Find out what a legionella risk assessment involves, whether the law requires one where you work and how to complete one step by step.
A legionella risk assessment (LRA) is a review of a building's water systems to find where Legionella bacteria could grow and spread. It identifies the hazards, rates the risk and sets out the controls needed to keep people safe. The goal is to prevent Legionnaires’ disease, a serious lung infection caused by breathing in contaminated water droplets.
Legionella is a bacterium that causes Legionnaires’ disease, a serious type of pneumonia. Symptoms range from a mild flu-like illness to severe pneumonia, and the disease can be fatal.
The most common route of infection is breathing in aerosols from water sprays, jets or mists, according to the World Health Organization.
A hazard identification walk-through of your building is the starting point. Look first at:
Air conditioning and cooling systems
Hot tubs and spa pools
Showers and household plumbing
Any area with warm, stagnant water
Once you know where the risk sits, you can act on it and meet your legal duties.
It depends on where you are and what you manage. In the UK, the law requires one. In the US and Australia, no federal or national law does, though guidance recommends it. In Germany and the Netherlands, larger or higher-risk facilities must assess and test their water.
Even where the law doesn’t require a risk assessment, health professionals in many countries recommend one because it helps stop the spread of Legionnaires’ disease. Here’s how the rules compare.
Although there is no federal law requiring property managers and landlords to conduct risk assessments or testing of any sort for Legionella, many authorities have argued that it should be done to help promote safer drinking water and protect public health. Some states have specific laws, particularly for cooling towers, water systems, healthcare facilities, and other related buildings. The CDC also offers a free toolkit to help building owners decide whether they need a water management program and how to build one.
According to the Health and Safety Executive (HSE), landlords and employers are mandated by law to conduct Legionella risk assessments to protect tenants and employees from potential health risks associated with the bacteria.
Similar to the US, there’s no specific legal requirement for Legionella risk assessments on a national level in Australia. However, the government has released guidelines for LRAs within facilities.
Legionella testing and risk assessments are required for large facilities that regularly heat drinking water, have an internal water storage capacity of more than 400 liters, and have a pipeline volume of at least three liters.
Businesses must have their water facilities checked by a certified assessor for the Legionella bacteria at least twice a year. These facilities include hospitals, swimming pools, and other establishments under priority institutions.
Landlords, employers, and property managers can use the following steps as a guide in performing a Legionella risk assessment and managing Legionella risks:
The first step in carrying out a Legionella risk assessment is to determine if there is a risk. Check if any of the top 3 Legionella-related risk factors are present.
If there is currently no risk, determine if there is a possibility that a risk will occur. If there is no reasonably foreseeable risk, according to the HSE, the Legionella assessment is complete.
If there is a risk, determine the risk level. If the risk level is low and risk is being properly managed to comply with the law, according to the HSE, the Legionella risk assessment is complete. Indications that the Legionella risk level is low (based on examples given by the HSE):
Use of hot and cold water systems
Use of small, domestic-type systems
Regular water usage and turnover
No stored water tanks
To test for Legionella, the HSE recommends doing the following:
Use the BS 7592 standard for water sampling
Neutralize biocide if used and where possible
Submit water sample to a UKAS-accredited laboratory that takes part in a water microbiology proficiency testing scheme
Ensure that the UKAS-accredited laboratory applies the minimum theoretical mathematical detection limit of <= 100 legionella bacteria per liter of sample for culture-based methods
Aside from cases where control measures do not seem to be effective, Legionella testing is typically only carried out for cooling tower systems. However, it’s also recommended for other open systems, such as evaporative condensers and spa pools. The HSE states these systems should be tested for Legionella at least quarterly.
It’s also good to note that UK law does not require a Legionella test certificate, nor does the HSE recognize it.
If you manage premises in the UK, two more rules can apply:
Cooling towers and evaporative condensers. Under the NCTEC regulations, tell your local authority in writing if you have one on site and where it is. Tell them again when you stop using it.
Reported cases. Under RIDDOR, you must report cases of Legionnaires’ disease in employees who worked on cooling towers or on water systems likely to be contaminated.
If a property is vacant, don’t let water stagnate. Use every outlet on hot and cold systems at least once a week.
Write down what you found and what you did about it. Good records show an inspector, auditor or court that you managed the risk. Keep these on file:
The assessment findings and the date you completed it
The control measures you put in place
Temperature readings, flushing logs and any test results
Corrective actions and who completed them
In the UK, employers with five or more employees must record the findings. Landlords aren’t always required to, but HSE says it’s wise to keep a record anyway.
Review your assessment regularly and whenever something changes, such as new plumbing, a long vacancy or a different use of the building. Regular facility inspections make this easier.
Temperature is the main control for hot and cold water systems. According to HSE, Legionella multiplies between 20°C and 45°C (68°F and 113°F). It stays dormant below 20°C and doesn’t survive above 60°C (140°F).
Where | Target |
|---|---|
Hot water storage (calorifier or cylinder) | 60°C (140°F) or higher |
Hot water at the outlet | At least 50°C (122°F) within one minute (55°C or 131°F in healthcare) |
Cold water storage and outlets | Below 20°C (68°F) |
Targets are from HSE guidance on hot and cold water systems. For most domestic systems, HSE’s advice is to "keep the hot water hot, cold water cold and keep it moving."
Other simple controls help too:
Flush rarely used outlets
Clean and descale showerheads
Fit tight-fitting lids on cold water tanks
Remove redundant pipework
Work through the hierarchy of controls when you choose measures. Removing unused pipework, for example, takes the hazard away entirely.
Put your controls in writing. UK guidance calls this a control scheme, and the US equivalent is a water management program.
Platforms like Mitti (by SafetyCulture) let you log temperature checks and flushing rounds in an inspection and assign a corrective action when a reading is off.
Mitti (by SafetyCulture) is the operations system for every site, shift and standard. Trusted by over 80,000 organizations, Mitti brings your people, operational data and workflows into one operating picture.
Your frontline teams get real-time visibility across every site, worker and task. They catch risks earlier, close out corrective actions and build a digital audit trail as the work happens, so you stay audit-ready without the paperwork.
✓ Catch hazards and near-misses the moment they happen
✓ Turn every issue into a clear next step with an owner and a deadline
✓ Stay audit-ready with a digital audit trail that builds itself
✓ Get workers trained and site-ready before they start
✓ Spot trends across sites, shifts and teams
✓ Improve safety every day with evidence from the people doing the work
