What a Water Management Plan Is For
Why this matters
A water management plan is not a binder and it is not a sampling contract. It is a set of decisions made in advance, in writing, so that nobody has to make them at 4 pm on a Friday with a tenant on the phone. Its whole value is that it names a location, a number, a person and an action BEFORE the number goes out of band. Shops that get asked to "help with the Legionella plan" and respond with a quarterly sample schedule have sold the least useful part of it, and when something does go wrong, a sample log with no control limits proves only that you were watching.
Before the first walk of the building
You cannot write control locations without opening the equipment they live in, and two of those openings are the hazardous ones.
- A cooling tower access door. The fan is a mechanical hazard with rotational stored energy and it can windmill on stack draft with the drive off. Lock and tag the fan motor disconnect under 29 CFR 1910.147, verify the fan is stopped by observation before any part of you crosses the plane of the opening, and treat the basin water as a potential aerosol source: do not pressure-wash a fouled basin or fill as a cleaning method, because that converts a contact exposure into an inhalation one.
- Work inside the tower's electrical panel is not a 1910.147 job. 1910.147(a)(1)(ii)(C) excludes exposure to electrical hazards from work on conductors and equipment in electric utilization installations, so that work runs under 29 CFR 1910.333(b)(2), and the live-dead-live proving sequence with a tester verified on a known source before and after is NFPA 70E-2021, 120.5.
- Reading water temperature on the hot system means handling water that may be at storage temperature. Run into a vessel and read the vessel.
What the plan is and is not
A plan is not a hazard assessment you file. It is a control system with seven parts, and three specific things go missing from them, always the same three: the corrective action in part six, the step size inside that corrective action, and the verification-versus-validation distinction inside part seven.
- A program team with named people, not job titles that may be vacant.
- A description and flow diagram of every water system in the building, including the ones nobody calls a water system: ice machines, decorative features, eyewash stations, humidifiers, emergency showers, misters.
- Control locations: the specific points where a control can actually be applied and measured.
- Control limits at each location, with the unit of analysis and the trigger stated.
- Monitoring: who checks, how often, with what instrument.
- Corrective actions, pre-written, with the step size of the change.
- Verification and validation, which are two different things, plus documentation.
The three that get dropped are the corrective action, the step size, and the distinction in item seven. Verification asks whether the program is being executed as written: were the temperatures taken, were they in band, were the flushes logged. Validation asks whether the program is actually controlling the hazard, which is the question sampling and outcome data answer. A building can pass verification perfectly while failing validation, and that is not a paradox, it is the signal that the control limits were set in the wrong place.
The control location is the unit of the plan
Everything in a plan hangs off a location. A control limit with no location is a slogan. The test for whether something is a real control location is whether you can stand at it, measure it, and change it. The water heater outlet qualifies. "The domestic hot water system" does not.
Pick locations where the control is applied AND at least one location where its effect is felt at the far end, because a plan that only measures at the source will report a healthy system for years while the ends drift.
One building's control table, filled in
This is a four-story office with a recirculated domestic hot water system, one cooling tower, and a set of low-use outlets in a floor that lost its tenant. The values below are what this building's team set; yours come from your own equipment, your water report and your treatment supplier, not from this table.
| Control location | What is controlled | Control limit, with unit and trigger | Monitoring | Corrective action, with step | Record |
|---|---|---|---|---|---|
| Water heater outlet | Stored temperature | At or above 140 F, single reading | Weekly, building engineer, calibrated stem thermometer in a vessel | Confirm the mixing valves, then raise setpoint one 5 F increment, re-read after 2 hours, repeat once to a hard ceiling of 150 F stored, re-reading the unmixed janitor sink after each, then service call | Weekly log line |
| Recirculation return, mechanical room | Loop temperature | At or above 120 F; trigger on two consecutive weekly readings below, not one | Weekly, same round | Verify pump running and check valve seated, then balance one branch at a time and re-read after 1 hour | Weekly log line plus a note of which branch was moved |
| Janitor sink, 4th floor, hot side, no mixing valve | Delivered hot at the far end | At or above 122 F within 60 seconds of opening; trigger on one reading, confirmed same day | Weekly, same round | Treat as a loop balance problem first, a dead-leg problem second | Weekly log line |
| Low-use outlet list (11 outlets) | Turnover | Each outlet flushed at least once every 7 days, at least 2 minutes, low flow, aerator removed. An outlet joins the list if measured turnover exceeds 1 day OR the tenant log shows zero use in a week | Weekly, day porter | Any outlet missed twice in a row is escalated to a piping review, not a third flush attempt | Initialed flush sheet per outlet |
| Cooling tower recirculating water | Oxidant residual | Within the band the treatment supplier states for this product and this tower, measured with the supplier's test kit | Three times weekly, contract service | Two consecutive readings below the band floor: isolate and relieve the feed line to a receptor and verify at a gauge before breaking any fitting, take glove class, eye and face protection and any respiratory control from that product's safety data sheet, keep the oxidant physically separated from any acid on the truck or in the room because that pair releases chlorine gas and separation is the only control, then inspect the feed pump and the injection point BEFORE changing dose, then one dose increment per the controller manual, re-read after one full system turnover | Service ticket plus controller log |
| Cold riser, 4th floor | Cold temperature | At or below 77 F standing | Monthly | Above on two consecutive months: insulate the riser and separate it from the heat source in the shaft | Monthly log line |
What each column has to survive
The limit column has to carry three things. The unit of analysis (a single reading, a rolling average, a per-outlet count), the Boolean when there are two conditions (the low-use list uses OR, deliberately, because a turnover calculation and an occupancy log fail in different ways), and the step size of the response. A limit that says "raise the setpoint" without saying by how much produces one of two failure modes: nobody moves it, or somebody moves it 20 F and creates a scald exposure at every fixture. Raising stored temperature is only permitted here because this building has listed thermostatic mixing valves controlling delivered temperature, and the plan says so on the same row.
The corrective-action column has to name the check before the dose. The tower row is written so that a low residual sends the technician to the feed pump and the injection point first. That ordering is not fussiness. A residual that is low because the pump lost prime and a residual that is low because organic load rose look identical on the test kit, and increasing dose on a dead pump changes nothing while the log now shows an intervention that did not happen.
The record column has to produce something a stranger can audit. "Checked" is not a record. A temperature with a location, a time and an initial is.
The monitoring column has to name a person who exists. The most common way a plan dies is that the row's owner leaves and the row silently stops.
Reading a control limit against reality, once
Take the recirculation return row. The limit is 120 F, and the trigger is two consecutive weekly readings, not one. That Boolean is doing real work: a single low reading on a Monday morning after a weekend of low draw is expected behavior on a loop with a small pump, and triggering on it produces a corrective action every fortnight, which trains everyone to ignore the row. Requiring two consecutive readings costs one week of delay and buys a trigger people believe.
Now look at what that same choice costs. If the loop drops out of band on a Tuesday and the next reading is a week later, the loop can sit near 110 F for as much as thirteen days before anyone acts, which is long enough to matter at the far end. That is the honest trade, and the way this building handled it was to keep the two-reading trigger and move the round to twice weekly during the shoulder seasons when the loop is least stable. The number did not change. The sampling interval did, because the interval is what sets the worst-case exposure, not the threshold.
What breaks a plan in its second year
- A renovation that nobody redrew. The flow diagram is the plan's map, and a re-piped floor makes every dead-leg judgement in the plan wrong. Any project that opens water piping triggers a diagram update, and the plan should say so.
- A control limit inherited from a different building. A tower band from another site's product, a temperature from a different code jurisdiction, a flush interval from a template. If nobody in the building can say why the number is that number, it will not survive its first argument.
- Verification passing while validation was never attempted. Two years of clean logs and no outcome check at all is the most common shape of a plan that fails when tested.
- A row with no owner and no instrument. If the thermometer lives in a truck that stopped coming, the readings quietly become estimates.
Where the building is a Medicare-certified hospital, critical access hospital or long-term care facility, a documented water management program is a condition of participation enforced through CMS survey guidance rather than an optional best practice, so the plan is inspected against its own written control limits. That raises the cost of writing a limit you cannot meet: an unmet limit in your own document is worse evidence than a limit you never claimed.
References
- ANSI/ASHRAE Standard 188, Legionellosis: Risk Management for Building Water Systems (pin the edition your client or jurisdiction references), and ASHRAE Guideline 12 for technical background
- CDC toolkit for developing a water management program for building water systems
- CMS survey and certification guidance requiring water management policies and procedures in Medicare-certified hospitals, critical access hospitals and long-term care facilities (confirm the current memorandum number with the state survey agency)
- 29 CFR 1910.147 for mechanical and stored-energy isolation; 29 CFR 1910.333(b)(2) for electrical work; NFPA 70E-2021, 120.5 for the live-dead-live sequence
- See related: Why Warm, Stagnant Water Is a Biological Problem; How to Reduce Biological Risk in the Systems You Service