Home / Guides / Legionella water management plan
Legionella · Water management plan · Written scheme of control · Template
Key facts
- Also called written scheme of control (ACOP L8), water management programme (CDC, ASHRAE 188)
- Method the CDC’s seven steps
- Hot water stored at 60 °C or above, outlets 50 °C or more within one minute
- Cold water below 20 °C within two minutes
- Cooling towers dip slides weekly, Legionella at least quarterly
- Records monitoring reports 40 years, control examinations and repairs 5 years
Build a plan your team can actually run
Legionella Responsible Person Training covers control limits, corrective actions, verification and validation, records and managing your water treatment contractor. In the workshop you build the monitoring schedule and corrective action matrix for a 140-room hotel. Ten hours, online, R2 950, HPCSA CPD accredited.
What is a Legionella water management plan?
It is the document your team works from every week. The risk assessment finds and rates the risk. The water management plan controls it: what is done at each asset, to what limit, how often, by whom, and what happens when a reading is out. UK ACOP L8 calls it a written scheme of control. The CDC and ANSI/ASHRAE Standard 188-2021 call it a water management programme, and WHO recommends water safety plans for buildings.
The CDC names the buildings that need one: healthcare facilities with overnight stays, senior housing, multifamily buildings with centralised hot water, and buildings over 10 storeys. In any building, so do cooling towers, hot tubs not drained between users, decorative fountains, and centrally installed misters and humidifiers.
The cost of a weak plan is on record. Of 27 Legionnaires’ disease outbreaks the CDC investigated in the USA from 2000 to 2014, 23 (85 percent) had problems a water management programme could have prevented: process failures in 65 percent, human error in 52 percent, equipment failures and unmanaged external changes in 35 percent each.
What does South African law say about a written scheme of control?
The HBA Regulations, 2022 never say “water management plan”, but three regulations describe one. Regulation 7 requires a monitoring programme by a competent person, at intervals set in the risk assessment, never more than 24 months apart. Regulation 10 requires documented work procedures, including maintenance of installations. Regulation 12 requires documented, risk-based protocols for every control, covering performance criteria, the verification method and interval, maintenance and minimum competency, with a thorough examination and test at least every 24 months. In my reading, regulation 12 is the clearest legal hook for a written scheme. And 24 months is a ceiling: a hot water loop under control is checked monthly.
ACOP L8 (para 60) says the written scheme should include, where appropriate: an up-to-date plan of the system’s layout, including parts temporarily out of use, a description of its correct and safe operation, the precautions to take, the checks that show it is effective and how often, and the remedial action if it is not.
How do the CDC’s seven steps apply to a South African building?
The CDC toolkit, “Developing a Water Management Program to Reduce Legionella Growth and Spread in Buildings” (version 1.2, September 2025), is the clearest method in print, shown here with South African detail.
- Build a programme team: the responsible person and deputy, the maintenance lead, housekeeping and spa supervisors, the water treatment contractor, and a manager who signs off spending. Tell the health and safety representatives, as regulation 4(1) requires. See who is responsible for Legionella.
- Describe the water systems with text and flow diagrams, from the municipal meter, borehole or JoJo-type tanks, through pumps, heat pumps, calorifiers and geysers, to every outlet. Mark dead legs and parts out of use.
- Identify where Legionella could grow and spread: warm cold water, hot water below 60 °C, stagnation, biofilm, and every route to aerosol.
- Decide where control measures are needed and how to monitor them, with a control limit for each. The template below does this.
- Set corrective actions for when a limit is missed. Decide in daylight what happens at 02h00.
- Confirm the programme runs as designed (verification) and works (validation).
- Document and communicate.
The Legionella water management plan template
Copy this into a spreadsheet, delete what does not apply, and add a column naming the log for each line. Limits and frequencies come from HSE HSG274 Parts 1 and 2, HSE HSG282 and, for hot tubs, the National Environmental Health Norms and Standards for Premises and Acceptable Monitoring Standards for Environmental Health Practitioners (GN 7779, 2026). In healthcare premises, the hot outlet and return limits rise to 55 °C.
| Asset | Control limit | Check | How often | Who | If the limit is missed |
|---|---|---|---|---|---|
| Calorifiers and geysers | Stored at 60 °C or above, calorifier flow never below 60 °C | Flow and return temperature, calibrated probe. Internal inspection | Monthly. Internal inspection annually. Point-of-use heaters monthly to six-monthly | Maintenance | Restore the set point, find the cause, recheck |
| Hot water loop returns | 50 °C or above from each loop | Return temperature | Principal loops monthly, subordinate loops quarterly | Maintenance | Balance the loop, check pumps and valves |
| Hot sentinel outlets | 50 °C or above within one minute | Run time and temperature, outlets nearest to and furthest from the calorifier | Monthly | Maintenance | Check calorifier and loop, recheck. Repeated failure: sample, review |
| Cold sentinel taps | Below 20 °C within two minutes | Run time and temperature, taps nearest to and furthest from the cold water tank | Monthly | Maintenance | Find the heat gain: tank, pipe runs, stored volume |
| Cold water tanks | No more than one day’s use stored (12 hours in healthcare) | Internal inspection. Temperature in summer | Annually | Maintenance | Clean and disinfect. Cut stored volume by lowering the float valve, with water still flowing through every tank. Shade or insulate |
| Little-used outlets | No standing water | Flush for several minutes, spray kept low | Weekly, or as the risk assessment sets | Housekeeping | Flush before next use, record why it was missed |
| Showerheads and hoses | Clean, free of scale | Clean, descale, disinfect | Quarterly, or as fouling indicates | Housekeeping | Replace heads that will not come clean |
| Thermostatic mixing valves | Fail safe if cold supply fails, strainers clean | Fail-safe test. Strainers cleaned, descaled, disinfected | Annually, or as the risk assessment sets | Maintenance | Repair or replace, outlet out of use if unsafe |
| Water softeners | Salt topped up, unit serviced | Salt level. Service and disinfection | Salt weekly. Service annually or per manufacturer | Maintenance | Top up, service |
| Other outlets | Hot and cold limits as above | Temperature profiling on rotation | Whole system covered over a defined period | Maintenance | As for sentinel outlets |
| Cooling tower: microbiology | Aerobic count 10 000 cfu/mL or less. Legionella 100 cfu/L or less | Dip slide. Legionella sample, accredited laboratory | Dip slides weekly. Legionella at least quarterly | Contractor, checked by the responsible person | Aerobic over 10 000: adjust biocide, resample after 24 hours. Legionella over 1 000: immediate action, resample within 48 hours |
| Cooling tower: condition | Clear water, drift eliminators intact, clean | Operation and water appearance. Physical condition. Control functions | Daily. Weekly. Every one to three months | Site and contractor | Clean and disinfect when fouled, altered, or after a month or more off |
| Spa pool or hot tub: water | pH and residual disinfectant within the supplier’s limits | Test and record. Backwash filters. Clean surfaces. Drain, clean, refill | pH and disinfectant at opening and every two hours. Filters backwashed at the end of each day, surfaces cleaned daily. Drained and cleaned at least weekly (GN 7779), daily where the risk assessment says | Spa staff | Out of use until it passes |
| Spa pool or hot tub: microbiology | Legionella below 1 per 100 mL, which is below 10 cfu/L (GN 7779). Ask for a laboratory detection limit of 10 cfu/L or lower | E. coli and Pseudomonas aeruginosa. Aerobic colony count and coliforms. Legionella | E. coli and P. aeruginosa weekly (GN 7779). Aerobic count and coliforms monthly (HSG282). Legionella monthly (GN 7779, hot tubs) | Responsible person | 10 cfu/L or more: review controls and resample. Over 1 000 cfu/L: close at once, keep people out, shut down, shock dose, drain, clean and disinfect, review, refill, retest next day and 2 to 4 weeks later |
| Emergency showers and eyebaths | No stagnant water | Flush to drain three to five times the stagnant volume. Clean heads | At least six-monthly. Heads quarterly | Maintenance | Flush, add to the rota |
The hot tub rows follow an ASC position: run a hotel hot tub to the stricter of GN 7779 section 7 and HSG282. Section 7 of GN 7779 (public swimming pools and spa baths) is the part that applies, and its 7.3 schedule sets monthly sampling for hot tubs. HSE gives typical cooling tower cleaning intervals, which it calls not prescriptive: at least twice a year for comfort cooling, every three months in a dirty environment, every 12 months for a clean industrial application.
Free tool: let the builder fill in the checks
Step 4 of the free Legionella Risk Assessment and Water Management Plan Builder suggests the usual control, limit, check and frequency for each asset type, and step 5 writes the corrective actions. Edit them for your site and export an xlsx workbook.
Open the free builder at step 4 →
The builder gives you the form. Legionella Responsible Person Training (R2 950) teaches the judgement behind every rating and limit.
What should happen when a control limit is missed?
CDC step 5 is where most plans I audit are blank. A reading of 43 °C with nothing written next to it shows only that someone saw the problem and did nothing. For every check, write down in advance what the person does straight away, who they tell, when to restrict use, when to sample and review the risk assessment, and how the fix is checked.
From the hotel case in our courses: the furthest guest shower reaches 43 °C after one minute against a limit of 50 °C: check the calorifier flow and loop return, balance the loop, recheck and record. If the hot tub’s disinfectant check fails or cannot be done, the tub goes out of use until it passes. Nobody should have to decide that on the spot.
Write the corrective actions before you need them
Our water management plan training has you build the monitoring schedule and corrective action matrix for all 14 assets of a 140-room hotel, then compare it with a model plan. Ten hours, online, R2 950.
What is the difference between verification and validation?
CDC step 6 asks two different questions, and plans that mix them up fail audits.
| Verification | Validation | |
|---|---|---|
| The question | Is the plan being carried out as written? | Does the plan actually control Legionella? |
| Evidence | Logs complete and on time, flushing records, contractor visits matching the scheme, audits | Temperature trends, temperature profiling, laboratory results |
| Hotel example | Were the 12 closed rooms flushed every week last quarter? | Does room 801 now reach 50 °C within one minute, and did its sample come back clear? |
| Matching HBA regulation | Regulation 12: verification method and interval | Regulation 7: the monitoring programme |
Sampling validates. It does not control. HSE HSG274 Part 2 says routine testing of hot and cold water is not usually needed when temperatures or disinfectant levels are consistently achieved, and points to sampling where they are not, where people are more susceptible, and when a system is suspected in a case. See Legionella testing in South Africa.
The hotel case shows why verification matters. Last month’s cooling tower service report reads, in full: “Cooling tower. Visit done. Biocide topped up. Dip slide OK. System in good condition. Next visit next month.” No reading, no dose, no name. Nothing in it can be verified, and with no Legionella sample in 18 months, nothing was validated either. See Legionella in cooling towers.
What records does a water management plan need?
Regulation 9 of the HBA Regulations, 2022 sets the retention periods: risk assessments and monitoring reports for at least 40 years, records of control measure examinations, tests and repairs for at least 5 years, and training records for as long as the person is employed. Inspectors and health and safety representatives must be able to see them.
Design the logbook so the honest entry is the easy one: date, time, outlet, run time, temperature, initials, and an action column that cannot stay blank when a reading fails. In the hotel case, last year’s calorifier reading cards were thrown away. To an investigating environmental health practitioner, missing months look like no control at all. For hot water readings, see Legionella and hot water temperature.
Train the team who do the checks (R799) →Start the Responsible Person course (R2 950) →
Frequently asked questions
What is a Legionella water management plan?
The written scheme that controls Legionella in a building’s water systems once the risk assessment has found the risks. For each asset it sets the control, the limit, the check, its frequency, who does it and the corrective action when a limit is missed.
Is a written scheme of control the same as a water management plan?
Yes, they describe the same thing. ACOP L8 calls it a written scheme of control, the CDC and ASHRAE 188 call it a water management programme, and WHO calls it a water safety plan. All describe written controls, limits, checks and corrective actions.
What are the CDC’s seven steps for a water management programme?
Build a programme team, describe the water systems with text and flow diagrams, identify where Legionella could grow and spread, decide where control measures are needed and how to monitor them, set corrective actions, verify and validate, and document and communicate.
How often should Legionella checks be done?
Under HSE guidance, calorifier temperatures and sentinel outlets monthly, little-used outlets flushed weekly, showerheads cleaned quarterly, and tanks and TMVs annually. Cooling towers need dip slides weekly and Legionella samples at least quarterly. Spa pools are checked for pH and disinfectant at opening and every two hours, and hot tubs are sampled for Legionella monthly under GN 7779.
What is the difference between verification and validation?
Verification checks that the plan is carried out as written: logs complete, checks on time, contractor visits matching the scheme. Validation checks that it works: temperatures in range across the system and laboratory results showing Legionella is under control.
Who should run the Legionella water management plan?
A named, competent person appointed in writing by the employer, usually called the responsible person, with a deputy. A contractor can carry out parts of it, but the employer keeps the legal duty.
Is there a free Legionella water management plan template?
Yes. Copy the table in this guide into a spreadsheet, or use ASC’s free Risk Assessment and Water Management Plan Builder, which suggests checks for each asset, writes the corrective actions and exports an xlsx workbook.
Turn this template into a plan your team runs every week
You walk away with a monitoring schedule and corrective action matrix, a results reader for laboratory reports, a contractor oversight checklist, and a complete hotel plan to compare your own against. Ten hours, self-paced, a fraction of a two-day classroom course.
Start the Responsible Person course (R2 950) →Train the team who do the checks (R799)Self-paced, works on a phone. HPCSA CPD accredited. Certificate on passing.