Legionella Action Levels in England: HSE Thresholds and Audit Steps
HSG274 treats a result under 100 CFU/L as evidence your system is under control, between 100 and 1,000 CFU/L as a warning to review your control scheme and resample, and over 1,000 CFU/L as a trigger for immediate remedial action followed by resampling. These bands apply to hot and cold water systems specifically. Testing itself only becomes necessary where your risk assessment says it is, and one sample is a snapshot, not a verdict on the whole system.
TL;DR:
Water systems should be resampled within days after a result between 100 and 1,000 CFU/L to confirm the presence and determine if control measures are effective.
Sampling methods vary in detection limits, so interpreting “not detected” versus “below 100 CFU/L” depends on the test’s sensitivity and method used.
An immediate remedial response is mandatory if a sample exceeds 1,000 CFU/L, including disinfection, restricting use, and rechecking with a clearance sample.
Routine checks should focus on critical points like outlets furthest from the heat source and include temperature logs and inspection of dead legs or faulty valves.
Confidence in a water safety program relies on consistent control, comprehensive recordkeeping, and follow-up testing, not a single “clean” sample alone.
Table of Contents
What legionella action levels actually mean
A laboratory result is expressed in colony-forming units per litre, or CFU/L. That figure tells you how many viable legionella bacteria grew from your water sample under controlled conditions, not a precise bacterial headcount. “Not detected” and “below 100” sound identical to most facilities managers, but they are not: “not detected” means the method found nothing at all, while “below 100” can mean a small count was present but fell under the reporting threshold. Both sit inside the acceptable band, but the distinction matters when you are tracking a trend over several quarters.
HSG274 Part 2 sets these bands specifically for hot and cold water systems. Cooling towers and evaporative condensers run under a different regime with tighter monitoring frequency, because aerosol generation carries a materially higher exposure risk. Healthcare premises also apply stricter thresholds and faster response timescales, reflecting the vulnerability of patients on site.
A few things worth holding in mind when you read any certificate:
The action bands are triggers for management response, not proof of safety at every point in between. Detection limits vary between culture methods and rapid molecular tests, so the same water could report differently depending on which method the lab used. A single “under 100” result tells you about that outlet on that day, nothing more. Culture-based testing typically takes around two weeks to produce a confirmed result, which is worth factoring into how quickly you can respond to a live concern.
How to read a lab report and when to resample
A legionella certificate carries more information than the headline CFU/L figure, and most of the useful detail sits in the small print. Check the method used (culture or a rapid alternative), the stated detection limit, and whether the report identifies the species, typically Legionella pneumophila, since that species carries the greatest health significance.
If a result comes back elevated or ambiguous, follow a structured resampling sequence rather than a single repeat test:
Resample the same outlet immediately to rule out a sampling or transport error.
Sample adjacent outlets on the same branch to check whether the issue is localised or spreading.
Test your designated sentinel points, the outlets furthest from the calorifier or tank, since these usually reveal system-wide control loss first.
Compare the new results against your last four to six sampling rounds, not just the previous one.
A single spike against an otherwise clean history usually points to a local fault such as a dead leg or a faulty thermostatic mixing valve. A pattern climbing across multiple outlets over successive rounds points to systemic control loss, which needs a full review of your written scheme rather than a spot fix.
Pro Tip: Never treat a disinfection job as finished until a follow up sample confirms it worked. Cleaning without a clearance certificate leaves a compliance gap that an inspector will spot immediately.
Practical checklist of actions mapped to each action band
Under 100 CFU/L means your control regime is functioning. Log the result, continue your existing monitoring frequency, and add the figure to your trend record. No remedial action is required, though a sudden jump from consistent “not detected” results to a value nearing 100 is worth watching.
Between 100 and 1,000 CFU/L, HSE guidance calls for a review of the control scheme and a rapid resample. In practice, that means:
Check outlet temperatures against your target regime and flag any that are running cold.
Inspect for dead legs, disused pipework, or a TMV that has drifted out of calibration.
Review whether flushing schedules for low-use outlets have actually been followed.
Resample within days rather than waiting for the next scheduled round.
Escalate to full remedial action if the repeat sample confirms the same band or rises further.
Over 1,000 CFU/L demands immediate remedial action: resample to confirm the reading, isolate or restrict use of affected outlets where practical, and arrange disinfection or a chemical/thermal shock treatment. Update the risk assessment to identify the cause, and consider whether occupants need to be informed, especially in higher-risk settings. A clearance resample after remedial work is essential to demonstrate the fix was successful.
Keep every piece of evidence an inspector might ask for: sample dates and outlet references, temperature logs, contractor reports detailing what was done and when, and the laboratory certificates for both the original and clearance samples, all tracked efficiently through comprehensive facility assessment software. Missing paperwork is one of the most common reasons a defensible response looks weak on paper even when the physical work was done correctly.
Who can test, and what makes a lab report defensible
Testing is not a blanket legal requirement for every premises. HSE is explicit that microbiological sampling is necessary only where the site risk assessment identifies it, for example where control regimes are inconsistent or temperature checks have thrown up doubts. A well-run system with reliable temperature control may need no routine sampling at all.
When testing is required, the laboratory matters as much as the result. Look for:
UKAS accreditation for the specific legionella test being carried out.
Participation in a recognised proficiency testing scheme, which proves the lab’s results are checked against independent standards.
A stated theoretical detection limit of no more than 100 CFU/L for culture methods, since a lab that cannot detect reliably at that level cannot confirm your system sits in the lowest band.
Clear method statements on the certificate itself, not just a bare number.
A quick UKAS status check before you commission any sampling round saves the awkward conversation later when an inspector asks whether your evidence stands up.
Prevention and control measures that keep counts down
Chasing test results after the fact costs more than running a tight control regime in the first place. HSG274 Part 2 sets the benchmark temperatures: store hot water at 60°C, and get it to outlets at 50°C, rising to 55°C in healthcare settings. Cold water should stay below 20°C where the system allows it. These figures balance legionella control against scalding risk, which is why thermostatic mixing valves matter so much in practice.
Key measures worth building into a routine include: fitting TMVs close to the point of use in higher-risk areas such as care settings, schools, and public washrooms to blend hot water down safely; flushing any outlet used infrequently by running water through for several minutes to clear stagnant sections; inspecting and cleaning cold water storage tanks regularly, checking for sediment and damage; removing redundant pipework and dead legs instead of just capping them since stagnant water can remain; considering biocide dosing or engineering changes such as replacing wet cooling plant with dry alternatives where control challenges persist despite basic measures.
Pro Tip: A TMV that has never been serviced is a common hidden cause of a 100 to 1,000 CFU/L result. Build TMV checks into your routine maintenance rather than treating them as fit-and-forget.
Reporting duties and the records that back them up
Occupational cases of legionellosis linked to workplace exposure fall under RIDDOR reporting duties, and duty holders need to know that obligation exists before an incident forces them to find out. A full breakdown of how legionella fits RIDDOR is worth keeping to hand.
After any positive result and remedial response, keep:
Laboratory certificates for both the triggering sample and the clearance sample.
Contractor reports detailing the disinfection or repair method used.
Temperature logs from before and after the intervention.
Dated records of every action taken, including who carried it out.
A structured legionella logbook turns these scattered documents into a single, chronological record that stands up to scrutiny.
Who should manage the risk, and what competence looks like
Every premises needs a named responsible person with the authority and knowledge to manage legionella risk day to day, as set out in INDG458. That includes preparing a written control scheme, appointing competent persons for specific tasks, and keeping monitoring records current.
Complex systems, multi-site portfolios, or a straightforward lack of in-house expertise are all good reasons to bring in external competence rather than stretching an internal team too thin:
Training should be refreshed periodically, with records kept of who attended and when.
Evidence of competence matters as much as the qualification itself: keep certificates, course content summaries, and attendance logs together.
Reviewing your risk assessment after any positive result is part of demonstrating ongoing competence, not a one-off formality.
How Bespokecompliancesolutions supports a response to an action-level result
When a sample comes back in the 100 to 1,000 or over 1,000 band, the clock matters. Bespokecompliancesolutions provides bespoke legionella risk assessments, coordinates UKAS-accredited sampling, and carries out disinfection and remedial works when a result demands it. Every stage gets documented, from the original certificate through to the clearance sample, so the audit trail an inspector or insurer might ask for already exists.
Beyond immediate fixes, we implement logbook systems and deliver legionella awareness training, helping in-house teams spot developing problems early. For organisations managing multiple sites, combining documented remedial work and ongoing training supports a defensible, long-term control regime.
What an action level actually tells you about infection risk
An action band is a management trigger, not a direct measure of how likely someone is to fall ill. Legionnaires’ disease develops when someone inhales fine water droplets, aerosols, carrying viable legionella bacteria deep into the lungs, which is why showers, spray taps, and cooling towers carry more inherent risk than a still body of water. A high CFU/L count raises the probability of aerosolised bacteria reaching someone, but factors like the person’s age, immune status, and smoking history all shape whether exposure actually leads to infection.
This is why HSE’s own framing centres on avoiding the conditions that let legionella proliferate, stagnant water, the right temperature band, biofilm buildup, rather than fixating on chasing a zero count. A system with consistently low counts across sentinel points and good temperature control carries meaningfully lower risk than one that occasionally scrapes under 100 CFU/L while temperatures drift. Treat the action bands as an early warning system for conditions that favour bacterial growth, not as a health guarantee for anyone using the water on a given day.
Cooling towers, healthcare and potable water: different systems, different rules
The standard hot and cold water action bands do not transfer neatly to every system type. Cooling towers and evaporative condensers generate fine aerosols continuously during normal operation, which pushes exposure risk higher even at comparable bacterial counts. These systems typically need more frequent monitoring and a lower tolerance for any upward trend, because the aerosol pathway to the lungs is so much more direct than a domestic tap.
Healthcare premises apply tighter thresholds across the board, reflecting patient vulnerability. Delivery temperatures at outlets are set at 55°C rather than the 50°C used elsewhere, and a positive result often triggers a faster, more cautious response given the population on site, including notification protocols that a low-risk office building would not need.
Potable hot and cold water systems in standard commercial or residential settings follow the HSG274 bands most duty holders are familiar with, but even within that category, risk varies with usage pattern. A rarely used guest bathroom in a hotel behaves very differently to a constantly flowing kitchen tap, which is exactly why a proper risk assessment, rather than a blanket testing schedule, drives where and how often you sample.
How often you should monitor, based on your own risk profile
Monitoring frequency should follow the risk assessment, not a fixed calendar imposed from outside. A low-risk system with reliable temperatures, a simple layout, and no history of positive results might need only an annual review with occasional spot checks. A complex system with cooling towers, extensive dead legs, or a track record of borderline results warrants monthly or even more frequent sampling at sentinel points.
Review intervals should tighten automatically after any result in the 100 to 1,000 band or above, since that result itself is evidence the current frequency was not catching a developing problem early enough. Seasonal factors matter too: water temperatures often drift during warmer months, and systems that have been partially shut down (over a holiday closure, for instance) need a check before full reoccupation rather than waiting for the next scheduled round.
The core principle from HSG274 is straightforward: monitoring frequency should scale with consequence. A care home with a large vulnerable population justifies a tighter schedule than a small office with healthy occupants and a simple, well-maintained system, even if both currently show identical results.
Where interpretation commonly goes wrong
The single most common mistake is treating one clean sample as proof the whole system is safe. A result under 100 CFU/L confirms that outlet was under control on that date; it says nothing about an outlet on the opposite end of the building or a shower that has not been used in three weeks. Sentinel point sampling exists precisely because it targets the locations most likely to reveal a developing problem first, rather than the easiest tap to reach.
A second frequent error is confusing “not detected” with a guaranteed absence of legionella, when it actually reflects the limit of what the test method could find. Culture methods and rapid tests carry different detection limits, and comparing results across methods without checking that detail can create a false sense of improvement or decline.
Duty holders also sometimes disinfect after a high result and consider the matter closed without a clearance resample, leaving no evidence the intervention actually worked. And a scattering of individually unremarkable results across several outlets over time can mask a slow, system-wide drift that only becomes obvious once someone plots the trend rather than reading each certificate in isolation.
Prioritise control over chasing a zero count
The biggest misjudgement duty holders make is treating a single clean result as job done. Legionella management is a continuous discipline built on temperature regimes, flushing, and honest recordkeeping, not a certificate to file away. A defensible position comes from consistent control and a paper trail, not from one favourable number.
— Sammi
Get help when a result exceeds an action level
If your last sample came back above 100 CFU/L, waiting for the next scheduled test is not a strategy. We provide legionella risk assessments, coordinate accredited water sampling, and carry out disinfection and system flushing when remedial work is needed, fully documenting the process from initial certificate to clearance sample.
[
We coordinate the entire response, so nothing falls through the gaps when an inspector asks for evidence. If you need urgent attendance following an elevated result, or you simply want a scheduled risk assessment before problems arise, get in touch to book a legionella risk assessment or explore risk assessment services in your area to get a site visit scheduled.
Sources
For legal and technical detail beyond this guide, consult HSE’s testing and monitoring page, HSG274 Part 2, the INDG458 dutyholder leaflet, and the Gov.
HSG274 Part 2 (control of legionella in hot and cold water systems)
FAQ
What are the acceptable levels of legionella in water?
Under HSG274, a result below 100 CFU/L is treated as the system being under control; 100 to 1,000 CFU/L requires review and resampling, and above 1,000 CFU/L needs immediate remedial action.
What is the British standard for legionella risk assessment?
There is no single “British standard” as such; HSE’s HSG274 series and the INDG458 dutyholder guide set the recognised framework duty holders in England follow for risk assessment and control.
What is an acceptable legionella sample result?
Any result under 100 CFU/L falls within the acceptable band and simply needs logging and continued monitoring. A “not detected” result is not automatically stronger evidence than “below 100”; both sit in the lowest band, but the detection limit and method noted on the certificate matter.
How long should I run the taps to flush out legionella?
HSG274 does not set one universal duration, but guidance generally recommends running infrequently used outlets for several minutes until the water runs clear and any warm stagnant water has cleared the pipe, as part of a regular flushing schedule rather than a one-off fix.
Is legionella testing legally required for every building?
No. HSE guidance is explicit that testing is required only where the site risk assessment identifies a need, such as inconsistent temperature control or doubts about the existing regime.
Recommended
Comments