ASHRAE Standard 188If local and state authorities in the United States “require water management plans in all public buildings including hotels, businesses, schools, apartments, and government buildings” – as recommended in the 300-page report issued by the National Academies of Sciences, Engineering, and Medicine three weeks ago – they will need a way to audit numerous water management programs (WMPs) affordably, fairly, and effectively.

Federal regulations would be much simpler for owners of properties in multiple cities or states, and thus more preventive because of higher compliance. However, they would be no simpler for the agency having to enforce the rules. Any government entity, as well as insurance companies, will find it challenging to effectively audit large numbers of WMPs for quality, performance, and risk with limited personnel, time, money, and knowledge.


Five Secrets to Auditing Large Numbers of ASHRAE 188 WMPs Successfully

Requiring WMPs without auditing performance will result in low compliance and thus failure to prevent disease. Trying to enforce and audit every detail is overly burdensome to both the regulator and regulated, which is expensive, wasteful, and probably unsustainable. For successful outcomes, consider the following for auditing WMPs:

1. Focus on control measures
Only control measures—procedures to control pathogens in water systems and prevent transmission from the systems to people—will reduce the risk of disease. The job of the other ASHRAE 188-required elements (e.g., list of team members; water system information; flow diagrams) is ultimately to ensure effective control measures are implemented.

A WMP audit should thus focus on control measures, ideally to determine whether they are (a) comprehensive, covering all water systems that can harbor and transmit pathogens, (b) effective in minimizing Legionella and other biofilm-associated pathogens that thrive in building water systems, and (c) implemented. Merely writing control measures does not reduce risk—they must be carried out.

2. Be satisfied with 95% of the story
With the right questions, system, and metrics, an auditor can get approximately 95% of the WMP story with 5% of the budget and time it would take to get all 100%.

Letting go of the time-consuming details (last 5%) will allow resources to go much further, ultimately resulting in more prevention. It also frees time to focus on the more important performance metrics that comprise the 95%.

Letting go of the last 5% is not easy, though. Professionals like to be thorough, and government agencies don’t like non-compliance. But it’s necessary for successful outcomes.

3. Audit most WMPs remotely
With smart reporting requirements, routine audits can be performed remotely, at the auditor’s desk. Site visits will be necessary only when the routine audit flags inadequacies to investigate.

Performing routine audits remotely not only saves time and money but requires less knowledge and training for the auditors (see #4). Onsite inspections, when required, could be handled by the more experienced and trained inspectors.

4. Minimize subjectivity and training
No reasonable amount of training will give inspectors the knowledge required to judge the efficacy of WMP control measures or evaluate Legionella risk factors associated with the design, components, materials, maintenance, condition, and operation of various types and configurations of building water systems. Doing that well takes many years of experience.

Therefore, another secret to auditing success is to minimize judgment calls. Doing so reduces the training required for auditors. Audits based on clear, objective criteria will be fairer, too, and reduce corruption.

5. Go paperless
Hire computer-savvy auditors and don’t require them to find, carry, send, or file a single piece of paper.


Eleven Metrics that Make the Five Secrets Possible

The only way to get 95% of the WMP story with 5% of the effort, audit most WMPs remotely, and minimize subjectivity and training, is to use smart metrics to evaluate a facility’s WMP. Consider these 11:

1. Control measures for all applicable water systems
To be preventive, a WMP must include control measures for all building water systems (e.g., domestic water systems, cooling towers, decorative fountains, whirlpool spas) that are prone to harboring and transmitting Legionella or other pathogens.

Simply require the building operator to check “Yes” or “No” for each water system type—Yes to indicate there is one or more of that system type on the property. The auditor can then see if the WMP has control measures for each “Yes” system.

2. Number of operation and maintenance control measures per system type
Obviously, if the control measures are not effective, it doesn’t matter how many there are, but the number of measures per system at least indicates whether the WMP is comprehensive and specific.

Too few control measures for a given system type means the WMP has vague objectives rather than real control measures. For example, “minimize stagnation” or “keep temperatures outside of the Legionella growth range” are not control measures—they are objectives. A control measure must be specific and measurable.

A good way to determine whether a control measure is clear and specific is to ask a maintenance technician to do it. If he or she cannot determine what to do and where the measure is probably vague.

Most facilities need about 40 control measures for operating and maintaining domestic hot and cold water systems. A small number (e.g., 5) indicates the WMP is vague, inadequate, or both.

3. Number of control measures for design and construction
Most control measures taken in the planning and construction of new buildings add zero cost to the project but can significantly reduce the health risk. Planning well can potentially save the facility hundreds of thousands of dollars in remediation and retrofitting, too.

As with operation and maintenance procedures (metric #2), the number of design and construction control measures can indicate whether the WMP is comprehensive and specific. “Consider Legionella prevention in the design and construction of new or renovated buildings” is an objective, not a control measure. A facility may need 30 to 40 specific procedures to accomplish that objective.

The auditor does not need to be trained in the design and construction of water systems. He or she can just count the number of WMP control measures for it.

The “Control Measures Verification Status Report” in the image below shows enough control measures for system maintenance but only one control measure for Design and Construction, which is inadequate.

WMP Control Measures Verification Status Report

4. Monitoring, limits, and corrective action for each control measure
Per ASHRAE Standard 188 and the CDC toolkit, a WMP should list performance criteria (control limits) for each control measure, a monitoring procedure for determining control measure performance, and corrective actions to take if the control measure is not performed within the control limit.

Determining the monitoring procedure, limits, and corrective action for each control measure is hard. It takes expertise, time, thought, and sometimes discussion among WMP team members. The auditor does not need to evaluate the monitoring procedures, limits, and corrective actions. He or she just needs to make sure they are listed for each control measure. A simple “Yes” or “No” will do.

5. Control measure implementation
Per ASHRAE Standard 188, WMPs must have procedures to verify the implementation of control measures.

To audit large numbers of WMPs efficiently, require facilities to document and report verification of control measures in a specified structure, electronically. In just a few seconds, an auditor could then determine the percentage of control measures for which verification is on schedule (“okay”) or overdue (see image below).

Also, the facility should upload its documentation for the performance of each control measure implemented in the past 12 months.

Performance of WMP Control Issues

6. Plan for shutdowns and incidents
Detailed plans for system shutdowns and responding to incidents (e.g., water main breaks) are crucial for preventing outbreaks. Readiness to act quickly is important.

The auditor can simply note whether the facility’s plan is clear and specific enough—who, what, and when—to be initiated immediately.

7. Plan for responding to a suspected or confirmed case of disease
The auditor just needs to answer two yes-no questions:

Does the facility have a written plan?

Does the plan include instructions detailed enough that it could be initiated tomorrow?

8. Validation procedures
ASHRAE 188 WMPs must be validated for effectiveness in controlling Legionella.

If regulations require testing water systems for Legionella, as the NAS report recommended for healthcare facilities, have the facility report the following:

  • Water systems sampled
  • Frequency of sampling
  • Number of samples tested per water system per sampling round in the last 12 months
  • Criteria for interpreting test results
  • Plan for responding to test results
  • Laboratory reports of the test results
  • Actions are taken in response to test results for each sampling round

If Legionella testing is not required and is not voluntarily conducted by the facility, have the facility report the above for whatever it is sampling or measuring, if anything, to validate the WMP.

9. Plan for communication and notification
Does the WMP include a written plan for communication and notification?

Does it list what should prompt communication, what should be communicated (e.g., test results), by whom, and to whom?

10. Number of disinfectant and temperature measurements
Instead of asking auditors to determine the adequacy of domestic water temperatures or disinfectant levels, the facility can provide the readings taken in the last 12 months.

The number and frequency of disinfectant and temperature readings indicate the facility’s attention to monitoring its domestic water systems.

11. Training of personnel
Expecting busy facility personnel to learn to write a WMP that has comprehensive and effective control measures is unrealistic. It has been attempted, with consistent failure. But providing a facility with a comprehensive WMP and then training personnel on the how and why of each control measure has proven successful. Facilities personnel are much more engaged when they understand why a control measure is important for protecting health, instead of just being told what do to and how to do it.

(If you have access to LAMPS Training content, watch video V28, Lessons to Learn from UCSF Medical Center on Executing a Water Management Program. You’ll be amazed by Bruce Mace’s story about plumbers coming up with a shutdown plan after he explained the importance of reducing health risk.)

Have the facility report water management-related courses completed by employees involved in the WMP, preferably with copies of certificates.


Among lessons learned since the June 2015 release of ASHRAE Standard 188 is that few facilities will implement a WMP unless required. However, to reduce disease associated with building water systems, regulations must be enforced, not just established. A smart approach to auditing WMPs will allow regulations to be enforced affordably and sustainably, bringing real prevention.


What do you think is important for auditing WMPs effectively, fairly, and affordably? Please comment below.




Share This