Legionella control and ACOP L8 record keeping.

Legionella control is the duty where the gap between doing the work and being able to prove it is widest. Temperatures get taken. Outlets get flushed. Then the readings live in a book in a plant room, the flushing is carried out by someone who has left, and the risk assessment is four years old with no record of whether it was ever reviewed. The work was real; the evidence is not.

This guide covers the shape of the duty and the records that evidence it. It is not a substitute for a risk assessment carried out by a competent person, and where it gives a frequency it gives the commonly applied one rather than the one that necessarily applies to your system.

Where the duty comes from

The obligation sits under the Health and Safety at Work etc. Act 1974 and the Control of Substances Hazardous to Health Regulations, with the Approved Code of Practice L8 — Legionnaires' disease: The control of legionella bacteria in water systems — setting out what is expected. The supporting technical guidance is HSG274, published in three parts covering evaporative cooling systems, hot and cold water systems, and other risk systems.

An approved code of practice has a particular status worth understanding. You are not obliged to follow it, but if you are prosecuted for a breach and are shown not to have followed it, you have to demonstrate that you complied with the law in some other way. In practice that means departing from L8 is a decision requiring a documented rationale from someone competent, not an informal one.

The duty holder has to be a named person

L8 expects a duty holder, and for water systems it also expects a nominated responsible person with sufficient authority and knowledge to manage the control scheme. This sounds administrative and is not: an unfilled role is the commonest single finding when a control scheme has quietly stopped running. Somebody left, the role moved informally to whoever was nearest, and nobody recorded the change or checked they had been trained for it.

• –Record who the responsible person is, in writing, with the date they took the role
• –Record the deputy — the scheme has to survive annual leave
• –Record their training, and re-record it when it is refreshed
• –Update all of the above the day the role changes, not at the next review

How often the risk assessment should be reviewed

This is the most searched question on the topic and the answer is less satisfying than people want. There is no universal statutory interval. The expectation is that the assessment is reviewed regularly, and specifically whenever there is reason to believe it is no longer valid. A two-year review cycle is very widely applied as a default in the absence of anything triggering an earlier one, and many estates work to it — but the triggers matter more than the cycle.

• –A change to the water system — new plant, altered pipework, a dead leg created or removed
• –A change in use or occupancy of the building, including extended closures or partial reopening
• –A case of legionellosis associated with the system
• –Monitoring results showing the control scheme is not achieving its parameters
• –A change in key personnel, or in the guidance itself

The practical failure here is not usually skipping a review. It is that a trigger occurred — a wing closed for six months, a new outlet was installed — and nobody connected it to the water risk assessment at the time. Recording the review date and its triggers against the building makes the connection visible rather than dependent on somebody remembering.

The monitoring regime, and what it produces

What your scheme requires comes from your risk assessment. The routines that appear most often in hot and cold water systems, and which HSG274 Part 2 discusses, look broadly like this.

• –Temperature monitoring at sentinel outlets, commonly monthly, with hot water reaching the required temperature within a minute and cold staying below the control threshold
• –Temperature checks on calorifier flow and return, and on stored hot water
• –Flushing of little-used outlets, commonly weekly, with the flushing recorded rather than assumed
• –Periodic inspection and cleaning of cold water storage tanks
• –Descaling and disinfection of showerheads and spray outlets at an interval set by the assessment
• –Checks on the wider system for dead legs and redundant pipework

Each of those produces a record, and the records are the point. A monitoring regime with no surviving readings is indistinguishable from no monitoring regime at all, which is a difficult position to be in when an inspector asks for twelve months of sentinel temperatures.

The closure problem

Buildings that sit empty or lightly used for extended periods — schools over the summer, offices between tenancies, wings taken out of service — change the risk on a water system materially, because stagnation is the condition the whole control scheme exists to prevent. The flushing regime that covers a closure is also the regime most likely to lapse, precisely because the building is empty and nobody is there to notice.

If you run a building with seasonal closures, treat the closure regime as a scheduled routine in its own right with a named owner, rather than as an instruction someone remembers in July. Scheduling it against the building and its assets is the difference between a regime that runs when the building is empty and one that only runs when someone is there to be reminded.

What good record keeping looks like

L8 expects records to be kept, and retention periods apply — commonly five years for monitoring records, with the risk assessment retained while it remains current and afterwards for the same sort of period. Check the current guidance for the exact expectation rather than relying on a number in an article, including this one.

More useful than the retention period is the shape of the record. What an inspection actually asks for is a continuous, contemporaneous, attributable series: this reading, at this outlet, on this date, taken by this person. A tidy summary produced afterwards is weaker evidence than a messy contemporaneous log, because the summary was written by someone with an interest in how it looked. Holding the readings against the asset as part of your statutory compliance records gives you the continuous version by default.