Water Hygiene Due Diligence When Buying a Business or Site
Water hygiene due diligence means checking, before you commit, whether the target’s water systems are assessed, controlled and documented to the standard UK law expects. In practice you ask for the Legionella risk assessment, the written control scheme and the monitoring records, then have a competent person confirm they match what is actually on site. Gaps found early become price, warranty or remedial-work discussions. Gaps found after completion become your problem.
TL;DR
Ask for the current Legionella risk assessment, the written control scheme and all management logs. If any are missing or out of date, treat that as a finding.
Compare paper with reality: schematics, tanks, outlets, temperatures and contractor records should match the building you are buying.
Unlimited fines and prosecutions cannot be indemnified or insured against, so findings should feed price, warranties, indemnities or a remedial plan.
After completion, name the new responsible person, review the assessment and fix anything flagged before it becomes a live risk.
An independent risk assessment and targeted water sampling during the deal give you evidence rather than the seller’s assurance.
Table of Contents
Why water hygiene belongs in the deal
Most acquisition checklists cover finance, contracts, employment and property title. Water safety tends to arrive late, if at all. Yet environmental, health and safety due diligence is meant to reveal liabilities and operational risks, and it routinely covers permits, statutory inspections, incidents that may attract enforcement and policies in areas such as Legionella, according to a UK legal briefing on EHS due diligence for buyers.
The stakes are practical as well as legal. The same briefing notes that EHS breaches can lead to third-party claims and unlimited criminal fines, and that prosecutions cannot be indemnified or insured against. When you buy a business or a site, you inherit the building’s water systems, the way they have been run and the record of it. You also take on the duty to manage them from the day you take control.
RICS makes a related point for technical surveys generally: technical findings should be read within the bigger legal and investment picture. A tank in poor condition is not just a repair cost. It may also be a compliance gap, an insurance question and a negotiation point.
What the law expects of the current dutyholder
You are checking the seller against a clear benchmark. The HSE’s approved code of practice and guidance, L8: Legionnaires’ disease, the control of legionella bacteria in water systems, sets out that whoever manages the risk must be competent: they need enough authority, knowledge of the system and training to manage Legionella risks effectively.
In a deal, that raises three questions:
Who is the responsible person today? Is it a named individual with real authority, or a role that was never properly filled?
Are they competent for this site? Training records and contractor appointments should show it.
Who will it be on day one after completion? If the answer is “we will work it out later”, you have a gap.
If you want a plain-English view of what that role involves, see our guide to the responsible person for Legionella and what duty holders must do.
The document request list
The HSE guidance points to the records a competent dutyholder should hold. Put these on your due diligence request list:
Document | What you are looking for |
Legionella risk assessment | Current, site-specific, carried out by a competent person, covering every system on the premises |
Written control scheme | Named responsible people, control measures, monitoring routines, and what happens when a result is out of range |
Schematic diagrams | Drawings that match the pipework and tanks actually installed |
Monitoring and inspection logs | Temperature checks, flushing, cleaning and inspection records, including those from external contractors |
Training records | Evidence that the people doing the tasks are trained for them |
Water analysis | Any chemical or biological test results and what was done about them |
That list reflects the HSE’s own description of the records buyers should expect to see: the risk assessment, the written control scheme, the management logs, schematics, maintenance and inspection logs, training records and analysis documents.
One detail matters for smaller targets. Employers with five or more employees must keep written records of the assessment, the control scheme and how it is implemented. Those with fewer than five are advised to, but are not strictly required by statute. A small target with thin paperwork has not necessarily broken the law, but it has given you very little evidence to rely on.
Our page on the Legionella logbook shows what a well-kept record looks like, and the guide to the Legionella written scheme explains what it should contain.
Red flags to look for in the documents
Paperwork can be present and still tell you something is wrong. These are the patterns that should prompt a closer look.
An out-of-date assessment. The HSE says the risk assessment should be reviewed regularly, and in particular when the water system, its use or the building’s use changes. If the seller has changed the layout, added a kitchen or shower block, or changed what the building is used for since the last assessment, the document may describe a building that no longer exists.
Records that stop. Logs that run neatly for six months and then vanish suggest a lapse in the routine, perhaps after a change of staff or contractor. Ask what happened.
Identical entries. Temperature logs where every reading is the same, or are all in the same handwriting on a single day, suggest records completed in bulk rather than taken at the outlet.
Unanswered results. A positive Legionella result or a failed temperature check is not in itself the finding. The finding is the absence of a documented response: re-sampling, disinfection, a review of the control scheme.
No named person. A written scheme that refers to someone who left the business two years ago is a competence gap, not a formality.
Contractors without evidence. Work such as tank cleaning, disinfection or valve servicing should come with reports. A line in a log saying “done” is not enough.
Red flags on site
A site visit by a competent person often tells you more than the folder. Things we would want to see checked:
Cold water storage. Condition of tanks, lids, insulation and location, and whether the tank is bigger than the building needs.
Little-used outlets. Rooms, showers and taps that are rarely run, because standing water is a classic problem.
Redundant pipework. Old branches left capped or abandoned after refurbishment.
Hot water temperatures. Whether the system can actually deliver the temperatures the control scheme says it does.
Thermostatic mixing valves. Whether they are installed where vulnerable people use the water, and whether they are serviced.
Mothballed areas. Wings or floors shut down without a plan for flushing or draining.
These are the points we look at during our own assessments, so treat them as a practical prompt rather than a legal list. Where the target is a care or clinical setting, the stakes are higher: see our note on Legionella risk management for immunocompromised patients and our overview of Legionella compliance for healthcare premises.
Matching the check to the type of target
The same questions apply everywhere, but the weight shifts with the building.
Offices and commercial premises. Often lower risk, but multi-tenanted buildings raise the question of who manages shared systems. See Legionella compliance for offices and commercial premises.
Schools, colleges and universities. Long holiday closures create stagnation risks, and many outlets go unused for weeks. Our page on Legionella compliance for schools and colleges covers it.
Hospitality and leisure. Showers, spas, pools and seasonal closures mean more outlets and more variation. Look at Legionella compliance in hospitality and leisure.
Healthcare and care settings. Vulnerable occupants mean the standard of evidence needs to be higher.
If the target has a private water supply rather than mains water, add further questions. The Drinking Water Inspectorate advises buyers to ask whether maintenance logs exist, whether the local authority has carried out a risk assessment and whether treatment is appropriate and effective. That guidance is written for dwellings, but the same questions are sensible for a commercial site on a private supply.
How gaps turn into liabilities
A water hygiene gap can cost a buyer in three ways.
Legal. Unlimited fines and prosecutions that cannot be indemnified or insured against, as the EHS due diligence briefing sets out. Third-party claims sit alongside them.
Financial. Remedial work such as tank cleaning or replacement, pipework alterations, disinfection and valve replacement. Until a competent person has looked, you cannot put a number on it, which is the point of doing the check before exchange.
Operational. A positive result or an outbreak investigation can mean restricted use of showers or whole areas, and reputational harm that is hard to price.
The benefit of finding these before completion is leverage. The same briefing lists what findings can support: price negotiation, warranties or indemnities, remedial work by the seller, environmental insurance or walking away. Solicitors advising on leisure deals make a similar point: due diligence lets sellers mitigate identified risks or put the buyer on notice, while buyers can seek warranties or indemnities.
Turning findings into deal terms
A sensible approach is to sort findings into three groups:
Paperwork gaps that can be fixed quickly, such as an out-of-date assessment. Ask the seller to commission a new one before completion.
Physical defects with a cost, such as a damaged tank. Seek a price adjustment or a seller-funded fix.
Unquantified or serious risks, such as a positive result with no response on record. Seek a specific warranty or indemnity, and consider environmental insurance as a backstop.
Take your solicitor’s advice on the drafting. Our job is to give you the technical evidence to put in front of them.
Commissioning your own evidence
The seller’s assurance is not evidence. During the deal window, three pieces of independent work make the biggest difference.
An independent Legionella risk assessment. It tests the existing assessment against the building as it stands, and gives you a prioritised action list. Our Legionella risk assessments start from £185.
Water sampling. Samples from representative points show what the system is doing now, rather than what the log says. Our Legionella water testing and analysis starts from £55 per sample. Where relevant it can extend to potable, microbiological and closed-system testing.
A review of the control arrangements. A competent person reads the written scheme, the logs and the contractor reports against what they saw on site, and tells you where they disagree.
You may only have access for a short window, so order the work early. Sampling results take time to come back, and they can reshape the negotiation if they arrive after the deal has been priced.
After completion: the first 90 days
The same legal briefing suggests that after completion, buyers should notify regulators of the change in ownership, review EHS policies and procedures, and transfer permits. For water hygiene, the practical version looks like this.
Name the responsible person in writing, with authority and training, and tell the contractors who they are.
Re-check the risk assessment if anything has changed, or if there is any doubt about its date or quality. The HSE advises review when the system, its use or the building’s use changes.
Close out the findings. Work through the due diligence action list in priority order and record each fix.
Bring the records into one system. A single logbook with a clear routine beats inherited folders of mixed formats.
Train the people doing the work. Our Legionella awareness training is available on site or online.
Plan the ongoing monitoring. For sites with many outlets or several buildings, automated water temperature monitoring can reduce reliance on manual rounds.
Perspective
When we are brought into an acquisition, the most common surprise is not a catastrophic failure. It is a mismatch. The folder says one thing, the building says another, and nobody on the buyer’s side knew to look. Our view is that water hygiene due diligence should be proportionate, early and evidence-led. A competent risk assessment and targeted sampling cost very little against the price of the deal, and they turn an unknown into a list. A list can be negotiated, costed and scheduled. An unknown cannot. We also think buyers should plan for the first day, not just the signing. Our approach is to make compliance simple: a bespoke plan for each site, clear documentation, remedial works where needed and ongoing support so the new owner is never left holding a binder they do not understand. Sammi
Where we can help
We work with commercial, healthcare, education, housing and hospitality organisations across the UK, and our services are bespoke to each site. For an acquisition that usually means a risk assessment and water sampling before completion, then remedial works, disinfection, TMV servicing, training and an ongoing support arrangement afterwards. Prices for those later services depend on the site, so we quote per job.
[
If you are mid-deal and need to understand a site’s water systems quickly, start with a Legionella risk assessment or contact us through our website. Our method of works page explains how we carry out the work. For a wider view of why this matters, read why Legionella is a health and safety priority, or see the business premises case study.
FAQ
Is Legionella due diligence a legal requirement when buying a business?
No law requires you to do it as part of an acquisition. However, once you take control you carry the dutyholder’s responsibilities, and the HSE expects a competent person to manage the risk. Doing the checks before completion is how you find out what you are inheriting.
What documents should I ask the seller for?
Ask for the current Legionella risk assessment, the written control scheme, management and maintenance logs including contractor records, schematic diagrams, training records and any water analysis results. These are the records the HSE guidance describes. Compare each with what you see on site.
Can I be fined for the seller’s past failures?
Liability depends on the deal structure and the facts, so take legal advice. What you can say is that EHS prosecutions cannot be indemnified or insured against, and that your own duties start when you take control. That is why findings should feed warranties, indemnities or price.
How long does a water hygiene check take?
A site assessment can often be carried out quickly, but sampling results need laboratory time. Plan the work at the start of the diligence window, not the end, and agree access with the seller early.
What if the target has no risk assessment at all?
Treat it as a significant finding. Ask the seller to commission one before completion, or make it a condition of the deal, and budget for any remedial work that results. Employers with five or more employees must keep written records, so a missing assessment there is a compliance gap.
Sources
Environment and Health & Safety Due Diligence For Buyers (Lexology)
Legionnaires’ disease: The control of legionella bacteria in water systems, L8 (HSE)
HSG274 Legionnaires’ disease, Technical guidance Part 1 (HSE)
Buying a dwelling with a private water supply (Drinking Water Inspectorate)
Carrying out legal due diligence in the leisure industry (Myerson Solicitors)
Recommended
Comments