I’ve received my Legionella Risk Assessment – What now?

by Peter Gunn, on 08-11-2022
Find me on:


Risk Assessment what next

Whilst at an organisational level the receipt of your latest Legionella risk assessment (RA) report is certainly evidence of your awareness of the need to meet guidance, at an operational level there is often a large degree of trepidation when individual weighty reports or multiple smaller reports arrive in your inbox.

Legionella Risk Asesssment - where do I start?

Clearly, risk assessments vary in size and complexity, whether for a small and simplistic stand-alone building or an acute hospital site. Although there is no right or wrong way of approaching your report, a systematic approach is always key and some of the following points may be worth considering;

  • Prior to receiving your report, establish via your Water Safety Group (WSG) or similar who will be expected to act on the findings within the report – there will likely be several individuals needed, at differing levels of management and who will be best placed to act;


  • Risk Assessment reports are often picked up and acted on and then put down for periods. This is to be expected, due to fluctuating workloads, however, if a dedicated member of staff can be used to continually act on non-compliances, the RA report will remain a ‘live’ document and adopted timeframes for completion of tasks are much more likely to be achieved. As Authorising Engineers (Water) the Water Hygiene Centre commonly witness Estates staff struggling to manage the day-to-day/reactive issues whilst at the same time driving the RA report forward;

New call-to-action

  • Consider a formal handover of your RA report from your water hygiene consultancy soon after you have received it, particularly if you have not used this consultancy previously;

  • Hopefully your report will have come in a format which allows for easy review and updating of actions as they are completed – if not, establish the best way of updating completed actions i.e. using a spreadsheet to allow filtering, etc;

  • Steve Simpson Engineering Risk Assessment OUHHComplete an initial internal review of your RA report as early as possible upon receipt – there may be several actions that require early or even immediate action;

  • It is also true to say a competent RA provider may have informed you at the RA survey stage of the need to carry out immediate actions dependent on risk – if this is the case and you’ve completed actions already, then you’ve made a start in reducing your to-do list;

  • Risk assessment findings in some cases, are also often only written confirmation of non-compliances, perhaps already commonly known within your organisation – so don’t wait for the RA report to arrive if you can act on it already;

  • Many RA recommendations relate to compliance with guidance and/or regulations and simply need acting on. Others will attempt to drive you towards best practice, particularly if following BS8580-1 and received a UKAS-accredited report. You may or may not agree with all the recommendations documented, either because the RA provider didn’t have up to date information or you simply feel a particular risk has been mitigated effectively already;


  • Although documented recommendations must all be considered and acted on where possible, an RA report is not a tablet of stone. Given adequate consideration of whether it is ‘reasonably practicable’ to undertake a particular task or recommendation and agreement by your WSG, it may be certain priorities can be re-considered;

  • Certain risk recommendations may also be very significant in size and scope, requiring capital funding or further staff/contract resource. Identifying these remedial / management actions early in the Risk Assessment review process is helpful. If it is apparent that certain identified risks cannot be acted on and are deemed a high priority despite the will to do so, these could be added to a corporate risk register or similar thereby escalating to the executive level and documenting why this is the case;

  • Should there be difficulties in interpreting your RA report or if you are unsure your approach will achieve the best outcome, it may be worth discussing with your Authorising Engineer (Water) or competent help who can provide an independent view.

Digging Deeper into your Legionella Risk Assessment.

In addition to the background to Legionella risks and other pro-forma information, your RA report should also provide information as to the specific methodology used including the risk scoring and how identified non-compliances have been prioritised for action.

In any RA report (particularly for larger sites) it’s important to address risk from the top downwards i.e., high risk initially, and this should be maintained through the risk minimisation process. However, there will also be ‘quick wins’ possible and ‘cherry picking’ of specific actions where it is convenient or a more practicable approach.

Risk Assessment  Remedial WorksGuidance does not however mandate the RA provider to provide rigid or specific timeframes for the completion of an action. Instead, the RA provider will provide prioritisation of risk i.e., Very high, High, Moderate, Low, etc or Priority 1, P2, P3, etc.

An RA provider cannot consider your competing funding issues, ability to act or other resource availability. To ensure ‘drift’ in the completion of tasks is kept to a minimum, it is useful for your WSG to adopt and agree on appropriate timeframes for action. Once a risk assessment is completed and accepted by your organisation, it will then ‘carry’ the known risks until they are resolved.

Over time and as individual RA recommendations progress they must all be signed off with a specific date, identify by whom and with a description of the action undertaken if possible. Photographic evidence i.e. showing before and after any works, can be useful too.

Although your RA risk minimisation scheme or plan of work may take two, three or several years to complete, an update in terms of numbers should be provided to your WSG both to demonstrate progress and alert your strategic management team when additional action or ‘catch up’ may be required.


The finishing line

Legionella Risk Assessment reports commonly recommend many actions. Although there may be an expectation that the RA remedial action list will be completed by the time the re-assessment is due, this is often not the case. Indeed, before all actions are completed your organisation may deem the current report is no longer valid and a new RA report is now necessary.


The key to effectively managing your risk assessment requires ongoing review by key individuals, ensuring that any slippage is reviewed and progress is documented and discussed regularly.


For more information about Water Hygiene Centre and our independent advisory services click here.

Editors Note: The information provided in this blog is correct at the date of original publication – November 2022. 

© Water Hygiene Centre 2022


New Call-to-action

About the author

Peter Gunn

Peter has been acting as an AE [water] and providing competent help services to multiple public sector and public services client in both the Midlands and North of England since 2004, and working within Legionellosis risk management since 1997. Peter currently acts as AE [water] for 11 large public services client’s including University’s, Councils, Healthcare and Constabularies.

Share your thoughts