As featured in waterline Winter 2019-20

Review or not to review?

A risk assessment story

Colin Shekleton

It only seems like yesterday that the fourth edition of the Approved Code of Practice (ACOP) and guidance on regulations L8 and its associated guidance and technical guidance was updated and published. Yet is was back in 2013, so we have been using, referring and applying the updated guidance for six years now!

Compared to the third edition, the 2014 updated version had separate technical guidance’s in the guise of HSG274 parts 1: The control of legionella bacteria in evaporative cooling systems, parts 2: The control of legionella bacteria in hot and cold water systems and part 3: The control of legionella bacteria in other risk systems.

Since its inception, the ACOP has provided advice on the requirements of the Health and Safety at Work etc. Act 1974 along with the Control of Substances Hazardous to Health Regulations 2002, in addition to giving guidance with the relevant parts of the Management of Health and Safety at work Regulations 1999.

The ACOP and HSG274 documents, as well as providing advice on how to comply with those aspects of the law, also provides sound and clear, albeit basic, technical information on various water systems types and their operation. In addition there was some specific guidance given for healthcare premises, and also for shared premises and residential accommodation when it was updated.

To further aid us, we have the recently updated BS8580-1:2019; Water quality – Risk assessments for legionella – Code of Practice. For more specialists systems; since 2017, we have had HSG282; The control of legionella and other infectious agents in spa-pool systems, and not forgetting the Department of Health’s; Health Technical Memorandum (HTM) 04-01: Safe water in healthcare premises (parts, a, b, c 2016 and supplement 2017). There are a plethora of other associated British Standards which are too numerous to mention. We are probably not lacking guidance or advice when it comes to this subject matter!

In terms of how to control the risk of exposure to legionella bacteria, little has changed from the first large outbreak in England and Wales which Review or not to review? A risk assessment story occurred at Kingston Hospital in Surrey between December 1979 and July 1980 (just 7 years after the author of this paper was born in that very establishment!). The principles of control that were eventually applied at Kingston 40 years ago still work today and therefore still apply. Of course there have been some detail changes, including the evidence and appraisal approach of when to clean a cooling tower packing, or the consideration of hot water circulation in far more detail by means of identifying principal, subordinate or tertiary hot water circulating loops (to name only two examples).

As someone who carries out legionella risk assessments on a regular basis, the above documents and the technical information therein has been hugely useful over the years. In the opinion of this humble risk assessor, one of the most significant changes was the removal of the 2 year frequency for reviewing legionella risk assessments. The industry seemed to “hang their coat” on this 2 year period, yet the wording “at least every two years” only ever appeared in the guidance part of the previous L8, not in the ACOP part! Even today we still get questions about when to review the risk assessment from end-users and Duty Holders. I do understand this frustration, as Duty Holders are usually very busy people with lots to consider, not just water. They say “just tell me how often I need to do the risk assessment!” unfortunately in the world of risk, and its assessment, this is not straightforward, there are just too many variables at play to give a single answer to this complex question. Whilst it may be a complex question, the principle behind the answer is actually quite straightforward, and again the ACOP gives us some well-defined advice on how to decide on when to carry out a review. Before analysing this advice let’s consider a scenario where a 2 year risk assessment frequency may be in-appropriate:

We begin with two buildings, of equivalent size and age, located on the same road. The surrounding area has commercial, retail and residential properties, along with a medium sized hospital within 2 km of the properties in question.

In property “A” we have a web development company where the average age of employee is 29. The workspace is predominantly desks and work-stations, along with a break-out meeting area. The water services include an incoming mains supplying a communal WC area, a kitchenette and a small electric water heater which provides all the hot water.

In property “B” we have an engineering company where the average age of the employee is 52. The workspace is predominantly desks, with a small manufacturing area set aside for prototyping one-off components. The domestic water services present are similar to building “A”, but in addition the manufacturing process requires that heat must be rejected, so a small, open circuit, evaporative cooling tower is located at the rear of the building exhausting to atmosphere.

Whilst the buildings in either scenario themselves are largely similar in size, the inherent risks associated with the systems described above are intrinsically very different, as is the potential for exposure to legionella bacteria, due to the presence of the cooling tower. In property “A” a suitable risk assessment frequency may be every 2 years, or perhaps longer than 2 years…? Yet in property “B” 2 years between assessments may be too long, given the inherent and potential residual risks at play.

In other words a risk based approach should be considered when attempting to define a recommended frequency for review.

The ACOP and Guidance states the following:

ACOP L8 Para 32: “You need to review the assessment regularly and specifically when there is reason to believe that the original risk assessment may no longer be valid.”

There is a potentially tricky word in that quote: “regularly”. When you look up the definition of the word “regularly”, you see explanation examples that use words such as “frequently” or “often”. Neither of these words are especially helpful, if you take the time to look up the meaning of “frequently” or “often”, you would find the word “regularly” is used as their primary definition, and hence we go round in circles! Another word that does come up in a definition search of “regularly” is “uniform”. In the context of “uniform intervals”, this is probably more useful to us. We therefore conclude that “regularly” could mean:

– Every 2 years, or
– Every 4 years, or
– Every 3 months… etc.

Whilst all of the above are “uniform” and hence “regular”, are they sufficient in the context of a legionella risk assessment? Well that depends…

It is of course reasonable, and indeed useful, to define a frequency of when next to review the risk assessment. However, as in life, things often change, and hence the risk may also be affected. As the “record of assessment is a living document that must be reviewed to ensure it remains up-to-date” a review should be considered. Yet again we can turn to ACOP L8 for assistance in this:

Within guidance of ACOP L8, specifically para 47 it states: “An indication of when to review the assessment and what to consider should be recorded. This may result from, e.g.:

(a) changes to the water system or its use;
(b) changes to the use of the building in which the water system is installed;
(c) the availability of new information about risks or control measures;
(d) the results of checks indicating that control measures are no longer effective;
(e) changes to key personnel;
(f) a case of legionnaires’ disease/ legionellosis associated with the system.

So whilst we may define a uniform, or “regular” frequency of risk assessment review, should something change (as defined above) then we should consider the impact this has to the inherent and residual risks, and we achieve this by reviewing the risk assessment. It should be noted that such a decision to review the assessment overrides the suggested timeframe frequency previously defined.

Such a review may be very simple and require just a small adjustment to documentation, perhaps such as a water outlet becoming little used due to a space being vacated. So we ask questions such as:

– Do we need the outlet, can it be removed?
– What impact does the lack of use of the outlet have on the rest of the water system? i.e. is it fed from a cold water storage tank that is now oversized?
– Is the water hygiene regime appropriate? The outlet should be flushed at a suitable frequency (HSG 274 table 2.1 suggests weekly, or as indicated by the risk assessment)

Likewise such a review may be much more involved, due to the addition of complex risk systems. Large parts of the entire document may need to be re-written.

As is so often the case much of this interpretation, and hence, decision making process is reliant on the competence of the individuals concerned. Someone with the appropriate skills, knowledge, ability, training and experience will understand the need to establish what has changed so that they can make an informed decision on when to review and what is sufficient in terms of what that review may require. Ultimately a decision must be made by those who are competent and understand the systems and the risks.

Summary
Every scenario is different, even if buildings are identical, the people within them and the usage may not be. Hence the frequency of review may be different. The ACOP is well written and does give useful advice in this aspect.

Whilst having a date in the diary to review a risk assessment is undoubtedly useful, a better measure on when a risk assessment should be reviewed is considering the validity of the current risk. So, instead of asking “when is the risk assessment due?”, perhaps we should ask “is the risk assessment still valid?”. This is a different mind-set, but is one that we should all work together with end-users to convey.

Happy Risk Assessing.