The Legionella Control Association (LCA) discusses why a thorough risk assessment is a good starting point for adhering to legislation, as well as the importance of ensuring it is undertaken by a trained and occupationally competent person
A Risk Assessment is required if you employ five or more people. The need for a Legionella risk assessment is driven by the Health & Safety at Work Act (1974) and the need to keep both staff and stakeholders safe (Sections 2 and 3 of the Act). The need to assess the risk is directed from the Control of Substances Hazardous to Health (2002) (COSHH) Guidance.
At the core of any assessment of risk we need to understand the basics. These are defined in the British Standard for Legionella Risk Assessments (BS8580-1 (2019)):
- Contamination: Can Legionella or any other bacteria or nutrients enterthe system?
- Amplification: Are growth conditions present?
- Transmission: Is there a way for aerosols to be created?
- Exposure: Can people encounter any aerosols created?
- Susceptibility: Who are the people present and how at risk are they?
These five factors – with the acronym CATES – form the basis of our scoring of risk. A competent risk assessor will be able to use the CATES in the context of your site, system and assets.
A competent assessor is critical
A risk assessment undertaken by someone who does not understand the different water systems, how they interact with each asset, potential infection pathways or the impact of susceptibility in the local population could make significant omissions or errors in assessing the risk. A bad risk assessment is nearly as bad as no risk assessment at all.
The risk assessment should make it clear which building(s) and system(s) are covered; details of any previous risk assessment (if applicable); the system conditions; an asset register with details on condition of the assets; any areas not assessed and details on the inherent and residual risks; and how far the gap is from the residual risk to as low as reasonably practicable (ALARP).
The inherent risk is the worst-case scenario, where there are no controls or our controls fail. If nothing happens to the system this is the risk that will eventually occur and needs to be avoided. The residual risk is the level of risk that remains once control measures are implemented – the risk that exists day to day when the controls are active. The ALARP risk is the lowest it can reasonably be; this should not be hampered by financial constraints and should be attainable.
The Approved Code of Practice for Legionella (ACoP L8)
Now in its fourth edition, ACoP L8 is the bible when it comes to Legionella control. It holds a special legal status, where if you don’t follow the guidance and you have an issue with Legionella then you have to demonstrate that your actions were equal to or better than the ACoP. Within ACoP L8 there is advice on finding competent help. Paragraph 57 of the ACOP talks about the use of third party competent help and how using such help doesn’t absolve the end user of responsibility to ensure the assessment or controls have been effective. It does say that an “illustration of the levels of services to expect can be found in the Code of Conduct administered by the LCA.”
A good risk assessment will identify the risks present, and recommend the steps to take to reduce that risk, taking the form of Technical Recommendations. The Risk Assessment may also include a Written Scheme of Control which needs to be converted into a set of Control Measures which can be used to help mitigate the risk.
The challenge with controlling legionella
We need to ensure that the hot water is kept above 50°C (and over 55°C in Healthcare), keep the cold water below 20°C, remove all dead-legs, keep the water clean, and keep it moving. The reality is that this can be challenging. A number of scenarios can cause an outlet to become infrequently used. This can create an area of stagnation where temperature control becomes challenging – ideal growth conditions for Legionella.
The aim of the risk assessment is to identify the risk. If we identify a risk we need to write down how we are going to manage and mitigate that risk. This is known as the Written Scheme of Control. We should look to provide practical ways to manage the risk. The hierarchy should be:
- Elimination: Can we eliminate the risk?
- Substitution: If we can’t eliminate it, can we substitute the asset for a less risky asset?
- Engineering controls: If we can’t substitute what engineering controls can we apply?
- Admin controls: If we can’t engineer a solution can we make a process to control?
- PPE/RPE: If we can’t control the risk we must break the infection pathway.
The Written Scheme of control – when implemented – will detail a set of control measures that are designed to reduce the risk from the inherent level to residual. It’s important that the controls are implemented, and you create records for these actions, be they temperature checks, flushing of little used outlets or bigger jobs like cleaning and descaling of showers or TMV servicing. The efficacy of the control measures also needs to be checked; we need to make sure that our controls are effective, and we have evidence. They must be kept for a minimum of five years and should be used whenever we come to review the Risk Assessment.
The LCA is a voluntary organisation whose membership comprises providers of services and products concerned with the control of legionella bacteria in water systems