What is a legionella risk assessment?

A legionella risk assessment is a structured review of a water system that identifies where the legionella bacteria could grow and be released as a breathable spray, judges how serious each of those risks is, and sets out the controls needed to keep them under control. For almost every employer and person in control of premises it is a legal requirement, and it is the document everything else in legionella management flows from.

If you are wondering whether you need one at all, start with do I need a legionella risk assessment. This page assumes you do, and explains what one is, what the law requires, what it involves, who can carry it out, and what it should cost.

What a legionella risk assessment is

At its core the assessment answers three questions for your specific building: where could legionella multiply, how could it reach and infect someone, and what are you going to do to prevent that. It looks at the whole water system, from the incoming supply through storage, heating, distribution and every outlet, and identifies the conditions that let legionella thrive: water sitting in the growth range of roughly 20°C to 45°C, stagnation in dead legs and little-used outlets, stored and recirculated water, and any outlet that produces an aerosol, such as a shower or spray tap.

The recognised method is set out in the British Standard BS 8580-1, the standard for legionella risk assessment, which describes how to survey the system, record the assets, rate the risk, and produce a report with prioritised recommendations. A good assessment is specific to your premises. A generic template filled in without a proper survey is not a suitable and sufficient assessment, and an enforcing officer will treat it as a failing. There is no official HSE template to fall back on either; despite how often it is searched for, the HSE has never published one.

The legal duty behind it

The requirement is not a matter of good practice alone. It is built into health and safety law, and several pieces fit together:

Source: HSE. The duty falls on the "duty holder", the employer or person in control of the premises. See the responsible person for how the roles fit together.

What the assessment involves

A competent assessment works through a recognised sequence rather than a tick-box form:

1. Survey the system. Walk and record the whole water system: the incoming supply, cold water storage, calorifiers and water heaters, pipework, and every outlet. A schematic diagram of the system is a normal output.
2. Identify the hazards. Find the conditions that let legionella grow and spread: water in the 20°C to 45°C range, stored and stagnant water, dead legs, redundant pipework, scale and biofilm, and aerosol-producing outlets.
3. Assess who is at risk. Consider the people exposed, and weight the risk where occupants are more vulnerable, for example the elderly, the very young, or those who are unwell.
4. Rate and prioritise. Judge how likely and how serious each risk is, so the most important actions come first.
5. Record the findings and the controls. Produce a written report that records what was found and sets out the control measures needed. Those controls then form the written scheme of control.

The controls the assessment points to are usually the familiar ones: keep hot water hot and cold water cold (see temperature control), keep water moving by flushing little-used outlets, remove dead legs, and monitor and record it all on a monitoring schedule.

Who can carry it out

The law does not require a licence, a specific qualification, or an external contractor. It requires a competent person: someone with the training, knowledge, experience and understanding of the particular water system to assess it properly. That competence is the legal test, not a certificate on the wall.

For a small, simple, low-risk premises, a well-informed duty holder can often carry out their own assessment. Our risk assessment builder walks you through the same questions an assessor asks and produces a tailored result, and can I do my own legionella risk assessment covers where the line sits. For larger buildings, cooling towers, spa pools, care homes or healthcare premises, the system is more complex and the occupants often more vulnerable, so a specialist assessor is the sensible choice.

How often to review it

A legionella risk assessment is not a one-off. ACOP L8 requires it to be reviewed regularly and whenever there is reason to believe it is no longer valid. A common cycle is about every two years, but the trigger events matter more than the calendar:

• Changes to the water system, plant or its use.
• A change of occupancy, or new occupants who are more vulnerable to infection.
• Water temperatures or monitoring drifting out of the expected range.
• A case of Legionnaires' disease linked to the premises.
• New guidance, or reason to think the controls are no longer effective.

If any of these happen, review the assessment straight away rather than waiting for the next scheduled date.

What it costs, and the free route

A professional assessment of a small, straightforward premises typically costs somewhere around £100 to £300, rising with the size and complexity of the building and the number of water assets. Our cost guide breaks down what drives the figure. Where the premises is genuinely simple and you are competent to assess it, you can do your own at no cost: our free risk assessment builder and downloadable template give you the structure a good assessment follows, including versions for Word and Scotland.

Where this sits in your legionella duties

The risk assessment is the first step, not the whole job. Once it identifies the risks, you put the controls into a written scheme of control, appoint a competent responsible person to manage it, carry out the monitoring on a schedule, and record everything in a log book. All of it sits under the duties in ACOP L8 and the practical detail of HSG274. The assessment tells you what your system needs; the scheme, the monitoring and the records are how you show you are actually doing it.