What Is a Legionella Risk Assessment? A Guide for Building Managers

A legionella risk assessment is a systematic review of a building's water system to identify where legionella bacteria could grow and how people could be exposed. It is not an inspection that results in a pass or fail. It is a documented analysis that identifies specific hazards in your system and leads to a set of control measures you must implement and maintain.

If you manage a commercial building, care home, school, hotel, or any premises where other people use the water system, this assessment is a legal obligation — not a recommendation.

Why water systems harbour legionella

Legionella pneumophila — the bacterium that causes Legionnaires' disease — occurs naturally in freshwater at low concentrations. It becomes dangerous when water systems create conditions that let it multiply to harmful levels and then disperse it as breathable aerosol droplets.

Three conditions must be present simultaneously:

Temperature between 20°C and 45°C — legionella multiplies most rapidly between 32°C and 42°C. Below 20°C, growth is negligible. Above 60°C, the bacteria are killed
Stagnation — still water in storage tanks, dead legs, or infrequently used outlets allows bacteria to multiply over time
A source of nutrients — biofilm, scale, sediment, rust, and certain rubber or plastic pipe materials provide food for bacterial colonies

The risk assessment's job is to find where these conditions exist in your specific system and determine what to do about them.

What the assessment must cover

ACoP L8 and HSG274 set out what a legionella risk assessment should include. The core sections are:

1. Water system inventory

A complete description of the building's water infrastructure:

Incoming water supply (mains, private, boosted)
Cold water storage (tank location, capacity, material, condition)
Hot water generation (boiler type, calorifier, stored cylinder, point-of-use heaters)
Distribution network — pipe routes, materials, insulation
All outlets (taps, showers, baths, WC cisterns, hose points, fire sprinklers, cooling towers)
Any ancillary systems: spa pools, decorative fountains, humidifiers, dental chairs, industrial process water

A schematic or system diagram is expected for non-domestic systems. This is not optional decoration — it is how an assessor (and an inspector) traces risk through the building.

2. Hazard identification

For each component of the water system, assess whether conditions for legionella growth exist:

Component	What to check	Common findings
Cold water storage tank	Temperature (below 20°C?), lid condition, insulation, debris, stagnation	Tanks in warm plant rooms often exceed 20°C in summer
Calorifier / hot water cylinder	Storage temperature (60°C+?), thermostat accuracy, sediment accumulation	Temperature stratification can leave the bottom of a large cylinder below 60°C
Distribution pipework	Dead legs, long pipe runs, proximity to heat sources, insulation gaps	HMO conversions and building refurbishments commonly create dead legs
Outlets	Frequency of use, temperature at the tap, showerhead condition	Infrequently used outlets in basements, plant rooms, or vacant areas
TMVs (thermostatic mixing valves)	Downstream temperature, distance from outlet, maintenance schedule	TMVs can create a zone of water between 20°C and 45°C if pipework between the valve and the outlet is long
Cooling towers / evaporative condensers	Drift eliminator condition, biocide treatment, legionella testing programme	These are the highest-risk systems — most UK Legionnaires' disease outbreaks trace to cooling towers

3. People at risk

Identify who could be exposed to aerosols from the water system:

Building occupants (employees, residents, patients, guests, pupils)
Visitors and contractors
Passers-by (relevant for cooling towers that emit drift)
Specifically flag people at higher risk: over-45s, smokers, heavy drinkers, anyone with a suppressed immune system or chronic respiratory condition

This assessment of who is at risk determines the proportionality of your control measures. A single-let residential flat with a healthy young tenant has a different risk profile from a care home with immunocompromised residents.

4. Risk evaluation

For each identified hazard, assess:

Likelihood — how likely is legionella to multiply here, given the temperature, stagnation, and nutrient conditions?
Severity — if exposure occurred, what is the likely consequence given the population at risk?
Current controls — what is already in place to manage this risk?

The combination produces a risk rating that determines the priority of action. High-risk findings (a stagnant dead leg feeding a shower used by vulnerable people) require immediate corrective action. Low-risk findings (a rarely used cold tap on direct mains feed) may need only monitoring.

5. Recommended control measures

The assessment must not simply list hazards — it must specify what to do about each one:

Temperature controls: store hot water at 60°C+, deliver at 50°C+ at outlets, keep cold water below 20°C
Flushing schedules for infrequently used outlets (see our flushing guide)
Dead leg removal or regular flushing
Showerhead descaling and disinfection (quarterly)
Cold water tank cleaning, inspection, and insulation
TMV servicing schedules
Water treatment programmes (for larger systems)
Legionella sampling programmes (for high-risk systems like cooling towers)

6. Monitoring programme

A schedule of ongoing checks that the duty holder or responsible person must implement:

Check	Typical frequency	Applies to
Hot water outlet temperatures	Monthly	All systems with stored hot water
Cold water outlet temperatures	Monthly	All systems, especially those with cold water storage
Flushing of infrequent outlets	Weekly	Any outlet unused for 7+ days
Showerhead descaling	Quarterly	All showers
Cold water tank inspection	Annual	All tank-fed systems
Calorifier inspection and drain-down	Annual	Systems with calorifiers
TMV servicing	Annual (or per manufacturer)	All TMV installations
Legionella sampling	Quarterly (cooling towers), or as risk assessment dictates	High-risk systems

How it differs from a "legionella test"

People sometimes confuse a risk assessment with legionella testing. They are different things:

	Risk assessment	Legionella testing
What it is	Systematic review of the water system	Laboratory analysis of water samples
What it finds	Conditions that could allow legionella growth	Whether legionella bacteria are present right now
Legal requirement	Yes — for virtually all non-domestic premises	Only for high-risk systems (cooling towers) or when the risk assessment recommends it
Frequency	Every 2 years minimum, or after changes	As specified by the risk assessment
Outcome	A set of control measures to implement	A snapshot bacterial count

A clean water test does not mean your system is safe — it means legionella was not detected in the sample taken on that day. Without the systematic analysis of a risk assessment, you have no way of knowing whether conditions might change next week.

For more on the distinction, see our UK legionella testing requirements guide.

Who needs one

The short answer: almost everyone responsible for a building with a water system. The Health and Safety at Work etc. Act 1974 and COSHH 2002 apply to employers, landlords, and anyone in control of premises.

For a detailed breakdown by building type, see our guide to who needs a risk assessment.

How often it must be reviewed

ACoP L8 does not set a fixed review interval, but two years is the widely accepted benchmark. Review sooner if:

The water system is modified (new boiler, additional outlets, refurbishment)
Building use changes (residential to commercial, new vulnerable occupants)
Monitoring reveals persistent non-compliance (repeated temperature failures)
There has been an outbreak or suspected case
The system has been out of use for an extended period

See our detailed guide to review frequency.

Self-assessment vs professional assessment

For simple domestic systems, landlords can do the assessment themselves. For non-domestic buildings (offices, care homes, hotels, schools), a professional assessment by a competent person is the practical standard. Complex water systems — those with cooling towers, large storage tanks, extensive distribution networks, or TMVs — need someone with technical water hygiene expertise.

Get started

LegioLog's Risk Assessment Template Generator creates a structured risk assessment document for your building type. Use the Temperature Compliance Checker to verify readings against ACoP L8 thresholds.

For the full regulatory background, see our ACoP L8 and HSG274 guide.

This guide covers legionella risk assessment requirements under ACoP L8 and HSG274 for England, Wales, and Scotland. This is general compliance guidance, not legal or professional advice — for site-specific assessments, consult a competent person as defined by ACoP L8.