A hot tap came out at 43°C. Now what?

A hot outlet reading 43°C is two problems at once. It sits below the 50°C that distributed hot water should reach within a minute of running the tap, and it sits inside the 20–45°C band where legionella multiplies. So the reading is not a number you write in a box and move past. It is the start of a short piece of work, and whether you do that work, and whether you write it down, is what an auditor or a court will actually look at.

Here is the awkward truth about temperature monitoring. Every firm has a process for the routine reading: run the tap, wait, record, tick. A 43°C hot reading usually turns up on a normal monthly sentinel round, in among dozens of clean readings either side of it. Almost nobody has a written process for the reading that fails. The engineer knows roughly what to do, does some of it, and the record shows a low number with no story attached. That gap is where compliance quietly falls apart.

First, make sure the reading is real

A failed reading is worth confirming before it becomes a finding, because a bad measurement wastes everyone's time and a real one you talked yourself out of is worse. Run the outlet properly. Distributed hot water should reach 50°C within a minute of the tap running, so give it that minute before you write anything down; test where the temperature settles, reading the flow, not the first slug of cooled water sitting in the tap. Put the probe in the running stream, not against the spout or in the air above the basin.

What you must not do is average the problem away. Two good outlets and one at 43°C is not "fine on average". The 43°C outlet is the finding. If a surface probe on the pipe disagrees with an in-flow reading, trust the water and note both. One honest low number beats three comfortable ones.

If the reading holds up, it is now a finding, and it needs to leave your head and land somewhere permanent.

Write it down as if it will be read in court

A low reading recorded as a pencil note in the margin of a logbook is, for practical purposes, not recorded at all. HSE's guidance says monitoring records should be "signed, verified, or authenticated by a signature or other appropriate means" and kept for at least five years. A finding with no author and no date fails that test the moment someone leans on it.

So the record needs the outlet identified, the reading, the date, who took it, and the part people forget: what happened next. A reading of 43°C with a blank beside it reads, three years later, as a problem nobody dealt with. The same reading with an investigation and a remedial logged against it reads as a system working. For what a compliant entry should carry, see our logbook requirements guide.

Work out why it failed

A single low hot reading has a handful of usual causes, and naming the likely one on the day beats "will monitor". Common culprits:

• A failed or failing TMV bleeding cold water into the hot supply at or before the outlet. This is the most common reason a hot tap runs lukewarm, and a TMV that has drifted needs servicing, not another re-read.
• The calorifier set point too low, or a stratified cylinder delivering cooler water than the gauge suggests.
• A recirculation or return problem, so the outlet sits on a long run that has cooled by the time water reaches it.
• A dead leg, a length of pipe with little or no flow, holding tepid water that never clears.
• In summer, a cold main running warm and pre-warming the incoming supply, which shows up as marginal readings that were fine in February.

You will not always resolve the cause at the outlet, and that is fine. The point is to record a probable cause and a next step, not to leave the finding hanging.

Raise a remedial with an owner and a date

This is where readings go to die. A finding without an owner and a target date is a wish. Assign the fix to a named person, put a date on it, and re-check the outlet once the work is done, because a remedial you never verified is not closed, it is assumed. We wrote about how open actions turn into prosecutions separately, because the pattern is depressingly consistent.

Where a reading stays out of parameter after the obvious fix, escalate it the way your written scheme of control says to. Persistent failure at one outlet is a different animal from a one-off, and it may need the outlet taken out of use, a sample taken, or the assessment revisited. The written scheme exists precisely so the engineer on site does not have to invent the escalation path at 4pm on a Friday.

The cold side fails upward

Everything above is written for a lukewarm hot tap, but the cold side fails just as often and gets watched half as closely. Cold water should drop to 20°C or below within two minutes of running the outlet. A cold tap still sitting at 22 or 24°C after two minutes is inside the 20–45°C growth band exactly as a lukewarm hot tap is, and it earns the same workflow: confirm it, record it as a finding, and chase the cause.

The causes differ. A cold outlet running warm usually points to poor insulation, a cold main sharing a riser or ceiling void with hot pipework, a storage tank warming in a hot plant room, or an outlet with so little turnover that the standing water has drifted up to room temperature. In a heatwave, cold readings creep across a whole site at once, which is worth expecting rather than treating each one as a shock in July. The fix and the record look the same as on the hot side. The reading you must not shrug off is any reading, hot or cold, that lands in the band.

The reading is a trigger, not a footnote

The alternative is on record, and it is grim. When HSE prosecuted over the Legionnaires' death of Graham Butterworth at HMP Lincoln, part of the finding was that water temperatures were not monitored at all in October and November 2017. The fine was £600,000. A 43°C reading that you confirmed, investigated and closed is the opposite of that case. It is the paper trail that shows the system caught a problem and dealt with it.

This is the part BlueWave was built to hold together. When an engineer's form captures a hot reading below its target, the app flags it as an out-of-band finding rather than swallowing it into a row of numbers, and the remedial raised against it stays visible on the compliance record until someone closes it, with the reading, the investigation and the re-check all carrying who and when. The five-year retention is automatic, so the record that clears you in three years' time is already being built today.

Whatever you record it in, use this test on the exception path. Take your last out-of-parameter reading and try to reconstruct it from the record alone. Can you see what caused it, and can you see that someone re-checked the outlet after the fix? If the file goes quiet after the low number, the reading was a footnote, and a footnote is what gets you prosecuted.