Home / Guides / Legionella risk assessment
Legionella · Risk assessment · HBA regulation 6 · Worked example
Key facts
- The law HBA Regulations, 2022, regulation 6, under the OHS Act
- Done by a competent person (regulation 6(2))
- Review at least every 24 months, and at once on a trigger (6(6))
- Shared with employees and health and safety representatives (6(7))
- Kept at least 40 years (regulation 9)
- Benchmark SANS 893-1:2018, a voluntary national standard
Write a risk assessment an inspector can follow
The Responsible Person course teaches the survey, the ASC rating scale and the action plan, then has you rate all 14 assets of a 140-room hotel against a model answer. Ten hours, online, R2 950, HPCSA CPD accredited.
What is a Legionella risk assessment, and is it a legal requirement?
It answers four questions about every water system on a site. Where could Legionella grow? How could it get out as droplets people breathe? Who would breathe it, and how vulnerable are they? Are the current controls working? The answers are rated, and the high ones become an action plan. If someone falls ill, it is the first document the investigating environmental health practitioner will ask for.
In South Africa it is required wherever people may be exposed. The Regulations for Hazardous Biological Agents, 2022 list Legionella spp. as a Risk Group 2 agent and apply wherever exposure may occur, which most competent persons read as covering water systems. Regulation 6 requires the documented assessment. Section 9 of the OHS Act extends the duty to guests, residents, patients and the public, so an assessment that only looks at staff misses the people most at risk. The full legal picture is in Legionella regulations in South Africa.
The risk assessment finds and rates the risk. The water management plan controls it afterwards. You need both.
What must a Legionella risk assessment contain?
Regulation 6(3) sets the minimum. This is what I look for when I read someone else’s report.
| Regulation 6 requires | Look for this in the report |
|---|---|
| The nature of the agent and the route of exposure | Legionella spp. named, and every route: showers, spray, mist, cooling tower drift, spa aerosol |
| Where it may be present and in what form | An asset register and schematic covering every tank, heater, loop, outlet type, tower and spray source |
| The work processes | Who flushes, cleans or services, and how close they get to spray |
| Current controls and how they could fail | Temperatures measured at outlets with a probe, not read off plant room dials |
| Effects on pregnant, immunocompromised and vulnerable employees | Named groups, plus guests, residents and the public under section 9 |
| A documented action plan (6(5)) | An owner, a date and a priority for every action, and interim controls for anything High |
| Review and sharing (6(6), 6(7)) | A review date on the cover and a circulation list |
Under regulation 4(1), tell the health and safety representative or committee before you start.
Who carries out a Legionella risk assessment?
A competent person. The HBA Regulations define one as someone with the knowledge, training, experience and, where applicable, qualifications specific to hazardous biological agents that the task needs. It can be a trained chief engineer, facilities or SHEQ manager, or a consultant, as long as they can show the competence and sign the report.
In the hotel case in our courses, the 2019 assessment was written by the water treatment company then holding the cooling tower contract. It carries a company stamp but no assessor’s name, read the calorifiers at 60 °C off the plant room dials, rated the whole site Medium and cites the 2001 regulations that the 2022 regulations replaced. In 2024 the calorifiers were turned down to 55 °C. That change should have triggered a review. Nobody did one.
A contractor can write a good assessment, but UK guidance (ACOP L8, para 57) is blunt that employing contractors or consultants does not absolve the duty holder. Roles are set out in who is responsible for Legionella.
Can an online course make you competent? No course can on its own. It gives you the knowledge, the method and a worked case, and competence comes from applying them on your own site.
How often should a Legionella risk assessment be reviewed?
Regulation 6(6) of the HBA Regulations sets the outside limit: at least every 24 months, and at once if the assessment is no longer valid, a process or plant changes, an incident occurs, or medical surveillance shows an adverse effect. Treat 24 months as a ceiling, not a schedule. ACOP L8 (para 47) adds practical triggers:
- Changes to the water system or its use: heat pumps fitted, set points lowered, JoJo tanks added after outages.
- Changes to the use of the building: a floor closed for renovation, a wing converted to frail care.
- New information about the risks or the control measures.
- Checks showing controls no longer work: failing sentinel outlets, a positive laboratory result.
- Changes to key personnel: the chief engineer or responsible person leaves.
- A case of legionellosis associated with the system.
Take the 2019 report apart, then write the new one
The hotel in the Responsible Person course has an old, unsigned assessment that rated the whole site Medium. You survey it again, rate all 14 assets and write the action plan, with a model answer after each sitting. Ten hours, online, R2 950.
How do you rate Legionella risk?
Rate each asset, not the whole site. The ASC scale, used in our Intermediate course and the free builder, multiplies likelihood by consequence, each scored 1 to 5.
| Score | Likelihood: how likely is growth? | Consequence: who breathes it? |
|---|---|---|
| 1 | Rare: all controls in place and verified, no growth conditions found | Negligible: no aerosol reaches people |
| 2 | Unlikely: controls in place with minor gaps | Minor: occasional exposure of a few healthy adults (for example maintenance staff) |
| 3 | Possible: one growth condition present, or controls in place but not monitored | Moderate: regular exposure of healthy adults (staff, gym users, conference delegates), or brief exposure of the public to very little aerosol (a gentle fountain people walk past) |
| 4 | Likely: two or more growth conditions present, a control limit failing, or plant that runs in the growth range by design (a cooling tower) with its monitoring lapsed | Major: exposure of the public including older or vulnerable people (hotel guests) |
| 5 | Almost certain: stagnant water in the growth range, or Legionella detected | Severe: aerosol reaches many people at once or highly susceptible people (frail care residents, a hot tub breathing zone, cooling tower drift over a terrace or an air intake) |
Risk score = likelihood x consequence. 1 to 6 is Low, 8 to 12 Medium, 15 to 25 High (7, 11, 13 and 14 cannot occur). High: interim controls within 24 hours and permanent action within 1 month. Medium: action within 3 months. Low: keep controls and monitoring, review at the next review.
One rule catches people out. Cooling towers, evaporative condensers, spa pools and hot tubs run in the growth range by design, so they can never be likelihood 1. With every control in place, monitored and verified they are 2, so a well-run tower whose drift reaches people scores 2 x 5 = 10, Medium, never Low. With monitoring lapsed they are 4, and with Legionella detected, 5.
Free tool: rate your own assets on the same scale
Step 3 of the free Legionella Risk Assessment and Water Management Plan Builder rates each asset on the ASC scale and sets the action plan due dates for you. Practise on the hotel case, then do your own site and export it.
The builder gives you the form. Legionella Responsible Person Training (R2 950) teaches the judgement behind every rating and limit.
A worked example: the Umthombo Bay Hotel
The hotel case in our courses is a training scenario built from real audit patterns: a 140-room, eight-storey beachfront hotel on the Eastern Cape coast, with many retired guests. For hot water, room 112 is the sentinel nearest the basement calorifiers and room 801 the furthest. The cold water comes down from the roof tanks, so for cold the order reverses: room 801 is the outlet nearest the tanks and room 112 the furthest. This is ASC’s model rating.
| ID | Asset | Key observations | L | C | Score | Band |
|---|---|---|---|---|---|---|
| UB-01 | Calorifiers 1 and 2 (2 x 3 000 L, heat pumps with element backup) | Set to 55 °C since 2024, flow reads 55 °C, no internal inspection or drain-down on record | 4 | 4 | 16 | High |
| UB-02 | Hot water circulation loop and four risers | Common return 46 °C (below 50 °C), room 801 hot 43 °C at one minute | 4 | 4 | 16 | High |
| UB-03 | Staff and spa change room geysers (2 x 200 L on timers) | Switched off 22h00 to 05h00, spa change shower 38 °C at 06h30 | 4 | 3 | 12 | Medium |
| UB-04 | Roof cold water tanks (2 x 10 000 L polyethylene) | About two days’ storage in winter, 27 °C in summer, no inspection record | 4 | 4 | 16 | High |
| UB-05 | Cold water distribution | Room 801 cold 24 °C at two minutes, room 112 cold 19 °C | 3 | 4 | 12 | Medium |
| UB-06 | Guest room showers, heads and hoses (140 rooms) | No cleaning or descaling schedule | 3 | 4 | 12 | Medium |
| UB-07 | Eighth floor, 12 closed rooms | Closed three months, not flushed, hot 43 °C at one minute, cold 24 °C | 5 | 4 | 20 | High |
| UB-08 | Conference centre shower room | Used a few times a year, not flushed | 4 | 3 | 12 | Medium |
| UB-09 | Rooftop cooling tower (conference air conditioning) | 15 m from the restaurant terrace, dip slides irregular, no Legionella sample in 18 months, drift eliminators never inspected | 4 | 5 | 20 | High |
| UB-10 | Spa hot tub (six seats) | Warm by design, no record of water checks, aerosol in the breathing zone, older guests | 4 | 5 | 20 | High |
| UB-11 | Lobby decorative fountain (recirculating) | On no maintenance schedule | 4 | 3 | 12 | Medium |
| UB-12 | Eyewash station, pool plant room | Never flushed | 4 | 2 | 8 | Medium |
| UB-13 | Kitchen hot and cold water including the pre-rinse spray at wash-up | Used every day, on the main loop | 2 | 3 | 6 | Low |
| UB-14 | Gym and pool change room showers | On the main loop, used daily | 2 | 3 | 6 | Low |
Six High, six Medium, two Low, against the 2019 report’s single “Medium”. Three High actions from the model answer:
- UB-07, the closed floor: flush every outlet weekly until it reopens, and before reopening flush, sample and disinfect where results require.
- UB-09, the cooling tower: dip slides weekly, Legionella sampling at least quarterly, inspect and repair the drift eliminators, review the contractor’s scheme and reports monthly.
- UB-01, the calorifiers: storage back to at least 60 °C and flow never below 60 °C, with TMVs fitted first where scalding is a risk, rather than a lower storage temperature.
What moved the ratings was measured temperatures, who is exposed and whether anything is monitored. The full workshop is in the Intermediate course. See also Legionella testing in South Africa.
What should a Legionella risk assessment template include?
Most free downloads are written for UK law. Build yours on these headings:
- Site, scope and date
- Assessor’s name, signature and competence
- Legal basis: OHS Act, HBA Regulations, 2022, SANS 893 as benchmark
- Schematic and asset register
- Survey findings, with measured temperatures and photographs
- People exposed, vulnerable groups named
- Current controls and how they could fail
- A rating per asset, with reasons
- Action plan: owners, dates, interim controls
- Review date, triggers and circulation list
The free builder produces the register, ratings, action plan and monitoring schedule as an xlsx workbook. The judgement behind each number is what our Legionella risk assessment course teaches.
Awareness Training for your team (R799) →Start the Responsible Person course (R2 950) →
Frequently asked questions
Is a Legionella risk assessment a legal requirement in South Africa?
Yes, wherever employees or other people may be exposed. Regulation 6 of the HBA Regulations, 2022 requires a documented risk assessment by a competent person and a documented action plan. Section 9 of the OHS Act extends the duty to guests, residents and the public.
Who can carry out a Legionella risk assessment?
A competent person: someone with the knowledge, training, experience and, where applicable, qualifications specific to hazardous biological agents that the task needs. It can be a trained staff member or a consultant, named on the report.
How often should a Legionella risk assessment be done?
At least every 24 months under HBA regulation 6(6), and at once if it is no longer valid, after a plant or process change or an incident. ACOP L8 (para 47) adds a change in the building’s use, checks showing the controls are not working, a change of key personnel and a linked case of legionellosis.
What does a Legionella risk assessment include?
At minimum the agent and route of exposure, where it may be present, the work processes, current controls and how they could fail, and the effects on people including vulnerable employees. Then a documented action plan and a review date.
Does a Legionella risk assessment include water testing?
Not necessarily. It surveys systems, temperatures, people and records. Sampling is added where temperatures are not consistently achieved, where people are more susceptible, for cooling towers and spa pools, and when a system is suspected in a case.
Can our water treatment contractor do the risk assessment?
Yes, if the person doing it is competent and named on the report. The duty stays with the employer, which under section 37 of the OHS Act is presumed liable for its employees and contractors unless it proves it did not permit the act, the act was outside their authority, and it took all reasonable steps. Read their assessment critically.
Is there a free Legionella risk assessment template for South Africa?
ASC’s free Legionella Risk Assessment and Water Management Plan Builder takes you through the asset register, risk rating, controls, corrective actions and results, then exports an xlsx workbook. It is built on the OHS Act and the HBA Regulations, 2022.
Learn the method, then use it on your own site
You walk away with an asset register and schematic method, the ASC rating scale, a complete risk assessment and action plan for a 140-room hotel, and the builder to export your own site’s plan. Written for South African law.
Start the Responsible Person course (R2 950) →Awareness Training for your team (R799)Self-paced, works on a phone. HPCSA CPD accredited. Certificate on passing.