Most facilities managers meet the written scheme of control the same way: something happens, someone asks for the paperwork, and it turns out the building has a risk assessment from four years ago and nothing else. The risk assessment gets the attention because it is the one people have heard of. The written scheme is the one that quietly determines whether your control arrangements actually operate effectively.
This article explains what it is, whether you need one, what it should contain, who is responsible for it, and how to tell in about ten minutes whether yours would provide credible evidence of an effective control regime.
The short answer
A written scheme of control is the plan for keeping Legionella risk under control day-to-day — what gets checked, by whom, how often, what “in control” looks like, and what happens when a check falls outside those limits.
The risk assessment identifies the hazards. The written scheme turns them into a routine somebody actually follows. Without it you have a diagnosis and no treatment plan.
Does your building need one?
If the risk assessment identifies a significant foreseeable risk from Legionella that requires ongoing control measures, a written scheme of control should be prepared and implemented.
The extent and detail should be proportionate. A large hospital estate and a small office with a mains-fed system and no stored water are not the same problem, and should not produce the same document. Some simple, low-risk systems may need only straightforward precautions rather than an extensive scheme. The test is what the assessment found, not whether the building has pipes. Occupant susceptibility and the consequences of control failure matter too — a physically simple system is not necessarily low risk in every setting.
The duty sits in a stack of law rather than a single regulation. The Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999 create the duty to assess and control. The Control of Substances Hazardous to Health Regulations 2002 apply to risks from exposure to Legionella bacteria as a biological agent.
ACoP L8 has special legal status and sets out recognised arrangements for complying with those duties. HSG274 provides more detailed technical guidance for particular types of water system — Part 2 covers the hot and cold water systems most facilities managers routinely oversee.
Healthcare premises are also expected to follow the relevant healthcare-specific water safety guidance alongside applicable legislation, ACoP L8 and HSG274. In England this includes HTM 04-01; in Scotland, the corresponding SHTM guidance should be consulted, and other UK nations have their own arrangements. These frameworks normally require formal water safety governance, including a multidisciplinary water safety group and a documented Water Safety Plan.
“We use a contractor, so they hold the scheme.” Appointing a contractor does not transfer your overall responsibility for ensuring suitable arrangements are in place. Contractors and consultants may also hold legal and contractual responsibilities for the services they provide — but the organisation in control of the premises must still satisfy itself that the scheme is suitable, current, and being implemented effectively.
What an effective written scheme should contain
The exact content should reflect the systems and risks identified, but an effective scheme will typically cover the following:
- An up-to-date description of the water systems, supported by an accurate schematic or system drawing where appropriate to the size and complexity of the premises.
- The roles and named individuals — those with control of the premises, the appointed responsible person, arrangements for competent cover during absence, and the contractors involved.
- How the system should be operated and maintained safely.
- The control measures and the precise checks — what to monitor, how, and at what frequency.
- The control parameters — the target temperatures, readings and limits that define “in control”. Without these, monitoring records are just numbers.
- The remedial action to take when a check falls outside those parameters. Decided in advance, in writing, rather than improvised on the day.
- The risk assessment, system information and relevant guidance or technical standards on which the control arrangements are based.
Points 5 and 6 are where schemes most often fall short. Plenty of documents list what to check and how often. Far fewer state what a passing result looks like and what happens when it does not pass. That gap is where a site drifts outside its defined control parameters without anyone noticing — readings get taken, filed, and never assessed against anything.
Who is responsible for it
The most common governance failure in water hygiene is not technical. It is a gap where everyone assumed somebody else was responsible.
| Role | Who | Responsible for |
|---|---|---|
| Dutyholder | The employer, or person or organisation in control of the premises — which may be an owner, landlord, managing agent or operator | Ensuring suitable arrangements exist, are resourced and are implemented. Appointing others does not remove the dutyholder's own responsibilities. |
| Responsible person | A named, competent individual with sufficient authority | Day-to-day management of the arrangements; keeping the scheme current and ensuring tasks happen and are recorded. |
| Cover arrangements | Competent cover during absence, which may include a formally appointed deputy | Continuity so that responsibility does not lapse during leave or vacancy. |
| Contractor / specialist | Competent water hygiene contractor, selected using evidence relevant to the work being undertaken | Risk assessment, sampling, cleaning and disinfection, specialist tasks. Membership of an industry scheme such as the LCA, or applicable UKAS accreditation, may form part of assessing competence but does not by itself guarantee it for every task or site. |
| Staff / operatives | Trained in-house people | Routine monitoring and simple tasks set out in the scheme. |
The organisation or person with relevant control of the premises must ensure the scheme exists, is suitable, and is implemented. The appointed responsible person normally manages it day-to-day. Where control is shared — a landlord and tenant, or an estate with a managing agent — the precise allocation of duties should be clearly documented rather than assumed.
How often it needs reviewing
There is no universal statutory expiry date, and no automatic two-year renewal rule. The scheme and its supporting risk assessment should be kept under review and reconsidered whenever there is reason to believe they may no longer be valid or effective.
A proportionate periodic review can be scheduled as an organisational control, and many organisations do. But it should not replace event-driven review. The two-year period sometimes quoted is a record-retention period associated with risk assessments and written schemes after they cease to be current; it is not a prescribed review frequency. Monitoring, inspection and maintenance records should normally be retained for at least five years.
The real trigger is change, not the calendar. Review whenever any of these happens:
- Changes to the water system or the plant
- Changes to how the building is used, or who uses it
- Building or refurbishment work, including new or removed pipework
- New information about risks, or a change in guidance
- Monitoring results showing the controls are not working effectively
- A suspected or confirmed case of Legionnaires’ disease linked to the premises
A building that has been reorganised, partially mothballed and brought back into use — as a great many were — has very likely outgrown a scheme written before all that happened.
Ten minutes to find out where you stand
Work down this list. Every “no” is a gap worth writing down.
- Can you put your hands on the written scheme right now, without asking a contractor?
- Does its description of the systems match the building as it stands today?
- Does it identify the current responsible person and the arrangements for competent cover during absence?
- Does it state the control parameters, not just the tasks?
- Does it say what to do when a check falls outside those parameters?
- Is the logbook up to date, with no unexplained gaps in monitoring?
- Where something did fall out of range, is there a record showing it was investigated and closed out?
- Has it been reviewed following the last change to the building or its use?
If someone asked this afternoon, could you produce a current risk assessment, a live written scheme, and a logbook showing the scheme has actually been followed? Those three together are the backbone of a defensible position. Unexplained gaps in the logbook may raise questions about whether the control regime remained effective throughout.
If you have just taken this on
Newly appointed responsible persons often inherit a situation nobody has explained to them. A workable first 90 days:
Week one — find out where you stand
- Confirm in writing that you hold the role, and what arrangements cover your absences
- Find the current risk assessment. Check that it remains suitable and sufficient, reflects the building and water systems as they now exist, and has been reviewed following any relevant changes
- Find the written scheme and logbook. Check monitoring is up to date with no unexplained gaps
First month — verify it on the ground
- Walk the site against the asset register and schematic — tanks, calorifiers, outlets, any cooling tower or spa pool. Note anything not on paper
- Establish who does what: which tasks are in-house, which are contracted, and what evidence demonstrates that the organisations and individuals involved are competent for their assigned work
By 90 days — close the gaps
- List the gaps, prioritise them, agree timescales, and start with the highest risk
- Diarise the recurring tasks and the next review so nothing lapses on your watch
The written scheme is not paperwork for its own sake. It is the difference between a building where somebody has decided how water safety will be managed, and one where it is happening by accident.
The rest of the picture
This covers the written scheme. The full guide covers the other seven sections — the regulations in plain English, what compliance looks like day-to-day with the frequencies that apply, the records that help demonstrate what has been done, when to bring a specialist in, and a self-audit checklist you can score your site against.
47 pages. £35. Instant download. A free 8-page sample is available if you would rather see it first.
This article is intended as general practical guidance only and is current at August 2026. It does not replace a suitable and sufficient site-specific risk assessment, competent professional advice, or reference to current legislation, approved codes of practice, standards and sector guidance. Users remain responsible for determining the suitability of any actions for their premises, systems and legal duties.