FieldOpFieldOp
Sign inStart freeTry it

Cooling tower requirements in Victoria: testing, risk management plans and audits

Victoria regulates cooling tower systems closely because of the Legionella risk. Owners carry the legal duties, and the maintenance contractor produces much of the evidence.

Try it now — no email needed See pricing

Last reviewed: September 2026 · General information, not legal advice — confirm requirements with the Victorian Department of Health.

The rules come from the Public Health and Wellbeing Act 2008 and the Public Health and Wellbeing Regulations 2019, and they're administered by the Department of Health. This guide walks through the obligations that shape a contractor's work on a cooling tower system: registration, the risk management plan, the annual audit and review, testing, and the notifications the department expects.

Registration

Owners must register their cooling tower system with the Department of Health. Registration is the starting point for everything else: it tells the department the system exists and who is responsible for it.

The department keeps a public register of cooling tower systems, showing the site address and registration expiry. When you take on a new site, it's worth checking the register so you know the system is registered and when that registration expires. If it's close to expiry, a quick word with the owner can save a problem later.

The risk management plan (RMP)

Owners must also develop a risk management plan, or RMP, for the system. The RMP is the document that sets out how the Legionella risk in that particular system is managed — and in practice it's what your maintenance program should line up with.

For a contractor, the RMP is the brief. Read it when you start on a site, make sure your service schedule and your service forms reflect what it says, and let the owner know if what you're seeing on site no longer matches the plan.

It also helps to keep a copy of the current RMP with your site records. When the plan is reviewed or updated after an audit, check whether anything in your service schedule, your forms or your on-site checks needs to change with it. A maintenance program that drifts away from the plan makes the next review and the next audit harder, and it leaves the owner explaining a gap they may not have known about. Keeping the two in step is one of the most useful things a contractor can do.

Annual independent audit and annual review

The RMP must be independently audited by an approved auditor every year. The department keeps a register of approved RMP auditors, so owners can check that the person they engage is on it.

Separately, the RMP must also be reviewed at least once every year. The audit and the review are two different things: the review keeps the plan current, and the audit checks it independently.

Both lean heavily on maintenance records. When the auditor asks what was done, when, and what the results were, the answer usually comes from the contractor's service history. An organised year of records makes the audit quicker for everyone.

Testing frequencies

The Regulations set minimum maintenance requirements for testing:

  • Heterotrophic colony count (HCC) — tested monthly.
  • Legionella — tested at least every 3 months.

These are minimums. Immediate actions are required after adverse results, so a test result isn't the end of a visit's paperwork — if a result comes back adverse, what happened next needs to be recorded just as clearly as the result itself.

Sample integrity matters too. It is an offence to tamper with a cooling tower water sample or falsify a laboratory report for HCC or Legionella. Keep sampling and lab reporting clean and traceable, and make sure everyone on your team understands that.

Notifying the department

Two kinds of notification apply, with different people responsible and different time limits.

Changes to the system: within 30 days

The registration holder must notify the department within 30 days of:

  • adding or removing a cooling tower;
  • removing or permanently decommissioning the system; or
  • relocating it on the land.

Contractors are often the first to know about these changes because they're the ones doing the work. Flag them to the registration holder as soon as they're planned or done, so the notification isn't missed.

Legionella detections: within 24 hours

The responsible person must notify the department within 24 hours when Legionella is detected in three consecutive samples, or at more than 1,000 cfu/ml in a single sample.

Twenty-four hours leaves no room for a result sitting unread in an inbox. Agree with the owner, before it happens, how lab results reach them and who acts on an adverse one.

What to record on every service visit

The following isn't a list of legal requirements — it's good practice that supports the owner's RMP review and the annual audit. On every visit, aim to record:

  • Which tower and system — so every record belongs to the right asset.
  • Date, time and technician — who was on site and when.
  • Readings and observations — what you checked and what you found.
  • Samples taken — what was sampled and where it went, with the lab report attached when it comes back.
  • Actions taken — especially after an adverse result, and when the owner was told.
  • Photos and a sign-off — evidence of the condition of the system and who completed the work.

Running cooling tower maintenance in FieldOp

In FieldOp, each tower sits on the site's asset register with its own service history, so every visit, reading and action lands on the tower it belongs to. A PPM contract generates the monthly and quarterly visits automatically, so nothing relies on someone remembering the next test.

On site, technicians record readings, photos and actions. The site owner gets a branded report link, and every report stays saved against the tower — which gives the auditor an organised trail to work through. See how it fits HVAC work on the commercial HVAC software page.

FieldOp doesn't notify the department and doesn't replace the RMP. Those stay with the owner and the responsible person. What FieldOp does is keep the maintenance evidence complete and easy to hand over.

Sources

Frequently asked questions

Explore more

Set up your FieldOp in 2 minutes

No email needed to start.

Try it now See pricing