FFP Guides

Compliance by state

How NSW's cooling water system rules work for a service contractor

In NSW an occupier of premises with a cooling water system notifies the local council before installation, has an independent audit of the risk management plan every year, and has the system sampled and tested for Legionella every month (Public Health Regulation 2022, Part 2 Division 3). A reportable result goes to council within 24 hours.

Last checked 25 Sep 2026 against the sources listed at the end of this page.

Official name
Notice of installation, risk management plan and independent audit certification for a cooling water system, under the Public Health Regulation 2022
Regulator
NSW Health sets the rules; the local government authority for the area holds the register and receives notices
Who issues it
The occupier of the premises, using a competent person for the risk assessment and a Secretary approved independent auditor for the yearly audit
When
Operating a cooling water system, other than one used solely for making snow
Deadline
Notice before installation; risk assessment before start up (then 12 months or 5 years by risk level); audit every year, lodged within 2 months of the audit period; sampling and testing every month; reportable results to council within 24 hours
Lodgement
To the local government authority for the area: installation notice, change of details within 7 days, RMP and audit completion certificates, reportable test results
Keep records for
Risk assessment documentation, 5 years of audit records, testing reports, the operating manual and maintenance records, available within 4 hours of a request
Penalty
Up to 20 penalty units for failing to display the identification number, for not reporting a reportable test result to council within 24 hours, or for not keeping records available on request. Up to 10 penalty units for not notifying council of a change of details within 7 days (Public Health Regulation 2022, ss 10, 18, 19 and 20).

Homeowner? If your NSW building has a cooling tower on the roof or plant deck, ask your building manager for the current audit certificate and the last month's Legionella test result: both are required by law and both should exist.

What the certificate must show

Recent change

The Public Health Regulation 2022 replaced the 2012 Regulation and strengthened independence requirements for auditors in section 15.

Produce it from a ServiceM8 job

  1. Record each cooling tower as an Asset in ServiceM8, with the council identification number, risk rating and the local government authority it reports to.
  2. Build a form, Cooling tower monthly sample NSW, with Number fields for Legionella cfu/mL and heterotrophic colony count, and a Multiple Choice flag for whether the result is reportable.
  3. Set a recurring job per tower from the Dispatch Board, monthly, using the sampling form so the job never falls outside the AS/NZS 3666.3 monthly requirement.
  4. Add a checklist item Reportable result notified to council, with a mandatory date field, triggered whenever the sampling form flags a reportable result, so the 24 hour deadline is visible to the office.
  5. Build a second form, Cooling tower annual audit NSW, attached to a yearly recurring job, capturing the auditor's name, approval status and the audit period so the certificate can be produced from the job diary.
  6. Map the client name, site address and tower identification number as field codes into a Word template, so the audit and sampling PDFs are ready to send to both the client and, where the office chooses to forward it, the council.
  7. Keep the last 5 years of audit records and all testing reports in the asset history rather than only in the job diary, so a 4 hour records request can be answered from the asset itself.

Three cycles, one system

Anyone who services cooling towers in NSW is really managing three different clocks on the same system. The risk assessment, which sorts the system into low, medium or high risk, is redone at least every 12 months for a high risk system and at least every 5 years for a low or medium risk one, or sooner if something makes the current rating doubtful. The independent audit of the risk management plan against the Regulation is yearly regardless of risk rating, and must be lodged within 2 months of the end of the audit period. The water sampling and testing, for Legionella and heterotrophic colony count under AS/NZS 3666.3:2011, is monthly, done by a qualified person.

None of these three cycles are optional extras. A contractor who only shows up for the annual audit and leaves monthly sampling to chance is leaving the occupier exposed on the cycle that actually catches an outbreak early.

Council is the front door

NSW has no single state cooling tower register. Section 20 requires written notice, with a fee, to the local government authority for the area before a cooling water system is installed, and the occupier must notify that same council of any change to the registered details within 7 days, which carries a maximum penalty of 10 penalty units if missed. The council keeps the register for its area, issues the tower its unique identification number, and receives the certificates confirming the risk management plan and the audit were completed. Failing to display the identification number on the tower is a separate offence.

The 24 hour reportable result

Section 18 sets a hard deadline that sits apart from the monthly testing cycle. If a sample comes back with Legionella at 1,000 colony forming units per millilitre or more, or heterotrophic colony count at 5,000,000 cfu/mL or more, the occupier must give the local government authority the result, in the approved form, no later than 24 hours after receiving it. That is a same day job: get the lab result, notify the council, and start the decontamination response, rather than waiting for the next scheduled visit.

Records on demand

Section 19 requires the occupier to keep the risk assessment documentation, the last 5 years of audit records, testing reports, the system's operating manual and maintenance records, either on the premises or accessible electronically, and to produce them to an authorised officer within 4 hours of being asked. If your service agreement holds these documents rather than the site, build the retrieval time into the contract so the client can actually meet the 4 hour window.

Who signs off what

A risk assessment is done by a competent person. The risk management plan itself can be prepared by a duly qualified person. The audit against both the plan and the Regulation has to be an independent auditor approved by the Secretary of NSW Health, and the 2022 Regulation tightened the independence rules in section 15 specifically to stop the same business auditing its own maintenance work. A licence from NSW Fair Trading may also be needed before you design, install or maintain a cooling water system, separate to the Legionella control roles.

Sources

  1. A cooling water system (other than one used solely for making snow) must be installed to AS/NZS 3666.1:2011 and operated to AS/NZS 3666.2:2011, maintained to AS/NZS 3666.3:2011 including the Legionella and heterotrophic micro-organism control tables, with risk assessments under section 12 and documentation and reporting under section 13. Public Health Regulation 2022 (NSW), ss 9 and 11, checked 25 Sep 2026.
  2. A risk assessment sorts a cooling water system as low, medium or high risk. High risk systems are reassessed at least once every 12 months; low and medium risk systems at least once every 5 years, or within 30 days if the current risk rating is put in doubt. Public Health Regulation 2022 (NSW), s 12, checked 25 Sep 2026.
  3. Written notice, with a fee not exceeding the amount in Schedule 5, must be given to the local government authority for the area before a cooling water system is installed. The occupier must notify the authority within 7 days of a change to the registered details. Maximum penalty 10 penalty units. Public Health Regulation 2022 (NSW), s 20, checked 25 Sep 2026.
  4. Independent audits must be completed within 2 months after the end of the audit period, and can only be carried out by an auditor approved by the Secretary, NSW Health. Independent auditing of compliance with the risk management plan and the Regulation is required every year. NSW Health, Legionella control: Regulatory requirements at a glance, checked 25 Sep 2026.
  5. Sampling, inspection and chemical analysis for Legionella and heterotrophic colony count must occur at least once a month, carried out by a qualified person, following AS/NZS 3666.3:2011. Public Health Regulation 2022 (NSW), s 17, checked 25 Sep 2026.
  6. The occupier must ensure a reportable test result, Legionella at or above 1,000 cfu/mL or heterotrophic colony count at or above 5,000,000 cfu/mL, is provided in the approved form to the local government authority for the area no later than 24 hours after the occupier receives it. Public Health Regulation 2022 (NSW), s 18, checked 25 Sep 2026.
  7. The occupier must keep risk assessment documentation, audit records for the past 5 years, testing reports, the operating manual and maintenance records, on the premises or electronically, and produce them to an authorised officer within 4 hours of a request. Public Health Regulation 2022 (NSW), s 19, checked 25 Sep 2026.
  8. Local government authorities maintain a register of cooling water systems in their area, issue each tower a unique identification number, receive notifications of installation, changes and reportable test results, and receive certificates of risk management plan and audit completion. They may charge fees for these functions. NSW Health, Legionella control: Local government authority, checked 25 Sep 2026.
  9. The Public Health Regulation 2022 strengthened the independence requirements for auditors in section 15 to address concerns about conflicts of interest, as part of the Legionella control changes from the earlier 2012 Regulation. NSW Health, Public Health Regulation 2022: Key changes, checked 25 Sep 2026.
  10. Completed ServiceM8 forms convert to a PDF saved to the job diary, where they can be emailed; form answers are placed into a Word document template using Template Field Codes. ServiceM8 Help Center, checked 25 Sep 2026.
  11. A ServiceM8 form can be completed against an asset from the job's Assets menu; each question shows past values for that asset, and the completed form is listed in the asset's history and saved in the job diary. ServiceM8 Help Center, checked 25 Sep 2026.