The written scheme of control, explained

For every water system that presents a Legionella risk, ACoP L8 expects a written scheme of control: the document that says how that risk is actually managed, day to day. It's the most practical document in the whole compliance stack — and the one most often found laminated, outdated and unread.

What it is, and which systems need one

The risk assessment says what could go wrong; the written scheme says what you do about it, routinely. Every system your assessment identifies as presenting risk needs the scheme treatment — hot and cold water systems, cooling towers and evaporative condensers, spa pools, and the odd systems HSG274 Part 3 collects. If the assessment names it, the scheme controls it.

The required contents, section by section

1. The system, described. What it is, where it runs, and an up-to-date schematic — the diagram an engineer who's never visited could navigate by. A scheme without a current schematic is describing a building from memory.
2. The control measures. Temperature regimes, biocide treatment, flushing of little-used outlets, cleaning and disinfection cycles — whatever the assessment concluded keeps this system safe, stated specifically enough to be followed.
3. The monitoring regime. What gets checked, where (sentinel points named), how often, against what limits — aligned to HSG274's tables for the system type.
4. Out-of-range actions. The part most schemes skimp: when a reading breaches its limit or a positive result lands, who does what, in what order, within what time. Written before the bad day, because the bad day is no time to draft.
5. Responsibilities. Named roles — who operates the scheme, who deputises, who reviews — connecting the document to the people answering for it.

Who writes it vs who follows it

Usually a competent contractor or consultant drafts it, and the site's responsible person operates it. Both halves matter. A scheme written in-house without competence misses controls; a scheme written by a contractor and never adopted by the site is shelf-ware. The handover moment — where the site's people read it, question it and sign it — is where the document starts working. Skip that and you own a PDF, not a control scheme.

How it stays current instead of laminated

A scheme decays the day the system changes: a calorifier swapped, outlets capped, usage patterns shifted. The fix is the same one the L8 checklist applies to risk assessments — wired-in review triggers rather than good intentions. System modified, monitoring breached, positive result, audit finding: each forces a scheme review, logged. And the monitoring records the scheme generates should file against it, so drift between what the scheme says and what actually happens is visible instead of discovered. That's the argument for keeping the scheme where the records live — the document and its evidence in one place.