Water hygiene policy review: a compliance guide
- Jul 1
- 8 min read
A water hygiene policy review is a mandatory periodic assessment that confirms an organisation’s water safety governance remains aligned with current risks, legal requirements, and operational realities. Under ACoP L8 guidance, the standard review cycle runs every two years, with additional event-driven reviews triggered by significant system changes, personnel shifts, or incidents. The industry term for the broader management framework is a water safety policy evaluation, and understanding what it involves is the first step to avoiding regulatory failure. Legionella control sits at the heart of this process. Legionella risks are the primary driver behind the legal obligation to keep water hygiene policies current, documented, and operationally verified.
What is a water hygiene policy review and why does it matter?
A water hygiene policy review is a formal, structured evaluation of an organisation’s water safety governance framework, conducted at least every two years or whenever a significant change occurs. It is not a simple document check. The review confirms that policy commitments match what is actually happening on site, from risk assessments to staff training records.
The importance of water hygiene policy reviews extends beyond paperwork. Legionella bacteria thrive in poorly managed water systems, and a policy that has drifted out of alignment with operational reality creates a direct public health risk. Facility managers and compliance officers carry personal legal accountability under health and safety legislation when that alignment breaks down.
A water hygiene policy document sets the governance framework at a high level. The Written Scheme of Control (WSOC) translates that framework into site-specific operational procedures. The review must verify this alignment between the two documents, confirming that the policy’s commitments are reflected in the day-to-day controls recorded in the WSOC.
What are the main regulatory and legal requirements?
ACoP L8, published by the Health and Safety Executive, defines the legal baseline for Legionella control in the UK. It requires organisations to maintain a written policy, conduct regular risk assessments, and review both documents on a defined cycle. The standard review interval is two years, but ACoP L8 is explicit that reviews must also occur after any significant change to the water system, the building’s use, or the personnel responsible for water safety management.
Temperature control is a non-negotiable element of any water quality management review. Hot water storage must be maintained at or above 60°C, hot water delivery must reach at least 50°C at outlets, and cold water must be kept below 20°C. Temperature compliance must be confirmed during every review cycle, not just when problems arise.
The table below summarises the key legislative checkpoints a compliance officer must verify during a water safety policy evaluation.
Review criterion | Regulatory requirement |
Review frequency | Every two years minimum, or on significant change |
Hot water storage temperature | At or above 60°C |
Hot water delivery temperature | At or above 50°C at outlets |
Cold water temperature | Below 20°C throughout the system |
Responsible Person authority | Confirmed delegated authority and budget |
Staff training records | Current and documented for all relevant personnel |
Written Scheme of Control | Updated to reflect current risk assessment findings |
Beyond temperature, the review must confirm:
That the Responsible Person named in the policy holds genuine authority and budget to act.
That staff training records are current and cover all personnel with water safety duties.
That the risk assessment has been reviewed and any new hazards are reflected in the WSOC.
That monitoring schedules, including flushing regimes for dead legs, are documented and being executed.
That incident records and any remedial actions have been closed out and recorded.
Compliance officers working across HSE legionella regulations should treat each of these checkpoints as a pass or fail item, not a general observation.
How is a water hygiene policy review practically conducted?
The review process follows a logical sequence. Start with the risk assessment, because the policy and WSOC must both reflect its current findings. If the risk assessment has identified new hazards since the last review, those hazards must appear in the WSOC with specific controls assigned to named individuals.
A practical review follows these steps in order:
Confirm the date and scope of the most recent risk assessment and check whether it is still current.
Cross-check the WSOC against the risk assessment to identify any gaps between identified hazards and documented controls.
Verify that monitoring schedules, including flushing regimes for dead legs and infrequently used outlets, are in place and being recorded.
Check that the Responsible Person named in the policy holds confirmed delegated authority and has the budget to commission remedial work.
Review all staff training records and confirm that anyone with a water safety duty has completed appropriate training within the required timeframe.
Audit temperature monitoring logs to confirm hot and cold water systems are operating within the required ranges.
Record all findings, assign corrective actions with deadlines, and update the policy and WSOC to reflect any changes.
The WSOC is a living document. Updating the WSOC whenever the risk assessment or operational procedures change is a legal expectation, not optional housekeeping.
Pro Tip: Never sign off a policy review without physically checking that the Responsible Person named in the document is still in post and still holds the authority described. Personnel changes are the most common reason a policy becomes non-compliant overnight.
What common mistakes occur during water hygiene policy reviews?
The most damaging misconception is treating the review as a compliance filing exercise rather than a live management tool. Organisations that tick the review box without verifying operational reality are creating a false sense of assurance. Regulators and insurers look for evidence that the policy drives actual behaviour, not just documentation.
The five most frequent errors compliance officers encounter are:
Failing to update the WSOC after policy changes. The policy and WSOC must move together. A revised policy that does not trigger a WSOC update leaves operational staff working to outdated procedures.
Missing event-driven reviews. A major system modification, a building change of use, or a Legionella detection event all require an immediate review. Waiting for the two-year cycle after a significant change is a compliance failure.
Misidentifying the Responsible Person’s authority. Audits frequently reveal that the person named in the policy lacks the actual authority or budget to commission remedial work. This renders the governance structure unenforceable.
Overlooking training currency. Staff training records are often present but out of date. A review must confirm that training is current, not just that it once occurred.
Treating temperature records as a formality. Monitoring logs that show consistent readings without any variation are a red flag. Real systems fluctuate. Logs that appear too clean suggest the monitoring is not being carried out properly.
Each of these errors has appeared in HSE enforcement actions. None of them requires specialist knowledge to avoid. They require discipline and a structured review process.
How are emerging technologies shaping water hygiene policy reviews?
Real-time sensor technology and automated monitoring systems are changing the way facility managers approach water quality management reviews. Continuous temperature monitoring, for example, removes the reliance on manual spot checks and creates an auditable data trail that supports policy compliance claims. Automated temperature monitoring systems can flag deviations immediately, allowing corrective action before a hazard develops.
Governance experts recommend shifting towards policy-aware, technology-supported management systems, but they are clear that current AI tools have significant limitations. Only 18% of current AI applications in water regulation incorporate assurance features such as explainability and trustworthiness. That figure means the vast majority of AI tools in this space cannot yet provide the audit-ready transparency that regulators expect.
The table below contrasts traditional manual review approaches with technology-enabled methods.
Aspect | Traditional manual review | Technology-enabled review |
Temperature monitoring | Periodic manual spot checks | Continuous automated logging |
Hazard detection | Reactive, based on scheduled visits | Real-time alerts on deviation |
Audit trail | Paper-based records | Digital, timestamped data |
Human oversight | Central to all decisions | Still required; AI supports, not replaces |
Policy update triggers | Calendar-driven or incident-driven | Data-driven and event-driven |
“Emerging best practices suggest integrating real-time sensor data and AI-assisted monitoring when reviewing policies, enhancing responsiveness while preserving human oversight.” — npj Clean Water, 2026
The practical implication for compliance officers is clear. Technology can improve the quality of evidence available during a review, but it does not replace the structured assessment process. Human judgement remains the deciding factor in whether a policy is fit for purpose.
Key takeaways
A water hygiene policy review is only effective when it verifies operational reality, not just documentation, covering the Written Scheme of Control, Responsible Person authority, temperature compliance, and staff training in a single structured cycle.
Point | Details |
Review frequency | Conduct reviews every two years minimum and after any significant system or personnel change. |
Policy and WSOC alignment | Every policy review must cross-check the Written Scheme of Control against current risk assessment findings. |
Responsible Person authority | Confirm the named Responsible Person holds genuine delegated authority and budget at every review. |
Temperature compliance | Verify hot storage at or above 60°C, hot delivery at or above 50°C, and cold water below 20°C. |
Technology as a support tool | Automated monitoring improves evidence quality but does not replace structured human-led review. |
Why I treat the policy review as the most important compliance event of the year
Facility managers often ask me which single compliance activity carries the most weight. My answer is always the water hygiene policy review. Not because it is the most technically demanding task, but because it is the one that exposes every other gap in the system.
I have seen organisations with excellent monitoring logs, well-trained staff, and up-to-date risk assessments fail a review because nobody had checked whether the Responsible Person named in the policy still worked there. That is not a technical failure. It is a governance failure, and it is entirely avoidable.
The shift I advocate for is treating the policy as a living document rather than an annual filing obligation. That means reviewing it when things change, not just when the calendar says so. A contractor replaces a section of pipework? Review the WSOC. A key member of the water safety team leaves? Review the delegation of authority immediately.
Technology is genuinely useful here. Automated monitoring systems create the kind of continuous evidence trail that makes a review faster and more credible. But I have also seen organisations become over-reliant on dashboards and miss the human-level checks that no sensor can perform. The policy review is where you step back and ask whether the whole system still makes sense. No algorithm does that for you.
My practical advice: schedule the review, assign it to a named individual with authority, and treat every finding as an action item with a deadline. A review that produces no actions is almost certainly a review that was not done properly.
— Sammi
How Bespokecompliancesolutions supports your water hygiene compliance
Bespokecompliancesolutions works with facility managers and compliance officers across commercial, healthcare, housing, and public sector organisations to keep water safety policies current, compliant, and operationally grounded.
From bespoke Legionella risk assessments to system disinfection and flushing, the team at Bespokecompliancesolutions provides the specialist support needed to back up your policy with verified, auditable controls. Whether you need a full policy review, an independent audit of your Written Scheme of Control, or ongoing consultancy to keep your water hygiene programme on track, Bespokecompliancesolutions builds solutions around your specific sites and risk profile across the UK.
FAQ
What is a water hygiene policy review?
A water hygiene policy review is a mandatory periodic assessment, conducted at least every two years, that confirms an organisation’s water safety governance, risk assessments, and operational controls remain aligned and legally compliant.
How often should a water hygiene policy be reviewed?
The standard review cycle under ACoP L8 is every two years, but event-driven reviews are required immediately after significant system changes, personnel changes, or water safety incidents.
What is the difference between a water hygiene policy and a Written Scheme of Control?
The water hygiene policy sets high-level governance accountability, while the Written Scheme of Control details the site-specific operational procedures. A policy review must verify that both documents are aligned and current.
What temperature standards must a water hygiene policy review confirm?
The review must confirm hot water storage at or above 60°C, hot water delivery at or above 50°C at outlets, and cold water maintained below 20°C throughout the system.
Who is responsible for conducting a water hygiene policy review?
The Responsible Person designated in the policy holds accountability for the review, but they must have confirmed delegated authority and budget to act on findings. Compliance officers should verify this authority at every review.
Recommended
Comments