Training - Awareness-1

What is a Legionella Risk Assessment?

Legionella Risk Assessment

The objective of this article is to provide a more detailed overview of the importance of getting your legionella risk assessment right.  Not all risk assessments are the same. Variations may occur as a result of:

  • The type of risk that is being assessed;
  • The competency and ability of the risk assessor; and/or
  • When your risk assessment for legionella should be reviewed and updated.

The risk assessment must be suitable and sufficient. The person who is responsible for the management of water safety within the organisation, known as the Responsible Person [Water], should prepare the specification for the risk assessment as part of the Written Scheme [Water Safety Plan].


Areas Discussed:

What is the difference between a legionella and a water risk assessment?

What a legionella risk assessment must Include

Legionella risk assessment frequency

Mistakes to avoid in a legionella risk assessment

The importance of suitable and sufficient legionella training

Legionella in healthcare organisations

Legionella news: HSE Investigations


UKAS Cert Landscape

What is the Difference Between a Legionella and a Water Risk Assessment?

Guidance issued from the HSE, ACoP L8 and HSG274 Parts 1, 2 & 3 covers the risk of legionella in water. Although, guidance issued by the Department of Health - HTM04-01 parts A, B & C relating to ‘water safety' is not just about legionella.  As such the HTM04-01 offers more clarity on what a water risk assessment includes.

The HTM04-01 states:

“to identify potential hazards (which may be microbial, chemical or physical) in the system…potential hazards caused by legionella, P. aeruginosa, and other relevant pathogens, chemicals, temperature and events that may arise during supply, storage, delivery, maintenance and use of water….”

Whereas the HSE’s ACoP L8 and associated HSG274 Technical Guidance is applicable to all organisations, the HTM04-01 guidance is written specifically for providers of health and social care. Within the health and social care sector occupant susceptibility may vary greatly but will inevitably include those persons who are most susceptible to infection; such locations will include:

  • Hospital;

  • Clinics;

  • Surgeries (including dental surgeries);

  • Nursing homes;

  • Psychiatric care.

 To comply with these requirements the ‘water risk assessment’ needs to look at a range of elements considerably broader than simply the risk from legionella bacteria.


Read more in the blog -  'What a Legionnaires' Disease Risk Assessment Must Include'


What a legionella risk assessment must Include...

The HSE’s ACoP L8 and HSG274 suite of documents offers advice on managing water systems; including the need to carry out a risk assessment that identifies the risks and methods to be used to control them. 

The HSE have detailed a checklist in each of the HSG274 documents outlining the most common requirements when assessing risk [we are not going to duplicate the lists here] although some of the more interesting requirements include:

  • Details of management processes;
  • An assessment of competence of who’s involved in the management, control and monitoring [inc. training];
  • Identification of roles and responsibilities;
  • Evidence of proactive management and follow-up to the previous risk assessment;
  • An assessment in respect to the validity of the schematic diagram;

Further guidance on this process can be found in the British Standards Institute’s [BSI] standards publication “Water Quality – Risk assessments for legionella control – Code of practice”. BS8580:2010. Risk assessments completed in accordance with the BS8580:2010 methodology must consider the following:

  • An assessment of:
    • Occupant susceptibility;
    • Management processes;
    • Processes for monitoring data;
    • Record keeping;
    • Inherent risk and actual risk.
  • A defined score matrix [although one is not defined in BS8580:2010];
  • A.L.A.R.P. [as low as reasonably practicable];

Again, this is not an exhaustive list, but here we’ve highlighted the need to consider occupant susceptibility [this should be considered at building, system and even departmental levels].

Actions identified in risk assessments are often designed to achieve low risk or no risk status on completion; in practical terms this isn’t always achievable. To this end, BS8580:2010 introduced the concept of A.L.A.R.P into legionella risk assessment.  This amounts to a more pragmatic approach to remedial works and control measures ensuring that each risk system is being managed appropriately according to the inherent risk.


Read more in the blog -  'Legionella Risk Assessment – New British Standard'


HSG 274
BS Docs

Legionella risk assessment frequency

Contrary to earlier editions, the fourth edition of the HSE ACoP L8 no longer specifies that risk assessments should be reviewed ‘every 2 years. With the publication of the revised ACoP by the HSE in 2013 and the associated HSG274 Technical Guidance Part 2 in 2014 all references to the 2-year frequency were removed and replaced with references to an ‘ongoing’ risk assessment process incorporating ‘regular’ reviews. To inform this process the HSE have provided a list of change criteria that could affect the validity of the assessment and therefore constitute the need to review/update a risk assessment. 


The criteria suggested include: 

  • A change to the water system or its use;

  • A change to the use of the building where the system is installed;

  • New information available about risks or control measures;

  • The results of checks indicating that control measures are no longer effective;

  • Changes to key personnel;

  • A case of Legionnaires’ disease/Legionellosis associated with the system.


This approach of introducing suggested criteria means there needs to be a degree of routine reviewing and updating managed by the Responsible Person [Water] and/or Authorised Person [Water]. The desired outcome of which is that the risk assessment process becomes more ‘fluid’ and dynamic. However, a process needs to be established to effectively manage this routine review and ensure that this, in turn, will identify when a change has occurred and trigger a review of the appropriate aspects of the risk assessment.  For example, if routine monitoring records show that a particular risk system is consistently failing to maintain the required control parameters then details will be reported to the Water Safety Group and identified as one of the criteria listed; a review/update of the risk assessment is then commissioned for the affected system.


Read more:

FREE TOOL: Water Risk Assessment and Schematic Review for your Organisation.

This risk assessment and schematic review tool is a desk-based review of your current reports against the criteria detailed in the HSE document HSG274 part 2 [2014].  

It can be easily updated and reviewed at each Water Safety Group meeting.

The risk assessment review tool, includes:

- Risk assessment review status 

- Schematic review status

Fill out the form on the right to receive your free tool.


Download your free tool

As mentioned earlier, a legionella risk assessment is different from a water hygiene risk assessment which can cover various other waterborne pathogens and risks, including Pseudomonas aeruginosa, Scalding, etc.

The Responsible Person [Water] / Authorised Person [Water] is responsible for ensuring the risk assessments for legionella are suitable and sufficient and carried out by a competent individual.


Experience of reviewing risk assessment reports completed by different organisations on various property types has highlighted ‘mistakes’, such as:

  • Poor specification and/or standards applied when commissioning the risk assessment, with no assessment of the competency of the organisation/risk assessor;

  • Risk assessments are completed by those organisations who have a vested interest in supplying additional services.  Typically, the appointment of contractors who provide remedial works.  For example, a risk assessment completed by the same contractor commissioned to undertake the monitoring programme contained a disproportionate recommendation for tanks to be cleaned every 3 months!

  • Risk systems are excluded and missed from the risk assessment. For example, a risk assessor reporting on a leisure centre omitted the swimming pool and a risk assessment of a hospital excluded the air handling units;

  • Risk assessments that do not consider the susceptibility of the building occupants. Equally, in some cases the same occupant susceptibility level has been applied to an entire site where various buildings and systems exist with differing populations;

  • Inadequate explanation of the risk scoring systems that prevents others from understanding how a particular risk rating has been arrived at (including subjective or over-complicated systems for risk analysis);

  • Deadlines for actions have not been agreed with input from the persons who will have to deliver them i.e. the Responsible Person [Water] and Authorised Person [Water].

By no way is this an exhaustive list of mistakes to avoid, but these are ‘repeat offenders’ when it comes to mistakes!


Read more:

Interested in getting a professional, competent legionella risk assessment? Have a look at how Water Hygiene Centre could help you >

Training features on two fronts when it comes to Legionella risk assessment. 

Firstly, who is involved in the management of legionella risk within the organisation and what training have they received.  The need for the Water Safety Group have established a Training Needs Analysis detailing all those involved and ensuring suitable and sufficient training has been received. 


Starting with those who are responsible for managing the overall risk and the day-to-day operation of risk systems, namely the Responsible Person [Water] / Authorised Person [Water], have they received training on the legionella risk, their roles and responsibilities and the operational processes required to ensure the legionella risk is being proactively managed?  Such training will detail the need for these types of risk assessments and the importance of ensuring they are suitable and sufficient and when they need to be reviewed. 


The risk assessment itself, when completed in accordance with the ACoP L8, HSG274 part 2, and BS8580:2010 will actually assess and evaluate the management process established by the organisation before risk assessing any physical risk systems.  Needless to say, this will include a review of the training records. 


The second element on the importance of legionella training covers the risk assessor and their competency [as detailed earlier].  Has the Responsible Person [Water] / Authorised Person [Water] actually interviewed the assessor and reviewed/received evidence of the risk assessors' training records?


Read more - 'Consequences of Insufficient Legionella Training'


       View our Training Courses Below

WHC trainingtableupdated-1



The bacterium Legionella pneumophila and related bacteria are common in natural water sources such as rivers, lakes, and reservoirs, but usually in low numbers. Conditions in these environments are rarely favorable for individuals to become infected with the bacteria. 

These naturally occurring bacteria may also be found within the built environment i.e. purpose-built water systems.  The built environment allows conditions to be maintained within the water system that will encourage growth and transmission of the bacteria, for example:

  1. The water temperature may be suitable for bacteria to grow in all or part of the system, this is typically between 20–45°C;

  2. It is possible for water droplets to be produced and, if so, they can be dispersed;

  3. Water may be stored and/or re-circulated;

  4. There may be deposits that can help to support bacterial growth, such as rust, sludge, scale, organic matter and biofilms.


Legionellosis is a collective term for diseases caused by legionella bacteria. The most serious form of Legionellosis is Legionnaires’ disease; which is a potentially fatal form of pneumonia. Legionnaires’ disease is normally contracted by inhaling contaminated water aerosol that is suspended in the air. These very small droplets of water can contain the legionella bacteria.


Although everyone is susceptible to infection, there is an increased risk for the following groups:

  • Newborn babies / Neonates;

  • Increasing age [> 50years. Children are rarely infected];

  • Men [approx. 3x more likely than women, this may change with altered smoking habits];

  • An existing respiratory disease that makes the lungs more vulnerable to infection;

  • Illnesses & underlying health conditions [cancer, diabetes, kidney disease or alcoholism];

  • Smoking [particularly heavy cigarette smoking - probability of impaired lung function];

  • Patients who are immunocompromised as a result of illness or treatment [i.e. those on immunosuppressant drugs that inhibit the body’s natural defences against infection].


Healthcare providers include organisations such as NHS Trusts, Health Boards and private healthcare companies. The buildings operated by these organisations, namely hospitals, clinics and surgeries, are often large with complex water systems that can provide the ideal environment for legionella bacteria to proliferate [as detailed above].

People who go to hospital invariably have a complaint that needs medical attention; the visit to hospital can be brief or for an extended period whilst they receive treatment.  During their visit, these susceptible individuals could be exposed to aerosols containing legionella bacteria that have multiplied within the building water system. The vulnerable nature of the population results in an increased risk of Legionnaires’ disease.


The Water Safety Group [WSG] needs to introduce sufficient measures & strategies, which do not allow unchecked proliferation of the legionella bacteria in the water systems and reduce, so far as is reasonably practicable, exposure to these aerosols.


The WSG is a multidisciplinary group of individuals, made up of appropriate experts to ensure all elements of the water safety plan are fully implemented.  The individuals can include, estates management, facilities management, infection prevention & control, microbiologist, Authorising Engineer [water], specialist departments, plumbers, contractors to name just a few.  The Authorising Engineer [Water] being an independent professional advisor with a defined responsibility for auditing, appraisals, reviews and support.


Read More in our blogs - 'The Hidden Dangers in Hospital Water Systems' and 'Water Hygiene Tips for the Control of Waterborne Pathogens in Healthcare Organisations' 


The monthly Public Health England surveillance report details the number of reported cases of Legionnaires’ disease per month and year to date [YTD].  The most recent report details 33 reported cases for May 2018 and 211 cases YTD in 2018. The report further categorises the source of each case as either: Travel abroad;

  • Noscomial [contracted within the healthcare environment];
  • Community / Travel within the UK.

An outbreak of Legionnaires’ Disease is classified as two or more cases, linked by time [weeks] and epidemiological evidence. Where a death or an outbreak has occurred due to Legionnaires’ disease the HSE will investigate.

There have been many well-publicized HSE investigations detailing the findings of the investigation and any fines imposed. 

Recent examples include:



Five firms were charged after a Legionnaires' Disease Outbreak - In the summer of 2012 an outbreak of Legionnaires’ disease in Edinburgh resulted in 56 confirmed cases and 36 suspected cases of the disease and 4 fatalities. The outbreak was centred on Wheatfield Road in Gorgie, west of the city centre, and an area where a number of industrial plants are located in close proximity to densely populated residential properties.


Visit Blog

legionella bacteria up close 2

International engineering firm fined £110,000 and £77,252 costs for failing to manage the risk in their cooling towers for over a year. The company’s water treatment programme and associated management arrangements were found to be severely ineffective. The HSE issued 4 improvement notices in June 2012. 




Visit Article

LRA Pillar image 6_100KB

Local Authority Care Home - 1 death due to Legionnaires’ disease in 2012. The HSE found that there were systematic failings, including: inadequate temperature checks, poor maintenance of showers and TMVs and over-reliance on the handyman who was inadequately trained – fined £100K and £20,000 costs.




Visit Article

image 5-1

NHS Trust – 1 death due to Legionnaires’ disease in 2011. The subsequent investigation discovered that between October 2010 and November 2011 there were:

a) 114 positive legionella counts;

b) 651 non-compliant temperatures;

c) 5x alternative technology systems failed to dose correctly.

Visit Article

image 7-2

Large private care home fined £3m over the death of a pensioner in 2015. 

Samples taken from taps contained a high concentration of legionella bacteria.




Visit Article 

G4S 4-1-264094-edited

Cash management solutions provider fined £1.8m and £34k costs in 2016 for failing to protect its workers. Maintenance of water systems did not comply with relevant regulations:

a) monitoring & testing erratically carried out
b) inadequately trained staff
c) out-of-date policies
d) risk assessment not suitable of sufficient.


Visit Article


Water Safety covers a spectrum of risks, as detailed earlier in this paper. The risk from legionella bacteria sits on this spectrum.  It is a naturally occurring bacterium that, when given favorable conditions within the built environment, presents a risk of Legionnaires’ disease; a potentially fatal form of pneumonia caused by breathing in contaminated water aerosols in the air.  Anyone can contract Legionnaires’ disease, although some individuals are more susceptible than others.

The risk of Legionnaires’ disease needs to be proactively managed by the Water Safety Group.  Completing a suitable, sufficient and independent Legionellosis risk assessment, will identify the risk systems in existence.  In turn, this allows the Responsible Person [Water] / Authorised Person [Water] to develop appropriate control measures [defined in the written scheme/water safety plan] to manage and minimise the risk of Legionnaires’ disease within their organisation.

Book a Free Consultation

Get Expert Advice

Do you have the right risk management solutions in place for water safety and Legionnaires’ disease?

By filling in the form to the left of this page you will get:

  • A one to one telephone review with a consultant

  • Independent and impartial feedback to improve your current risk management solutions