Legionella Audit Preparation: A Checklist for Your Site Survey
Preparing for a Legionella audit or site survey comes down to four things: knowing your water systems, having your records to hand, arranging safe access, and naming the people who run the control regime. If an assessor can walk the site with an accurate schematic, find every logbook within minutes and reach every tank and outlet safely, the visit is quicker, cheaper and far more useful. This guide sets out what to gather, in what order, and what to do with the findings afterwards.
It is written for facilities managers, estate managers, compliance managers and health and safety leads responsible for UK premises: schools, surgeries, offices, care settings and housing.
TL;DR
An audit looks at three things: the physical water systems, your paperwork, and the people who manage the controls.
Before the visit, prepare an up-to-date schematic, an asset register, the previous risk assessment, and dated monitoring, maintenance and disinfection records.
Include deadlegs, little-used outlets and parts taken out of use. They are where problems hide.
Arrange access to roofs, tanks and plant rooms in advance, with permits and safe working in place.
After the survey, give every finding an owner and a target date, and keep the evidence.
Table of Contents
What an audit or site survey actually checks
The two words are often used loosely, so it helps to separate them.
A site survey is the physical part of a Legionella risk assessment. The assessor inspects the water systems, notes how water is stored, heated, distributed and used, and records what could let bacteria grow. HSE’s technical guidance says the practical risk assessment should include a site survey of all water systems, looking at whether water is stored or recirculated, whether temperatures may sit between 20 and 45°C, and whether deposits could support bacterial growth.
An audit is wider. HSE describes a Legionella audit as checking the risk-assessment process and control arrangements through physical inspection, a review of procedures and paperwork, and discussion with the people responsible for the control regime. In other words, an auditor is asking two questions: is the system safe, and can you prove you have been managing it?
That second question is why preparation matters. A well-run system with no records looks the same on paper as a neglected one.
Know your system before anyone arrives
The assessor can only judge what they can see and understand. The more of the picture you hand over at the start, the less time they spend hunting and the fewer assumptions they have to make.
An up-to-date schematic
HSE’s approved code of practice says a survey of a complex site should come with an up-to-date schematic showing the system layout, including parts that are temporarily out of use. It should help someone unfamiliar with the system understand where components sit and how they connect.
Test yours with a simple exercise: hand it to a colleague who has never visited the plant room and ask them to trace the route from the incoming main to the furthest shower. If they cannot, neither can an assessor. If the drawing is out of date because of refurbishments, extensions or removed fittings, correct it first.
An asset register
The same guidance says to include an asset register covering associated plant, pumps, strainers and other relevant items. In practice, list:
cold water storage tanks and their locations
calorifiers, water heaters and boilers
pumps, strainers and expansion vessels
thermostatic mixing valves (TMVs) and their service dates
showers, spray taps and any other outlets that produce aerosols
any specialist equipment such as hydrotherapy pools, dental unit water lines, humidifiers or closed heating and chilled circuits
HSE also says to understand the water systems, associated equipment such as pumps, heat exchangers and showers, and their constituent parts. If you do not know what a tank feeds, say so at the start. That is a finding in itself, and a useful one.
Deadlegs and rarely used outlets
This is the area most often missed. HSE says to consider the system as a whole and to include deadlegs and intermittently used parts, because microbial growth there can go unnoticed and cause heavy contamination when the section is brought back into use.
Before the survey, walk the building and make a list of:
outlets that are used less than weekly (spare classrooms, guest rooms, disused showers, staff changing rooms)
pipework capped off after alterations
equipment taken out of service but still connected
areas that have been closed, mothballed or shared between tenants
Tell the assessor about each one. If you are unsure whether pipework is live, flag it rather than guessing.
The records an auditor will ask for
HSE’s technical guidance lists what dutyholder records should contain: the responsible people, significant findings, the written control scheme and how it is implemented, the operating status of the system, and dated results of monitoring, inspection, tests or checks, with any corrective actions. That translates into a folder (paper or digital) with the following.
Document | What it should show |
Current risk assessment | Date, assessor, system description, significant findings |
Written control scheme | How the system operates, shutdown procedures, maintenance frequencies, actions for abnormal results |
Appointment records | Who the competent person and responsible person are, and their training |
Temperature logs | Dated hot and cold readings at the points your scheme specifies |
Inspection records | Tanks, pipework, showerheads and taps, with dates and findings |
Sampling results | Laboratory reports where sampling forms part of your scheme |
Cleaning and disinfection | Certificates or reports for tanks, systems or outlets |
Maintenance records | TMV servicing, descaling, plant repairs, water-treatment chemical usage |
Corrective action log | Each defect, who owns it, when it was closed |
Training records | Staff and contractors who carry out checks |
The guidance recommends having monitoring results, chemical and microbial analyses, water-treatment chemical usage, maintenance records and cleaning and disinfection reports or certificates ready, and says training and external-contractor records may also help.
Check the written scheme says what you actually do
HSE says a written scheme should detail how the system operates, including shutdown procedures, maintenance frequencies, and remedial actions for breakdowns or abnormal results. A common audit failure is a scheme that promises monthly checks while the logbook shows gaps. Better to amend the scheme to something you can sustain, then follow it, than to leave a promise you are not keeping.
Close the gaps before the visit, not during it
Spend an hour scanning your logs for missing months, unsigned entries and readings outside the target range with no recorded follow-up. A reading outside range is not the problem; an unrecorded response to it is. If you cannot fill a gap truthfully, do not backfill it. Note it and explain it. Our guides on how to complete temperature monitoring checks and a temperature monitoring checklist show what a consistent routine looks like.
Retention
HSE’s code of practice says monitoring and inspection records should be kept for at least five years. If your archive was cleared sooner, expect questions.
People: who the auditor will want to talk to
Because an audit includes conversation, the people matter as much as the paperwork. HSE’s guidance says a dutyholder must appoint a competent person, and that where there are five or more employees the significant findings of the risk assessment must be recorded. The assessment should also set out management responsibilities, including the competent person’s name and the competence and training of key personnel.
Before the visit:
Confirm who is the named responsible person and who deputises.
Make sure whoever takes the readings can explain what they measure, where, how often, and what they do if a reading fails.
Have the person who knows the building’s history (alterations, closed wings, tenant changes) available for the walk-round.
Confirm contractors who carry out disinfection, TMV servicing or sampling can provide their paperwork.
If your team has not had recent instruction, Legionella awareness training before an audit is time well spent. Staff who understand why they take a reading answer questions better than those following a sheet.
What the survey will actually inspect
Expect the assessor to follow the water from the point it enters the building to the point it leaves a tap or shower. HSE’s guidance on identifying and assessing sources of risk points to the water systems, the equipment connected to them and their component parts, so a walk-round typically covers:
Incoming mains and storage: cold water tanks (condition of lids, vents, screens, internal cleanliness, temperature), plus any evidence of debris or sediment.
Hot water generation: calorifiers, boilers and heaters, including flow and return temperatures.
Distribution pipework: insulation, routing near heat sources, deadlegs, and sections no longer in use.
Outlets: taps, showers, showerheads and hoses, checked for scale, biofilm and infrequent use.
Controls: thermostatic mixing valves and their servicing history.
Specialist systems: cooling towers, spa or hydrotherapy pools, humidifiers, and closed heating or chilled circuits where relevant.
Documentation on site: logbooks, signage, outlet labelling and the schematic compared with what is physically there.
For healthcare settings, the Care Quality Commission expects providers to show evidence of temperature checks at outlets, water sampling where required, visual inspection of tanks and pipework, and showerhead and tap descaling schedules. Settings that look after vulnerable people should also consider the wider context in our piece on Legionella risk management for immunocompromised patients. Healthcare sites should also consider what happens when water is interrupted, and an emergency water supply plan sits comfortably alongside your written scheme as part of surveyor-ready documentation.
Offices and shared buildings have their own quirks, such as tenant turnover and underused floors, which we cover in Legionella compliance for offices and commercial premises.
Arranging access and safe working
A survey fails quietly when the assessor cannot get to the tank. Arrange these in advance:
Keys and codes for plant rooms, roof hatches, risers and locked classrooms or clinical rooms.
Ladders and fixed access that are safe and inspected. Do not expect an assessor to improvise.
Permits to work where required. HSE says the practical risk assessment should consider health and safety aspects of investigations, such as working at height, confined spaces and permits-to-work.
A site contact who can open doors, answer questions and tell occupants what is happening.
Occupant notice for rooms that need entry, such as bedrooms, treatment rooms or staff areas.
Site rules and inductions, including any infection-control or safeguarding requirements.
HSE’s guidance effectively treats this as two jobs at once: giving the assessor enough knowledge and records to produce a meaningful assessment, while controlling the risks the investigation itself creates. If a tank lid is bolted down or a roof hatch is painted shut, say so early. A rescheduled visit costs more than a phone call.
A week-before checklist
Use this as a working list.
Seven days out
Confirm date, time and assessor with your contractor.
Pull the last risk assessment and check its action list.
Update the schematic and asset register.
Three days out
Review logbooks for gaps and unrecorded follow-up.
Identify deadlegs, unused outlets and closed areas.
Arrange access and permits.
The day before
Brief the site contact and relevant staff.
Put records in one place, in date order.
Check that outlets in rarely used rooms can be reached.
On the day
Walk the assessor round, volunteering what you know is imperfect.
Ask questions as you go; note any immediate safety concerns.
Agree when to expect the report.
A note on honesty with your assessor
The biggest preparation mistake is tidying the problem away. An assessor who finds a deadleg you did not mention will question what else is missing. One you were told about, with a note of when it was last flushed, is simply a task.
Perspective: what we see on the ground
We work with schools, surgeries, housing providers, hotels and facilities teams across the UK, and the pattern is consistent: the sites that cope best with an audit are not the ones with the thickest folders, but the ones where the folder matches reality. A schematic that reflects the last refurbishment, a logbook that is filled in by the same people week after week, and a named person who can explain the routine will beat a glossy file nobody uses.
Our approach is to make compliance simple. That means bespoke arrangements for each site, clear documentation and knowledge passed to your team, so the next audit holds no surprises. If you can answer three questions without hunting (what is in the system, who checks it, and what happens when a reading fails), you are most of the way there.
— Sammi
After the survey: managing findings
The report is where the real work starts. HSE’s code of practice says the assessment’s findings should be recorded and acted on, and a sensible handling routine looks like this:
Log every finding with its risk rating and the corrective action required.
Assign an owner and a target date to each action.
Prioritise urgent risks. Temperature failures, heavily scaled outlets or unmanaged systems usually need quick action.
Record why any action is delayed or not carried out, so the decision is traceable.
Keep evidence of completion, such as invoices, certificates, photographs and updated readings.
Verify the control works by following up with monitoring or sampling, not just a sign-off.
Update the written scheme if the findings change how the system is run.
HSE’s technical guidance also says a risk assessment should be reviewed regularly and whenever there is reason to suspect it is no longer valid, for example after a change to the water system, its use or the building’s use. Our article on reviewing a Legionella risk assessment walks through the triggers, and four checks facilities managers can assign today gives you tasks to start on straight away.
If the survey flags remedial work such as tank cleaning, disinfection, TMV servicing or repairs, you will want it done and documented promptly. The paper trail from “defect found” to “defect closed” is exactly what an auditor looks for next time.
Independent re-inspection
UKAS guidance for accredited assessors says periodic, independent re-inspections can provide unbiased checks on the accuracy of original risk-assessment findings, and that the quality of third-party records should be evaluated. If you manage many sites, or you simply want assurance that an earlier assessment was sound, a second pair of eyes is a reasonable step.
How we can help
We can carry out your Legionella risk assessment, from £185, and tailor the survey to your site, with a clear report and an action list you can work through. If your scheme includes sampling, our Legionella water testing and analysis starts from £55 per sample. For ongoing readings without manual rounds, we also offer automated water temperature monitoring. Our method of works explains how we approach a site.
FAQ
How long before an audit should I start preparing?
Give yourself at least a week for a single building, longer for multi-site portfolios or if you suspect your records have gaps. Updating a schematic and tracing deadlegs takes more time than gathering logbooks. Starting early also leaves room to fix simple defects before the assessor arrives.
What is the first step in a Legionella risk assessment?
The first step is understanding your water systems: what they are, how they work and how they are used. HSE says the practical assessment should include a site survey of all water systems. Everything else, such as temperatures, deposits and records, builds on that.
What if my records are incomplete?
Present what you have and be open about the gaps. Do not recreate readings that were never taken. Instead, restart the routine now, record the reason for the gap and ask your assessor to advise on any sampling or inspection that would reassure you about the period concerned.
Do I need to include unused outlets and closed rooms?
Yes. HSE says deadlegs and intermittently used parts should be included, because growth can go unnoticed and cause heavy contamination when they are brought back into use. Tell the assessor about every closed area, even if you plan to leave it untouched.
Sources
Recommended
Comments