Who Can Carry Out a Legionella Risk Assessment?

It is one of the most common questions facilities managers ask when they start looking into their legionella compliance obligations — and the answer is not as straightforward as you might hope.

The short version is that the law does not specify a particular qualification, but it does set a clear standard of competence that the person carrying out the assessment must meet. Getting that wrong carries serious consequences.

This guide sets out who the regulations say can carry out a legionella risk assessment, what competence actually means in practice, and when it makes sense to bring in an external specialist rather than attempting the assessment in-house.

What the Regulations Actually Say

The legal requirement for a legionella risk assessment sits within a framework of overlapping legislation — principally the Health and Safety at Work etc Act 1974, the Control of Substances Hazardous to Health Regulations 2002 (COSHH), and the Management of Health and Safety at Work Regulations 1999. But it is ACoP L8 — the Approved Code of Practice for the control of Legionella bacteria in water systems — that addresses the question of who can carry one out most directly.

ACoP L8 states that the duty holder must ensure that the person carrying out the risk assessment and providing advice on control of exposure is competent to do so. It describes competence as having sufficient authority, knowledge, and experience to understand the water systems being assessed, identify where risks exist, and specify appropriate control measures.

Crucially, ACoP L8 does not require a specific qualification or certification. What it does require is that the person has the knowledge and experience to do the job properly — and that the duty holder is satisfied that this is the case. Delegating the task does not remove your responsibility; it transfers the execution while leaving accountability with you.

The supporting technical guidance, HSG274, goes further by describing what a competent assessor should actually be doing in practice — surveying the system, reviewing existing records, identifying control failures, and producing a written scheme that reflects the actual state of the installation.

The Duty Holder's Role

Before looking at who carries out the assessment, it is worth being clear about the duty holder's position. Whether you use an internal resource or an external contractor, the duty holder — typically the employer or the person in control of the premises — remains legally responsible for ensuring the assessment is suitable and sufficient. If a legionella outbreak occurs and your assessment is found to be inadequate, the fact that you handed it to someone else will not protect you from enforcement action.

This is why the choice of assessor matters as much as the assessment itself.

In-House vs External Assessor: What Are Your Options?

Carrying Out the Assessment In-House

There is nothing in ACoP L8 that prevents an in-house member of staff from carrying out a legionella risk assessment, provided they meet the competence standard. For straightforward, low-risk water systems — a small office with a simple cold water supply and a direct-fed hot water heater, for example — a trained and experienced member of your facilities team may be entirely capable of completing a proportionate assessment.

However, ACoP L8 also notes that the assessor should be able to demonstrate impartiality and independence from the remedial or control tasks identified within the assessment. In practice, this means someone who also manages the maintenance of the system may face a conflict of interest when assessing their own work. It does not make in-house assessment impossible, but it is a factor worth considering.

For more complex systems — buildings with cold water storage tanks, calorifiers, cooling towers, TMVs, or multiple distribution circuits — the technical knowledge required increases significantly. If your in-house team does not have specific training in legionella control and water system design, the risk of missing something material is real.

Using an External Specialist

For the majority of commercial buildings, appointing an external water hygiene specialist to carry out the legionella risk assessment is the most defensible approach. A qualified assessor will have the technical knowledge to survey your systems thoroughly, the experience to recognise risk factors that an untrained eye might miss, and the independence to report findings objectively.

When selecting an external assessor, the most reliable indicator of competence is membership of the Legionella Control Association (LCA). The LCA sets industry standards for water hygiene contractors and requires members to demonstrate both technical competence and appropriate insurance. Membership is not a legal requirement, but it provides a recognised benchmark and gives you a basis for demonstrating due diligence if your arrangements are ever questioned.

Other indicators to look for include relevant qualifications such as the City & Guilds Level 3 Award in Legionella Risk Assessment, or BOHS (British Occupational Hygiene Society) P901 certification. Experience across a range of building types and water system configurations is at least as important as paper qualifications.

For guidance on what to look for when appointing a legionella specialist, our article on choosing a legionella remedial works specialist covers several of the same principles and is worth reading alongside this one.

What the Assessment Should Cover

Regardless of who carries it out, a suitable and sufficient legionella risk assessment for a commercial building should include the following:

A Physical Survey of the Water Systems

The assessor should walk the system — not just review paperwork. This means inspecting cold water storage tanks, tracing pipework, identifying dead legs, checking TMV installations, and recording the condition of key components. Temperature readings should be taken at sentinel points on both the hot and cold water systems.

A Review of Existing Records and Control Measures

If previous risk assessments, monitoring records, or cleaning logs exist, the assessor should review them. Gaps in the records are themselves a finding. A system that looks compliant on a single visit may have a history of temperature excursions or positive legionella test results that change the risk picture significantly.

A Written Report and Action Plan

The output of the assessment should be a written report that identifies the risks found, rates their significance, and sets out the remedial actions required in priority order. This report forms the basis of your written scheme of control — the live document that governs how your water systems are managed on an ongoing basis.

Once the assessment is complete, the work does not stop there. For a clear breakdown of what needs to happen after you receive your report, our article on what facilities managers must do next after a legionella risk assessment sets out the practical steps in straightforward terms.

How Often Should the Assessment Be Reviewed?

A legionella risk assessment is not a one-off exercise. ACoP L8 requires it to be reviewed regularly — and immediately if there is reason to believe it may no longer be valid. Common triggers include significant changes to your water systems, changes to building occupancy or use, following an incident or near-miss, or if monitoring results suggest your control measures are not working as expected.

As a general rule, the assessment should be reviewed at least every two years for most commercial premises, though higher-risk sites may warrant more frequent review. The legionella risk assessment services page has more detail on what a full assessment involves and what you should expect from the process.

Getting the competence question right at the outset saves a significant amount of difficulty further down the line. An assessment that misses key risks, fails to produce a workable written scheme, or cannot withstand scrutiny from the HSE is not just a compliance failure — it is a liability. Choosing the right person for the job is the most important decision in the process.

If you would like to understand more about what a professional legionella risk assessment covers and what the process looks like from start to finish, visit our legionella risk assessment services page for a full overview.

SPEAK TO OUR TEAM