Legionella risk assessments to ACOP L8
A legionella risk assessment is a written assessment of every water system on a site that could create and spread breathable droplets. It identifies where the bacteria could grow and what has to be done about it. It is required of every employer in England, Wales and Scotland by regulation 6 of the Control of Substances Hazardous to Health Regulations 2002, and in Northern Ireland by regulation 6 of the equivalent 2003 Regulations. In Great Britain, the standard it is judged against is the HSE's Approved Code of Practice L8, fourth edition, which also treats anyone in control of premises or water systems in connection with work as a dutyholder.


What a legionella risk assessment includes
Every water system on site, assessed against ACOP L8 and written up so your team can act on it.
An assessor walks the site, traces the water from where it enters the building to every outlet it reaches, and records the conditions that raise the risk: water sitting between 20 °C and 45 °C, pipework that has stopped being used, and anything that turns water into a breathable aerosol.
What you get back is a risk assessment, a schematic of the systems, a prioritised action list and a written control scheme naming who does what. The technical detail follows HSG274, the HSE's guidance in three parts, so the assessment matches the guidance inspectors may refer to.
What a legionella risk assessment includes
Every water system on site, assessed against ACOP L8 and written up so your team can act on it.
An assessor walks the site, traces the water from where it enters the building to every outlet it reaches, and records the conditions that raise the risk: water sitting between 20 °C and 45 °C, pipework that has stopped being used, and anything that turns water into a breathable aerosol.
What you get back is a risk assessment, a schematic of the systems, a prioritised action list and a written control scheme naming who does what. The technical detail follows HSG274, the HSE's guidance in three parts, so the assessment matches the guidance inspectors may refer to.
The site survey
Every tank, calorifier, pipe run, dead leg and outlet, from cold water storage through to the rarely used shower in the back of the welfare block. Cooling towers, evaporative condensers, spray humidification, vehicle wash bays and misting are surveyed as systems in their own right, because HSG274 treats them that way.
The written assessment
A risk assessment written to regulation 6 of the Control of Substances Hazardous to Health Regulations 2002 and the ACOP: what each system is, how it is used, where the risk sits, and a schematic your maintenance team can work from. Actions are ranked by urgency, so the thing that matters this week is at the top of the list.
The control scheme, and who owns it
HSE expects the assessment to include the name of the responsible person, so it is finished only once someone is named. You get a written scheme with temperature monitoring points, flushing routines for low-use outlets, treatment regimes where they apply, and the review triggers that say when the assessment stops being valid. A walkthrough at handover means the person named in it has been shown it.
What lands on your desk afterwards
Four documents.
The risk assessment itself
Written against ACOP L8, system by system, with the conditions that create risk recorded and the date of the survey.
A schematic of your water systems
Drawn from the survey, not from the original building drawings. The two drift apart when the plumbing changes and the drawings stay as they were.
A prioritised remedial action list
Ranked this week, this month, this quarter. Dead legs to cut back, temperatures out of range, outlets to bring into a flushing routine.
A written control scheme with names in it
Monitoring points, frequencies, temperatures and responsibilities. It turns the assessment into something you can be judged to be complying with.
What you should be able to show
These are the records L8 expects you to keep. Could you put your hands on all six today?
- ✓A current written risk assessment, covering every water system on site
- ✓The name of your responsible person, in writing, with evidence they are competent to hold it
- ✓The written control scheme, setting out what is monitored, how often, and by whom
- ✓Monitoring records for temperatures, flushing and any treatment, kept for at least five years
- ✓Evidence the assessment has been reviewed after a change to the system, the use of the building, or the people responsible
- ✓Where you have a cooling tower, the written notification to the local authority
HSE's guidance in L8 also expects the people who carry out your control scheme to be trained for the job, with regular refresher training and a record of both. Our legionella awareness course covers the risks, the legal duties and the controls, and runs at your premises.
Speak with an expert
What a legionella risk assessment costs
Price depends on a number of variables, including:
The number and type of water systems
A single incoming main, a calorifier and eight outlets is a short survey. Add a cooling tower, a wash bay and process water and the survey grows with them, because HSG274 gives each its own guidance.
Site size and how much of it is plant
The assessor has to physically reach every tank, dead leg and outlet. A large single-storey shed with two welfare blocks takes less time than a smaller site with plant rooms on four levels.
Whether a usable schematic exists
If there is no schematic, or the one you have predates the last refit, it has to be produced from the survey. That adds survey time, and the quote reflects it.
Number of sites, and whether they are alike
A group of similar depots can be assessed in one programme.
A sampling visit is not a risk assessment: testing water for legionella tells you about that tap on that day, and it is not what regulation 6 of the Control of Substances Hazardous to Health Regulations 2002 asks for. A quote with a schematic buys different work from one without, because producing the drawing can be much of the work.
Two ways to work with Opus
Book a one-off service for a specific need, or take on a partnership for ongoing support. Either way, the work gets done by the same team.
Book a service
For a specific need - a single assessment, audit, or
on-site service with a clear deliverable.
Opus Safety Partnership
Ongoing support and consider-it-done compliance. For businesses that want compliance off their plate, not on their to-do list.
Not sure which fits? Speak to a consultant - no commitment required.
Kellaway

Why businesses bring legionella to Opus
Our consultants include former HSE and local authority regulators. Enforcement follows the main activity on the premises: shops, offices, merchants, distribution warehouses and nurseries fall to the local authority, and factories and schools to the HSE, so on a local authority site the person likely to read your assessment does the job some of our team used to do.
Assessed by someone who has stood in your kind of building
A warehouse welfare block, a merchant yard and a glasshouse fail in different ways.
A report sized to the site
The deliverable is a document your maintenance team will open. A 200-page assessment of a two-system site is padding, and it makes the real actions harder to find.
We will tell you when you do not need us back
If your systems are simple, stable and already well monitored, your own team may be able to keep the assessment under review, and we will say so.
Legionella risk assessments by sector
Builders Merchants
Yard wash-down, vehicle wash bays and the welfare block behind the trade counter, plus taps in a covered store that nobody has run since the last stocktake. Our ACOP L8 assessment covers the whole site, and sets a flushing routine that fits around a busy counter.

Warehousing & Logistics
A large warehouse can have showers and taps standing unused for days, and sometimes evaporative cooling as well. The assessment finds the dead legs and low-use outlets, then sets a monitoring routine that suits a quiet welfare block.

Manufacturing & Engineering
Cooling towers, quench tanks and process water are the kind of systems ACOP L8 was written for. Our assessment covers both welfare water and these engineered systems, including cooling tower notification to the local authority and ongoing monitoring.

Garden Centres
Plant-display misting sprays water straight into the aisles where customers walk. HSG274 lists horticultural misting and water features on display for sale among its legionella risk systems, so the assessment covers them alongside the cafe and sets controls for the misting.

Metal Stockholders
Wash bays, process water and unused yard taps can create the warm, stagnant conditions legionella needs, and they sit well outside the obvious plumbing. Our ACOP L8 assessment maps process water and welfare water together.

Childcare & Nurseries
Low-use showers and water play need legionella control, and young children are at greater risk of scalding, so the two have to be managed together. The assessment balances legionella control against safe water temperatures.
.jpg)
Ready to book a Legionella Risk Assessment?
Tell us how many sites you have and what water systems are on them. We will quote for the work, and by the end you will know every water system, every risk point, every remedial action and who is monitoring what.
Frequently asked questions
Who can carry out a legionella risk assessment?
Anyone you can show to be competent. ACOP L8 does not name a qualification or require a particular accreditation. It requires the assessment to be suitable and sufficient and the assessor to have the necessary ability, experience, instruction, information, training and resources. In practice that means someone who understands water systems and can defend the assessment to an enforcing officer. You can use an employee if they meet that bar, and the duty stays with you either way.
How much does a legionella risk assessment cost?
The price is set by how many water systems are on the site, how much of the site is plant instead of floor, whether a usable schematic already exists, and how many sites are being done together. A missing schematic adds to the price, because it then has to be produced from the survey. Tell us about your sites and systems and we will quote for the work.
How often should a legionella risk assessment be reviewed?
ACOP L8 sets no fixed interval. It says the assessment must be reviewed regularly, and specifically whenever there is reason to suspect it is no longer valid: for example a change to the water system or its use, a change to the use of the building, new information about risks or control measures, checks showing controls are no longer effective, a change of key personnel, or a case of legionnaires' disease associated with the system. The trigger events matter more than the calendar, and a refurbishment is one of them.
What is the difference between ACOP L8 and HSG274?
L8 is the Approved Code of Practice, fourth edition, published 2013. It carries special legal status: follow it and you are doing enough to comply on the matters it covers; depart from it and, if prosecuted, you have to show you complied with the law in some other way. HSG274 is the technical guidance sitting underneath it, second edition March 2024 (only Part 1 was revised), in three parts covering evaporative cooling systems, hot and cold water systems, and other risk systems such as spray humidifiers, wash bays and misting. L8 tells you what has to be achieved. HSG274 tells you how.
What is a legionella responsible person?
The named individual with day-to-day responsibility for managing legionella control on the site. The fourth edition of L8 gave this role ACOP status, and the Code says the dutyholder should appoint one wherever the assessment shows a reasonably foreseeable risk. They need sufficient authority, competence and knowledge of the installation, and a deputy should be named for when they are away. The responsible person can be you, an employee or someone from outside the business, and the duty stays with your organisation whichever you choose.
Do I need to tell anyone if I have a cooling tower?
Yes. In Great Britain, under regulation 3 of the Notification of Cooling Towers and Evaporative Condensers Regulations 1992, the person in control of the premises must notify the local authority in writing, on the approved form, before a notifiable device is on site. You also have to tell them when it is permanently taken out of use, and within one month when the notified details change. This is separate from the risk assessment, and it is easy to miss on a site that inherited the plant with the building.
Is water sampling the same as a risk assessment?
No. Sampling tells you what was in that outlet on that day. A risk assessment tells you which systems could grow legionella, why, and what has to change. Regulation 6 of the Control of Substances Hazardous to Health Regulations 2002 asks for the assessment. Sampling has its place as part of a monitoring regime, particularly on cooling towers, but a folder of clear sample results still needs a current assessment behind it.
Does legionella advice written for landlords apply to us?
Landlords and employers both have to assess the risk; the scale differs. HSE's typical low-risk rented home has mains-fed cold water with no stored water tanks and instantaneous or low-volume water heaters, which is why guidance written for landlords can be short. A warehouse with a cold water tank, an unused shower block and an evaporative cooler is a different assessment, and a template written for a two-bedroom flat will not cover it. Everything on this page is written for commercial and industrial premises.
What if we already have an assessment from another provider?
Check that it is current, covers every system on site and has a written control scheme attached. The gaps to look for are a missing schematic, no named responsible person, or a system the assessment misses entirely. If you want a second view, tell us what you have and we will say whether it needs more work.