What tour-operator audits check for Legionella: TUI, ABTA and the 15-point plan
If your hotel sells rooms through a European tour operator, Legionella is a contract matter, not a guideline. This is what the paperwork says and what the auditor looks for.
The contract
TUI’s Security, Health & Safety Accommodation Addendum, which every contracted hotelier signs, says the hotelier must “implement and maintain a water safety management system that ensures both the quality of the water and that it is free from contamination such as legionella bacteria”, and will “work with the ECDC” to control any case of travel-associated Legionnaires’ disease. Assessments are based on the ABTA guide; a hotelier must provide a competent member of staff to accompany the assessor with access to all areas; an unsatisfactory report can be a material breach, and TUI may remove its customers without paying. TUI’s 18 national operators, from the UK and Germany to the Nordic countries, work to the same regime.
The audit
SGS carries out TUI’s hotel audits. The Full Operational Assessment has a water-safety section whose Legionella items ask, in short:
- Is there a documented Legionella prevention and control plan, based on the European guidelines, often called the 15-point plan? Provide it.
- Are hot-water systems, cooling towers, pipework and tanks inspected, cleaned and disinfected before every season, or once a year for year-round hotels? Provide the maintenance records.
- Are spa pools and hot tubs continuously treated, with records of temperature, chemicals and disinfection?
- Are Legionella testing records available, satisfactory and up to date?
- Are hot and cold water temperatures monitored and recorded, with calibrated thermometers?
- Are showers and showerheads cleaned regularly, with records?
- Are taps and showers in unoccupied rooms run for several minutes at least once a week?
- Is there a trained person responsible for water safety, including Legionella control? Provide the training and designation records.
Everything on that list is a record. The audit does not assess your water; it checks that you have, and can show, a system. The “full risk assessment of the accommodation” that TUI’s own guidance tells hotels to obtain from experts is what sits behind the records.
The numbers TUI gives hotels
TUI’s 15-point plan for hotels: one named, trained responsible person; hot water at 50 to 60 °C throughout the system; cold water below 20 °C at all outlets; weekly flushing of unoccupied rooms; cooling towers cleaned and disinfected at least twice a year; calorifiers cleaned yearly; hyperchlorination at 50 mg/L for two to four hours after work and before each season; monthly inspection of tanks, towers and pipework; spa pools at 2 to 3 mg/L checked three times a day; daily records of temperature, pH and chlorine checked by the manager. After a seasonal closure, TUI tells hotels to “seek specialist advice” and to follow the 15-point plan before reopening.
Other UK operators publish similar norms. Jet2holidays, which does not sell Thailand but whose guide is public, asks for hot water stored above 60 °C and distributed above 50 °C, cold below 25 °C, residual disinfectant of 0.2 to 0.5 ppm, quarterly Legionella sampling, annual tank cleaning, showerheads descaled every three months and records kept for at least three years.
Chain hotels
Large chains such as Marriott, Hilton, RIU and Meliá can have their own health and safety systems approved by TUI, after which their properties are not audited by SGS on TUI’s behalf. For a branded hotel in Thailand that usually means the brand’s own water management programme, often modelled on ASHRAE 188 or the WHO water safety plan, applies instead. The content is the same: an inventory and diagrams of the water systems, a hazard analysis, control measures, monitoring, verification and documentation.
When a guest falls ill
The other half of the operator relationship is surveillance. A European guest diagnosed after a stay is reported to the ELDSNet network, which passes the case through WHO to Thailand’s Department of Disease Control. Two cases at one hotel within two years is a cluster. Hotels in non-member countries like Thailand are never published, but tour operators are routinely told about clusters, and ELDSNet asks the hotel’s country for a two-week report (was a site risk assessment carried out, was a water management plan in place) and a six-week report (what was found, what was done, was a routine sampling and control system in place before the notification). Thailand had 44 such accommodation visits in 2023, joint second among non-EU destinations.
Preparing for the audit
A hotel should be able to hand the auditor one folder: the current risk assessment with system schematics; the written prevention plan mapped to the 15 points; the responsible person’s training certificate; temperature, chlorine, flushing and cleaning logs with calibration records; the seasonal clean-and-disinfect reports; laboratory results with the laboratory’s accreditation certificate; and the closure and reopening procedure. We build that folder, in English and Thai, and check it before the auditor does. Hotels and resorts.