Work through all 19 modules, then generate your completion record.
0/19 modules complete0%
The law and who owns it
Module 1
You and the rules
There's a law that says you must. And a code that shows you how.
Module 2
It stays with you
You can ask someone else to do the work. But if something goes wrong, it's still yours.
Module 3
The person you choose
Pick someone who knows the pipes, not just someone with a certificate.
Understand the risk
Module 4
Look first
You can't fix what you haven't looked at.
Module 5
Where water waits
Water that moves is fine. Water that sits still is where trouble starts.
Module 6
What comes in
Once it crosses your threshold, it's yours.
Cold water control
Module 7
Keep it cold
Cold water storage only helps if the system actually keeps water cold.
Module 8
Know it. Record it.
A system is only controlled if you can show what was checked, where, when, and what happened next.
Module 9
Use it or lose it
An outlet unused for seven days is a stagnation risk. First question: should it still be there?
Module 10
Start with the baseline
Incoming mains temperature tells you how much margin you have before cold water control gets difficult.
Hot water control
Module 11
Keep it hot
Hot water storage only controls legionella if the stored and circulated water actually stays in the right range.
Module 12
The places that prove it
Sentinel points are the locations you check to see whether the system is doing what the written scheme says it should.
Module 13
Two risks, one valve
TMVs solve scalding. But blended water downstream can sit in a temperature range that supports legionella growth.
Module 14
Check it works
A combination heater may be compact, but it still has to prove it is producing hot water in the right range.
Check, respond, prove
Module 15
Look inside
Incoming water tells you what to expect. Internal inspection tells you what's actually happening.
Module 16
Test when in doubt
Sampling is not routine. It is triggered by doubt about whether control measures are working.
Module 17
Read it against the scheme
A temperature reading means nothing on its own. It only means something when compared with the control regime you said you were using.
Module 18
What happens next
When a control reading is wrong, the real question is what you do about it.
Module 19
Prove it happened
If you cannot show what was done, when, and what happened next, you cannot show the written scheme was ever operated.
Module 1
You and the rules
There's a law that says you must. And a code that shows you how.
Four pieces of law you need to know — tap each
HSWA
The big law
COSHH
Hazardous stuff
ACOP L8
The legionella code
HSG274
The how-to guides
Employers must protect their workers. That's the core duty.
And anyone else who might be affected. Visitors, residents, patients, the public.
Every other legionella regulation sits underneath this one. It's the foundation.
If your building has a water system that could expose people to legionella, this law applies.
School Care home Landlord Office
If there's a foreseeable risk, you have a legal duty to manage it.
L8 gives advice on HSWA sections 2, 3, 4 and 6
Legionella is a biological agent. Under COSHH, it counts as a hazardous substance — the same category as chemicals.
What it asks is straightforward: assess the risk, prevent exposure where you can, and control it where you can't prevent it entirely.
The bacteria grow naturally in water. You're not expected to make them vanish — you're expected to stop them reaching levels that could make someone ill.
Control of Substances Hazardous to Health Regulations 2002, Regulations 6 & 7
ACOP L8 — Approved Code of Practice. This is the bridge between law and action. It has a special legal status: you don't have to follow it exactly, but if you don't, you must show your approach works just as well.
Think of it this way: L8 is the path that's already been checked. You can take a different route, but you need to prove it gets you to the same place safely.
In an investigation, following L8 is your strongest evidence of compliance. Choosing a different way isn't wrong — but you carry the burden of showing it works.
L8 ACOP: Legionnaires' disease — The control of legionella bacteria in water systems (4th ed., HSE)
HSG274 and BS 8580. If L8 says what to do, these tell you how. Temperatures to hit, how often to test, which methods to use.
HSG274 comes in three parts: hot and cold water systems, cooling towers, and other risk systems like spa pools. Most buildings only need Part 2 — hot and cold water.
BS 8580 adds another layer — it helps you assess risk based on who is in your building. A care home with elderly residents needs tighter control than a warehouse with three staff.
HSG274: Legionnaires' disease — Technical guidance (HSE); BS 8580-1:2019 (BSI)
What the law asks you to do — tap each
Find
Find the risk
Record
Write it down
Control
Do the work
Monitor
Prove it
Assist
Get help
Find the risk. Before anything else, look at your water system and ask: where could legionella grow? This is the risk assessment — and it must happen before controls, testing, or monitoring.
You're looking for places where water sits still, warms to between 20–45°C, or collects sediment. Dead legs, rarely used outlets, storage tanks without lids.
L8 ACOP, paragraphs 29–35
Write it down. If you assessed it, record it. If you controlled it, record it. The written record is your proof that you took the risk seriously and acted on it.
Records must stay up to date and be available for inspection. This isn't paperwork for its own sake — it's the thread connecting what you found to what you did about it.
L8 ACOP, paragraph 46
Do the work. Put the controls in place that your risk assessment identified. Temperature management, flushing, cleaning, disinfection — whatever your system needs.
Controls aren't one-off. They're ongoing. A monthly temperature check that stops being monthly isn't a control any more — it's a gap.
L8 ACOP, paragraphs 36–45; HSG274 Part 2
Prove it. Monitoring confirms your controls are working. Temperature logs, test results, inspection records — these show that what you planned is actually happening.
If your records show a target of 60°C but your monitoring shows the water is regularly at 48°C, the control isn't working. The proof is in the numbers, not the intention.
L8 ACOP, paragraphs 47–52; HSG274 Part 2, Section 2.3
Get help. You don't have to do this alone. The law expects you to use competent assistance — people who understand water systems and the controls that work.
That might be someone in-house or an external consultant. The key word is competent — they need to know your type of system, not just hold a qualification. We come back to this in Module 3.
L8 ACOP, paragraph 25; Management of Health and Safety at Work Regulations 1999, Regulation 7
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 2
It stays with you
You can ask someone else to do the work. But if something goes wrong, it's still yours.
The dutyholder — tap each
You
Who is it?
Tasks
What you can hand over
Duty
What stays with you
The dutyholder is the person in control. If you own the building, it's you. If you're the employer using the building, it's you. If you're a landlord letting it out, it's you.
It doesn't matter whether you know about legionella or not. The duty exists the moment you have control of a building where people could be exposed to water systems.
In a block of flats, it's the landlord or management company. In a school, it's the governing body. The question is always: who controls the premises?L8 ACOP, paragraphs 17–20
You can hand over the work. Flushing, testing, temperature checks, maintenance — all of these can be given to someone else.
What you're handing over is the task, not the duty. You're saying "please do this for me." You're not saying "this is no longer my problem."
The person you hand work to must be competent. If you hand flushing to someone who doesn't know why they're doing it, that's your gap, not theirs.
L8 ACOP, paragraphs 22–24
Legal responsibility doesn't move. You can delegate every single task. The responsibility for making sure it all works stays with you.
If your contractor misses a month of testing, the regulator won't ask your contractor why. They'll ask you.
This isn't about blame. It's about ownership. The system in your building is yours to manage. Other people help — but the thread always leads back to you.
L8 ACOP, paragraphs 17–18; HSWA 1974, Section 3
Good governance looks like this — tap each
Name
A named person
Scope
A clear scope
Authority
Authority to act
Escalate
A way up
Start with a name. Not a job title, not a department — an actual person. "The facilities team handles water" is a gap. "Sarah Chen manages legionella controls for this building" is governance.
The named person should know they've been named, understand what it means, and have the time to do it properly. A name on paper without a conversation behind it is just paperwork.
L8 ACOP, paragraph 22
Define what's covered. Which building? Which systems? Hot and cold? Cooling? Showers, taps, tanks? If the scope isn't written down, it's assumed — and assumptions create gaps.
If you have two buildings and the scope only covers one, the other building doesn't have a legionella control programme — it has a hope.
L8 ACOP, paragraphs 22–24
Give them authority to act. If the person responsible spots a problem but has to wait three weeks for a budget sign-off, the authority isn't real.
Authority means: they can call a contractor, shut down an outlet, spend money within a defined limit — without asking permission first. The risk won't wait for your next board meeting.
L8 ACOP, paragraph 22; HSG274 Part 2, Section 1.3
Build a way up. A legionella detection, a system failure, a budget they can't cover — there must be a clear route to someone with more authority.
Escalation isn't failure. It's the system working. The person on the ground reports upward, the dutyholder decides, and the record shows the chain.
L8 ACOP, paragraphs 22–25
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 3
The person you choose
Pick someone who knows the pipes, not just someone with a certificate.
The responsible person — tap each
Who
Who they are
Competence
What it really means
Hats
One person, many roles
The responsible person is the day-to-day pair of hands. They're the one who makes sure flushing happens, temperatures get checked, and records get kept.
They're appointed by the dutyholder — not self-appointed, not assumed. The dutyholder decides who this person is and tells them.
This might be the building manager, the facilities lead, or a site caretaker. In a smaller building, it might be you — the dutyholder and responsible person in one.
L8 ACOP, paragraphs 22–24
Competence does not mean a certificate on the wall. It means knowing THIS system in THIS building — where the tanks are, how the pipework runs, which outlets are rarely used.
The HSE defines it as the right combination of training, experience, and knowledge for the task at hand. A qualification helps — but without site-specific knowledge, it's not enough on its own.
A consultant with twenty years' experience who has never seen your building is not yet competent for your building. Someone who has walked your system every week for a year might be.
L8 ACOP, paragraph 25; Management of Health and Safety at Work Regulations 1999, Regulation 7
One person can wear many hats. In a small building, the dutyholder might also be the responsible person, the risk assessor, and the one doing the weekly checks.
The risk is spreading too thin. If one person is doing everything — managing the building, handling complaints, ordering supplies, AND running the legionella programme — something gets missed.
That's legal. But it needs to be honest. If you're the one person, ask yourself: do I actually have time to do this properly? If the answer is no, appoint someone who does.
L8 ACOP, paragraphs 22–25; HSG274 Part 2, Section 1.2
What a good appointment looks like — tap each
Name
Name the person
System
Name the system
Authority
Give them authority
Escalate
Show them the way up
Write it down. A name, not a role. "The caretaker" is a gap. "James Osei, site caretaker, appointed 14 March 2025" is a record.
The appointment should be in writing. The person should know they've been appointed, understand what it means, and have accepted the role.
L8 ACOP, paragraph 22
Say which system they're responsible for. Which building? Which water systems — hot, cold, both? Cooling towers? Showers in the sports block?
If you manage three buildings and the appointment letter only mentions one, the other two don't have a responsible person. They have an assumption.
L8 ACOP, paragraphs 22–24; HSG274 Part 2, Section 1.3
Give them real authority. Can they call a plumber without asking? Can they shut off an outlet that's reading 30°C? Can they spend £200 on an emergency repair without a purchase order?
If the answer to any of those is "they'd need to check with someone first," the authority isn't real. Legionella doesn't wait for a sign-off chain.
L8 ACOP, paragraph 24
Show them the way up. A positive legionella result, a system failure they can't fix, a cost they can't cover — there must be a clear route to someone with more authority.
Escalation isn't failure — it's the system working. The responsible person reports up, the dutyholder decides, and the record shows the chain. If there's no route up, the person you chose is on their own. That's not an appointment — it's abandonment.
L8 ACOP, paragraphs 22–25; HSG274 Part 2, Section 1.2–1.3
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 4
Look first
You can't fix what you haven't looked at.
What a risk assessment really is — tap each
Look
The act of looking
When
When to do it
Who
Who should do it
A risk assessment is a physical inspection, not a form. It means walking the building, following the pipes, opening tank lids, checking temperatures, looking at what's actually there.
You're looking for the three conditions that let legionella multiply: warmth (20–45°C), stillness (stagnant water), and nutrients (rust, scale, sediment, biofilm).
A desktop review of drawings and schematics is useful preparation — but it's not the assessment. The assessment happens in the building, with your eyes on the system.
L8 ACOP, paragraphs 29–31; HSG274 Part 2, Section 2.1
Review at least every two years. That's the minimum. If something significant changes — new pipework, a change of use, a refurbishment, a legionella detection — review it immediately.
"Significant change" isn't just major construction. A wing closing for summer, a shower block going out of use, a new tenant with different water demand — these all change the risk picture.
The two-year clock is a backstop. A good responsible person is constantly noticing — not waiting for the calendar to tell them to look.
L8 ACOP, paragraph 35; HSG274 Part 2, Section 2.1
The risk assessment must be done by a competent person. For a simple system — a small office with a few taps — your trained responsible person may be enough.
For a complex system — a hospital, a care home, a building with cooling towers — you'll likely need specialist help. The complexity of the system determines the competence required.
Even if you bring in an external assessor, the dutyholder still owns the assessment. An expert writes it — you act on it.
L8 ACOP, paragraph 25; HSG274 Part 2, Section 2.1
What you're looking for — tap each
Dead legs
Capped branches
Temp gaps
Where heat drifts
Tanks
Tanks and storage
Unused
The tap nobody turns
People
Who's in your building
A dead leg is a capped-off branch of pipe. It might be left over from a renovation — a pipe that used to serve a sink that was removed, now capped and forgotten.
Water in a dead leg doesn't move. It sits at ambient temperature, chlorine residual decays, and biofilm builds undisturbed. It's a perfect incubator.
Best fix: remove it. Cut back to the main pipe run. If removal isn't possible, the dead leg must be flushed regularly — but removal is always better.
HSG274 Part 2, Section 2.1; L8 ACOP, paragraph 33
Temperature gaps are where hot water cools and cold water warms. Any point in the system where water drifts into the 20–45°C danger zone is a risk.
Look for long pipe runs, poorly insulated sections, cold pipes running next to hot pipes, and outlets far from the heat source where hot water arrives lukewarm.
The rule is simple: cold should stay below 20°C, hot should arrive above 50°C within one minute of running. Anything in between needs attention.
HSG274 Part 2, Section 2.3, Table 2.1; L8 ACOP, paragraph 33
Open the lid. Look inside. Is there sediment at the bottom? Is the water clear or discoloured? Is the lid actually tight-fitting, or is there a gap where insects and debris can get in?
Check the insulation. Is the tank in a warm space? Is it insulated to keep heat out? Is the incoming temperature staying below 20°C after storage?
Check turnover. An oversized tank for a building's actual demand means water sits for days. Stale water, decaying disinfectant, rising temperature — all the wrong things happening slowly.
HSG274 Part 2, Section 2.3; L8 ACOP, paragraph 33
The shower nobody uses. The basin in the meeting room that's always empty. The tap in the kitchen that people forgot was there. Anywhere water sits because nobody draws it.
Unused outlets are dead legs with a handle. The pipe behind them holds water at ambient temperature, and nobody flushes it through.
Options: flush weekly, remove the outlet, or put it on a scheduled-use rota. A weekly flush log is the most common solution. If an outlet genuinely has no purpose, remove it.
HSG274 Part 2, Section 2.3; L8 ACOP, paragraph 33
Who is in your building matters. Legionella doesn't affect everyone equally. Older people, people with weakened immune systems, smokers, and people with chronic lung conditions are at significantly higher risk.
BS 8580 gives a framework for assessing occupant susceptibility. A care home full of elderly residents with respiratory conditions is a fundamentally different risk profile to a warehouse with six healthy staff.
Your risk assessment must account for who's actually there. The same system in the same building has a different risk score depending on who breathes the air.
BS 8580-1:2019, Section 6; L8 ACOP, paragraph 30; HSG274 Part 2, Section 2.3
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 5
Where water waits
Water that moves is fine. Water that sits still is where trouble starts.
Tap each part of the system
<20°C Cold water stays safe
20–45°C Legionella multiplies
>60°C Killed within minutes
The mains supply is the safest point in your system. Water arrives cold — typically 5–15°C in the UK — well below the 20°C growth threshold.
It carries a chlorine residual from the water company — a small amount of disinfectant that suppresses bacterial growth in transit.
From the moment water crosses your boundary, it's yours. The chlorine starts decaying, the temperature starts changing. Module 6 goes deeper into what arrives and what happens next.
HSG274 Part 2, Section 2.3, Table 2.1
The cold water tank is where the first real risk appears. Water sits here before being distributed. If the tank is warm, oversized, or poorly covered, conditions start favouring legionella.
Stored cold water must stay below 20°C. Lids must be tight-fitting and insect-proof. Insulation keeps external heat out. Turnover should be at least once per day.
Sediment at the bottom is food for bacteria. Regular inspection and cleaning are part of the control regime — a clean tank with fresh, cold water is a hostile environment for legionella.
HSG274 Part 2, Section 2.3; L8 ACOP, paragraph 33
The hot water cylinder stores water at 60°C or above. At that temperature, legionella is killed within minutes. The cylinder is your primary weapon — as long as it's hot enough throughout.
Watch for stratification. The top of the cylinder can read 60°C while the bottom sits at 45°C. If the thermostat only reads the top, you think you're safe when you're not. The whole volume must reach 60°C.
The cylinder thermostat should be set to at least 60°C. At 70°C, legionella is killed almost instantly. At 50°C, it takes hours. At 45°C, it multiplies.
HSG274 Part 2, Section 2.3, Table 2.1; L8 ACOP, paragraph 33
A dead leg is a capped pipe branch. Water sits in it at ambient temperature — no flow, no disinfectant renewal, no flushing. Biofilm builds undisturbed.
Dead legs often come from past renovations — a basin removed, a pipe capped off and forgotten. They're invisible from the outside. You find them by walking the system.
Remove them. Cut back to the live pipe run. If removal truly isn't feasible, flush regularly — but removal is always the better answer.
HSG274 Part 2, Section 2.1; L8 ACOP, paragraph 33
The outlet is where the risk becomes real. Showers are the highest-risk outlet because they create an aerosol — fine water droplets that can be inhaled deep into the lungs.
Hot water should arrive at 50°C or above within one minute of running. If it takes longer, or never reaches 50°C, the pipework between the cylinder and the outlet is the problem — too long, too poorly insulated, or both.
Taps are lower risk because the water stream doesn't atomise in the same way. But an unused tap still creates a dead leg behind it — the stagnation risk doesn't disappear just because there's no aerosol.
HSG274 Part 2, Section 2.3; L8 ACOP, paragraph 33
Three things legionella needs — tap each
Warmth
20–45°C
Stillness
Stagnant water
Food
Rust, scale, biofilm
Between 20°C and 45°C, legionella multiplies. This is the danger zone. Below 20°C the bacteria go dormant — they don't die, but they stop growing. Above 50°C they start dying. At 60°C they're killed within minutes. At 70°C, almost instantly.
Your entire control strategy comes down to this: keep cold water cold and hot water hot. The moment either drifts into the middle, conditions favour the bacteria.
HSG274 Part 2, Section 2.3, Table 2.1
Moving water is hostile to legionella. Flow brings fresh disinfectant, carries bacteria away, and prevents colonisation. Stagnation does the opposite — it lets bacteria settle, feed, and multiply.
Dead legs, unused outlets, oversized tanks, holiday closures — anywhere water sits without being replaced is a stagnation risk. The fix is always the same: keep it moving.
HSG274 Part 2, Sections 2.1, 2.3; L8 ACOP, paragraph 33
Legionella feeds on organic material. Rust, scale, sediment, and biofilm — the thin slimy layer that forms on the inside of pipes and tanks. Biofilm is both food and shelter. It protects bacteria from heat and disinfectant.
Clean systems give bacteria less to work with. Regular tank cleaning, removing sediment, managing scale — these reduce the food supply. You can't eliminate biofilm entirely, but you can starve it.
HSG274 Part 2, Section 2.4; L8 ACOP, paragraph 33
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 6
What comes in
Once it crosses your threshold, it's yours.
The water arriving at your building — tap each
Boundary
Where yours begins
Temp
Temperature on arrival
Chlorine
Disinfectant residual
Chemistry
What's in the water
The boundary is where the water company's responsibility ends and yours begins. Usually the external stopcock or the point where the service pipe enters your building.
Upstream of the boundary, the water company treats, tests, and delivers. Downstream, it's yours — temperature, quality, distribution, storage, everything.
Know where your boundary is. It's the starting point of your risk assessment — everything you're responsible for flows from that line.
HSG274 Part 2, Section 2.1; Water Supply (Water Fittings) Regulations 1999
Mains water arrives at 5–15°C depending on the season — colder in winter, warmer in late summer. That's well below the 20°C growth threshold.
But between the boundary and your first tap, the water passes through pipes — some buried, some in ducts, some running through heated spaces. A cold pipe through a boiler room can arrive at 22°C before it reaches the tank.
Measure the incoming temperature at the point of entry. If it's already above 20°C by the time it reaches storage, you have a pipe route problem to solve before worrying about the tank.
HSG274 Part 2, Section 2.3, Table 2.1
The water company adds chlorine to suppress bacteria in transit. By the time it reaches your building, there's a small residual — enough to help, but not enough to rely on.
Chlorine decays. Warm water accelerates the decay. Long pipe runs and storage accelerate it further. In a system with an oversized tank and long distribution, the chlorine residual at the far end can be effectively zero.
That's why temperature is your primary defence, not disinfectant. The chlorine residual is a bonus on arrival — your hot and cold temperature controls are what actually keep legionella suppressed.
HSG274 Part 2, Section 2.4; L8 ACOP, paragraph 38
Hard water leaves scale. Soft water causes corrosion. Both create conditions legionella likes. Scale roughens pipe surfaces and gives biofilm more area to attach to. Corrosion produces sediment — food for bacteria.
Your water company publishes chemistry data. Your risk assessment should reference it — knowing what arrives helps you understand what your system is dealing with. Hard area? Expect scale. Soft area? Watch for corrosion.
This is where water quality data meets building safety. The same pipe in a hard-water area and a soft-water area ages differently, corrodes differently, and feeds bacteria differently.
HSG274 Part 2, Section 2.4; BS 8580-1:2019, Section 7
How you store it — tap each
Tank
Size and demand
Lids
Lids and covers
Turnover
How fast it's replaced
Insulation
Keeping heat out
An oversized tank is a stagnation risk. If you store 1,000 litres but only use 200 per day, water sits for five days before being replaced — five days of warming, chlorine decay, and bacterial opportunity.
Match tank size to actual demand. A tank that turns over at least once per day keeps water fresh. If the tank was sized for a building that used to have twice the occupancy, it's now too big for its purpose.
If you can't replace the tank, consider a ball valve adjustment to reduce the stored volume, or increase draw-off through scheduled flushing.
HSG274 Part 2, Section 2.3; L8 ACOP, paragraph 33
A cold water tank needs a tight-fitting lid. Not resting on top — properly fitted, with no gaps. The lid keeps out dust, insects, bird droppings, and any other organic material that feeds bacteria.
A missing or ill-fitting lid is one of the most common findings in risk assessments. It's a direct contamination pathway — and one of the easiest to fix.
Check that overflow pipes and vent pipes are screened too. An unscreened overflow is an open invitation for insects and debris.
HSG274 Part 2, Section 2.3; L8 ACOP, paragraph 33
Turnover is how quickly stored water is replaced by fresh supply. High turnover means fresh water, fresh disinfectant residual, and less time for temperature to drift. Aim for at least once per day.
Watch for short-circuiting. If the inlet and outlet are too close together, fresh water flows straight through while old water sits in the far corners of the tank, untouched. The tank looks busy but pockets of stagnation persist.
Good tank design places the inlet and outlet at opposite ends, forcing water to travel the full length of the tank before being drawn off.
HSG274 Part 2, Section 2.3; L8 ACOP, paragraph 33
Insulate the sides and top of a cold water tank. The insulation keeps external heat out. In a heated roof space, an uninsulated tank absorbs warmth and stored water creeps into the danger zone.
Do NOT insulate underneath in a heated space. That seems counterintuitive, but warmth from below should escape downward — insulating the base traps it against the tank, turning the floor into a heat bridge.
Cold pipes running alongside hot pipes need separate insulation. Without it, heat transfers across — a cold pipe touching a hot pipe is a heat bridge. Water that should arrive at 10°C reaches the outlet closer to 25°C.
HSG274 Part 2, Section 2.3; L8 ACOP, paragraph 38; BS 8580-1:2019, Section 7
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 7
Keep it cold
Cold water storage only helps if the system actually keeps water cold.
How the system works
What to check — tap each
Sentinel taps
Monthly check
Tank
Annual inspection
Insulation
Heat gain defence
Written scheme
Where checks live
Cold water sentinel taps should be below 20°C within two minutes of running. Watch the temperature during flushing — do not just take a reading at the end. A rising temperature during the run may indicate local heat gain in the distribution system.
HSG274 Part 2, Table 2.1
Inspect the tank annually for condition, contamination and failed lids. Measure the tank water temperature remote from the ball valve — this represents stored water conditions, not incoming supply. Check incoming mains temperature at the same time.
HSG274 Part 2, Table 2.1
Long pipe runs through warm plant rooms with low turnover are most likely to push cold water temperatures up. Thermal insulation should be checked annually. Poor insulation is one of the most common causes of cold water exceeding 20°C.
HSG274 Part 2, Table 2.1
Cold water storage checks must be defined in the written scheme. L8 paragraphs 60 and 62 require the scheme to specify checks, frequencies, control parameters, tolerances, measurement methods and remedial actions. These are not optional extras.
L8 ACOP, paragraphs 60 and 62
What the scheme must specify
L8 requires the written scheme to specify checks, frequencies, parameters, methods and remedial actions. For cold water that means: sentinel tap temperatures monthly, tank inspection annually, tank temperature and mains temperature annually in summer, and insulation condition annually. If sentinel taps consistently exceed 20°C, the storage and distribution system may be losing temperature control — investigate potential causes such as insulation, turnover or heat gain.
L8 ACOP, paragraphs 58–69; HSG274 Part 2, Table 2.1
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 8
Know it. Record it.
A system is only controlled if you can show what was checked, where, when, and what happened next.
What the system contains — tap each
Calorifiers
Hot water source
Tanks
Cold water store
Loops
The circuit
Outlets
Where it arrives
Hot water generation sits at the centre of temperature control. Calorifier flow and return temperatures determine whether downstream outlets can stay compliant. Flow and return checked monthly. Internal condition inspected annually.
HSG274 Part 2
Cold water storage tanks influence whether water warms before reaching outlets. Annual inspection covers condition, temperature remote from the ball valve, and incoming mains temperature.
HSG274 Part 2
Circulation loops return water to the calorifier. Return temperatures show whether the whole loop is maintaining control — not just the nearest outlet. Subordinate loops are checked on a rotational basis to build a profile across the system.
HSG274 Part 2
Sentinel taps, showers, spray points. Monthly checks at sentinel points. Each component type has different checks and frequencies because each behaves differently within the system.
HSG274 Part 2
What every record must show — tap each
Who
The named person
What & where
The check itself
Result
What was found
Action
What happened next
Every check needs a name behind it. L8 requires the identity of the person who carried out or authenticated the work. Accountability starts here.
L8 ACOP, paragraphs 70–74
A record that says "checked" means nothing on its own. It must state what was checked and where — the specific outlet, tank, loop or component.
L8 ACOP, paragraphs 70–74
The actual reading or condition observed. Not just pass or fail — the measured value, so trends and deterioration can be spotted over time.
L8 ACOP, paragraphs 70–74
If a result was out of range, the record must show what was done about it. A failed reading with no follow-up recorded is a compliance gap, not a record.
L8 ACOP, paragraphs 70–74
How long to keep them
Records of monitoring, inspection, tests and checks must be retained for at least five years. General records — risk assessment, written scheme, responsible person details — must be retained for at least two years after they are no longer current. This framework is set by L8 paragraphs 70–74. In practice, keeping clear records is the difference between a system that was controlled and a system that merely existed.
L8 ACOP, paragraphs 70–74
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 9
Use it or lose it
An outlet unused for seven days is a stagnation risk. First question: should it still be there?
The decision — follow the flow
Outlet unused ≥7 days?
Yes
Can it be removed?
Yes
Remove outlet. Cut back pipe to common supply. No dead leg.
No
Include in flushing regime
Weekly baseline (or per RA)
Flush until temp stabilises
Purge to drain
Log every flush
Vulnerable users: increase frequency per risk assessment
No
Normal use. No action.
Why this matters
L8 paragraph 59: precautions should include avoiding water stagnation that may encourage microbial growth. The decision is sequential — remove if you can, flush if you must, always log what you did. A flushing regime that is started but not recorded cannot demonstrate control.
L8 ACOP, paragraph 59; HSG274 Part 2
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 10
Start with the baseline
Incoming mains temperature tells you how much margin you have before cold water control gets difficult.
How margin works
What the baseline tells you — tap each
Margin
Headroom below 20°C
Timing
Check in summer
During flushing
Watch the reading
Context
Not the whole answer
Incoming mains temperature shows how much margin exists before cold water at outlets risks breaching 20°C. When mains temperature is already warm — especially in summer — the system has less room for error.
HSG274 Part 2, Table 2.1
HSG274 says incoming mains temperature and cold water tank temperature remote from the ball valve should be checked annually in summer or as indicated by temperature profiling. Summer is when margin is lowest.
HSG274 Part 2, Table 2.1
The thermometer reading at sentinel taps should be observed during flushing, not just at the end. A temperature that rises during the run may indicate local heat gain in the distribution system that a single endpoint reading would miss.
HSG274 Part 2, Table 2.1
Mains temperature provides context for interpreting cold water performance. It does not replace outlet monitoring. A low mains temperature with high outlet temperatures means the system — not the supply — is the problem.
HSG274 Part 2, Table 2.1
Frequencies are indicative
HSG274 Table 2.1 frequencies are indicative, not universal. Paragraph 2.79 says monitoring frequency depends on system complexity and the susceptibility of those using the water. The risk assessment should define the appropriate frequency for the system. But where cold water consistently approaches 20°C at outlets, system performance should be reviewed regardless of the scheduled frequency.
HSG274 Part 2, paragraph 2.79 and Table 2.1
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 11
Keep it hot
Hot water storage only controls legionella if the stored and circulated water actually stays in the right range.
How the system works
What to check — tap each
Calorifier
Flow and return
Loops
Circulation returns
Outlets
Sentinel points
Inspection
Annual condition
Flow temperature should modulate as close to 60°C as practicable without going below. Return temperature should not be below 50°C. These are checked monthly. If the calorifier underperforms, outlet compliance will be inconsistent even when local checks sometimes pass.
HSG274 Part 2, Table 2.1
Principal loop returns should be at least 50°C, or 55°C in healthcare premises. Subordinate loops should be checked quarterly on a rolling monthly rota to build a profile of temperatures across the system.
HSG274 Part 2, Table 2.1
In non-circulating systems, hot water sentinel outlets should reach at least 50°C within one minute, or 55°C in healthcare premises. Monthly checks at sentinel points. Compliant calorifier temperatures do not guarantee compliant outlets — distribution issues can undermine control.
HSG274 Part 2, Table 2.1
Calorifiers should be internally inspected and cleaned annually, or at an interval adjusted based on the rate of fouling and previous findings. Increasing fouling means increasing cleaning frequency, not ignoring it.
HSG274 Part 2, Table 2.1
Storage and distribution together
Storage temperature alone does not guarantee compliance. Both storage and distribution temperatures must be controlled. A system that meets calorifier thresholds but shows poor temperatures at distal outlets has a distribution problem — not a monitoring problem. Investigate circulation, heat loss, or system design. L8 paragraphs 60–69 require the written scheme to specify checks, parameters and remedial actions for the whole system.
L8 ACOP, paragraphs 60–69; HSG274 Part 2, Table 2.1
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 12
The places that prove it
Sentinel points are the locations you check to see whether the system is doing what the written scheme says it should.
Where to check
What to check — tap each
Hot sentinel
≥50°C in 1 min
Cold sentinel
<20°C in 2 min
Pipe surface
Circulating systems
Records
Full detail needed
Hot water sentinel outlets should reach at least 50°C within one minute, or 55°C in healthcare premises. Typically the nearest outlet, the furthest outlet and long branches. Monthly checks. If a sentinel passes but a nearby long branch does not, the long branch may be undermining control.
HSG274 Part 2, Table 2.1
Cold water sentinel taps are usually those nearest to and furthest from the cold water tank, plus other key locations on long branches or different floor levels where needed. Below 20°C within two minutes. Watch the reading during flushing — a rising temperature may indicate local heat gain.
HSG274 Part 2, Table 2.1
In circulating systems, temperature measurements may be taken on the surface of metallic pipework rather than at outlets. This applies to loop returns and subordinate loops. Plastic pipework is not suitable for surface measurement.
HSG274 Part 2, Table 2.1
Each temperature check should record the location, time, result, operator and any action taken. A check without a location proves nothing. A failed reading without recorded follow-up is a compliance gap. L8 paragraphs 70–72 set the standard.
L8 ACOP, paragraphs 70–72
The written scheme defines the plan
The written scheme must specify checks, frequency, parameters, methods and remedial actions for sentinel monitoring. L8 paragraphs 60 and 62 require this. Sentinel points are not random — they are chosen to reveal whether the control regime is working at the parts of the system most likely to show failure. If sentinel points vary significantly across floors or branches, distribution performance may be inconsistent.
L8 ACOP, paragraphs 60 and 62; HSG274 Part 2, Table 2.1
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 13
Two risks, one valve
TMVs solve scalding. But blended water downstream can sit in a temperature range that supports legionella growth.
How a TMV creates risk
What you need to know — tap each
Balance
Two risks assessed
Position
Close to outlet
Types
2 vs 3
Maintenance
Not a fixed rule
The decision to install a TMV should follow a comparative assessment of scalding risk and infection risk. TMVs are not a default for every outlet. Where scalding risk is low, they may not be needed — and removing an unnecessary TMV removes a legionella risk point.
L8 ACOP; HSG274 Part 2
TMVs should be installed as close to the point of use as possible. A single TMV serving multiple outlets via long pipe runs increases the length of pipework carrying blended water in the growth-risk temperature range.
HSG274 Part 2
Type 2 TMVs can be overridden by the user — required by building regulations where scalding risk is low. Type 3 TMVs are pre-set and fail-safe — required in healthcare premises where scalding risk is significant. In dwellings, Approved Document G limits bath outlet temperature to a maximum of 48°C.
Approved Document G; HSG274 Part 2
TMV maintenance intervals are defined by risk assessment and manufacturer guidance — not a blanket six-monthly rule. Strainers and filters should be inspected, cleaned, descaled and disinfected annually or at a frequency the risk assessment justifies. Routine maintenance by competent persons in line with manufacturer instructions.
HSG274 Part 2; manufacturer guidance
Scald control and legionella control together
Both risks must be balanced through assessment. Scald control does not remove legionella risk. Legionella risk is not automatically more important than scald risk. The written scheme, risk assessment and maintenance regime must address both. Where a TMV is installed far from the outlet and serves multiple taps, review the design and consider relocating closer to the point of use.
L8 ACOP; HSG274 Part 2; Approved Document G
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 14
Check it works
A combination heater may be compact, but it still has to prove it is producing hot water in the right range.
The check
What to check — tap each
Temperature
50–60°C at outlet
Evidence
Proving operation
Frequency
Monthly baseline
Combination water heaters should be checked at an outlet monthly to confirm operation at 50–60°C. In healthcare premises, the 55°C threshold applies where relevant. If the heater consistently delivers below 50°C, it needs investigation.
HSG274 Part 2, Table 2.1
The check is about proving the heater is operating correctly — not assuming it. Records should show what was checked, when, the result, and any action taken. An outlet check that is not recorded cannot demonstrate control.
HSG274 Part 2, Table 2.1
HSG274 Table 2.1 gives monthly as the indicative frequency. Paragraph 2.79 says monitoring frequency depends on system complexity and user susceptibility. The risk assessment defines the final approach, but the baseline is monthly.
HSG274 Part 2, paragraph 2.79 and Table 2.1
Performance over time
If a combination heater operates within range but performance varies over time, investigate possible causes such as scaling or low turnover. Consistent compliance today does not guarantee compliance next month. Where user complaints persist despite acceptable readings, distribution or usage factors may be affecting perceived performance — investigate rather than dismiss.
HSG274 Part 2, paragraph 2.79 and Table 2.1
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 15
Background chemistry and inspection
What arrives matters for context. What the system does with it is the real control question.
Background chemistry — context, not control — tap each
Hardness
Scale risk
pH
Supply character
Disinfectant
What arrives
Iron & Mn
Fouling signals
Hardness indicates how likely scale is to form on heating elements and pipework. DWI classifies water above 300 mg/L as CaCO3 as very hard. Useful for planning descaling frequency — but not a legionella control measure in itself.
DWI hardness classification
An indicator parameter. In England, the acceptable range at consumers' taps is 6.5 to 9.5. Background context for understanding the supply, not a substitute for system control.
Water Supply (Water Quality) Regulations 2016
Residual disinfectant in the public supply is monitored by the water company. Any incoming residual is background information — it does not prove the internal system is under control.
Water Supply (Water Quality) Regulations 2016
Iron has a national requirement of 200 ug/L at consumers' taps; manganese 50 ug/L. Higher levels may contribute to sediment and fouling. These are maintenance and inspection signals, not replacements for core legionella controls.
Water Supply (Water Quality) Regulations 2016
What to inspect — tap each
Showers
Aerosol sources
TMVs
Blending valves
Tanks
Storage condition
Biofilm
The hidden layer
Showers and spray taps foul, scale up and generate aerosols. Removable parts, heads, inserts and hoses should be dismantled, cleaned and descaled quarterly — or more frequently where fouling rates or vulnerable users justify it.
HSG274 Part 2
TMV maintenance is not a blanket six-monthly rule. First assess whether the TMV is still needed. Where it remains, strainers and filters should be inspected, cleaned, descaled and disinfected annually or as defined by risk assessment and manufacturer guidance.
HSG274 Part 2
Cold water storage tanks should be inspected annually for condition, contamination and temperature. Look for debris, corrosion, failed lids, and evidence of warming.
HSG274 Part 2
Scale and fouling create surfaces where biofilm can persist. Acceptable incoming chemistry does not mean acceptable internal condition. The inspection question is always: what does the inside of the system actually look like?
HSG274 Part 2
The primary regime
Temperature control, stagnation control, cleanliness and maintenance remain the primary legionella control regime. Incoming water chemistry provides useful background — especially for anticipating scale and fouling — but it does not replace the duty to control conditions inside the building. L8 paragraph 59: avoid temperatures between 20°C and 45°C, avoid stagnation, maintain cleanliness, ensure correct operation and maintenance.
L8 ACOP, paragraph 59; HSG274 Part 2, Table 2.1
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 16
Test when in doubt
Sampling is not routine. It is triggered by doubt about whether control measures are working.
When to sample — follow the flow
Doubt about control effectiveness?
Yes
Carry out sampling
Follow BS 7592
UKAS-accredited lab in suitable proficiency scheme
Competent person interprets
No
Maintain temperature and stagnation controls. Sampling not indicated.
Interpret results
Not detected
Does not prove absence. Continue monitoring.
100–1000 cfu/l
Response depends on proportion positive. Review controls.
>1000 cfu/l
Resample immediately. Review controls and risk assessment. Consider disinfection. Retest after action.
Healthcare / vulnerable populations? Use Table 2.3 action levels instead of Table 2.2
What results do and do not mean
A negative result does not guarantee legionella are absent. A positive result does not necessarily mean control has failed — legionella are present in almost all natural water sources. That is why L8 requires results to be interpreted by a suitably experienced and competent person. Sampling confirms or challenges — it does not replace — the control regime.
L8 ACOP; HSG274 Part 2; BS 7592
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 17
Read it against the scheme
A temperature reading means nothing on its own. It only means something when compared with the control regime you said you were using.
Interpreting a reading — follow the flow
Take reading at monitoring point
Compare against written scheme
HSG274 baseline values:
Calorifier flow: ≥60°C
Calorifier return: ≥50°C
Hot sentinel: ≥50°C in 1 min (55°C healthcare)
Cold sentinel: <20°C in 2 min
Within range?
Yes
Record result. Continue monitoring at defined frequency.
No
Out-of-range response
1. Investigate cause under the written scheme
2. Implement specified remedial action
3. Record the failure AND the corrective action
4. Re-test to confirm control is restored
Frequencies are not fixed
HSG274 monitoring frequencies are indicative, not mandatory for all systems. The risk assessment should define the appropriate frequency. But the written scheme must specify what to check, how often, what the limits are, and what to do when they are breached. L8 paragraphs 60–69 set this framework.
HSG274 Part 2, Table 2.1; L8 ACOP, paragraphs 60–69
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 18
What happens next
When a control reading is wrong, the real question is what you do about it.
Respond and escalate — follow the flow
Out-of-range reading recorded
1. Record clearly
2. Investigate: local or systemic?
Local
Single outlet, TMV, showerhead, branch. Fix component. Re-test and record.
Systemic
3. Implement remedial action from written scheme. Match action to failure found. Re-test and record
Persistent, widespread, or disease-linked?
No
Continue monitoring.
Yes
4. Escalate
Review risk assessment
Consider cleaning / disinfection
Bring in competent specialist help if needed
RIDDOR reporting if legionellosis in employee from relevant system
Dutyholder retains responsibility even with contractor appointed
Thermal disinfection — say it accurately
HSG274 paragraph 2.133: raise the temperature of the whole calorifier contents, circulate for at least one hour, maintain outlet temperatures not below 60°C, then run each outlet sequentially for at least five minutes at full temperature. Measure and record. A risk assessment and safe system of work are required because of scalding and other hazards.
HSG274 Part 2, paragraph 2.133
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Module 19
Prove it happened
If you cannot show what was done, when, and what happened next, you cannot show the written scheme was ever operated.
What L8 expects to be recorded — tap each
People
Who is responsible
Findings
What was assessed
Scheme
What was planned
Results
What was checked
The appointed responsible person or persons. Names and positions of those with duties. Lines of communication. Authentication of the person doing the work.
L8 ACOP, paragraphs 70–74
The significant findings of the risk assessment. This is not the assessment document itself sitting on a shelf — it is evidence that the assessment's findings were acted on.
L8 ACOP, paragraphs 70–74
The written scheme and its implementation. The scheme says what controls should be in place. The record shows whether they actually were.
L8 ACOP, paragraphs 70–74
Results and dates of any monitoring, inspection, test or check. Also: precautionary measures applied, remedial work, contractor visits, cleaning and disinfection reports, and training records.
L8 ACOP, paragraphs 70–74
Six things every entry needs — tap each
What
The task
Where
The location
When
The date
Result
The finding
Action
The response
Who
The name
What was checked — the specific type of check: temperature, flushing, inspection, cleaning, descaling, servicing.
L8 ACOP, paragraphs 70–74
Where it was checked — the specific outlet, tank, loop, or component. A record that says "checked" without a location proves nothing.
L8 ACOP, paragraphs 70–74
When it was checked. Dates allow trends to be tracked and gaps to be spotted.
L8 ACOP, paragraphs 70–74
What the result was — the actual measured value or observed condition, not just pass or fail.
L8 ACOP, paragraphs 70–74
What action was taken if the result was out of range. A failed reading with no follow-up is a compliance gap.
L8 ACOP, paragraphs 70–74
Who carried out or authenticated the task. Accountability requires a name, not just a tick.
L8 ACOP, paragraphs 70–74
How long to keep them
Records of monitoring, inspection, tests and checks must be retained for at least five years. General records — risk assessment, written scheme, responsible person details — must be retained throughout the period they are current and for at least two years afterwards. L8 paragraph 72 sets the framework. In practice, good retention is what turns a folder of paperwork into evidence that a control regime was actually operated.
L8 ACOP, paragraph 72
Check what you've learned
Five questions, drawn at random. You need four out of five to move on.
Training complete
Enter your name to generate your record of completion.
TapCheck
Legionella Awareness Training — Record of Completion