Do you need a legionella risk assessment or a water safety plan?

A legionella risk assessment is a periodic snapshot that identifies and evaluates the risks in your water system and recommends controls. A water safety plan is a continuous management framework that wraps the assessment in an organisation: a named group that owns water safety, mapped systems, monitoring schedules, incident response, and scheduled review. The assessment answers "what are the risks?"; the plan answers "who is in charge of controlling them, every day?"

Every duty holder needs the first. The second is required in healthcare and increasingly adopted anywhere the estate is big enough that water safety cannot live in one person's head. The two are covered individually in legionella risk assessment and water safety plans and groups; this page is about which one you need and how they relate.

The two compared

What the plan adds beyond the assessment

The water safety plan approach comes from the World Health Organization's model for drinking-water safety, adapted to building water systems. Its core insight is that risk assessments fail not because the findings were wrong but because nobody owned the follow-through. So the plan builds ownership in. A water safety group, typically estates, infection prevention and control, microbiology, and operational or clinical staff, meets on a schedule, reviews monitoring results and samples, decides on corrective action, and tracks it to completion. The plan also contains the things an assessment assumes but does not supply: current system drawings, escalation routes when a temperature fails or a sample comes back positive, and an incident plan so that a failure triggers a rehearsed response rather than improvisation.

Seen this way, a water safety plan is what a written scheme of control grows into when the building is too big, too complex, or too full of vulnerable people for a single responsible person to carry. The responsible person model and the water safety group model are the same idea at different scales.

Which one do you need?

Apply a simple test of scale and vulnerability. A landlord with a house or a small block, a shop, a small office: you need a risk assessment, a written scheme of control, and monitoring records. That trio is your management framework, and dressing it in water-safety-plan language would add paperwork without adding control. Our risk assessment builder produces exactly that structure.

A hospital, and anything operating under HTM 04-01: you need a water safety plan and a functioning water safety group; the healthcare guidance makes that the expected standard. Between the poles, large hotels, universities, big commercial estates, councils with many buildings, the honest question is whether the responsible person can genuinely see the whole system. When the answer is no, when water safety depends on handovers between teams and contractors across many buildings, the water safety plan's structure of named ownership, escalation, and review starts earning its keep, even though no guidance compels it.

How they fit together in practice

The documents nest rather than compete. The risk assessment identifies the risks; the written scheme of control schedules the controls; the monitoring records, kept in a log book for at least five years, evidence the execution; and the water safety plan, where one exists, is the binder that holds all three together under a named group with a review cycle. A hospital has all four layers. A landlord has the middle three and does not need the binder. What no building may have is the first document alone, an assessment in a drawer, because an assessment that is not turned into scheduled, recorded controls is not controlling anything.