2. Identify and assess sources of risk
Carrying out a risk assessment is your responsibility. You may be competent to carry out the assessment yourself but, if not, you should call on help and advice from a competent person, either within your own organisation or from outside sources, for example consultancies.
A competent person is someone who has sufficient training and experience or knowledge and other qualities that allow them to assist you properly. HSE has more guidance on how to appoint a competent person.
What to look for in your water system
You, or the person responsible for managing risks, need to understand your water systems, the equipment associated with the system such as pumps, heat exchangers, showers etc, and its constituent parts.
Identify whether they are likely to create a risk from exposure to legionella, and whether:
- the water temperature in all or some parts of the system is between 20–45°C
- water is stored or recirculated as part of your system
- there are sources of nutrients such as rust, sludge, scale, organic matter and biofilms
- the conditions are likely to encourage bacteria to multiply
- it is possible for water droplets to be produced and, if so, whether they can be dispersed over a wide area, for example showers and aerosols from cooling towers
- it is likely that any of your employees, residents, visitors etc are more susceptible to infection due to age, illness, a weakened immune system etc and whether they could be exposed to any contaminated water droplets
Specific systems likely to cause risk
You will also need to consider technical and further information on the following systems:
What to include in your risk assessment
Your risk assessment should include:
- management responsibilities, including the name of the competent person and a description of your system
- competence and training of key personnel
- any identified potential risk sources
- any means of preventing the risk or controls in place to control risks
- monitoring, inspection and maintenance procedures
- records of the monitoring results and inspection and checks carried out
- arrangements to review the risk assessment regularly, particularly when there is reason to suspect it is no longer valid
If you conclude that there is no reasonably foreseeable risk or the risks are low and are being properly managed to comply with the law, your assessment is complete.
You may not need to take any further action at this stage, but any existing controls must be maintained and the assessment reviewed regularly in case anything changes in your system.