Water hazard identification process: a compliance guide
- Jun 7
- 9 min read
A water hazard identification process is the systematic method of recognising, documenting, and evaluating all potential biological, chemical, physical, and radiological risks within a water system. Formally known within the World Health Organisation’s framework as the hazard identification and risk assessment component of a Water Safety Plan (WSP), this process is the foundational first step before any control measures can be designed or implemented. For facility managers and compliance officers, understanding this process is not optional. It is the mechanism that determines whether your Legionella management programme is built on evidence or assumption.
What is a water hazard identification process?
A water hazard identification process is, as the Australian Drinking Water Guidelines define it, the fundamental first step of a Water Safety Plan, involving systematic documentation of hazards and hazardous events across the entire water supply system. This means physically mapping every component of your water infrastructure, from cold water storage tanks and hot water calorifiers through to distribution pipework and end-point outlets, and then identifying every agent or event that could compromise water quality or safety.
The process matters because you cannot control what you have not identified. A facility that jumps straight to disinfection schedules without first completing a thorough hazard assessment is, in effect, treating symptoms without diagnosing the condition. The WHO WSP approach and UK guidance under the Health and Safety Executive’s Approved Code of Practice L8 both require this structured identification stage to precede any risk control programme.
Three named entities anchor this process in practice: the WHO Water Safety Plan framework, the Source-Pathway-Receptor (SPR) conceptual model, and the ACOP L8 guidance published by the HSE. Each provides a different lens through which hazards are viewed, but all converge on the same principle. Identify first, then assess, then act.
What are the key steps in a water hazard identification process?
The hazard identification process is typically structured into five sequential phases, each building on the last.
Initial site survey and physical audit. A qualified assessor walks the entire water system, producing accurate schematics of pipework, storage vessels, heat exchangers, and outlets. This is not a desk exercise. Dead legs, infrequently used outlets, and areas of stagnation are only visible on site.
Hazard and hazardous event identification. Every biological, chemical, physical, and radiological agent that could be present in the system is catalogued. Critically, hazardous events, meaning the operational failures or conditions that allow hazards to arise, are documented separately. This distinction is explored in detail in the next section.
Risk reporting and prioritisation. Each identified hazard is scored using a combination of likelihood and severity. The output is a prioritised risk register that directs attention and resources to the highest-consequence risks first.
Development of a Water Safety Plan. The risk register feeds directly into a WSP, which specifies control measures, monitoring frequencies, and responsible personnel for each identified risk.
Implementation, monitoring, and periodic review. Control measures are put in place and monitored against agreed parameters. The process requires periodic review and updates following infrastructure or usage changes, because a static document quickly becomes inaccurate.
Pro Tip: Engage a multidisciplinary team during site audits. Including engineers, maintenance staff, and water hygiene specialists in the same walkthrough surfaces risks that any single discipline would miss.
How does the Source-Pathway-Receptor model guide hazard identification?
The Source-Pathway-Receptor model is the analytical framework most widely used to structure water hazard assessments. It works by tracing the journey a hazard must take to cause harm, and it is this tracing that reveals where intervention is most effective.
The Source is the hazard itself: Legionella bacteria colonising a storage tank, for example, or a chemical contaminant entering through a cross-connection. The Pathway is the route by which the hazard reaches a person, such as aerosol generation from a shower head or recirculation through a cooling tower. The Receptor is the person at risk, with particular attention paid to vulnerable individuals in healthcare or residential care settings.
The SPR model requires identifying hazards and the specific contamination pathways to properly assess risks to water users. This matters because breaking any link in the chain, source, pathway, or receptor, reduces or eliminates the risk. A facility manager who identifies sediment buildup as a source but fails to map the pathway through which it reaches outlets has only half the picture needed to act.
The table below illustrates how the SPR model applies to common water system scenarios.
Hazard (source) | Pathway | Receptor |
Legionella bacteria in storage tank | Aerosol from showers or taps | Immunocompromised building occupants |
Disinfectant by-products | Distribution pipework to drinking outlets | General building users |
Sediment and scaling | Pipework to heat exchangers | Maintenance personnel and end users |
Cross-connection contamination | Backflow through pipework | All building occupants |
Using this framework in a semi-quantitative risk assessment allows you to assign numerical scores to both the probability of the pathway being active and the severity of harm to the receptor. This produces a defensible, auditable risk score for each hazard scenario.
What common water hazards must facility managers identify?
Hazard identification must cover all categories to produce a complete risk picture. The four main categories, with examples relevant to built environment water systems, are as follows.
Biological hazards are the most operationally significant for most facilities. Legionella pneumophila is the primary concern under UK legislation, but other microbial contaminants including Pseudomonas aeruginosa and coliforms are also relevant, particularly in healthcare settings. You can find a detailed breakdown of how these risks are assessed in the context of hospitals and care facilities in this healthcare water risk guide.
Chemical hazards include disinfectant by-products such as trihalomethanes formed when chlorine reacts with organic matter, as well as heavy metals like lead and copper that leach from ageing pipework. Both categories require water sampling and laboratory analysis to detect reliably.
Physical hazards cover sediment accumulation, corrosion products, and scaling within pipework and storage vessels. These are often visible during site surveys and are significant because they create the biofilm environments in which Legionella thrives.
Radiological hazards are less common in standard commercial or healthcare facilities but must be considered in certain industrial or laboratory water systems where radioactive materials are handled.
Beyond the hazard categories themselves, hazardous events such as equipment failure, prolonged low water turnover, or unexpected temperature drops are equally critical to document. These are the operational conditions that create the circumstances for hazards to proliferate.
Pro Tip: Schedule regular environmental checks and water temperature monitoring alongside your formal assessment cycles. Emerging hazards, such as a newly installed dead leg following a refurbishment, will not appear in last year’s documentation.
How is risk assessed and prioritised after hazards are identified?
Risk is defined as the product of likelihood and severity of consequences. Once hazards and hazardous events are catalogued, each one must be scored against both dimensions to determine where action is most urgent.
The qualitative scales used in water safety assessments typically run from “rare” to “almost certain” for likelihood, and from “insignificant” to “catastrophic” for severity. Combining these produces a risk rating that sits within a matrix, often colour-coded from green through to red. A water hygiene risk matrix translates these scores into clear, auditable priorities that compliance teams can act on directly.
The table below shows how a typical semi-quantitative scoring system works in practice.
Likelihood | Severity | Risk rating | Priority action |
Almost certain | Catastrophic | Extreme | Immediate intervention required |
Likely | Major | High | Urgent control measures needed |
Possible | Moderate | Medium | Scheduled monitoring and review |
Unlikely | Minor | Low | Routine management sufficient |
Prioritisation is not merely an administrative exercise. It determines where your budget, personnel, and monitoring effort are directed. A facility with limited resources that treats all hazards as equally urgent will spread its capacity too thin and miss the highest-consequence risks. The health and safety manager’s role in this prioritisation process is to translate risk scores into operational decisions and resource allocation.
What practical steps help facility managers implement hazard identification?
Effective implementation of a water hazard assessment process requires structure, the right people, and clear documentation. The following steps reflect best practice for facilities of any size.
Assemble a multidisciplinary team. Collaborative evaluation covering technical system design and operational management produces more complete hazard registers than any single-discipline approach. Include engineers, maintenance operatives, and a qualified water hygiene specialist as a minimum.
Produce accurate water system schematics. Site surveys must result in up-to-date drawings that show all pipework, storage vessels, outlets, and ancillary equipment. Outdated or incomplete schematics are one of the most common causes of missed hazards.
Document findings in a standardised format. Hazard registers, risk scores, and control measures must be recorded in a format that is auditable and accessible to all responsible parties. Verbal agreements or informal notes do not satisfy regulatory requirements.
Use software or structured templates for ongoing monitoring. A logbook system, whether paper-based or digital, creates the audit trail that demonstrates compliance over time. Bespokecompliancesolutions offers bespoke logbook systems tailored to individual site configurations.
Schedule formal review cycles. The WHO WSP approach requires formal updates after significant facility changes. Reviews should also be triggered by refurbishments, changes in building occupancy, or following any incident or near-miss.
Engage external specialists where internal expertise is limited. Reviewing a Legionella risk assessment with an external specialist provides an independent check on completeness and compliance alignment.
Key takeaways
A water hazard identification process is only as effective as the rigour applied to every phase, from site survey through to ongoing review and documentation.
Point | Details |
Hazards vs. hazardous events | Document both the agent (e.g. Legionella) and the operational failure that enables it (e.g. temperature drop). |
SPR model application | Trace each hazard from source through pathway to receptor to identify where intervention breaks the risk chain. |
Risk prioritisation | Score every hazard by likelihood and severity to direct resources to the highest-consequence risks first. |
Multidisciplinary teams | Include engineers, maintenance staff, and hygiene specialists to avoid blind spots in hazard coverage. |
Continuous review | Formal reassessment after infrastructure changes or incidents keeps your Water Safety Plan accurate and defensible. |
Why hazard identification is where compliance is won or lost
The most common mistake I see in facilities is treating hazard identification as a box-ticking exercise completed once every few years. The documentation gets filed, the risk assessment sits in a drawer, and the next review only happens when a regulator asks for it. That approach is not compliance. It is the appearance of compliance, and the difference matters enormously when something goes wrong.
What I have found, working across commercial, healthcare, and housing association sites, is that the facilities with the strongest compliance records are the ones where hazard identification is treated as a living process. Their schematics are updated after every refurbishment. Their hazard registers are reviewed after every incident, however minor. Their teams understand the difference between a hazard and a hazardous event, and that distinction shapes every control decision they make.
The SPR model is genuinely useful here, not as a theoretical framework but as a practical thinking tool. When a maintenance engineer asks whether a newly installed outlet needs to be included in the monitoring programme, the answer becomes obvious once you ask: what is the source, what is the pathway, and who is the receptor? That three-part question cuts through ambiguity faster than any checklist.
The other pitfall worth naming directly is over-reliance on generic templates. A water hazard assessment for a 200-bed hospital and one for a small commercial office block are not the same document with different headers. The hazards, pathways, receptors, and control priorities are fundamentally different. Bespoke documentation is not a luxury. It is what makes the assessment defensible.
— Sammi
How Bespokecompliancesolutions supports your water hazard assessment
Bespokecompliancesolutions works with facility managers and compliance officers across commercial, healthcare, housing, and hospitality sectors to deliver water hazard assessments that are thorough, site-specific, and fully aligned with ACOP L8 and HSG274 requirements.
Our Legionella risk assessments are built around detailed site surveys, accurate system schematics, and prioritised hazard registers that feed directly into your Water Safety Plan. Where physical hazards such as sediment or biofilm are identified, our tank cleaning and disinfection services address the source directly. We also implement bespoke logbook systems and ongoing monitoring programmes to keep your documentation current and your compliance continuous. Contact Bespokecompliancesolutions to discuss a tailored assessment for your site.
FAQ
What is the difference between a hazard and a hazardous event?
A hazard is the agent that causes harm, such as Legionella bacteria or a chemical contaminant. A hazardous event is the operational condition or failure, such as a temperature drop or equipment fault, that allows the hazard to arise or proliferate.
How often should a water hazard identification process be reviewed?
The process requires review and updating following any significant infrastructure change, change in building use, or incident. As a minimum, a formal review should occur at least every two years, or as specified by your competent person.
What framework is used to assess water hazards in UK facilities?
UK facilities follow the HSE’s Approved Code of Practice L8 and HSG274 guidance, both of which align with the WHO Water Safety Plan approach. The Source-Pathway-Receptor model is the standard analytical framework applied within these assessments.
Does a water hazard assessment cover Legionella specifically?
Legionella is the primary biological hazard addressed in most built environment water assessments, but a complete process covers all biological, chemical, physical, and radiological hazards relevant to the specific water system and its users.
Who should carry out a water hazard identification process?
The assessment must be carried out by a competent person with knowledge of water systems, microbiology, and relevant legislation. A multidisciplinary team approach, combining internal facility knowledge with external specialist expertise, produces the most complete and defensible results.
Recommended
Comments