The Water That Waits: Board Oversight of Legionella in Underused Premises
Photo: empty office washroom unused taps commercial building water safety UK, via images.pexels.com
Empty desks and closed kitchens are now a familiar feature of many UK SME premises. Hybrid working, seasonal shutdowns and partially let buildings can leave water systems designed for daily use sitting idle for days or weeks. That inactivity is not merely a facilities inconvenience. It is a governance issue, because stagnant water, lukewarm temperatures and biofilm can create the conditions in which Legionella bacteria multiply. If the board cannot show who is responsible, what has been assessed and when remedial action was taken, the organisation is carrying an unmanaged risk.
Why low occupancy changes the risk profile
Legionella risk is often discussed as a technical matter for contractors. In practice, it is shaped by how a building is used. A washroom block that once served fifty people every day may now serve five people twice a week. Little-used taps, showers, toilet cisterns and kitchen outlets can hold water for long periods. Where temperature control is marginal, the system can move into a range that supports bacterial growth. Aerosol generation from showers, spray taps or cooling equipment can then create an exposure route.
The governance point is that the original risk assessment may no longer reflect the building as it operates in 2026. Occupancy assumptions embedded in a 2019 assessment are not evidence of current control. Boards should treat any material change in use, including a floor closure, a shift to hybrid working, a seasonal shutdown or a refurbishment, as a trigger to review the water safety arrangements.
Name the duty holder and the responsible person
UK guidance on Legionella control, particularly the Approved Code of Practice L8 and HSG274, places duties on those in control of premises. For an SME, that usually means the company and its board. The first governance step is to record who holds the duty and who has been appointed as the responsible person to carry out day-to-day control. That appointment should be in writing, with a named deputy and a clear route for escalation.
A job title alone is not enough. The responsible person needs competence, access to competent contractors and sufficient authority to act when records show a problem. In multi-site organisations, the board may appoint local responsible persons for each building while retaining central oversight. The board does not need to test water temperatures itself, but it should be able to see that someone competent is doing so and that the arrangement survives annual leave, staff turnover and site closures.
Keep a water safety log that the board can actually read
The operational record may be a detailed folder held by a contractor or facilities provider. The board record should be shorter and more decision-focused. A one-page water safety summary can show the named responsible person, the date of the current risk assessment, the number of open remedial actions, the flushing regime and any exceptions. Beneath it, the full log should hold asset registers, schematics, temperature checks, contractor reports and records of action taken.
The test is whether a director can answer three questions without calling an engineer: which sites have current assessments, which actions are overdue, and what has been done about them. If the answer depends on a contractor's assurance that everything is fine, the board has not yet established control.
Schedule assessment and flushing by risk, not habit
Risk assessments should be reviewed at the frequency set out in the organisation's arrangements and whenever there is a significant change. Flushing regimes should reflect actual use. Low-use outlets may need weekly flushing, with records showing who did it and when. Seasonal closures require a planned approach: some systems may be drained or isolated, while others need continued flushing and temperature monitoring. Reopening should not be treated as simply unlocking the door.
The board's role is to approve the programme, fund it and receive exceptions. A site that has been closed for several weeks should have a documented reopening check before staff return. That may include flushing, temperature checks and a review of the risk assessment. The precise method belongs to the competent person, but the decision to reopen without evidence should not sit below board level.
Oversee contractors with evidence, not assurances
Many SMEs rely on external water hygiene contractors. Procurement should require competent personnel, method statements, site-specific reports and clear records of remedial work. The board should see the contract terms that require data, not just a certificate. Where a contractor reports a failed temperature check or a damaged outlet, the governance question is who owns the corrective action and when it will be closed.
A useful board discipline is to review contractor reports for exceptions rather than volume. A report that says no issues is less informative than a schedule showing outlets tested, temperatures recorded, actions raised and actions completed. If remedial work is deferred for cost reasons, the decision and its rationale should be recorded at the appropriate level.
Put the decisions in the minutes
Governance is evidenced by decisions. The board should minute the appointment of the responsible person and deputy, approval of the risk assessment programme, budget for flushing and remedial work, the closure and reopening protocol, and any escalation thresholds. For multi-site premises, a quarterly dashboard can show assessment status, overdue actions and site-specific exceptions.
Where a site is partially vacant, the board should also record how vacant areas are being managed. An empty floor is not outside the water safety regime simply because no one works there. Access, isolation and flushing arrangements should be documented.
The board pack test
Before the next board meeting, directors can apply a simple test. Is there a named responsible person with a deputy? Is the current risk assessment date visible? Are open actions listed with owners and dates? Is there evidence of flushing and contractor oversight? Are decisions recorded? If any answer is no, the organisation has a gap between operational activity and board assurance. Closing that gap is not a technical exercise. It is a matter of governing the water that waits in underused premises.
