Monthly temperature monitoring that doesn't leak

Monthly temperature monitoring is the most repeated task in water hygiene, and the most repeatedly botched. It fails in three specific ways, and they are worth naming because each needs a different fix. Scope: the wrong outlets get tested, or some never do. Rhythm: a month gets skipped because the person who does the round was away. Transcription: the reading is right on the pad and wrong in the spreadsheet.

None of these is exotic. A review of common legionella monitoring failures lists them almost exactly: monitoring too infrequently, testing the wrong outlets, and never investigating readings that came back out of limits, on top of the incomplete records, transcription errors and coverage gaps that manual logging produces when someone is off. The task is simple. Keeping it from leaking is the hard part, and the leaks are predictable.

Scope: the outlets, not a habit

The monthly round is built on sentinel outlets, and HSG274 Part 2 is specific about which they are. Hot at the outlets nearest to and furthest from the calorifier. Cold at the outlets nearest to and furthest from the storage tank. Plus the calorifier flow and return. That set, monthly, is the floor.

The floor is not the whole building, and this is where scope quietly narrows. Sentinels are chosen to represent the extremes of the system, but the outlet nobody has tested for two years is exactly the one that grows something. That is what the quarterly rotating check of a representative selection of other outlets is for: over a defined period, every outlet gets covered, rather than the same handful forever. Drop the rotation and keep the sentinels, and your monitoring looks busy while a whole wing of the building goes unwatched. The sentinels are the floor. The rotation is what actually catches the building.

Testing the wrong outlets is rarely a decision. It is drift. The sentinel furthest from the calorifier is up three flights in a locked cupboard, and the one by the boiler-room door is thirty seconds away, so over a few busy months the round relocates to whatever is convenient. The readings still get logged and the sheet still fills up, and nothing looks wrong until an assessor asks to see the furthest outlet and the record for it has thinned to almost nothing. For the full task-by-task cadence, we put every water hygiene frequency on one page.

Rhythm: the month that didn't happen

A monthly task depends on someone doing it every month. When that someone is off and nobody covers the round, the record shows nothing for that period, and a gap in a monitoring record is not a neutral absence. It reads, to anyone who looks later, as monitoring that did not happen.

Cover is where it breaks, because the knowledge is personal. The engineer who does that site knows which cupboard, which key, and which tap is the real sentinel rather than a decoy someone mislabelled in 2019. Hand the round to a colleague at short notice, and half of that walks out the door with the person who is off.

The consequences are not hypothetical. In December 2024, Amey Community Ltd was fined £600,000 after a prisoner died of Legionnaires' disease at HMP Lincoln, and part of the finding was blunt: water temperatures simply were not monitored in October and November 2017. Two months of the most basic control task, absent, in the run-up to a death. The gap was the failure.

Transcription: the pad-to-spreadsheet hop

The third leak is the quietest. A reading taken correctly on site is copied, later, into a spreadsheet, and somewhere in that hop a 5 becomes a 6. The values that matter sit close together. Stored hot water should be 60°C or above, distributed hot 50°C or above within a minute, cold 20°C or below within two minutes, and the whole regime exists to keep water out of the 20 to 45°C band where legionella multiplies. A calorifier logged as 62 passes. The same reading transcribed as 52 fails. One transposed digit, and a compliant system looks like a breach, or a real breach hides behind a tidy number.

The deeper problem with the hop is timing. A reading that fails should be acted on where it fails, in the plant room, while the engineer and their tools are still there. If the failure only surfaces days later when the numbers are typed up, the response is late by design. We wrote about what should happen the moment a reading fails separately, because the exception path is where most programmes are thinnest.

Let the outlet list drive the work

All three leaks close the same way: the list of outlets drives the round, not the engineer's memory of it. Build the monthly form from the actual assets on the site, one row per sentinel, and the round can't shrink unnoticed to the four taps nearest the door. A required row can't be left blank without someone noticing. Validate each reading against the control values as it is entered, and the 62-that-should-be-52 gets caught on the spot instead of three days later. Flag the out-of-band reading the instant it is typed, and the failure becomes a prompt on site rather than a discovery at month-end.

That also closes the transcription leak at the root, because there is no second copy. The reading is entered once, on site, into the record. The office reviews it rather than re-typing it, which is a separate saving we wrote about on its own.

This is why the asset and site register sits under the whole thing in BlueWave. Each site's outlets, tanks, calorifiers and TMVs are recorded once, and the monthly monitoring form is seeded from that register: a row per sentinel outlet, the same set every month, nothing depending on whether the engineer remembers the layout of a building they visit twelve times a year. Each reading is captured once, on the form, against the specific outlet, so the finished record shows exactly what was tested and, just as usefully, what wasn't.

The register is the part that makes the rhythm hold. If the list of what must be checked lives in the system rather than in one experienced engineer's head, the round survives that engineer being on holiday, which is precisely when the gaps used to open.

The honest test of a monthly programme isn't whether last month got done. It is whether you would know if it hadn't. Pull the flushing and temperature logs for the site you visit most, and look for the quiet gap: the month with three readings instead of thirty, the wing that hasn't appeared in the rotation since last spring. If a gap like that could sit there unnoticed until an assessor found it, the programme is already leaking. You just haven't been billed for it yet.