How a Legionella Written Scheme of Control Works

From Risk Assessment to Written Controls

A Legionella written scheme of control sets out how identified water-system risks will be managed in practice. It connects the findings of a risk assessment with defined precautions, responsibilities, operating procedures and checks. Rather than simply describing potential hazards, the scheme explains how the people responsible for the system intend to keep the selected controls effective.

The level of detail should reflect the system and its risks. A complex managed building may require procedures covering several areas, teams and items of equipment, while a straightforward low-risk system may need much simpler arrangements. The starting point is always the assessment of the actual water system, not a generic document copied from another property.

When a Documented Control Scheme Is Needed

A written control scheme is needed where an identified Legionella risk cannot be prevented and suitable control measures must be implemented. UK HSE guidance expects the dutyholder to establish a course of action explaining how those risks will be controlled. The scheme must reflect the particular system, how it is operated and the people who could be exposed.

This does not mean every domestic property automatically requires a lengthy management document. Where an appropriate assessment finds no reasonably foreseeable risk, or a low risk that is adequately managed, further elaborate controls may not be necessary. Existing precautions still need to remain effective, and the position should be reconsidered when circumstances change.

Requirements for recording significant assessment findings, including the rules affecting employers with five or more employees, should not be confused with the underlying duty to manage identified risks. The scale and documentation of the arrangements must be appropriate to the actual responsibilities and risks involved.

What the Scheme Adds to an Assessment Report

A risk assessment identifies what needs attention, while the written scheme explains how the chosen precautions will be carried out and checked. For example, an assessment might identify infrequently used outlets, difficult-to-monitor equipment or unclear responsibilities. The scheme should translate relevant findings into specific tasks, assigned roles, monitoring arrangements and instructions for dealing with unacceptable results.

A practical scheme therefore needs more than a list of recommendations. It should be usable by the people operating the premises, with enough detail to show what happens, who carries it out, how completion is evidenced and when an issue must be escalated. Keeping the assessment and scheme aligned helps prevent important actions from being lost between reporting and implementation.

Building the Scheme Around the Water System

An effective Legionella control scheme must describe the water system it covers and the precautions selected for that system. The document should provide a reliable operational reference rather than a general explanation of water hygiene. Equipment, pipework arrangements, usage patterns and the site's established safety procedures all influence what needs to be included.

Clear boundaries are particularly important where a building contains several systems, has been extended over time or uses external maintenance contractors. The scheme should make it possible to identify the relevant equipment, understand which instructions apply and locate the records showing that the required controls have been followed.

System Schematics and Equipment Boundaries

A current system schematic helps the responsible person understand which components and areas fall within the control scheme. Depending on the installation, it may identify water supplies, storage vessels, heaters, distribution routes, circulation equipment, representative outlets and parts that are temporarily or permanently out of use. Important locations should be recognisable to those inspecting or maintaining the system.

The schematic is not a substitute for inspecting the actual installation. Changes to pipework, equipment or building use can make an older drawing unreliable. Documents should therefore be version-controlled and updated when significant alterations occur, with any uncertainties or inaccessible sections clearly identified for further investigation.

Safe Operation and Control Methods

The scheme should explain how the water system is to be operated safely and which precautions are used to control Legionella risk. Relevant arrangements may include managing water temperatures, preventing stagnation, maintaining suitable circulation, controlling water spray and keeping equipment in an appropriate condition. Procedures for start-up, shutdown or unusual operating conditions may also be necessary.

These controls should be selected through the risk-based arrangements for the premises, not copied as a universal checklist. For instance, temperature management, flushing little-used outlets and maintaining shower fittings address different problems. The written scheme establishes when each applicable control is required, who is responsible and how its effectiveness will be verified; the detailed technical procedure may sit in a supporting instruction.

Checks, Frequencies and Control Criteria

Each essential control should have a defined checking method, frequency and action criterion. A schedule that simply says "check regularly" is difficult to operate consistently or audit. The responsible person should be able to identify the required observation, the location, the person or role undertaking it and the result that would indicate the control is not working as intended.

For a managed hot and cold water system, an agreed schedule might distinguish between routine operational checks, planned inspections and maintenance reviews. The appropriate frequency and control criteria depend on the risk assessment, equipment and applicable HSE technical guidance. Not every system requires the same programme, and microbiological sampling should not automatically be treated as a substitute for monitoring established controls.

Making the Scheme Work in Practice

A written scheme only provides effective protection when its instructions are understood, carried out and supervised. The dutyholder needs suitable management arrangements so that monitoring does not depend on informal knowledge or an individual remembering an occasional task. Relevant staff should know the procedures they are expected to follow and where to obtain the current instructions.

Implementation also requires a clear route for reporting unusual results, equipment defects and missed checks. Where contractors undertake specialist work, their responsibilities should be agreed without creating uncertainty about who oversees the overall control programme. The records produced by these activities provide evidence of whether the scheme is functioning as intended.

Named Responsibilities and Competence

The dutyholder should appoint a competent responsible person with sufficient authority to oversee the control arrangements. The written scheme should identify who manages the programme, who carries out individual checks, who reviews the results and who authorises further action. Deputies or alternative contacts may be necessary where responsibilities are shared across shifts, teams or locations.

Competence involves understanding the water system, the relevant hazards and the limits of the person's role. External specialists can carry out defined tasks, but their appointment does not automatically remove the dutyholder's responsibilities. The division of work, reporting arrangements and expectations for contractors should be documented and communicated to everyone involved.

Monitoring, Inspections and Evidence

Monitoring records should show whether the specified precautions have been performed and whether their results were acceptable. Depending on the control, useful information can include the date, location, person completing the check, result obtained, equipment condition and any follow-up action. A missing result should not be treated as proof that the required check took place.

Records may be kept electronically or on paper, provided they remain accurate, accessible and suitably authenticated. HSE guidance distinguishes between general records, retained while current and for at least two years afterwards, and monitoring, inspection or check records, which should be retained for at least five years. The relevant record-keeping duties must be applied to the organisation and system concerned.

The objective is not to create paperwork for its own sake. Records should allow the responsible person to identify recurring faults, confirm that tasks are completed and decide whether existing precautions remain adequate. A log book or digital platform can support this process, but the value lies in the quality of the information and the actions taken.

Escalation and Corrective Actions

The scheme should state what happens when a check indicates that an agreed control is ineffective. A result outside the site's specified criteria may require verification, further investigation, temporary precautions or competent specialist input. The response should reflect the actual risk and the affected system rather than assuming that every deviation can be resolved through the same maintenance action.

A clear escalation procedure can follow four stages:

1. Identify: Record the failed check, defect or unexpected condition.
2. Notify: Inform the named responsible person or escalation contact.
3. Respond: Apply the approved precautions and arrange competent investigation or remedial work where required.
4. Verify: Record the outcome and confirm that the affected control has been restored or replaced by an appropriate alternative.

The scheme should also distinguish routine maintenance findings from situations that require urgent restrictions or other protective action. Unresolved failures need a named owner and a follow-up date, so they do not remain indefinitely open without a decision.

Reviewing the Scheme and Keeping It Current

A Legionella written scheme should be reviewed when there is reason to question whether its controls remain suitable or effective. A document that accurately described a building several years ago may no longer reflect its water system, occupants or operating arrangements. The dutyholder should therefore check both the continuing relevance of the instructions and the evidence that they are being implemented.

Reviewing the scheme is not simply a matter of changing a date on its cover. The process should consider whether the documented responsibilities are current, the system description remains accurate, monitoring results reveal recurring weaknesses and previously agreed actions have been completed. Significant changes should be reflected in the working documents used by staff and contractors.

Changes That Trigger a Review

Changes to the water system, its operation or the people exposed may require the control scheme to be reconsidered. Examples include alterations to pipework, newly installed equipment, extended periods of reduced use, changes in occupancy, new vulnerable users, repeated failed checks or the appointment of different maintenance providers. The relevant risk assessment may also need to be reviewed.

There is no single review interval that makes every scheme suitable for every premises. A planned management review can be useful, but significant changes or evidence of ineffective controls should prompt earlier action. Any revised instructions must be communicated to the people responsible for carrying them out, and superseded versions should not remain in operational use.

Checking Performance and Follow-Up

The final test of a written scheme is whether its controls are consistently implemented and continue to manage the identified risks. A management review should examine completed checks, outstanding corrective actions, equipment changes, staff responsibilities and evidence of repeated failures. The findings should lead to clearly assigned improvements rather than another document that is never acted upon.

Where the review suggests that original assumptions are no longer valid, a competent reassessment of the water-system risks may be necessary. MyConstructor provides an on-site Legionella Risk Assessment with written findings and recommendations. Its assessment service does not include preparing or managing a written scheme, ongoing monitoring, water sampling, disinfection or remedial work.

Once any revisions are approved, update the relevant schematics, schedules, procedures and responsibility records. Keeping these documents aligned helps the dutyholder demonstrate a functioning control process and gives the people managing the system a clear basis for their next decisions.