What should a legionella risk assessment form contain?

A legionella risk assessment form is the structured document the assessor fills in while surveying a water system: it records the premises and duty holder, describes the water system, lists the risks found and the controls in place, sets out corrective actions with owners and dates, and states when the assessment should be reviewed. This page sets out what a competent form contains, how a form differs from a template or a worked example, and where to download one free.

Form, template, example or builder: which one you need

The four words get used interchangeably and they are not the same thing:

We publish all four: the free risk assessment template (the form with guidance built in, following the ACOP L8 framework), the two-page simple template for genuinely simple lets, a filled-in example for a six-flat HMO, and the risk assessment builder that walks you through question by question. The templates hub lists every format, including the Word and PDF versions.

The sections a competent form must contain

ACOP L8 requires the assessment to be suitable and sufficient, and BS 8580-1, the British Standard for legionella risk assessment cited in HSG274, sets out what a competent assessment captures. Any form worth using has a section for each of these:

• Premises and people. The site, the duty holder, the named responsible person, and who carried out the assessment with what competence.
• The water system. A description and asset register of the plant: incoming supply, cold water storage tanks, calorifiers or water heaters, distribution pipework, and the outlets — ideally with an up-to-date schematic.
• Risk identification. Where conditions favour legionella: water held or stagnating between roughly 20°C and 45°C, dead legs, infrequently used outlets, scale and sediment, and anything that produces an aerosol such as showers and spray taps.
• Who is exposed. Occupants and visitors, flagging anyone more susceptible — older people, the immunocompromised, and settings such as care and healthcare.
• Existing controls and how well they work. Whether hot water is stored at 60°C and distributed at 50°C (55°C in healthcare), cold kept below 20°C, and the monitoring regime around those targets, judged against the frequencies in HSG274 Part 2 Table 2.1.
• Risk rating. A recorded judgement of likelihood and consequence for each risk found, so priorities are defensible rather than implied.
• Actions. A table of corrective and preventive actions, each with a named owner and a target date.
• Review. The assessor's indication of when to review, and the triggers that would force an earlier one.

A form that stops at tick-boxes and skips the actions table has captured a survey but not an assessment. The actions, owners and dates are where control actually happens, and they are the first thing an inspector reads.

The review field: no expiry date, but never optional

One field on the form causes more confusion than any other, because the industry spent years repeating a two-year review rule that has not existed in current guidance since 2013. The legal position is trigger-based: the assessment is reviewed regularly and specifically when there is reason to suspect it is no longer valid — changes to the water system or its use, changes to the building or its occupants, new information about risks or controls, monitoring that shows controls failing, changes to key personnel, or a case of Legionnaires' disease linked to the system. ACOP L8 expects the assessor's indication of when to review to be recorded on the assessment itself, and writing in a nominal date of up to two years is common good practice — but it is a ceiling, not a certificate of validity, and any trigger overrides it. Our guide to how often a risk assessment is reviewed sets out the full trigger list.

Filling in your own versus hiring an assessor

Nothing in ACOP L8 requires the form to be completed by a contractor. The requirement is competence: enough understanding of the system and the guidance to identify the risks and judge the controls. For a simple combi-fed flat or a small office, a duty holder working through a structured form can produce a suitable and sufficient assessment, and our page on doing your own assessment sets the honest limits of that. For complex systems, healthcare and care settings, or anywhere the pipework cannot be fully traced, the competent decision is to commission a specialist — the cost calculator gives an indicative price, and DIY versus professional assessment weighs the trade-off.

After the form: the document has to live

A completed form is the start of the compliance trail, not the end of it. The risks it identifies become the written scheme of control; the monitoring it specifies becomes the entries in the log book; and the review date it records becomes the prompt to look again, sooner if any trigger fires. Keep the assessment and its reviews: ACOP L8 expects records to be retained, with the current assessment kept while it remains valid and monitoring records held for at least five years. The form records that the risk was assessed and controlled — it does not, and no document can, certify that a building is safe.