The 'every two years' risk assessment rule isn't a rule

There is no rule that a legionella risk assessment must be reviewed every two years. People used to lean on a line that said so, but the two-year frequency was removed from ACOP L8 in 2013, when the fourth edition landed. What replaced it asks more of you, not less: the assessment must be reviewed regularly and whenever there is reason to believe it is no longer valid.

That sounds softer. It is not. "Every two years" is a date you can put in a diary and forget. "Whenever it is no longer valid" means you have to keep noticing whether your building has changed, which is a harder discipline than turning up biennially with a clipboard. The two-year habit lulls people into treating a live document as a periodic chore.

What actually triggers a review

The trigger is change, not the calendar. The routine monitoring cadence runs on the calendar; the assessment review does not. A review is due when something about the system or the way the building is used moves the risk. In practice that means:

• Alterations or refurbishment to the water system, including any pipework you added or capped.
• A change of use or occupancy: a wing repurposed, or a floor let to a new tenant.
• Part of the building mothballed or left at low occupancy, so outlets that used to flow now sit stagnant.
• A new dead leg created by plumbing changes, which is easy to create and easy to forget.
• Monitoring results that keep coming back out of spec, which should already be raising remedial actions and which tell you the control scheme the assessment assumed is not holding.
• An incident or a near-miss.
• A change of responsible person, who inherits a system they did not assess.

Any one of these can invalidate an assessment that was accurate the day it was signed, and usually the written scheme of control underneath it needs the same fresh look. The calendar cannot see them. Only somebody paying attention can.

What a review actually checks

Reviewing is not re-dating the front page. A real review holds the document up against the building and looks for daylight between them. The first check is the inventory: do the tanks, calorifiers, TMVs and outlets on paper still match what you can walk through today? Monitoring is the second, and drifting temperatures or samples are telling you the controls the assessment assumed are not doing what it expected. The written scheme is the last of the three, and it should still describe how you run things now, not how you ran them three refurbishments ago.

Where those line up, the review can honestly conclude that nothing material has changed. That is a legitimate outcome, not a failure to find fault. What it cannot be is silent, because a review that leaves no trace is indistinguishable from a review that never happened.

The failure mode is drift

Here is how it actually goes wrong. The assessment is done well, filed, and treated as complete. Over the next few years the building quietly changes: a store room becomes an office with its own basin, a boiler is swapped out. None of these changes feels like a legionella event at the time, so none of them prompts anyone to open the assessment. The document slowly stops describing the building it is supposed to describe. Guidance on duty-holder responsibilities makes the same point, that an assessment left to gather dust while the system changes around it has stopped being a risk assessment and become a historical record.

The two-year myth makes this worse, because it gives everyone a reason to relax for 24 months at a time. A building can change a great deal in 24 months.

The change that never got captured

The clearest illustration is the Royal United Hospitals Bath case. The trust pleaded guilty to breaching section 3(1) of the Health and Safety at Work etc Act 1974, and was fined £300,000 plus £37,451.78 costs at Bristol Crown Court in April 2018. HSE said the annex to the hospital's William Budd ward is on a separate loop of the water system from the one supplying the main ward, that the trust had not recognised this between the annex opening in 2009 and 2015, and that the required temperature checks and legionella tests were not carried out there in that period. A patient died of Legionnaires' disease in July 2015; HSE said the strain that caused the death was not the same as the one found in the water system. HSE inspector Susan Chivers said RUH "had measures in place to prevent and control the risk to its patients from exposure to legionella from its water systems, but these were ineffective due to the Trust not having accurate knowledge of the layout of those water systems".

The guidance asks for a review whenever there is reason to suspect the assessment is no longer valid, and a change to the water system is the reason that gets skipped. A system grows and the record of it does not. A review is only as good as the map it reviews against, and no review cycle, two-yearly or otherwise, can check a part of the system it does not know exists. The map has to be kept true first.

A recorded conclusion, or none at all

HSE's guidance splits records in two. Monitoring results are kept for at least five years; the general records, meaning the responsible people, the significant findings and the written scheme, are kept while current and for two years after. A review and its conclusion are significant findings. If you employ five or more people you are required to record significant findings, and below that threshold you still should, because an unrecorded "we looked and it was fine" is worth nothing the day someone asks you to prove it.

So a review that changes nothing still produces a line: who reviewed it, when, what they checked, and the conclusion that no action was needed. That line is cheap to write and expensive to be without.

Make change visible instead of remembered

The lesson is not "review more often", though you might. It is that your assessment is only as current as your knowledge of what you are assessing. If the only place your building's water system lives is in one person's memory and a PDF from three years ago, drift is inevitable. When a change happens, a new outlet or a capped leg, it has to land somewhere the next review will actually see.

That is the quiet argument for keeping a live asset and site register rather than a static survey. BlueWave holds every site's water assets as records with their own service history, so a new calorifier or a decommissioned tank is a change to the asset register, visible on the site, not a fact that depends on the right person remembering to mention it. The register is what a review reads against, which turns "is this assessment still valid?" from a memory test into a comparison.

One test to finish on. Walk your largest site with the risk assessment in hand, and check whether every water asset in front of you appears in it, and whether everything in it is still in front of you. If the building and the document have drifted apart, the date of your last review is beside the point.