Below is a practical audit approach housing providers can run internally, or use to brief an independent auditor.
Key takeaways
- A strong audit checks the full chain: risk assessment, written scheme, monitoring, remedials and evidence. That’s the difference between “we do it” and “we can prove it”.
- If you’re a registered provider, regulators expect you to complete actions arising from required health and safety assessments within appropriate timescales. Your audit should test that, not just document existence.
- Temperature control and stagnation controls are routine audit hotspots: cold below 20°C where possible, hot stored at least 60°C, 50°C within 1 minute at outlets, plus weekly flushing of low-use outlets and quarterly shower descaling.
- Sampling and lab testing should be treated as a controlled process, not a comfort blanket. If you test, use the right method and the right lab standard.
Set the scope so the audit is fair and useful
Start by defining what you’re actually auditing:
- Which systems: communal hot water plant, cold water storage, TMVs, boosted systems, or simple domestic supplies?
- Which sites: pick a representative sample plus a risk-led sample (higher risk blocks, vulnerable residents, historic issues, etc.).
- Which period: typically the last 3 to 12 months, long enough to include routine checks and remedials.
- Which parties: e.g. in-house teams and every water hygiene contractor involved.
In social housing, make sure your scope tests whether required assessment actions are being completed in appropriate timescales, as expected under the Safety and Quality Standard.
Build an “evidence pack” before you visit a single site
An audit stalls when evidence is spread across email threads and contractor portals. Pull these into one pack per site or per system:
- The latest Legionella risk assessment and review history
- Written control scheme and roles (responsible person, deputies, contractor responsibilities)
- Asset list and schematic for communal systems
- Monitoring records: temperatures, flushing, inspections, tank checks
- Cleaning and maintenance records: showers, tanks, strainers, and any planned tasks
- Sampling results (if used), sampling plan, and lab accreditation details
- Remedial works log: raised date, owner, completion evidence, re-check
The programme structure and record-keeping expectations sit clearly in HSE’s ACOP L8 and HSE’s HSG274 technical guidance.
Test competence, not just the presence of documents
A common audit blind spot is assuming any “risk assessment” is automatically suitable.
Practical checks:
- Is the assessor demonstrably competent for the system type and building profile?
- Does the assessment reflect the current system, or does it describe pipework that no longer exists?
- Are control measures and monitoring points clear enough to run without interpretation?
If you want an objective marker to include in your audit criteria, UKAS publishes guidance for accreditation of bodies undertaking legionella risk assessment activities in UKAS RG9.
Walk the system, then compare it to what your records claim
Do a short plantroom and outlet walkround with someone who knows the site.
Look for:
- Unlabelled tanks or redundant pipework
- Dead legs created by past refurb work
- Little-used outlets with no flushing plan
- Missing insulation, damaged lids, poor screens, or obvious contamination routes
Then cross-check: if the system has changed, the risk assessment and written scheme should reflect that.
Audit the controls that usually fail: temperature and stagnation
Most programmes fall down on routine delivery and escalation.
Temperature control checks
Use HSE benchmarks as your audit reference point:
- Cold water below 20°C where possible
- Hot water stored at least 60°C
- Hot water reaches 50°C within 1 minute at outlets (55°C in healthcare)
Audit questions:
- Are the right outlets used for checks consistently?
- When results are out of tolerance, is there evidence of action and re-check?
Stagnation and outlet hygiene
Here are some steps that are easy to audit because they should be scheduled and evidenced:
- Flush infrequently used outlets at least weekly
- Clean and descale shower heads and hoses at least quarterly
Audit questions:
- Do you know which outlets are “infrequently used”, or are you guessing?
- Can you trace a completed task to a specific outlet, date, and person?
If you sample for Legionella, audit the method end-to-end
Sampling is often the most expensive part of a programme, and the easiest place to lose credibility.
What you do next depends on the risk assessment and the system context, and sets expectations for laboratory standards and interpretation.
Audit questions:
- Why are you sampling this system, and where is that decision recorded?
- Is the sampling plan repeatable, or does it change with the engineer?
- Is the lab UKAS-accredited and operating to the detection limit expectations set out by HSE?
- Are results linked to actions, not filed as “passed/failed”?
Grade findings, then force close-out
Avoid vague action points like “monitor” or “review”. For each non-conformance, record:
- The control that failed
- The risk it creates (resident exposure route, loss of control, missing evidence)
- Owner and deadline
- The verification step that closes it (re-check temperature, photo evidence, revised schematic, updated assessment)
This is the point where a programme becomes audit-ready, because it creates a clear trail that shows governance and follow-through.
A short audit checklist you can reuse
- Do we have a current risk assessment that matches the actual system?
- Is there a written scheme with named roles and frequencies?
- Are temperature targets being met and evidenced?
- Are low-use outlets identified, flushed weekly, and are showers cleaned quarterly?
- Are actions from assessments closed within appropriate timescales, with proof?
If you’re struggling with auditing and tracking your water compliance, software could be a significant help. If you’d like to know more about that, check out the True Compliance page on water quality compliance.
