How ACOP L8 compliance is demonstrated: a practical guide
- 6 days ago
- 8 min read
ACOP L8 compliance is demonstrated by producing a verifiable audit trail of documentation, not by holding any formal certificate. The Approved Code of Practice L8, published by the Health and Safety Executive, sets the legal framework for controlling Legionella bacteria in water systems across the UK. Compliance professionals in every sector need to understand that demonstrating compliance means showing active, ongoing management through risk assessments, written control schemes, and detailed logbook records. Failure to follow ACOP L8 is treated by UK courts as failure to comply with the Health and Safety at Work Act 1974, which carries unlimited fines and potential imprisonment under Section 37.
How ACOP L8 compliance is demonstrated through documentation
The foundation of any compliance demonstration is a complete set of written records. ACOP L8 compliance is not a status you achieve once. It is a demonstrable state of active management that you must be able to evidence at any point during an inspection.
Three core documents form the backbone of your audit trail:
Legionella risk assessment. This must be “suitable and sufficient,” meaning it identifies all water system components, potential risk sources, and the population at risk. A generic template does not satisfy this requirement. The assessment must reflect your specific site, its water systems, and its occupants.
Written scheme of control. This document sets out the specific control measures for your site, the tasks required, the person responsible for each task, and the frequency at which each task must be completed. Without a written scheme, you have no baseline against which to measure performance.
Operational logbook. This is the living record of everything that happens to your water system. It captures temperature monitoring results, flushing records, descaling dates, TMV servicing, water sampling results, and all remedial actions taken after out-of-tolerance findings.
Record retention and audit readiness
All monitoring records must be retained for a minimum of five years under ACOP L8. Healthcare settings carry a higher duty, and records are typically retained for longer periods in those environments. This distinction matters because an inspector reviewing a care home or hospital will expect a more extensive historical record than one reviewing a commercial office.
Record type | Minimum retention | Notes |
Temperature monitoring logs | 5 years | All outlets, dated and signed |
Flushing records | 5 years | Outlets unused for 7+ days |
Showerhead descaling | 5 years | Typically quarterly |
TMV servicing records | 5 years | Include service dates and outcomes |
Remedial action records | 5 years | What, when, by whom, and outcome |
Paper logbooks remain legally acceptable, but electronic systems are now standard practice for larger estates. Electronic records allow you to search by date, outlet, or result type, which significantly reduces the time needed to respond to an inspector’s request.
Pro Tip: Organise your logbook so that any inspector can find a specific record within two minutes. If you cannot locate a record quickly, the inspector will assume it does not exist.
Who is the responsible person under ACOP L8?
The responsible person is the individual appointed by the duty holder to manage Legionella risk controls on a day-to-day basis. This role requires sufficient authority, competence, and resources to implement and maintain the written scheme of control. Competence is not defined purely by qualifications. It means the person understands the water systems they oversee, knows the risks those systems present, and has the practical ability to act when something goes wrong.
The appointment must be documented. A verbal arrangement does not satisfy ACOP L8. The written appointment should specify:
The name and job title of the responsible person
The scope of their authority over water system management
Their specific duties under the written scheme of control
Any tasks delegated to other team members, with those individuals named
The date of appointment and any review dates
In complex environments such as large healthcare estates or multi-site property portfolios, the duty holder may engage an external consultant to fulfil the responsible person role. This is permitted under ACOP L8, but the appointment must still be formally documented and the consultant must demonstrate the required competence. Inspectors will ask to see this appointment document as one of their first requests during a site visit.
Pro Tip: If your responsible person changes, update the appointment document immediately. An outdated document naming a former employee is a red flag for any inspector and suggests your compliance management is not actively maintained.
What does routine monitoring look like in practice?
Active monitoring is the clearest evidence that your written scheme of control is being implemented rather than simply filed away. Temperature monitoring must confirm that hot water reaches above 50°C at outlets within one minute and that cold water remains below 20°C. These thresholds are not targets. They are the minimum conditions required to inhibit Legionella growth.
A structured monitoring schedule for a typical commercial building would include:
Monthly hot and cold water temperature checks at a representative sample of sentinel outlets, with results recorded against each outlet by name and location.
Weekly temperature checks at calorifiers and cold water storage tanks, including the temperature at the base of the calorifier.
Flushing of infrequently used outlets for any outlet unused for seven or more days, with the date, duration, and outlet identity recorded.
Quarterly showerhead descaling and disinfection, with the date, method, and operative recorded.
Annual TMV servicing, with the service record filed in the logbook alongside the written scheme.
Remedial actions and out-of-tolerance results
Records must show every remedial action taken after an out-of-tolerance result, including what was done, when, by whom, and the outcome. This is the point where many compliance professionals underestimate the risk. A logbook that records a cold water temperature of 24°C but shows no subsequent action is worse than no record at all. It proves the duty holder knew about the problem and did nothing.
The absence of remedial action records after poor results is one of the most common findings during HSE inspections. It indicates that the written scheme exists on paper but is not being actively implemented.
Pro Tip: Electronic monitoring platforms allow you to set automatic alerts when readings fall outside acceptable ranges. This removes the risk of a poor result being recorded but not acted upon, and creates a timestamped evidence trail of your response.
Electronic systems also enable trend analysis across multiple outlets and time periods. That capability makes it far easier to identify a developing problem before it becomes a compliance failure. You can review temperature monitoring guidance to understand how these checks align with sector-specific standards.
When should risk assessments and control schemes be reviewed?
Risk assessments no longer require a fixed two-year review cycle under current ACOP L8 guidance. The requirement is that assessments must be reviewed whenever they are no longer valid. That means any significant change to the water system, building use, or control programme triggers a mandatory review.
Common triggers include:
Modifications to the water system, including new pipework, storage tanks, or heat exchangers
Changes in building occupancy or use, such as a ward closure or a change from office to residential use
Extended shutdowns or periods of low water use, such as a building closed for refurbishment
Repeated monitoring failures or a confirmed Legionella detection in water sampling
Changes in the responsible person or key personnel managing the system
High-risk premises, including care homes and hospitals, typically conduct annual reviews as best practice regardless of whether a specific trigger has occurred. The review must be carried out by a competent person, and the outcome must be documented. If the assessment is found to still be valid, that conclusion must be recorded. If changes are required, the updated assessment and any revised written scheme must be filed in the logbook.
You can find detailed guidance on reviewing a risk assessment and the process for documenting updates after system changes.
Pro Tip: Date-stamp every review, even when no changes are made. A series of dated review records demonstrates that you are actively monitoring the validity of your assessment, which is exactly what an inspector wants to see.
Key takeaways
Demonstrating ACOP L8 compliance requires a current, complete audit trail of risk assessments, control schemes, and operational records that show active management of Legionella risk at all times.
Point | Details |
Documentation is the proof | Compliance is shown through risk assessments, written schemes, and logbooks, not certificates. |
Retain records for five years | All monitoring and remedial records must be kept for at least five years, longer in healthcare. |
Appoint and document the responsible person | The appointment must be written, scoped, and kept current whenever personnel change. |
Record remedial actions without exception | Every out-of-tolerance result must be followed by a documented response showing what was done and when. |
Review assessments on trigger, not just on schedule | Any system change or monitoring failure requires a formal review and updated documentation. |
What I have learned about compliance that most guides miss
Compliance professionals often treat ACOP L8 as a documentation exercise. The real test is whether your records tell an honest story of active management. Inspectors prioritise well-maintained, honest logs that reflect system issues and responses over pristine but templated documents. A logbook that records a problem, shows the investigation, and documents the fix is far more compelling evidence than one that shows perfect results every single time.
The most common mistake I see is what I call “paper compliance.” The risk assessment exists. The written scheme exists. But the logbook has not been updated in three months, the responsible person named in the appointment letter left the organisation last year, and nobody has reviewed the assessment since a new hot water cylinder was installed. That gap between paperwork and practice is exactly what HSE inspectors are trained to find.
Investing in electronic monitoring changes this dynamic. Electronic systems facilitate proactive compliance through trend analysis, early warning, and audit readiness in a way that paper records simply cannot match. When an inspector arrives, you can pull up six months of temperature data for any outlet in under a minute. That capability signals a genuinely managed system, not a managed file.
The other lesson is that delegation without accountability creates risk. You can assign monitoring tasks to facilities staff, but if those tasks are not being completed and nobody is checking, the responsible person is still liable. Build a review rhythm into your compliance programme so that gaps are caught internally before they become inspection findings.
— Sammi
How Bespokecompliancesolutions supports your ACOP L8 compliance
Maintaining a complete, current audit trail across multiple sites is demanding work. Bespokecompliancesolutions delivers site-specific legionella risk assessments that meet the “suitable and sufficient” standard required by ACOP L8, alongside written control schemes and logbook implementation tailored to your premises.
The team at Bespokecompliancesolutions works directly with responsible persons and duty holders across commercial, healthcare, housing, and facilities management sectors. Services include water sampling and analysis, automated temperature monitoring, TMV servicing, and ongoing consultancy to keep your documentation current and inspection-ready. Whether you need a first assessment or a full compliance review, Bespokecompliancesolutions provides the specialist support to make compliance straightforward and defensible. Contact the team to discuss your site’s requirements.
FAQ
What documents prove ACOP L8 compliance?
The three core documents are a site-specific legionella risk assessment, a written scheme of control, and an operational logbook containing temperature records, flushing logs, and remedial action records. Together, these form the audit trail that demonstrates active compliance management.
How long must legionella records be kept?
All monitoring, inspection, and maintenance records must be retained for a minimum of five years under ACOP L8. Healthcare settings typically retain records for longer periods due to the higher risk profile of those environments.
Does ACOP L8 require a risk assessment every two years?
No. The fixed two-year review cycle no longer applies under current ACOP L8 guidance. Assessments must be reviewed whenever they are no longer valid, which includes any significant change to the water system, building use, or control programme.
Who can be the responsible person under ACOP L8?
The responsible person is typically an internal appointment, but an external consultant may be engaged in complex environments. The appointment must be documented in writing and the individual must have sufficient authority, competence, and resources to manage Legionella controls day to day.
What happens if monitoring records show poor results but no action?
A logbook that records out-of-tolerance results without corresponding remedial action records is evidence of a control failure. HSE inspectors treat this as proof that the written scheme is not being implemented, which constitutes non-compliance regardless of whether the other documentation is in order.
Recommended
Comments