Legionella Control Association registration is voluntary, scoped by service category and audited annually, so a logo proves less than buyers assume. Check the registration categories, the individual assessor's competence, whether the laboratory holds UKAS accreditation, and how sampling and remedial work are separated from the assessment. Twelve checks and the exact questions to ask before you appoint are listed below.
The legionella market sells three different things under one label. A risk assessment is a survey and a written judgement. Monitoring is a recurring visit that takes temperatures and records them. Remedial work is plumbing. Most buyers ask for a price on the first, receive a proposal that quietly bundles all three, and then cannot compare it with anything.
The duty sits in regulation 6(1) of the Control of Substances Hazardous to Health Regulations 2002, which requires a suitable and sufficient assessment of the risk before work liable to expose employees is carried out. Regulation 6(3) creates the review duty, regularly and forthwith where there is reason to suspect the assessment is no longer valid or the work has significantly changed. Sections 2 and 3 of the Health and Safety at Work etc. Act 1974 carry the general duties to employees and to everyone else, and section 3 is the provision HSE used when Sanctuary Housing Association was fined 900,000 pounds plus 11,480.60 pounds costs at Liverpool Crown Court on 22 October 2024 over water system contamination in a residential block.
The Approved Code of Practice L8, fourth edition, is not law, but section 17 of the 1974 Act gives it evidential weight. If you are shown to have departed from it, the court takes the breach as proved unless you can show you complied by some other means. What L8 does not do is tell you how to buy. It says at paragraph 83 that service providers should ensure their staff and contractors are "properly trained to a standard appropriate to the various tasks they perform, such as risk assessment, advising on water treatment measures, sampling or cleaning and maintaining water systems", and at paragraph 57 that the Legionella Control Association Code of Conduct is "an illustration of the levels of service to expect from Service Providers". The rest is your judgement. The full legionella risk assessment duty and review cycle is covered separately.
Check the firm
1. Registration, and what it is scoped to. Legionella Control Association registration is voluntary, but it is audited annually by occupationally competent assessors, non-conformances must close within three months, and membership can be suspended at three months and terminated at six. Critically, registration is granted per service category. The published categories include legionella risk assessment services split by system type, water treatment services, hot and cold water monitoring and inspection services, cleaning and disinfection services, independent consultancy services, training services, legionella monitoring services split into sampling and interpretation of analysis, and plant and equipment services. Ask: "What is your LCA registration number, what is the current registration period, and which categories are you registered for?" Worry if the firm is registered for monitoring but not for risk assessment and is quoting you for a risk assessment.
2. Whether the scope of registration matches your building. The risk assessment categories are split by system, covering hot and cold water systems, evaporative cooling systems, process and other systems, and healthcare. A firm registered only for hot and cold water is not registered for your cooling tower or your spa pool. Ask: "Which system types on my site fall inside your registration, and which do not?" Worry if the answer treats a cooling tower or a spa pool as the same instruction as a domestic hot and cold water system. If you operate cooling towers or evaporative condensers you also have a separate notification duty to the local authority under the Notification of Cooling Towers and Evaporative Condensers Regulations 1992.
3. The competence of the individual who attends. There is no mandatory qualification for a legionella risk assessor anywhere in the UK. The Water Management Society publishes a risk assessor qualification route and awards its own certificate, and its classroom courses carry a City and Guilds number, but none of this is a legal requirement and none of it is a licence. BS 8580-1:2019, the code of practice for legionella risk assessments, deals with assessor competence at section 5.1. Ask: "Who will carry out the survey, what training and how many years on my building type, and what does your firm's competence record show for them?" Worry if the firm names no individual, or if the LCA audit findings point at training records, which the association itself has identified as a recurring member vulnerability.
Check the delivery
4. Capacity and the real lead time. Ask: "How many assessors do you employ directly, what is the current lead time to survey, and when will the last report land?" Worry if a portfolio survey is offered inside a week with no site count questions asked, and worry if monitoring visits are subcontracted while the assessment is done in house, because the two then drift apart.
5. Coverage across a multi-site portfolio. Consistency is the point. A portfolio with one assessment methodology and one asset register is defensible. A portfolio with six formats is not. Ask: "Will you use one schematic and asset register format across all sites, and will the same assessor cover them?" Worry if the firm cannot say who owns the asset register, or if each site is priced as an isolated job with no portfolio view.
6. Sampling, and who does it. Sampling is a separate discipline from assessment. HSE guidance states that samples should be tested by a UKAS accredited laboratory taking part in a water microbiology proficiency testing scheme such as the one run by the UK Health Security Agency, that the laboratory should apply a minimum theoretical detection limit of no more than 100 legionella bacteria per litre for culture based methods, and that sampling should be carried out in accordance with BS 7592, with any biocide neutralised where possible. Ask: "Which laboratory, what is its UKAS accreditation, what detection limit does it report to, and is your sampler trained to BS 7592?" Worry if the laboratory is unnamed, or if the answer is that testing is done in house without accreditation. The legionella testing frequencies that apply in care settings show why this matters most where the population is vulnerable.
Check the output
7. Reporting format, and whether findings are actionable. A legionella risk assessment that does not contain a schematic, an asset register, a written scheme of control and a prioritised action plan is a document you cannot operate from. Ask: "Can I see a redacted assessment for a building like mine, including the schematic and the action plan?" Worry if the sample has no schematic, or if every action is marked as high priority, which usually means none of them has been thought about.
8. Remedial independence and the conflict it creates. No published HSE or standards guidance prohibits the assessor from carrying out the remedial and monitoring work, so this is your commercial judgement. The structural point stands. The firm writing the action list is often the firm that will price it, and the Legionella Control Association recognises independent consultancy as a separate registration category precisely because the distinction exists. Ask: "Do you or an associated company price the remedials, and how do you separate the two?" Worry if the assessment fee is unusually low and the proposal assumes a monitoring contract.
9. Insurance, and whether it covers the advice. Public liability responds to damage on site. It does not respond to a negligent assessment. Ask: "What is your professional indemnity limit, is it any one claim or in the aggregate, and does the policy cover advisory work?" Worry if only employers' liability and public liability certificates are produced.
Check the aftercare
10. Review policy, and what triggers one. The regulation sets a trigger based test, not a calendar. Ask: "What changes on my site would trigger a review, and how will you know they have happened?" Worry if a two year review cycle is described as a legal requirement, because regulation 6(3) says regularly and forthwith on change, and the two year figure is convention.
11. Subcontracting policy. Ask: "Which parts of this instruction do you subcontract, to whom, and are they LCA registered in that category?" Worry if monitoring, tank cleaning or chlorination is subcontracted to firms the contractor will not name, because your record then depends on a company you have never assessed.
12. References you can actually check. Ask: "Give me two clients with my building type whose risk assessments you completed in the last twelve months, and who will take a call." Worry if the references are all from a different sector, or if the only evidence offered is a client logo wall. You can also search the HSE public register of convictions for the firm's name, which is a free check almost nobody runs.
What the four nations do differently
Health and safety law is not devolved to Scotland or Wales, so the 1974 Act, COSHH 2002 and L8 apply identically across Great Britain. Northern Ireland runs a mirrored but separate statute book, principally the Health and Safety at Work (Northern Ireland) Order 1978 and the COSHH Regulations (Northern Ireland) 2003, regulated by HSENI, which has formally approved L8 for use in Northern Ireland.
Healthcare is where the divergence is real, and it is the fastest question to ask a contractor bidding for clinical space.
| Nation | Statutory regime | Healthcare water guidance |
|---|---|---|
| England | HSWA 1974, COSHH 2002, ACOP L8, HSG274 | HTM 04-01 Parts A, B and C, published by NHS England in 2016, plus the D08 supplement on thermostatic mixing valves |
| Wales | Identical to England | WHTM 04-01 Part B, published 2016 by NHS Wales Shared Services Partnership, expressly based on the English 2016 document |
| Scotland | Identical to England | SHTM 04-01 Parts A to G, published by NHS National Services Scotland |
| Northern Ireland | Health and Safety at Work (NI) Order 1978 and COSHH (NI) 2003, regulated by HSENI, with L8 formally approved for use | Nation specific healthcare water guidance not established |
If you operate hospitals or clinical space in more than one nation, ask the contractor which memorandum it is assessing against, by name and part. A firm that answers with the English document for a Scottish site has told you something useful.
Turning twelve answers into a decision
Score every firm out of two on each check, zero for no answer, one for a verbal answer, two for evidence in writing. The pattern to watch for is a firm that scores well on registration and badly on sampling, laboratory accreditation and remedial separation, because registration is the part most easily displayed. The same method applies across every discipline you buy, and is set out in the contractor vetting and accreditation guide alongside the wider duty holder guide to UK building compliance. Operators of vulnerable settings should read it with the care home statutory compliance checklist or the hotel statutory compliance checklist open alongside.
Running these checks across a market is what we do
TICDesk is a matching desk. You submit one brief describing what your buildings need. We approach credible firms anonymously with that scope and area, check accreditation, insurance, capacity and coverage, and return a match pack of three confirmed firms within 48 hours. It is free to you, there is no obligation, and your identity is not shared with any firm until you approve it. If a strong firm responds late, we flag it in a second wave. We are paid by the supply side, not by you. We do not carry out risk assessments, sampling or water treatment ourselves. The water hygiene service line sets out what we cover.
Frequently asked
Is Legionella Control Association registration a legal requirement?
No. The Legionella Control Association describes itself as a voluntary, independent, not for profit organisation. The Approved Code of Practice L8 refers to its Code of Conduct only as an illustration of the levels of service to expect from service providers. Registration is still the most useful single signal available to a buyer, because it is audited annually and scoped by service category, but it is evidence rather than compliance.
Who is legally responsible for the legionella risk assessment?
The duty holder, normally the employer or the person in control of the premises. Regulation 6(1) of the Control of Substances Hazardous to Health Regulations 2002 requires a suitable and sufficient assessment of the risk before work liable to expose employees is carried out. HSE states that carrying out a risk assessment is your responsibility, and that if you are not competent to do it yourself you should call on help from a competent person.
Does the water sample have to go to a UKAS accredited laboratory?
HSE guidance states that water samples should be tested by a UKAS accredited laboratory that takes part in a water microbiology proficiency testing scheme such as the one run by the UK Health Security Agency. The same guidance says the laboratory should apply a minimum theoretical detection limit of no more than 100 legionella bacteria per litre for culture based methods. Ask for the laboratory name and its accreditation schedule.
How often does a legionella risk assessment need to be reviewed?
Regulation 6(3) of COSHH requires the assessment to be reviewed regularly, and forthwith if there is reason to suspect it is no longer valid or there has been a significant change in the work. There is no fixed statutory interval. A contractor selling a mandatory two year cycle is describing common practice rather than the regulation, so ask which triggers they will monitor on your behalf.
Should the same firm assess the risk and carry out the remedial work?
No published HSE, Legionella Control Association or standards guidance prohibits it, so treat it as commercial judgement rather than a compliance rule. The Legionella Control Association does register Independent Consultancy Services as a distinct category, which tells you the market recognises the distinction. Where the remedial spend is material, separate the assessment from the works and put the works out on the assessment findings.
Sources & further reading
