What You Need to Know About Your Annual RMP Review & Audit

Many cooling tower operators assume that if routine servicing is occurring, compliance is under control. In reality, we regularly speak with site managers who are unaware that their Annual RMP Review & Audit is a separate legal obligation. Often, this only becomes apparent when an audit deadline approaches or documentation is requested.

An Annual RMP Review & Audit is not optional. It is a regulatory requirement.

Under the Public Health and Wellbeing Regulations 2019, every registered cooling tower system must have a compliant Risk Management Plan in place, must undergo an annual review of that plan, and must be audited annually by an approved independent auditor. At the time of the audit, the Certificate of Registration for the cooling tower system must also be produced. These requirements apply regardless of whether servicing is outsourced. The legal responsibility remains with the responsible person for the system.

Understanding what the Annual RMP Review & Audit actually involves is critical to avoiding unnecessary compliance risk.

A review focuses on whether the plan itself remains fit for purpose. It requires technical assessment of the system, its operation, and its risk controls. An Annual RMP Review should also be conducted whenever the system is modified, when a Legionella result exceeds regulatory thresholds, when an audit identifies deficiencies, or when operating conditions change. Without an up to date and accurate RMP, compliance cannot be demonstrated.

Beyond verifying that documents are present, the auditor assesses whether records are consistent, complete, and reflective of actual system management. They consider whether actions were taken within allowable tolerances for risk and whether regulatory requirements have been met in practice. An audit is therefore not a paperwork exercise. It is an evidence based assessment of how your system has been controlled.

A compliant and current Risk Management Plan underpins the entire Annual RMP Review & Audit process. If the RMP does not accurately reflect the system, deficiencies will inevitably be identified.

An Annual RMP Review & Audit should never be treated as two isolated administrative requirements. Together, they form a structured compliance cycle designed to continuously strengthen risk control rather than simply confirm that documentation exists. The independent audit looks backward, assessing how the cooling tower system was managed over the previous audit period and identifying any gaps, deficiencies, or areas for improvement. Those findings are not simply compliance notes. They provide a clear picture of where processes, documentation, or control measures may not be fully aligned with regulatory expectations.

The annual review then shifts the focus forward. It provides the opportunity to formally incorporate audit findings into the Risk Management Plan, update system descriptions where required, refine control measures, and ensure monitoring and corrective action procedures remain appropriate. When the review is conducted promptly after the audit, necessary changes can be embedded within the plan while there is still adequate time to implement improvements before the next audit cycle begins.

This sequencing is critical. When sites delay the review until just before the next audit, pressure increases and compliance becomes reactive. Documentation must be assembled quickly, corrective works may need to be expedited, and there is limited opportunity to demonstrate that improvements have been integrated into routine management. By contrast, a well managed Annual RMP Review & Audit cycle provides a clear twelve month window to address identified risks, strengthen documentation practices, and confirm that control measures are operating effectively. Proactive scheduling reduces compliance risk, improves audit outcomes, and allows responsible persons to demonstrate due diligence with confidence.

Under the Public Health and Wellbeing Act 2008 (Victoria) and the Public Health and Wellbeing Regulations 2019 (Victoria), the responsible person for a registered cooling tower system remains legally accountable for its management and compliance. The legislation makes clear that the duty holder must ensure a compliant Risk Management Plan is in place, that an Annual RMP Review & Audit is completed within required timeframes, and that records are accurate and available for inspection by authorised officers.

For many facilities, keeping track of compliance deadlines alongside operational demands can become challenging. Audit due dates approach quickly, documentation must be assembled, and coordination with independent auditors takes time. Without a structured system in place, an Annual RMP Review & Audit can shift from a controlled process to a reactive exercise.

Tandex assists clients by conducting structured Annual RMP Reviews, coordinating independent audits with approved auditors, confirming documentation readiness in advance, and implementing corrective actions where required. We monitor compliance timelines and contact you before your Annual RMP Review & Audit is due. Once confirmed, we manage the process through to completion so your cooling tower system remains compliant, audit-ready, and aligned with regulatory expectations.

If you would like support with your Annual RMP Review & Audit, contact us to discuss how we can help you maintain compliance with confidence.