Responsible person legionella: what duty holders must do
- 11 minutes ago
- 11 min read
The responsible person for legionella is the competent individual the duty holder appoints to run day-to-day control of a building’s water systems. Under the Health and Safety at Work etc Act 1974 and COSHH 2002, the duty holder must appoint that person and get a written control scheme in place before anything else matters.
Everything else follows from those two moves. Skip either one and no amount of good intentions on temperature checks will hold up during an inspection.
Do this today, in order:
Appoint a named responsible person in writing, with a clear description of scope and authority.
Document the appointment inside the written control scheme, alongside the current risk assessment.
Start monitoring immediately if it isn’t already happening, even a basic temperature log while the fuller scheme is built out.
Pro Tip: If you’re not sure whether your current arrangement counts as a formal appointment, ask this: could you produce a signed document naming the responsible person within five minutes of an inspector asking? If not, it isn’t documented, it’s just understood, and understood doesn’t count.
Key Takeaways
The duty holder must appoint a competent responsible person and maintain a written control scheme, and legal liability for both never transfers away, even when a contractor does the daily work.
Point | Details |
Appoint in writing | Name the responsible person and any deputies with clear scope and authority, signed by the duty holder. |
Document the control scheme | Keep the written control scheme and risk assessment current, referencing ACOP L8 and HSG274. |
Monitor without gaps | Run daily, weekly and monthly checks on a shared calendar so cover continues during absences. |
Vet contractors properly | Check competence, insurance, references and LCA membership before appointing external support. |
Get coordinated support | Bespoke Compliance Solutions handles risk assessments, testing, training and logbooks as one service. |
Table of Contents
What the law and HSE guidance require for legionella management
Four pieces of legislation and guidance sit behind every legionella compliance decision you make: the Health and Safety at Work etc Act 1974, the Control of Substances Hazardous to Health Regulations 2002 (COSHH), the Management of Health and Safety at Work Regulations (MHSWR), and the Approved Code of Practice, ACOP L8. HSG274 sits alongside ACOP L8 as the detailed technical guidance that tells you how to actually meet the code’s requirements across cooling towers, hot and cold water systems, and other installations.
In practice, this framework translates into three obligations that never go away:
Carry out and keep updated a legionella risk assessment covering every relevant water system on site.
Maintain a written control scheme describing how the risk is managed, monitored and reviewed.
Keep records of monitoring, sampling, and any corrective action taken.
The duty holder must identify and assess legionella risk, prepare a written control scheme, and appoint a competent person to take day-to-day responsibility, but the legal duty to make sure this happens properly never transfers away from the duty holder, even once someone else is doing the daily work.
That last point catches people out constantly. Appointing a responsible person, whether an employee or an external contractor, does not hand over legal liability. HSE’s own guidance is explicit that the dutyholder retains ultimate accountability for making sure the appointed person is actually competent and actually doing the job. If you’re a facilities manager who has delegated legionella control to a site engineer, you are still the one who needs to be able to prove that engineer knows what they’re doing.
Who can be the responsible person for legionella?
Competence for a legionella responsible person scales with the complexity of the water system, not with job title. A small office with a single hot water cylinder and a handful of outlets needs someone who understands basic temperature control and can recognise warning signs. A hospital with cooling towers, multiple risk zones and vulnerable patients needs someone with far deeper technical knowledge and, usually, dedicated time allocated to the role.
ACOP L8 sets out that the appointed person should have sufficient authority and knowledge of the installation to make sure operational procedures happen effectively and on time. Authority matters as much as knowledge here. A responsible person who spots a fault but has no power to commission remedial work or halt an unsafe system is not fulfilling the role, whatever their technical grasp of the subject.
Competence generally rests on four things:
Working knowledge of the specific water system on site, not generic legionella theory.
Formal training, refreshed periodically rather than a single certificate filed away years ago.
Practical experience with the site type, ideally supervised before working solo.
Delegated authority to act, including the power to stop unsafe operation or approve corrective spend.
Job titles vary widely across sectors. In a small commercial office, the role often sits with a facilities coordinator or office manager. In a larger commercial building, it’s typically a dedicated facilities manager or building services engineer. In healthcare settings, it’s usually a named estates or water safety officer, sometimes supported by a water safety group. None of these titles are prescribed by law. What matters is the substance of the appointment, not the label on the business card.
Deputies matter more than most duty holders realise. Where shift patterns, holidays or sickness could leave a gap, you need at least one named deputy with the same clarity of authority as the primary responsible person. Handovers should be documented, not verbal, so that monitoring never quietly lapses when the usual person is off.
Pro Tip: Write competence requirements against the system, not the person. If your current responsible person left tomorrow, could you hand a new starter a document that tells them exactly what “competent” looks like for your site? If the answer is no, you don’t have a competence standard, you have a personality dependency.
Core duties: what the responsible person actually does day to day
The legionella responsible person’s job breaks down into a rhythm of checks, most of which are quick but none of which can lapse. HSG274 makes clear that monitoring system performance, inspecting accessible parts of the system, and confirming the treatment regime is working all sit with the responsible person, whether they do the work themselves or oversee a contractor doing it.
An operational rhythm typically looks like this:
Daily — visual checks on obvious signs of system failure where relevant, particularly on higher-risk systems such as cooling towers.
Weekly — temperature checks at sentinel taps, calendar-flagged so they can’t be quietly skipped.
Monthly — checks on little-used outlets, shower heads and hoses that can harbour stagnant water.
Quarterly to annual — descaling, dosing checks, tank inspections and calibration of monitoring equipment, timed to manufacturer and risk assessment guidance.
Sampling frequency depends on the system rather than a fixed calendar date; HSG274’s technical guidance treats microbiological sampling as part of the wider treatment regime rather than a box-ticking exercise done once a year regardless of risk. A temperature monitoring checklist built around your specific outlets makes this far easier to keep consistent across a team.
Frequency | Typical check | Why it matters |
Daily | Visual inspection of high-risk systems | Catches obvious faults before they become failures |
Weekly | Sentinel tap temperatures | Confirms hot water stays hot and cold stays cold |
Monthly | Little-used outlets flushed and checked | Prevents stagnation in low-flow areas |
Quarterly/Annual | Descaling, dosing checks, calibration | Keeps control measures working as designed |
The logbook is where all of this becomes evidence rather than just activity. It should contain the current risk assessment, the written control scheme, every monitoring result, records of corrective action taken when a check fails, and training records for everyone involved, including refreshers. A robust logbook genuinely is the difference between an inspection that takes twenty minutes and one that drags on for a day.
Pro Tip: If a temperature check fails, the worst thing you can do is note it and move on. Isolate the affected outlet if practical, flag it for immediate remedial attention, and record what you did and when. An unexplained failed check sitting in a logbook with no follow-up looks worse to an inspector than no logbook at all.
How to appoint and document the responsible person
A defensible appointment is short, specific, and signed. It doesn’t need to run to pages. It needs to answer six questions clearly enough that anyone reading it, including an inspector, understands exactly who is accountable for what.
A workable appointment record includes:
Full name and job title of the responsible person.
Scope of responsibility, naming the specific sites or systems covered.
Delegated authorities, including spend limits and the power to halt unsafe operation.
Start date of the appointment.
Named deputy or deputies, with the same scope clearly stated.
Sign-off from the duty holder confirming the appointment.
Once that’s written, the harder part is keeping the paper trail alive. Retain records like this:
Risk assessments, along with every review, for as long as the system is in use plus a reasonable margin afterwards.
The written control scheme, updated whenever the system or its management changes.
Training logs, showing both initial and refresher training.
Contractor competence checks, kept alongside any contracts or service agreements.
Monitoring and sampling results, retained for at least five years as a working minimum, longer for healthcare or higher-risk sites.
Version control trips up more sites than people expect. A physical logbook works fine for a small single-site operation, but for anyone managing several properties, a secure digital system prevents the classic problem of three different versions of the same risk assessment floating around different inboxes. Reviewing your existing legionella risk assessment on a set schedule, rather than only after an incident, keeps the whole document set current.
When to bring in external help and how to vet it
External competence usually makes sense in three scenarios: the water system is genuinely complex, such as cooling towers or extensive healthcare pipework; there’s no realistic in-house capacity to build and maintain the expertise; or the site sits in a sector, like healthcare, where the consequences of getting it wrong are severe enough that specialist oversight is the sensible default.
Before appointing a contractor, ask direct questions rather than accepting a glossy brochure:
Can they show evidence of relevant competence and training for your specific system type?
Do they carry appropriate insurance for the scope of work?
Can they provide references from comparable sites?
Are they a member of a recognised industry scheme, such as the Legionella Control Association?
What does their standard reporting format look like, and does it integrate with your logbook?
Bringing in a contractor doesn’t dilute your responsibility. HSE guidance is clear that duty holders must be able to demonstrate they selected a competent contractor and retained genuine oversight, not just handed over the keys. Practical oversight looks like contract terms with defined KPIs, periodic site audits, and the contractor’s role written explicitly into the control scheme rather than sitting in a separate, disconnected contract folder. For sites weighing up broader employer obligations alongside legionella specifically, it’s worth understanding duty of care as a wider employer concept too, since the two overlap more than people expect.
Common gaps we see on site, and quick fixes
Across sites we’ve reviewed, the pattern is remarkably consistent: risk assessments are usually solid, but the daily discipline around them slips. That’s the gap worth closing first.
The most frequent failures, and what fixes them fast:
No documented deputy. Fix: name one today, in writing, with the same authority as the primary responsible person.
Incomplete logbooks with gaps around holidays or staff changes. Fix: build a simple handover template that gets completed every time responsibility shifts, even temporarily.
Missed monitoring during busy periods. Fix: put monitoring on a shared calendar with automated reminders rather than relying on memory.
Responsible person lacks authority to commission corrective works. Fix: agree and document a spend threshold they can approve without further sign-off.
Many enforcement issues trace back to exactly these simple, avoidable gaps: a missing named responsible person, an incomplete control scheme, or monitoring records with unexplained holes.
Pro Tip: Institutional knowledge walks out the door with staff turnover more often than any other compliance failure we see. A simple digital log that survives staff changes, rather than knowledge kept in one person’s head, is one of the cheapest risk reductions available to any site.
What inspectors check, and what happens if you fail
An HSE inspection or a local authority environmental health visit tends to follow a predictable sequence. Inspectors typically ask to see a named responsible person, the written control scheme, monitoring and sampling records, and evidence of corrective action where checks have failed.
Where those gaps show up, enforcement can range from an improvement notice giving you a set period to fix specific failings, through to prosecution in more serious cases, particularly where an outbreak has occurred or risk was left unmanaged despite known warning signs. Beyond the legal exposure, there’s genuine reputational damage, and in the worst cases, real risk to health, which is ultimately the entire reason this framework exists.
The single most effective way to reduce enforcement risk is early, documented rectification. An inspector who finds a failed check followed by a clear, dated record of what was done about it sees a functioning system. An inspector who finds a failed check with no follow-up sees a system that only exists on paper.
What patterns look like across real sites
Across the sites we’ve worked with, the same story tends to repeat: a thorough, professionally written risk assessment sits in a folder, while the day-to-day monitoring that’s supposed to flow from it has quietly drifted. Temperature checks get done when someone remembers, sampling gets pushed back a month, and nobody’s quite sure who’s covering it while the usual person is on leave.
The single change that improves most sites fastest is ridiculously simple: put every recurring check on a shared calendar with a named owner, and review completion weekly rather than monthly. It sounds too basic to matter, and that’s exactly why most sites skip it.
How Bespoke Compliance Solutions supports your responsible person
Bespoke Compliance Solutions is the practical alternative to piecing compliance together yourself across multiple contractors and spreadsheets. Where many duty holders end up juggling a risk assessor, a separate testing lab, and a training provider, we handle legionella risk assessments, water sampling and analysis, awareness training, and logbook implementation as one coordinated service, so your responsible person has one point of contact rather than three.
[
If your current arrangement leans on a verbal understanding rather than a documented one, that’s the first thing worth fixing. Our legionella compliance service for offices and commercial premises covers exactly the appointment, documentation and monitoring gaps this guide has walked through, and our logbook system gives your responsible person a structure that survives staff changes rather than living in someone’s head. If your site sits in a specific sector with its own risk profile, our sector-specific legionella control services address that directly. Book a site review and we’ll tell you plainly where your current setup stands and what, if anything, needs fixing first.
Sources
Your written control scheme carries more weight with inspectors when it references the actual guidance behind it, not a paraphrase.
Legionnaires’ disease: The control of legionella bacteria in water systems (L8)
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
Who is responsible for legionella checks at my workplace?
The duty holder, usually the employer or building owner, must appoint a competent responsible person to carry out day-to-day legionella checks, but the duty holder remains legally accountable throughout.
Whose responsibility is it to test for legionella?
Testing sits with the responsible person or a competent contractor they appoint, following a schedule set out in the written control scheme and based on the system’s specific risk profile.
What is the difference between a duty holder and a responsible person?
The duty holder is the legal entity, typically the employer, who holds ultimate accountability under HSWA 1974 and COSHH 2002; the responsible person is the competent individual the duty holder appoints to manage the practical, day-to-day control work.
Who manages the written legionella control scheme?
The responsible person typically manages and updates the written control scheme day to day, while the duty holder retains overall legal accountability for making sure it exists, stays current, and is actually being followed.
Recommended
Comments