Every building with a hot and cold water system carries a legal obligation to control the risk of Legionella bacteria. If you manage facilities across multiple UK sites, that obligation multiplies, and so does the complexity of staying compliant. A legionella risk assessment is the formal starting point for identifying where Legionella bacteria could colonise your water systems and what controls you need in place to protect building occupants.
This guide covers the full scope of legionella risk assessment services for UK multi-site estates. You will find explanations of the legal framework, what the assessment process involves, who is responsible, and how to keep your compliance records audit-ready across every property in your portfolio. SMS Environmental delivers UKAS-accredited legionella risk assessments that give facilities managers the clarity and confidence to manage water safety obligations at scale.
Key Takeaways: Legionella Risk Assessments
- A legionella risk assessment is a legal duty for every employer or person in control of premises with water systems.
- The assessment must follow the source, pathway, receptor model outlined in HSE guidance and ACoP L8.
- UKAS ISO 17020 accreditation confirms the competence and impartiality of the assessor carrying out the work.
- Multi-site estates need a structured approach to scheduling, record-keeping, and corrective actions across all locations.
- SMS Environmental offers UKAS-accredited risk assessments with Opuz software for real-time compliance visibility.
What Is a Legionella Risk Assessment?
A legionella risk assessment is a documented evaluation of the risks posed by Legionella bacteria in your water systems. It examines how water is stored, heated, distributed, and used across your premises, looking for conditions that allow Legionella Pneumophila to multiply and disperse.
The assessment identifies whether a water system has the potential to create breathable water droplets (aerosols) that could expose building occupants to infection. It also reviews the susceptibility of people using the building, including those with weakened immune systems or respiratory conditions.
This is not a one-off exercise. Under UK health and safety law, the assessment must be treated as a living document that is reviewed regularly and updated whenever there are changes to the water system, building use, or occupant profile.
Why Is a Legionella Risk Assessment a Legal Requirement in the UK?
UK law places an absolute duty on employers and those in control of premises to assess and control the risk of exposure to Legionella bacteria. This obligation sits across several pieces of legislation:
- The Health and Safety at Work etc. Act 1974
- The Management of Health and Safety at Work Regulations 1999
- The Control of Substances Hazardous to Health Regulations 2002 (COSHH)
The HSE's Approved Code of Practice L8 (ACoP L8) and its supporting technical guidance documents HSG274 Parts 1, 2, and 3 set out the practical steps you need to take. Failing to carry out a risk assessment, or failing to act on its findings, can result in enforcement action, prosecution, and significant fines.
Legionnaires' disease is a severe and sometimes fatal form of pneumonia caused by the bacterium Legionella Pneumophila. The HSE takes non-compliance seriously, and prosecutions in the UK have resulted in penalties running into hundreds of thousands of pounds.
Who Is the Responsible Person for Legionella Compliance?
Under ACoP L8, the "responsible person" is the employer, the self-employed, or the person in control of a building. In practice, for multi-site estates, this responsibility often falls to the estates director, facilities manager, or a named individual appointed to manage water safety.
The responsible person must ensure that an adequate and sufficient risk assessment is carried out and that the identified control measures are implemented and maintained. They do not need to carry out the assessment themselves, but they must appoint a competent person to do so.
Competence is defined by having sufficient training, experience, knowledge, and other qualities to carry out the role properly. For many organisations, commissioning a UKAS-accredited external assessor gives the clearest demonstration of due diligence.
What Does a Legionella Risk Assessment Include?
A thorough legionella risk assessment follows the source, pathway, receptor model. This means the assessor examines three things:
Source: Is Legionella Bacteria Present or Likely?
The assessor checks whether your water systems have conditions that could support Legionella colonisation. This includes reviewing water temperatures, checking for biofilm, sediment, or scale deposits, and assessing how water is stored and circulated.
According to the HSE's guidance on hot and cold water systems, cold water should be maintained below 20°C and hot water stored at a minimum of 60°C, with distribution reaching 50°C at outlets (55°C in healthcare premises). Deviations from these thresholds raise the risk profile.
Pathway: Can Aerosols Be Created and Dispersed?
Legionella bacteria become dangerous when they are inhaled as fine water droplets. The assessment identifies potential aerosol sources, including showers, cooling towers, spa pools, and fire suppression systems.
Dead legs, rarely used outlets, and poorly maintained equipment all increase the likelihood of bacterial build-up and aerosol generation. A competent assessor maps these risks across your entire water system schematic.
Receptor: Who Could Be Exposed?
The assessment considers who uses the building and their susceptibility to infection. Older adults, people receiving immunosuppressive treatment, smokers, and those with chronic respiratory conditions are at heightened risk.
In healthcare and social care settings, the receptor analysis is particularly important. The HSE's technical guidance requires proportionate controls based on the vulnerability of the building population.
How to Conduct a Legionella Risk Assessment: Step-by-Step
If you are commissioning a risk assessment for your estate, here is the process your assessor should follow:
Step 1: Appoint a Competent Assessor
Select an assessor with demonstrable competence. UKAS ISO 17020 accreditation is the gold standard, as it confirms that the individual and their organisation meet internationally recognised standards for inspection bodies.
SMS Environmental was the UK's first water treatment service to be accredited by UKAS for legionella risk assessment inspections. This accreditation confirms competence and impartiality, reducing your insurance premiums and strengthening your due diligence position.
Step 2: Gather Asset and System Information
Before the site visit, the assessor should receive up-to-date schematics, asset registers, and previous risk assessment records. For multi-site estates, having this documentation centralised in a compliance management system saves time and reduces the risk of information gaps.
The Opuz Portal from SMS Environmental gives facilities managers full transparency of worksheets, asset data, and previous assessment documentation. Multiple users can access the system without restriction, which simplifies handovers and audits.
Step 3: Carry Out the On-Site Inspection
The assessor physically inspects the water system, checking temperature readings at sentinel outlets, examining storage tanks, calorifiers, showerheads, and distribution pipework. They note the condition of insulation, the presence of dead legs, and the effectiveness of existing controls.
All inspections carried out by SMS Environmental use the Opuz compliance system, which plays an important role in the UKAS-accredited process and ensures every data point is recorded digitally for audit purposes.
Step 4: Assess the Risk and Recommend Controls
The assessor evaluates each identified risk and recommends control measures. These might include temperature adjustments, removal of dead legs, installation of point-of-use filters, increased flushing regimes, or chemical treatment programmes.
Recommendations are prioritised by severity, allowing you to allocate resources where they will have the greatest impact on reducing risk. The output is a clear action plan with defined timescales.
Step 5: Document, Communicate, and Review
The completed risk assessment must be documented and made available to all relevant parties. This includes site managers, maintenance teams, and any external contractors responsible for water hygiene works.
The assessment must be reviewed regularly. ACoP L8 does not prescribe a fixed review interval, but a minimum of every two years is widely accepted as good practice. You must also review the assessment whenever there are material changes to the water system, building use, or occupant profile.
What Is UKAS ISO 17020 Accreditation for Legionella Assessments?
UKAS (the United Kingdom Accreditation Service) is the sole national accreditation body recognised by the UK Government. ISO 17020 is the international standard for inspection bodies. When a company holds UKAS ISO 17020 accreditation for legionella risk assessments, it means their processes, personnel, and quality management have been independently verified.
Choosing a UKAS-accredited assessor gives you several advantages:
- Independent verification of assessor competence and impartiality
- Assurance that the assessment follows recognised methodologies
- Stronger due diligence position in the event of an HSE investigation
- Potential reduction in insurance premiums linked to a lower risk profile
HM Government's own conformity assessment policy recommends that businesses, local authorities, and government departments source conformity assessment services from UKAS-accredited bodies. SMS Environmental holds this accreditation for hot and cold water systems, cooling towers, spa pools, and other risk systems.
How Multi-Site Estates Can Manage Legionella Risk at Scale
Managing legionella compliance across dozens or hundreds of sites introduces operational challenges that a single-site approach cannot address. You need consistency in assessment methodology, centralised visibility of compliance status, and a structured way to track corrective actions through to completion.
Centralised Compliance Software
Fragmented paper records and siloed spreadsheets make multi-site compliance difficult to maintain and nearly impossible to audit at pace. A dedicated compliance platform brings all your assessment data, worksheets, and corrective action records into one accessible location.
SMS Environmental's Opuz Portal is built for this purpose. It gives you audit-ready access to all documentation, service histories, and asset data across your entire estate. The platform supports planned preventative maintenance scheduling and integrates all your compliance records in a single system.
IoT and Remote Monitoring for Water Temperature
Manual temperature checks at every outlet across a large estate are resource-intensive and difficult to schedule consistently. IoT remote monitoring systems deliver minute-by-minute sensor data directly to your compliance platform, giving you real-time visibility of water temperatures across all sites.
SMS Environmental's SMS Sense IoT Monitoring System reports sensor data in real time and includes annual calibration and maintenance. This means you can identify temperature excursions as they happen rather than waiting for the next scheduled visit.
Coordinating Remedial Works Across Sites
When a risk assessment flags the need for corrective works, you need a clear process for prioritising, scheduling, and closing out those actions. For multi-site estates, this often means coordinating multiple contractors or internal teams across different regions.
A partner with nationwide coverage and the ability to mobilise rapidly simplifies this coordination. SMS Environmental operates from offices in Harwell (Oxfordshire), Derby, Cardiff, and Bellshill (Scotland), giving coverage across England, Wales, and Scotland.
How Often Should You Review a Legionella Risk Assessment?
ACoP L8 does not specify a mandatory review frequency, but the general expectation is that the risk assessment should be reviewed at least every two years. You must also trigger a review whenever:
- There are changes to the water system (extensions, modifications, or new equipment)
- The building use changes (new tenants, change of function, increased occupancy)
- The occupant profile changes (more vulnerable users, healthcare patients)
- An incident occurs, such as a confirmed Legionella detection or a case of Legionnaires' disease
- There is reason to believe the existing controls are no longer effective
For multi-site estates, scheduling reviews in a rolling programme helps distribute the workload and ensures no single site falls behind. Your compliance software should flag upcoming review dates automatically.
What Happens if You Fail to Carry Out a Legionella Risk Assessment?
Non-compliance with legionella regulations can result in criminal prosecution under COSHH and the Health and Safety at Work Act. The HSE has the authority to issue improvement notices, prohibition notices, and to prosecute organisations and individuals.
Fines for legionella-related offences in the UK can run into hundreds of thousands of pounds, with recent cases exceeding £900,000. In serious cases, directors and responsible persons can face personal liability and even imprisonment.
Beyond the legal penalties, an outbreak of Legionnaires' disease causes reputational damage, operational disruption, and, most importantly, puts lives at risk. Proactive compliance is not just a legal obligation. It is an investment in the safety and reputation of your organisation.
What to Look for in a Legionella Risk Assessment Service
When selecting an assessor, you should evaluate the following criteria:
Accreditation and Competence
Look for UKAS ISO 17020 accreditation specifically for legionella risk assessments. This is the clearest independent verification of competence and impartiality. Membership of the Legionella Control Association (LCA) is another positive indicator, as members are regularly audited against the LCA Code of Conduct.
Technology and Reporting
Ask whether the assessor uses digital inspection tools and a compliance platform for record storage and reporting. Paper-based processes create delays and increase the risk of lost or incomplete records, especially across multi-site estates.
Breadth of Service
A legionella risk assessment often identifies the need for follow-on works, including remedial works, water treatment, monitoring, and training. Working with a single partner who can deliver the full cycle of assessment, remediation, ongoing monitoring, and compliance support reduces handoff risk and improves accountability.
SMS Environmental offers this full-cycle capability, covering risk assessments, water sampling and analysis, water treatment, remedial works, IoT monitoring, compliance software, and City and Guilds assured training courses.
The Role of Training in Legionella Control
Inadequate management, lack of training, and poor communication have all been identified as contributory factors in outbreaks of Legionnaires' disease. ACoP L8 requires that people involved in assessing risk and applying precautions are competent, trained, and aware of their responsibilities.
For facilities managers and site-based staff, practical training on legionella control and water system management is essential. City and Guilds assured training courses ensure that your team meets the competence expectations set out in HSE guidance and can carry out day-to-day control measures with confidence.
SMS Environmental is a City and Guilds Assured Training organisation, delivering practical courses designed for responsible persons, building managers, and operational staff who carry out water hygiene duties on site.
How Legionella Risk Assessments Fit Into a Wider Water Safety Plan
A legionella risk assessment is the foundation of your water safety management, but it does not stand alone. The assessment should feed into a broader water safety plan that covers ongoing monitoring, routine maintenance, emergency procedures, and defined responsibilities.
A water safety plan typically includes:
- Named responsible persons and their roles
- A description of the water system and its components
- The risk assessment findings and recommended controls
- Monitoring schedules for temperature checks, sampling, and inspections
- A record of all maintenance, treatment, and remedial actions
- Incident response procedures
For multi-site organisations, centralising this plan in a platform like SMS Environmental's Opuz system gives every authorised team member access to up-to-date documentation, service histories, and action logs.
In Conclusion: Building Confidence in Your Legionella Compliance
A legionella risk assessment is a legal duty that protects people and gives your organisation a clear framework for managing waterborne risks. For multi-site estates, the challenge lies in maintaining consistency, visibility, and accountability across every location.
By choosing a UKAS-accredited partner, using digital compliance tools, and investing in practical training for your team, you can move from reactive risk management to a proactive compliance posture that delivers operational efficiency, reputational protection, and genuine peace of mind.
TO SPEAK TO A MEMBER OF OUR EXPERT TEAM OR TO GET A QUOTE, PLEASE CALL 0800 138 21 21 OR FILL IN OUR QUICK AND EASY CONTACT FORM.
FAQs About Legionella Risk Assessments
How often does a legionella risk assessment need to be reviewed?
A legionella risk assessment should be reviewed at least every two years. You must also review it when there are changes to the water system, building use, or occupant profile. SMS Environmental records review dates in the Opuz Portal so you never miss a scheduled update.
Who is legally responsible for carrying out a legionella risk assessment?
The employer or person in control of premises is legally responsible under ACoP L8 and COSHH. They must appoint a competent person to conduct the assessment. Many organisations commission external UKAS-accredited assessors for impartial, expert evaluations.
What is UKAS ISO 17020 accreditation for legionella risk assessments?
UKAS ISO 17020 accreditation confirms that an inspection body meets international standards for competence, impartiality, and quality management. SMS Environmental holds this accreditation, giving you independently verified due diligence when commissioning assessments.
Can I carry out a legionella risk assessment myself?
Yes, if you are competent to do so. However, for complex water systems or multi-site estates, commissioning an accredited specialist is strongly recommended. SMS Environmental's UKAS-accredited team gives you the assurance of independent, qualified inspections.
What happens if Legionella is found during a risk assessment?
If Legionella bacteria are detected, immediate corrective actions are needed. These may include thermal or chemical disinfection, system modifications, or increased monitoring. SMS Environmental supports you through the remediation process, from sampling and analysis through to water treatment and follow-up testing.