How often should you review a Legionella risk assessment?
- 2 days ago
- 8 min read
UK law sets no fixed interval for reviewing a Legionella risk assessment. ACoP L8 requires you to review it “regularly” and immediately whenever there’s reason to believe it may no longer be valid. In practice, most stable, low-risk sites benchmark this at roughly every two years, but that figure is a planning guide, not a legal deadline, and any of six trigger events can override it overnight.
No statutory fixed interval exists under ACoP L8
Around two years is a common benchmark for stable, low-risk sites
Six trigger events (covered below) force an immediate review regardless of when the last one happened
Monitoring and sampling cycles run separately from the risk assessment review
The six triggers are: a system change, a change of building use, new information about risk, a failure of control measures, a change of key personnel, or a case of Legionnaires’ disease linked to the system. Miss one of these and the clock resets to zero, no matter how recent your last review was.
Key Takeaways
Legionella risk assessment frequency has no fixed legal number; it must be reviewed regularly and immediately after any of six defined trigger events.
Point | Details |
No statutory interval | ACoP L8 requires “regular” review plus review whenever the assessment may no longer be valid. |
Two-year benchmark, not a deadline | Stable, low-risk sites often use roughly two years, but this must be justified in writing. |
Six triggers override the clock | System change, use change, new risk information, control failure, personnel change, and linked disease cases all force review. |
Evidence beats a new date | Inspectors want updated schematics, logs, and signed notes, not a cosmetic date change. |
Professional support closes gaps | Bespoke Compliance Solutions carries out assessments, sampling, and control programme implementation across UK sites. |
Table of Contents
Legionella risk assessment frequency: what HSE guidance actually requires
The confusion around legionella risk assessment frequency mostly comes from an earlier version of ACoP L8 that did specify a two-year default. The fourth edition dropped that fixed figure deliberately, shifting the emphasis to ongoing, risk-based management rather than a calendar tick-box exercise.
Paragraph 25 of ACoP L8 states the assessment “should be reviewed regularly,” while paragraph 47 adds that it must also be reviewed “when there is reason to suspect it is no longer valid.” Neither paragraph names a number of months or years. The duty sits with you to judge what “regularly” means for your own system.
That’s deliberately open ended, and it puts the burden of justification on you as the dutyholder. HSE isn’t interested in whether you reviewed on a specific date; it wants to see that your chosen interval reflects the actual risk profile of the building.
HSG274 Part 2 fills in the operational detail that ACoP L8 leaves out. It sets inspection and monitoring frequencies based on system complexity, fouling potential, and how the water is used, and it provides checklists you can lift directly into your own inspection regime:
Simple, low-risk domestic systems may need only annual checks of key controls
Complex or higher-risk systems (large calorifiers, extensive pipework, multiple outlets) often need more frequent checks
Sentinel points and representative outlets should be defined and checked on a schedule the assessment itself sets
INDG458 then tells you what the finished document has to contain: a description of the system, an assessment of risk, the control scheme, and crucially, a recorded review date. HSE treats the assessment as a living document, not a one off report filed away and forgotten.
Six trigger events that force an immediate review
Waiting for a calendar date to pass while one of these happens is the single most common way dutyholders fall foul of an HSE inspection. Each trigger demands not just a new review, but a specific documentary update.
System change (new pipework, a replaced tank, added outlets): update the schematic and reassess affected sections.
Change of building use (offices converting to residential, a wing mothballed then reopened): reassess usage patterns and dead-leg risk.
New information about risk (a manufacturer alert, revised HSE guidance): note the source and its impact on your control scheme.
Failure of control measures (a temperature check outside range, a failed disinfection): append the monitoring result and record remedial action taken.
Change of key personnel (a new responsible person or duty holder): formally hand over records and confirm the new person understands the scheme.
A case of Legionnaires’ disease linked to the system: commission an urgent reassessment and preserve all monitoring evidence.
Not every failed monitoring check is a full trigger. A single out-of-range reading that’s corrected and explained might just need a logged note. A pattern of failures, or one that points to a genuine control breakdown, is what escalates into trigger four.
Pro Tip: Keep a one-page “trigger log” alongside your main assessment. Every time something on this list happens, date it and note what was updated. That log becomes your best evidence in front of an inspector.
Typical review intervals by property type
Legionella assessment schedules should reflect the actual risk sitting inside the building, not a generic industry habit. HSG274 gives the framework for setting those frequencies, but here’s how it tends to play out across common UK settings.
Domestic rented properties: low complexity, low occupancy turnover. Most landlords review roughly every two years, more often if the property has sat empty for a stretch.
Offices: similar to domestic lets in complexity, but occupancy and system use change more often. Two years is a reasonable working benchmark, tightened after any refurbishment.
Care homes and healthcare settings: vulnerable occupants push the risk category up significantly. These sites typically need ongoing review with monthly or quarterly oversight checks, not just a periodic full reassessment.
Cooling towers and other open systems: the highest-risk category. HSG274 recommends frequent review, with sampling at least quarterly and more often where fouling or biofilm risk is high.
None of these numbers are legal deadlines. What actually matters is that your assessment states the interval you’ve chosen and why. A void period, a refurbishment, or a wave of tenant turnover should all shorten the gap between reviews, even mid-cycle. A flat that’s stood empty for three months, then let again, carries different risk to one continuously occupied, and your paperwork should say so.
Recording reviews so you can prove they happened
An inspector reading your file wants to see evidence a review actually changed something, or a clear reason why it didn’t. A cosmetic date swap on the cover page won’t hold up.
A defensible record typically includes:
An updated system schematic showing any changes since the last review
The named responsible person who carried out or commissioned the review
Monitoring and sampling logs covering the period since the previous assessment
Signed minutes or notes from the review itself, even if brief
A revised written control scheme where anything has changed
A few hundred confirmed cases of Legionnaires’ disease are reported in England and Wales each year, a figure that has stayed broadly stable, which is exactly why HSE keeps pressing dutyholders on genuine, evidenced review rather than paperwork for its own sake.
Retain records for a minimum of five years, longer for healthcare or high-risk sites where litigation timeframes stretch further back. A competent person in-house can often handle straightforward reviews on simple systems. Once you’re dealing with cooling towers, multiple buildings, or a system that’s failed checks, bringing in an external competent person like Bespoke Compliance Solutions stops gaps in expertise becoming gaps in compliance.
What to do immediately after a trigger event
The sequence matters as much as the speed. Skip a step and you risk leaving a control gap that looks worse on paper than the original fault.
Contain the immediate risk first: increase flushing on affected outlets, isolate a failed calorifier, or apply interim temperature controls.
Commission an updated risk assessment or bring in a competent person for targeted checks and sampling on the affected part of the system.
Update the written control scheme to reflect what’s changed, and notify anyone with a stake in the building, tenants, facilities staff, or the landlord.
Record every action taken with dates, and set an expedited review date rather than waiting for the next scheduled cycle.
Pro Tip: Don’t let the “interim” controls become the permanent fix. Diarise a follow-up check within four to six weeks to confirm the interim measures actually resolved the underlying problem, and file that confirmation with the rest of your evidence.
Governance habits that keep an assessment genuinely current
Treating the risk assessment as a filing cabinet document is where most dutyholders come unstuck. It works better as a standing item on a Water Safety Group agenda, reviewed alongside monitoring data rather than in isolation once every couple of years.
Quarterly cross-checks against your sentinel point list catch drift long before it becomes a trigger event. Handover procedures matter just as much: when a responsible person leaves, a rushed five-minute briefing isn’t a handover, it’s a liability waiting to surface at the next inspection. Bespoke Compliance Solutions has seen the difference this makes across sites we support in Coventry and the wider region, where clients who build review into routine governance rarely face a scramble when HSE comes calling.
How Bespoke Compliance Solutions supports your review cycle
Getting the frequency right is only half the job. The other half is having someone competent actually carry out the review, interpret the results, and update your control scheme when something’s changed. Bespoke Compliance Solutions provides bespoke Legionella risk assessments, water sampling and analysis, disinfection and remedial works, Legionella awareness training, and ongoing consultancy for sites across the UK.
[
Engage a professional when your system is complex, when you’ve just hit one of the six triggers, or when nobody on site holds the competence to judge whether “regularly” is being met. We work across commercial, healthcare, housing association, and retail sites, building a control programme and logbook system that stands up to scrutiny rather than just looking tidy on the surface. If your last review is more than two years old, or a trigger event has just happened, get in touch about Legionella compliance for offices and commercial premises and we’ll assess what your site actually needs next.
Sources
Legionnaires’ disease: The control of legionella bacteria in water systems. Approved Code of Practice and guidance on regulations L8
FAQ
Is a Legionella risk assessment a legal requirement?
Yes. Employers, landlords, and dutyholders must assess and control Legionella risk, and ACoP L8 sets out how.
Should a risk assessment be reviewed every two years?
Two years is a common practical benchmark for stable, low-risk sites, but ACoP L8 sets no fixed statutory interval. Higher-risk systems, or any trigger event, require review sooner.
How long is a Legionella risk assessment valid?
It stays valid only until circumstances change or new risk information emerges; there’s no automatic expiry date, which is why ACoP L8 frames it as a living document rather than a certificate.
How many Legionella cases are reported per year in the UK?
A few hundred confirmed cases of Legionnaires’ disease are reported in England and Wales each year, a figure that has stayed broadly stable and underpins HSE’s continued focus on genuine, evidenced reviews.
Recommended
Comments