Choosing the right Legionella risk assessment provider is not just about finding someone who can visit site and produce a report.
A suitable Legionella risk assessment should help you understand the risks within your water systems, identify where control measures are needed, and support you in meeting your legal duties as a dutyholder, responsible person, property manager or facilities manager.
In the UK, employers and those in control of premises have duties to identify and assess sources of Legionella risk, prepare and implement a scheme to prevent or control risk, monitor precautions, keep records and appoint someone competent to help manage the risk.
That means the provider you choose matters.
A poor-quality assessment may leave you with unclear actions, weak evidence, missing system information or recommendations that do not properly reflect the level of risk on site. A good assessment should give you a clear and practical basis for managing Legionella risk going forward.
In summary: To choose a Legionella risk assessment provider, look for relevant sector experience, evidence of competence, knowledge of ACOP L8, HSG274 and BS 8580-1:2019, clear reporting, practical recommendations, LCA membership and support after the assessment. The provider should produce a site-specific report with clear actions, priorities and evidence-based findings.
What is a Legionella risk assessment provider?
A Legionella risk assessment provider is a company or competent person who assesses the risk of exposure to Legionella bacteria from water systems within a building or premises.
This may include systems such as:
• Hot and cold water systems
• Cold water storage tanks
• Calorifiers and hot water generation systems
• Showers and spray outlets
• Thermostatic Mixing Valves, also known as TMVs
• Little-used outlets
• Expansion vessels
• Process water systems, where applicable
• Spa pools, hot tubs or other higher-risk systems, where present
The purpose of the assessment is to identify where Legionella could grow or spread, who may be at risk, and what control measures are needed.
A Legionella risk assessment should not be a generic tick-box exercise. It should be specific to your site, your water systems, your building use and the people who may be exposed.
Is a Legionella risk assessment a legal requirement?
For workplaces and premises with water systems, Legionella risk needs to be assessed and managed as part of health and safety duties.
The Health and Safety Executive explains that dutyholders must identify and assess sources of risk, manage and monitor precautions, keep records and appoint a competent person to help meet those duties.
A Legionella risk assessment is therefore a key part of demonstrating that you have considered and are managing the risk.
It is especially important for premises such as:
• Care homes and supported living settings
• Schools, colleges and universities
• Hotels and hospitality venues
• Healthcare and dental settings
• Offices and commercial buildings
• Leisure facilities, gyms and spas
• Housing associations and landlords
• Industrial and manufacturing sites
The level of risk will vary depending on the complexity of the water systems, the condition of the assets, how the building is used, and whether vulnerable people may be exposed.
Who can carry out a Legionella risk assessment?
A Legionella risk assessment should be carried out by someone competent.
Competence is not just about having attended a training course. The person carrying out the assessment should have suitable knowledge, experience and understanding of Legionella control, water systems, relevant guidance and the practical risks that can occur within different types of premises.
HSE describes a competent person as someone with sufficient authority, competence, skills, knowledge of the system and experience.
For many businesses, using an external specialist provider is the most practical route, particularly where the site has complex water systems, vulnerable occupants, limited internal expertise or previous compliance issues.
However, it is still important to remember that appointing an external provider does not remove the dutyholder’s responsibility. The dutyholder remains responsible for ensuring that Legionella risk is properly managed.
What should you look for in a Legionella risk assessment provider?
When comparing Legionella risk assessment companies, it is worth looking beyond price and availability.
Here are the key areas to check.
1. Relevant experience with your type of premises
A provider should understand the type of building you operate.
For example, a care home has different risk considerations to a small office. A school has different usage patterns to a hotel. A dental practice may have specialist waterline considerations. A leisure facility may have showers, spa pools or other higher-risk systems.
Ask whether the provider has experience with your sector.
This is particularly important if your site includes:
• Vulnerable people
• Complex hot and cold water systems
• Multiple buildings
• Stored water
• TMVs
• Showers or spray outlets
• Spa pools, hot tubs or hydrotherapy equipment
• Periods of low use
• Previous Legionella detections
• Historic remedial actions that have not been completed
A good provider should be able to explain the common risks in your type of premises and tailor the assessment accordingly.
2. Knowledge of ACOP L8, HSG274 and BS 8580-1:2019
A Legionella risk assessment provider should understand the key UK guidance and standards that apply to Legionella control.
This includes:
• ACOP L8, which gives practical guidance on controlling Legionella bacteria in water systems.
• HSG274, which provides technical guidance on managing Legionella risk in different types of water systems.
• BS 8580-1:2019, which gives recommendations and guidance on risk assessments for Legionella control in artificial water systems.
The provider should be able to explain how their assessment approach aligns with these documents.
Be cautious of vague claims such as “fully compliant report” if the provider cannot explain what their assessment includes, how risks are evaluated, or how findings are prioritised.
3. Legionella Control Association membership
The Legionella Control Association, often referred to as the LCA, operates a Code of Conduct and Service Standards for companies providing Legionella control services. LCA members commit to helping customers prevent legionellosis and keep water systems safe.
Using an LCA member can provide additional reassurance that the company is operating under recognised industry standards for service delivery.
However, it is still important to check the scope of services offered, the experience of the assessors and the quality of the reports produced.
LCA membership should be seen as an important indicator, but not the only factor in your decision.
4. Clear reporting, not just a long document
A Legionella risk assessment report should be detailed enough to evidence the assessment, but clear enough for the dutyholder or responsible person to act on.
A good report should usually include:
• Details of the site and water systems assessed
• Identification of relevant assets
• Findings from the inspection
• Photographic evidence where useful
• Risk factors identified
• Areas of non-compliance or concern
• Clear remedial or corrective actions
• Priority ratings or risk levels
• Practical recommendations
• Information to support the written scheme of control
• Any limitations of the assessment
The report should not simply list observations. It should help you understand what needs doing, why it matters and what should be prioritised.
If the report is difficult to follow, lacks clear actions or does not distinguish between minor observations and higher-risk issues, it may not be useful for managing compliance.
5. Practical and proportionate recommendations
A good Legionella risk assessment provider should make recommendations that are proportionate to the risk.
Not every finding requires major remedial work. Equally, serious issues should not be understated.
For example, the following may require different levels of action depending on the site:
• Poor temperature control
• Stagnant pipework or dead legs
• Little-used outlets
• Stored water with sediment
• Missing or poorly fitting tank lids
• Inadequate TMV servicing
• Lack of monitoring records
• Missing written scheme of control
• Previous positive Legionella results with no evidence of follow-up
The provider should be able to explain why an action has been recommended and how it supports risk control.
Avoid providers who appear to use the assessment purely as a sales tool for unnecessary remedial work. The recommendations should be based on evidence, guidance and the actual risk presented by the system.
6. Ability to support you after the assessment
A Legionella risk assessment is not the end of the process.
Once the assessment is complete, the dutyholder or responsible person needs to make sure suitable control measures are in place and that any required actions are managed.
This may include:
• Updating or creating a written scheme of control
• Completing remedial works
• Implementing temperature monitoring
• Flushing little-used outlets
• Cleaning and disinfecting water systems where required
• Servicing TMVs
• Inspecting cold water storage tanks
• Reviewing records
• Training responsible staff
• Reassessing risk after significant changes
A strong provider should be able to help you understand what needs to happen next. They do not necessarily need to carry out every service themselves, but they should be able to provide clear guidance and support.
7. Understanding of your existing records
The assessor should not only inspect the physical water systems. They should also review relevant management records where available.
This may include:
• Previous Legionella risk assessments
• Written scheme of control
• Temperature monitoring records
• Flushing records
• Tank inspection records
• TMV servicing records
• Shower cleaning and descaling records
• Sampling results
• Remedial action records
• Training records
• Previous non-conformances
Records are important because they show whether control measures are actually being implemented and maintained.
A site may appear broadly acceptable during a single visit, but if there is no evidence of ongoing monitoring or control, the management risk may still be significant.
8. Site-specific assessment, not generic wording
One of the most important signs of a good Legionella risk assessment is whether it reflects the actual site.
Generic reports often use repeated wording, standard phrases and broad recommendations that could apply to almost any building.
A stronger assessment should reference specific systems, assets, observations and actions.
For example, instead of simply stating:
“Ensure temperatures are monitored.”
A more useful report would explain which outlets or systems require monitoring, what records are missing, and what should be added to the control programme.
Instead of stating:
“Clean tank if required.”
A clearer recommendation would explain the tank condition, the issue identified and whether cleaning, repair, replacement or further investigation is recommended.
The more site-specific the assessment is, the more useful it will be for compliance management.
9. Appropriate risk scoring and prioritisation
Risk scoring should help you understand which actions need attention first.
The provider should have a clear and consistent way of prioritising findings. This might include action priority, likelihood, risk rating or another structured method.
What matters is that the scoring is understandable and justified.
For example, a missing record may not always carry the same level of risk as a failed control measure. However, missing records across multiple areas may indicate a wider management system issue.
Likewise, a minor isolated issue may not require the same urgency as widespread temperature failures, poor tank condition, stagnant pipework or a lack of control scheme.
A good report should help you distinguish between:
• Immediate concerns
• High-priority corrective actions
• Planned remedial works
• Management system improvements
• Routine monitoring recommendations
This helps you plan budgets, assign responsibilities and demonstrate progress.
10. Clear communication and professional advice
Your provider should be able to explain findings in plain English.
A Legionella risk assessment can involve technical information, but the final advice should be understandable to the people responsible for acting on it.
Before choosing a provider, consider whether they are willing to:
• Explain their assessment process
• Discuss your site type and concerns
• Confirm what is included
• Clarify how findings are prioritised
• Explain what happens after the report is issued
• Provide support with follow-up actions
The relationship should feel professional, transparent and practical.
Questions to ask before appointing a Legionella risk assessment provider
Before choosing a provider, it can help to ask:
1. Are you a member of the Legionella Control Association?
2. Do your assessments follow ACOP L8, HSG274 and BS 8580-1:2019 guidance?
3. Do you have experience with our type of premises?
4. What will the assessment include?
5. Will you review our existing records and written scheme?
6. Will the report include clear actions and priority ratings?
7. Will the report identify management system issues as well as physical system risks?
8. Can you explain what support is available after the assessment?
9. Who will carry out the assessment and what experience do they have?
10. How will you help us understand what needs to happen next?
These questions can help you compare providers on quality, not just cost.
Warning signs when choosing a provider
Be cautious if a provider:
• Offers a very low-cost assessment without explaining what is included
• Cannot explain their assessment methodology
• Does not ask about your site type or water systems
• Produces generic reports with limited site-specific detail
• Does not review existing records
• Provides unclear or vague remedial actions
• Cannot explain risk scoring or priorities
• Focuses only on selling remedial works
• Does not reference relevant UK guidance
• Cannot provide evidence of competence or industry standards
A cheap assessment may cost more in the long run if it fails to identify important risks or leaves you without clear actions.
How often should a Legionella risk assessment be reviewed?
A Legionella risk assessment should be kept up to date and reviewed when there is reason to believe it may no longer be valid.
This may include:
• Changes to the water system
• Changes to building use or occupancy
• New vulnerable users
• Poor monitoring results
• Positive Legionella sample results
• Completion of significant remedial works
• Changes in management responsibility
• Evidence that control measures are not working
• A long period since the last assessment
There is no single fixed review period that applies to every site. The review frequency should reflect the level of risk, site complexity and whether there have been changes that could affect control.
Should you choose a local or national Legionella risk assessment provider?
This depends on your site portfolio and operational needs.
A local provider may be suitable for a single site or small number of premises in one area. A national provider may be more appropriate if you manage multiple sites across different regions and need consistent reporting, centralised account management and standardised compliance support.
When choosing between providers, consider:
• Site coverage
• Response times
• Sector experience
• Reporting consistency
• Ability to support multiple locations
• Quality assurance processes
• Ongoing service capability
For multi-site organisations, consistency is particularly important. Reports should be comparable across sites so that risks and actions can be prioritised properly.
What should happen after the Legionella risk assessment?
After the assessment, you should not simply file the report away.
The findings should be reviewed, actions should be assigned, and the written scheme of control should be updated where required.
The next steps may include:
• Reviewing the summary of findings
• Assigning responsibility for corrective actions
• Prioritising higher-risk issues
• Updating monitoring schedules
• Arranging remedial works where required
• Keeping evidence of completed actions
• Reviewing the written scheme of control
• Scheduling future monitoring, inspections or servicing
• Ensuring staff understand their responsibilities
A Legionella risk assessment is most effective when it becomes part of an active water safety management process.
Why choose Brodex Trident for Legionella risk assessments?
Brodex Trident provides Legionella risk assessments for a wide range of commercial, healthcare, education, residential and industrial premises across the UK.
Our assessments are designed to help dutyholders, responsible persons and facilities teams understand their water hygiene risks and take practical steps to manage them.
We can support with:
• Legionella risk assessments
• Written scheme of control reviews
• Hot and cold water monitoring
• Water sampling
• Cold water storage tank inspections
• Tank cleaning and disinfection
• TMV servicing
• Remedial works
• Ongoing water hygiene compliance support
Our approach is practical, clear and focused on helping clients understand what action is required and why.
If you are unsure whether your current Legionella risk assessment is suitable and sufficient, or you need a new assessment for your premises, our team can help.
Need a Legionella risk assessment?
If you are responsible for a building or water system, a suitable Legionella risk assessment is an important part of managing health and safety compliance.
Brodex Trident can help you assess the risk, understand your responsibilities and put suitable control measures in place.
Contact our team to discuss Legionella risk assessment support for your site or portfolio.
Common questions about choosing a Legionella risk assessment provider
Who is responsible for arranging a Legionella risk assessment?
The dutyholder, employer, landlord, managing agent or person in control of the premises is responsible for making sure Legionella risk is assessed and managed. An external provider can carry out the assessment, but responsibility for managing the risk remains with the dutyholder.
Does a Legionella risk assessment need to be carried out by an external company?
No. It can be completed internally if there is a competent person with suitable knowledge and experience. Many organisations use an external provider where systems are complex, vulnerable people may be exposed, or internal competence is limited.
What should a Legionella risk assessment include?
It should identify the water systems present, assess where Legionella could grow or spread, consider who may be exposed, review current controls and records, and provide clear actions to control the risk.
How do I know if a Legionella risk assessment provider is competent?
Look for relevant experience, evidence of training, knowledge of UK guidance, clear reporting, and the ability to explain findings and priorities in a practical way.
Is LCA membership important when choosing a provider?
LCA membership is a useful indicator because member companies commit to recognised service standards and a Code of Conduct. It should be considered alongside experience, competence, report quality and the provider’s understanding of your premises.
How often should a Legionella risk assessment be reviewed?
It should be reviewed when there are changes to the water system, building use, management responsibility, occupancy or risk profile, or where there is reason to believe the current assessment may no longer be valid.
What happens after a Legionella risk assessment?
The findings should be reviewed, actions should be prioritised, responsibilities assigned, and the written scheme of control updated where needed. Completed actions and ongoing monitoring should also be recorded.
