Legionella Audit vs Risk Assessment: What's the Difference?
A legionella risk assessment and a legionella audit are not the same thing. The risk assessment is the legal starting point: a competent person examines your water systems, identifies where legionella could grow and sets out what must be done. An audit comes later. It checks whether the risk assessment is good enough, and whether your site is doing what it says. You need the first by law. The second is how you find out whether the first is working.
This guide explains the difference in plain terms, shows where each one fits in a compliance programme and helps you decide which your site needs now.
TL;DR
A risk assessment is a legal requirement for employers and those in control of premises. It identifies hazards in your water systems and tells you what to control.
An audit is a check on the whole management system: the risk assessment itself, the control scheme, the records and the people carrying out the tasks.
Water testing is a third, separate thing. It is a snapshot of bacteria at one moment, and it does not replace either.
If you have no current, suitable and sufficient risk assessment, start there. Audit once you have a programme to audit.
Our legionella risk assessments start from £185, and water sampling starts from £55 per sample.
Table of Contents
Why the two terms get confused
Both jobs involve a visit, a report and a list of findings. Both are done by someone who understands water systems. Both end up in the same file. So it is easy to assume one is just a more thorough version of the other.
They answer different questions:
Risk assessment: where could legionella grow in our systems, who could be exposed, and what should we do about it?
Audit: are we actually doing what we decided to do, and is the paperwork behind it sound?
There is a third mix-up that causes real trouble. Many people treat a risk assessment as a test. It is not. A risk assessment is a survey and diagnostic exercise. Water testing is laboratory validation of whether bacteria are present at a particular moment. A clean lab result does not remove your duty to hold a suitable and sufficient risk assessment.
What a legionella risk assessment is
Under health and safety law, employers and people in control of premises must assess the risk of exposure to legionella. The Health and Safety Executive explains that carrying out the assessment is your responsibility. You may be competent to do it yourself, but if not, you should call on a competent person, either within your organisation or from outside. The general duty to make a suitable and sufficient assessment of risks sits in regulation 3 of the Management of Health and Safety at Work Regulations 1999.
The detailed guidance sits in the HSE’s Approved Code of Practice and guidance, L8. It covers identifying and assessing sources of risk, preparing a scheme to prevent or control the risk, implementing and monitoring precautions, keeping records and appointing a person responsible for management.
What the assessor looks at
A proper site assessment is hands-on. Typically it covers:
The layout and construction of hot and cold water systems, including tanks, calorifiers, pipework and dead legs
Outlets such as taps, showers and any equipment that creates a spray
Water temperatures at key points
Areas of low use where water can stagnate
Who uses the building, including anyone more vulnerable to infection
Existing control measures, cleaning schedules and records
The output is a written report with a risk rating for each system or asset, and prioritised actions. It should also set out a written scheme for controlling risk, which is the operating plan your site follows day to day.
It can conclude that risk is low
A risk assessment does not always lead to heavy work. The HSE’s position is that if the assessment shows the risks are insignificant and properly managed, the assessment is complete and no further action is needed beyond regular review. That is why a small, simple site can have a short, inexpensive assessment.
It is not a one-off
The assessment must be kept under review. The HSE says it should be reviewed regularly, and sooner if there is reason to believe it is no longer valid. Typical triggers are changes to the water system, a change in how the building is used, changes in key personnel or new information about the risk. We cover this in more detail in our guide to reviewing a legionella risk assessment.
What a legionella audit is
An audit is a structured check of how well your arrangements work in practice. It does not start from a blank page. It starts from your existing risk assessment, control scheme and records, and asks whether they meet the standard and whether the site follows them.
The HSE publishes checklists for the responsible person to audit their arrangements for controlling legionella. These work by auditing the risk assessment process as well as the practical precautions. That tells you something useful about the scope: an audit examines the assessment as one of the things under review, not as the thing it replaces.
What an audit typically tests
Area | Audit question |
The risk assessment | Is it current, complete and specific to this site? Does it reflect the systems that really exist? |
Roles | Is there a named responsible person, appointed in writing, with the training and authority to act? |
Control scheme | Are the written monitoring tasks, such as temperature checks and flushing, clear and realistic? |
Records | Are logbooks complete, signed and up to date? Are gaps explained? |
Actions | Have the actions from the last assessment been completed, and when? |
Competence | Do the people doing the tasks know what they are doing and why? |
Change | Has anything changed in the building that the assessment does not reflect? |
The HSE’s own inspection approach points the same way. Its guidance to inspectors lists the legionella risk management system they should examine, starting with the identification of a competent person and the assessment of risk. If a regulator would look at those things, it makes sense to check them yourself first.
Who should carry out an audit
Independence matters. The most useful audits are done by someone who did not write the risk assessment and does not carry out the day-to-day monitoring. People rarely spot the weaknesses in their own work. For larger organisations, that might be an internal compliance team from another site or an outside specialist. For a single site, it is often simply a competent consultant who reviews the whole system with fresh eyes.
Audit vs risk assessment: side by side
Risk assessment | Audit | |
Purpose | Identify and evaluate sources of risk and set out controls | Check that the arrangements and the assessment itself are sound and followed |
Legal standing | A legal duty for employers and those in control of premises | Good practice and a sensible way to demonstrate you manage the risk |
When | Before you have a programme, then reviewed regularly or when things change | Once a programme is running, then at intervals you set |
Looks at | The water systems, outlets, temperatures, users | The management system: paperwork, people, actions, records |
Output | Risk ratings, actions, written scheme | Findings on gaps, non-conformities and improvements |
Needs a site visit | Yes, always | Usually, to compare paperwork with reality |
The central point: you cannot audit what does not exist. If you have no risk assessment, an audit would simply tell you that. Get the assessment first.
And where does water testing fit?
Testing sits beside both. Sampling gives a laboratory result for the water at the time it was taken. It can support a risk assessment, for example by confirming a suspected problem, and it can support an audit by showing whether controls are holding. It does not stand in for either.
The point of a risk assessment is to decide, on the evidence, whether and how often sampling is needed. Sampling at random without an assessment tells you little about why a result came out as it did.
We provide legionella water testing and analysis from £55 per sample, including potable water, microbiological, Pseudomonas aeruginosa, TVC and closed system testing.
Which one do you need?
Use these situations as a guide.
You have no risk assessment, or you cannot find it
You need a risk assessment. This is the legal baseline, and everything else depends on it.
Your assessment is old, or the building has changed
You need a review of the risk assessment, which may become a fresh assessment if the changes are substantial. Examples include new plumbing, a refurbishment, a change from occasional to full occupancy, or a new responsible person. Our guide to reviewing a legionella risk assessment explains how to judge this.
You have an assessment and a logbook, but you are not sure either is working
This is the audit case. Typical signs include temperature records with gaps, actions from the last report that nobody can show were closed, or staff who change every few months without handover.
You manage many sites
An audit programme across several buildings is a practical way to compare standards, find the weakest sites and prioritise spending. The risk assessments give you the site-level detail, and the audit shows you the pattern.
You are in a healthcare setting
The HSE expects health and social care providers to carry out a full COSHH risk assessment of their hot and cold water systems. Patients are more vulnerable, so regular independent checks of how the system is managed are especially worthwhile.
Someone has asked for an audit
Insurers, landlords, funders and parent organisations sometimes ask for an “audit” when what they really want is proof of a current risk assessment. Ask what they need before you commission anything. If the request is for evidence of compliance, a suitable and sufficient assessment with a working logbook may be the answer.
The responsible person sits at the centre of both
The HSE’s guidance expects a competent person to be appointed to manage the risk, often called the responsible person. If that role is vague, both the risk assessment and the audit will expose it quickly. Our explainer on the responsible person for legionella sets out what duty holders must do, and our overview of HSE legionella regulations for facilities managers puts the wider framework in context.
Our perspective
We spend much of our time on the gap between a report that exists and a system that works. Most of the sites we meet do not have a legionella problem on paper. They have a follow-through problem: an assessment sitting in a drawer, a logbook with a three-month hole in it, and a handover that never happened.
That is why we resist the idea that an audit is a premium version of a risk assessment. They do different jobs. A good assessment should be specific to your site, written so the people who run the building can use it, and linked to a logbook they can actually keep up. If it is, a later audit becomes straightforward and low-stress. If it is not, an audit mostly confirms what you already suspect.
Our approach is to make compliance simple. That means bespoke documentation for each site, plain-language actions, training for the people doing the tasks and ongoing support so the programme does not decay after the first visit. We would rather you spend money on closing actions than on a thicker report.
One practical tip: when you read any assessment or audit report, ask of every finding, “who is doing this, by when, and where will it be recorded?” If the report cannot answer that, it is not finished.
— Sammi
How we can help
If you need to get the foundations right, our legionella risk assessments start from £185. We work with commercial premises, schools, colleges, healthcare and dental settings, housing associations, hotels and facilities teams across the UK, and we write each assessment around your site rather than a template.
If you already have a risk assessment and want help putting the control scheme into practice, we also offer legionella awareness training, remedial works and ongoing compliance support. For sites that want continuous temperature records rather than manual checks, there is automated water temperature monitoring. Prices for these are quoted per site.
A practical order of work
For most organisations, the sensible sequence looks like this:
Confirm who is responsible. Appoint a competent person in writing and make sure they have time and training.
Get a suitable and sufficient risk assessment for each site, carried out by a competent person.
Close the high-priority actions from the report, such as remedial works, cleaning or disinfection.
Set up the control scheme and logbook so routine checks are clear and recorded.
Sample where the assessment says it is needed, and keep the results with the records.
Review the assessment regularly and whenever the building, system or people change.
Audit the system at a frequency that suits your risk, using an independent person where you can.
The order matters. Each step gives the next one something to work from.
FAQ
Is a legionella audit a legal requirement?
The legal duty is to assess the risk and then manage it, including keeping the assessment under review. The HSE’s L8 guidance describes monitoring and review but an audit is how many organisations demonstrate they are doing that. If you are unsure how your obligations apply, ask a competent legionella consultant or your health and safety adviser.
Can an audit replace a risk assessment?
No. An audit checks the arrangements you already have, including the assessment. Without a suitable and sufficient risk assessment there is nothing sound to audit against, and your legal duty remains unmet.
Does a clean water test mean I do not need a risk assessment?
No. A test shows what was in the water when the sample was taken. A negative result does not exempt you from holding a suitable and sufficient risk assessment, and it says nothing about conditions that could allow bacteria to grow later.
How often should a risk assessment be reviewed?
The HSE says to review regularly and whenever there is reason to believe the assessment is no longer valid, for example after changes to the water system, how the building is used or who manages it. Many dutyholders set a fixed review date as well, so that the review does not depend on someone noticing a change.
How much does a legionella risk assessment cost?
It depends on the size and complexity of the site. Our assessments start from £185, and larger or multi-site work is quoted on a site basis. Contact us with the building type, number of systems and location for an accurate quote.
Sources
Recommended
Comments