A risk assessment tells you what could go wrong with your water system. The written scheme of control tells you, and everyone else, what you're actually going to do about it. It's the bit people use every week, and it's often the bit that's missing.
September's a good time to dust yours off. Schools and colleges are back, offices fill up again after the summer, and new staff or contractors may have taken over the checks. If the scheme isn't clear, things slip.
What the scheme is for
Under the HSE's Approved Code of Practice L8, if your risk assessment finds a reasonably foreseeable risk from Legionella, you need a written scheme for preventing or controlling it. Think of it as the instruction manual for your building's water: who does what, how often, what "good" looks like and what to do when it isn't.
For a very simple property it might be a page or two. For a hospital it can be a hefty document sitting inside a wider Water Safety Plan. Size doesn't matter much. What matters is that it's specific to your building and that the people doing the work can follow it.
What L8 says it should contain
L8 sets out the main things a written scheme should include. In plain English, those are:
- An up-to-date plan of the system. A schematic showing tanks, water heaters, the main pipe runs and outlets. It doesn't need to be a full architect's drawing, but it should be clear enough that someone new can find their way round.
- A description of how the system should run. What it's meant to do when everything's working properly, including set temperatures.
- The precautions you're taking. The control measures that keep the risk down, such as keeping hot water hot, keeping cold water cold and avoiding stagnation.
- The checks to be carried out, and how often. So the controls can be shown to be working.
- What to do if the checks show a problem. The remedial actions to take if the scheme isn't working.
On top of that, a good scheme names the people involved and says where the records are kept.
The people bit
A scheme that just says "temperatures to be checked monthly" without saying who checks them is a scheme that won't get done. We'd expect to see:
- The duty holder. Usually the employer, landlord or person in control of the premises. They carry the legal responsibility.
- The responsible person. Someone appointed to manage the day-to-day control of the risk. L8 expects them to be competent, with enough authority and time to do it properly.
- Anyone else doing tasks. Site staff, a caretaker, an outside contractor. Each should know which tasks are theirs.
- A deputy. So the checks carry on when the responsible person is on holiday or off sick.
The routine checks
For a typical hot and cold water system, the checks come from HSG274 Part 2. Your scheme should spell out which apply to your building. Common ones include:
- monthly temperature checks at sentinel outlets (the nearest and furthest taps on each loop), with hot reaching at least 50°C and cold below 20°C
- monthly checks on the flow and return temperatures of hot water cylinders or calorifiers, with stored water at 60°C or above
- weekly flushing of little-used outlets
- regular cleaning and descaling of shower heads and hoses, typically quarterly, or as your assessment says
- an annual inspection of cold water storage tanks, plus periodic temperature checks on the tank
- servicing any thermostatic mixing valves, at intervals set by the manufacturer and your risk assessment
Your assessor might add or drop items depending on what's actually there. A building with no stored water doesn't need tank inspections, for example.
What to do when something's wrong
This is the bit most schemes skimp on. If the person doing the monthly checks finds the hot water at a sentinel tap only reaching 44°C, what do they do? Who do they tell? How quickly?
A useful scheme answers that in advance. It might say: re-check the next day, look at the cylinder thermostat, report to the responsible person, and call in a plumber if it isn't back within range in a set time. The same goes for a dirty tank, a TMV that fails its test or a positive water sample. Clear steps stop small faults turning into big ones.
Records
L8 expects records of the assessment, the scheme and the results of monitoring and checks to be kept for at least five years. That includes temperature readings, flushing logs, tank inspection reports and any remedial work. A paper logbook is fine. So is a spreadsheet or an online system. What matters is that it's filled in, it's easy to find, and it shows the readings, not just a tick.
Signs your scheme needs work
- It's a generic template with someone else's building name crossed out.
- There's no schematic, or it shows a layout that's since changed.
- The named responsible person left last year.
- Nobody's sure what to do if a reading is out of range.
- It doesn't mention closures, holidays or empty rooms.
If any of those ring a bell, the scheme should be updated. It's normally reviewed alongside the risk assessment, and our guide on how often to review a Legionella risk assessment covers when that should happen. Closures in particular are worth spelling out. We wrote about what's involved in reopening a building after closure.
A typical scenario
Imagine a small secondary school with a new site manager starting in September. The previous one kept the checks in their head and a notebook that's gone with them. There's a risk assessment from two years ago, but no scheme. Nobody's quite sure which taps are the sentinels or when the tank was last looked at.
The fix isn't dramatic. We'd review the assessment, mark up a simple schematic, write a scheme listing each task with a name against it, set up a logbook and walk the new site manager round so they know exactly where everything is. From then on the checks have a home.
Want a hand?
We write schemes as part of our risk assessments, tailored to the building and to the people you actually have on site. If you'd rather not run the checks yourself, our Legionella maintenance service can do them for you and keep the records up to date.