covered on the sampling and action levels page.

How management is recorded and reviewed

Recording is not paperwork for its own sake. Under ACOP L8 the records are how you evidence that the scheme is actually being run, and they are the first thing an HSE inspector asks for. The monitoring schedule generates most of them: dated temperature readings, flushing logs, valve servicing, and any sample results, gathered in a log book.

Our free legionella risk-assessment template gives you a structured place to record the assessment that starts the cycle, so the controls and reviews that follow rest on a documented foundation. It is a tool for recording what you find and do, not a statement that a system is safe or compliant.

Reviewing keeps the scheme matched to the building. There is no single legal interval, but HSE guidance points to reviewing the assessment and scheme regularly, in practice about every two years, and sooner on a trigger such as changes to the system, a change of use, more vulnerable occupants, or results outside the control limits. The review frequency page sets out the triggers in full.

If legionella is ever detected, the management scheme is what tells you what to do next and who acts. The steps to take on a positive result sit inside the same programme, not outside it.

Why a test or a certificate is not legionella management

The sharpest misconception worth correcting is that legionella management is a thing you buy once. A single water sample, a one-off risk assessment, or a so-called legionella certificate is sometimes treated as the whole job. None of them is.

A test is a snapshot of the water on the day it was taken. It tells you nothing about next month. A risk assessment identifies the hazards but does not control them. And there is no statutory legionella certificate in UK law at all: the phrase usually refers to a risk-assessment report, which is one input to management, not proof that the risk is under control.

Management is the continuing loop that connects these pieces: assess, control, record, review. It is judged not on a single document but on whether the controls are happening and can be evidenced over time. That is why the honest measure of a management scheme is the log book, not a certificate on the wall.