The short definition
A written scheme of control is the document that sets out how the risk from Legionella in your water system is prevented or controlled, in practice, day to day. If the risk assessment identifies what could go wrong, the written scheme is the plan for making sure it doesn't.
It's required under ACOP L8 wherever the risk assessment concludes there is a reasonably foreseeable risk — which, for almost any building with a stored or recirculating water system, it does. It is one of the four core duties: assess, manage, control, record.
Where it sits in the ACOP L8 framework
ACOP L8 sets out four obligations: identify and assess the risk; appoint a responsible person to manage it; prevent or control the risk; and keep records. The written scheme of control is how you discharge the third — it's the bridge between the risk assessment (the diagnosis) and the monitoring logbook (the evidence).
Crucially, the duty to have a competent scheme can't be transferred to a contractor. You can have a specialist write and deliver it, but the legal responsibility for ensuring it exists and is followed stays with the duty holder.
What it must contain
ACOP L8 is specific about content. A compliant written scheme of control must include: an up-to-date description of the system, normally with a schematic diagram; the precautions and control measures to be taken; how those controls will be monitored and checked, and how often; who is responsible for each task; the remedial action thresholds and what to do when they're breached; and the records that will be kept.
In plain terms it should answer, for every control: what is done, to which part of the system, by whom, how often, against what acceptance criteria, and what happens when a reading is out of range. A scheme that says 'temperatures monitored monthly' fails that test; one that names the sentinel outlets, the responsible person, the 50°C/55°C and below-20°C criteria and the escalation route passes it.
Why generic templates fail audit
The single most common written-scheme failing HSE finds is a generic, off-the-shelf template with the site name changed. It fails because it isn't specific to the system, the building or the people — and ACOP L8 requires exactly that specificity.
A scheme that references a calorifier the building doesn't have, or omits the cooling tower it does, tells an inspector the document was never grounded in the real system. Worse, a scheme nobody on site recognises is a scheme nobody is following — which is the second-most-common failing.
The control measures it typically covers
For a hot and cold water system the scheme usually covers: hot water stored at 60°C and distributed to reach 50°C (55°C in healthcare) at the outlet within a minute; cold water kept below 20°C; monthly sentinel temperature monitoring; weekly flushing of infrequently-used outlets; quarterly showerhead cleaning and descaling; annual tank inspections; and periodic calorifier checks.
Where the risk assessment identifies them, it will also cover cooling towers (HSG274 Part 1), and other risk systems such as spa pools or emergency showers (Part 3). Each control links back to a specific risk the assessment raised.
Keeping it live
A written scheme of control is not a one-off document. It must be reviewed when the risk assessment is reviewed — at least every two years, and immediately on any material change to the system, its use, or the responsible person. A scheme that still describes the building as it was three refurbishments ago is no longer a control measure.
The practical test of a good scheme is simple: hand it to the person doing the monitoring and ask them to follow it. If they can, it works. If they can't, it's a document written for a filing cabinet, not for the system — and that's what audits expose.