The risk assessment wasn't the failure. The open actions were

Read the enforcement notices closely and a pattern shows up. The legionella risk assessment is rarely the thing that gets a company prosecuted. What gets prosecuted is the list of actions that assessment produced, sitting untouched, while the risk it described carried on unchecked.

Amey Community Limited is the case to sit with. HSE said the company failed to act on a risk assessment carried out in 2016, and failed to put in place a written scheme for preventing and controlling legionella risks. Its investigation also found the company failed to ensure appropriate water temperatures were maintained, and failed to monitor them in October and November 2017. The investigation followed the death of an inmate: HSE said Graham Butterworth, 71, died on 5 December 2017 after contracting Legionnaires' disease while serving a prison sentence at HMP Lincoln. The company pleaded guilty to breaching section 3(1) of the Health and Safety at Work etc. Act 1974 and was fined £600,000 with £15,186.85 costs at Lincoln Magistrates' Court on 3 December 2024. An assessment is a starting gun, not a finish line.

The gap is where the prosecutions live

Bupa Care Homes (BNH) Ltd tells the same story on a longer timeline. The Court of Appeal judgment records that Kenneth Ibbetson, 84, died of Legionnaires' disease on 23 June 2015 while a resident of the company's Hutton Village Nursing Home. It records a fine of £3,000,000 at the Crown Court at Ipswich on 14 June 2018, quashed on appeal and replaced with £1,500,000.

The sequence matters more than the number. A standard issued in 2012 required flushing and disinfection after construction works, the judgment says, and the judge found that no such flushing and disinfection took place after the refurbishment. The same judgment says the risk had been recognised "as long ago as 2012" by the company's estate surveyor, who had carried out a risk assessment noting that the steps taken to tackle it were insufficient. The judge also found that the home's manager, to whom responsibility for legionella had ultimately been devolved, had not had appropriate training. A maintenance man dismissed in 2014 had falsified records, the judgment notes.

The judgment separates two things, and it is worth keeping them apart. The judge found that the systemic maintenance failures were not the cause of Mr Ibbetson contracting the disease, and concluded that the most likely cause was the failure to flush and disinfect pipes and fittings installed during the refurbishment work. An old finding stops being a warning. It becomes a record of what you knew.

Sanctuary Housing Association shows how long the tail is: conduct in 2018, sentence in 2024. All 44 samples taken from the water systems at Vincent Naughton Court, a sheltered housing scheme in Birkenhead, tested positive for legionella in July and August 2018, HSE said. Its investigation found legionella during testing on 16 and 31 July, and a letter to residents dated 3 August that failed to tell them to avoid using their showers. The association pleaded guilty to breaching section 3(1) of the Health and Safety at Work etc. Act 1974 and was fined £900,000 with £11,480.60 costs at Liverpool Crown Court on 22 October 2024. HSE inspector Rose Leese-Weller said the company "had not provided its staff with adequate instruction and training". Six years between the samples and the sentence, and the samples never stopped being evidence.

The pattern is not confined to the private sector. HSE prosecuted Tendring District Council after a customer contracted Legionnaires' disease at its Walton-on-the-Naze Lifestyles leisure centre. The council pleaded guilty to a single charge relating to its legionella management systems and was fined £27,000, with costs, at Colchester Magistrates' Court in December 2018. Chief executive Ian Davidson said the council "was not ignorant of Legionella, but our systems for managing the risk fell short of the standard they should have been". He also said the council closed the showers and then the leisure centre as soon as it became aware of the shortcomings, and brought in a specialist contractor. Knowing about legionella and having a system that closes actions are different things.

What these cases have in common is the paperwork. In the Bupa case the court found that a 2012 assessment had already named the hazard. In the Amey case HSE found a 2016 assessment the company had not acted on. Naming a hazard does not reduce it. A risk you have documented and not acted on is arguably worse than one you never assessed, because now there is a written record of you knowing. Sample results protect nobody until someone reads them and acts.

Why the fines stopped being survivable

If these numbers look larger than legionella fines used to be, they are, and the change was deliberate. The Sentencing Council's definitive guideline for health and safety offences came into force on 1 February 2016. It sets the fine from the culpability of the offender and the risk of harm created by the offence, with separate sentencing tables by organisation size, and size is set by annual turnover. You do not need a death for the numbers to hurt. The Council's own assessment of the guideline found the median fine for large and very large organisations rose from £25,000 to £370,800. The smaller bands moved too: micro and small from £20,100 to £45,200, medium from £20,000 to £100,000. The giants got the headline numbers. The smaller bands are where a fine stops being a line item.

That is the point that should change behaviour. The old mental model, no outbreak so no real exposure, is gone. HSE's inspector said it was "very fortunate that none of the residents became ill" at Vincent Naughton Court, and the fine was still £900,000. A monitoring programme with gaps in it creates risk of harm whether or not anyone fell ill, and that is now what the fine is calculated against.

Run an open-actions register and actually close it

The fix is unglamorous and it works. Every finding from a risk assessment, and every failed monitoring result, whether a temperature reading out of parameter or a positive sample, becomes an action with two things attached: a named owner and a due date. No owner means no one is doing it. No date means it is not scheduled, which means it is not happening.

What goes in a row should be specific enough to act on without a phone call. "TMV issue, upstairs" is not a row. "TMV3 on the second-floor washroom failing at 41°C, owner J. Ross, re-check due in 14 days" is a row. And "closed" has to mean verified, not "the engineer says it is done". An action you marked closed on trust is an open action wearing a disguise, and it is the one that surfaces in an investigation. A register at that resolution also survives a change of staff, because the next person can read it, which a shared memory cannot.

Then it needs a review rhythm. Once a month, someone senior enough to chase people looks at the open actions and asks what has moved. The review does not need to be long. It needs someone with authority reading the overdue items back to the people who own them, because discomfort is the mechanism, and a register that never embarrasses anyone is decoration. An action log nobody reads is the same as no log, with extra filing.

A short, honest register beats a long, aspirational one. Ten open actions with real dates and a person against each is a controlled site. Forty vague "ongoing" items is a site that has stopped counting.

Be careful who marks their own homework

One structural weakness deserves naming. It is common for the same contractor to carry out the risk assessment and then win the remedial work it recommends. That is not automatically wrong, and often the assessor is the right firm to do the fixing. But the findings still deserve follow-through that someone other than the contractor can see and check.

If the assessor's report lists twelve actions and the duty holder never reads past the summary, the loop is closed by the one party with a commercial interest in how it is closed. Keep the actions in your own register rather than in the assessor's PDF. Sign them off yourself. The duty to control the risk stays with the duty holder no matter who holds the clipboard, and the duties under ACOP L8 do not transfer with it. The assessment is not a permanent artefact either; it needs review when the building changes, which is its own widely misunderstood rule.

None of this is complicated, which is what makes the prosecutions so bleak. Flushing, temperature checks, a training record, a written scheme: ordinary work, and easy to leave half-finished. Closing the loop is the part that gets skipped.

This is the specific gap BlueWave is built to close. Findings and failed checks become actions with an owner and a date, and they stay on the compliance record until someone marks them done, carrying the timestamp of who closed them and when. Overdue actions surface as overdue rather than sinking to the bottom of an inbox, so the monthly review has something concrete to chase instead of a vague sense that things are probably fine.

If you do one thing after reading this, open your last risk assessment and count the actions it raised. Then find out, from a record and not from memory, how many are closed. The distance between those two numbers is your actual exposure.