The 'every two years' risk assessment rule isn't a rule

There is no rule that a legionella risk assessment must be reviewed every two years. People used to lean on a line that said so, but the fixed two-year review frequency was removed from ACOP L8 when the 4th edition landed in 2013. What replaced it asks more of you, not less: the assessment must be reviewed regularly and whenever there is reason to believe it is no longer valid.

That sounds softer. It is not. "Every two years" is a date you can put in a diary and forget. "Whenever it is no longer valid" means you have to keep noticing whether your building has changed, which is a harder discipline than turning up biennially with a clipboard. The two-year habit lulls people into treating a live document as a periodic chore.

What actually triggers a review

The trigger is change, not the calendar. The routine monitoring cadence runs on the calendar; the assessment review does not. A review is due when something about the system or the way the building is used moves the risk. In practice that means:

• Alterations or refurbishment to the water system, including any pipework you added or capped.
• A change of use or occupancy: a wing repurposed, or a floor let to a new tenant.
• Part of the building mothballed or left at low occupancy, so outlets that used to flow now sit stagnant.
• A new dead leg created by plumbing changes, which is easy to create and easy to forget.
• Monitoring results that keep coming back out of spec, which should already be raising remedial actions and which tell you the control scheme the assessment assumed is not holding.
• An incident or a near-miss.
• A change of responsible person, who inherits a system they did not assess.

Any one of these can invalidate an assessment that was accurate the day it was signed, and usually the written scheme of control underneath it needs the same fresh look. The calendar cannot see them. Only somebody paying attention can.

What a review actually checks

Reviewing is not re-dating the front page. A real review holds the document up against the building and looks for daylight between them. The first check is the inventory: do the tanks, calorifiers, TMVs and outlets on paper still match what you can walk through today? Monitoring is the second, and drifting temperatures or samples are telling you the controls the assessment assumed are not doing what it expected. The written scheme is the last of the three, and it should still describe how you run things now, not how you ran them three refurbishments ago.

Where those line up, the review can honestly conclude that nothing material has changed. That is a legitimate outcome, not a failure to find fault. What it cannot be is silent, because a review that leaves no trace is indistinguishable from a review that never happened.

The failure mode is drift

Here is how it actually goes wrong. The assessment is done well, filed, and treated as complete. Over the next few years the building quietly changes: a store room becomes an office with its own basin, a boiler is swapped out. None of these changes feels like a legionella event at the time, so none of them prompts anyone to open the assessment. The document slowly stops describing the building it is supposed to describe. Guidance on duty-holder responsibilities makes the same point, that an assessment left to gather dust while the system changes around it has stopped being a risk assessment and become a historical record.

The two-year myth makes this worse, because it gives everyone a reason to relax for 24 months at a time. A building can change a great deal in 24 months.

The change that never got captured

The clearest illustration is the Royal United Hospitals Bath case. A ward annex was opened in 2009 on a separate water loop, and it was never added to the monitoring programme. A patient later died, in 2015, after contracting Legionnaires' disease. The HSE inspector's account of why the controls failed is worth quoting directly: the trust lacked "accurate knowledge of the layout of those water systems". The fine was £300,000.

The monitoring was not done badly on the annex. The annex was invisible to the programme. The system had grown and the paperwork had not, and nobody reconciled the two until after someone died. No two-year review cycle would have caught this reliably, because the failure was structural: the thing that changed was never entered into the record the reviews looked at. A review is only as good as the map it reviews against, and the annex was never on the map.

A recorded conclusion, or none at all

HSE's guidance splits records in two. Monitoring results are kept for at least five years; the general records, meaning the responsible people, the significant findings and the written scheme, are kept while current and for two years after. A review and its conclusion are significant findings. If you employ five or more people you are required to record significant findings, and below that threshold you still should, because an unrecorded "we looked and it was fine" is worth nothing the day someone asks you to prove it.

So a review that changes nothing still produces a line: who reviewed it, when, what they checked, and the conclusion that no action was needed. That line is cheap to write and expensive to be without.

Make change visible instead of remembered

The lesson is not "review more often", though you might. It is that your assessment is only as current as your knowledge of what you are assessing. If the only place your building's water system lives is in one person's memory and a PDF from three years ago, drift is inevitable. When a change happens, a new outlet or a capped leg, it has to land somewhere the next review will actually see.

That is the quiet argument for keeping a live asset and site register rather than a static survey. BlueWave holds every site's water assets as records with their own service history, so a new calorifier or a decommissioned tank is a change to the asset register, visible on the site, not a fact that depends on the right person remembering to mention it. The register is what a review reads against, which turns "is this assessment still valid?" from a memory test into a comparison.

One test to finish on. Walk your largest site with the risk assessment in hand, and check whether every water asset in front of you appears in it, and whether everything in it is still in front of you. If the building and the document have drifted apart, the date of your last review is beside the point.