How to Carry Out a COSHH Risk Assessment

A step-by-step guide to assessing the risks from hazardous substances at work, with three worked examples from cleaning, hairdressing and construction.

A COSHH risk assessment is the document and the process that tells you what hazardous substances are in your workplace, who's at risk from them, and what you're going to do to control that risk. It's also a legal requirement — Regulation 6 of the COSHH Regulations 2002 prohibits work that exposes employees to hazardous substances unless a suitable and sufficient assessment has been made first.

This page walks through how to carry out a COSHH risk assessment properly. If you're looking for the form to fill in afterwards, see the COSHH risk assessment template. If you want the wider context on what COSHH covers, see what COSHH is.

What a COSHH risk assessment is for

A COSHH risk assessment has two purposes. The first is legal: you need it to comply with Regulation 6. The second, and more important in day-to-day terms, is operational: it's the document that tells your supervisors and workforce what to do with a substance, what controls to use, and what to do if something goes wrong. A good assessment makes the work safer. A bad one is paperwork.

The assessment is specific to hazardous substances — it sits alongside, but doesn't replace, the more general workplace risk assessment required under the Management of Health and Safety at Work Regulations 1999. In practice, many businesses combine them, with a section in the general risk assessment covering hazardous substances at a high level and individual COSHH assessments for each substance or substance group.

Who must do it

The legal duty sits with the employer. The employer can delegate the practical work of carrying out an assessment, but the duty itself can't be delegated — if the assessment is wrong, the employer is still in breach. Self-employed people have the same duty for their own work.

The person who actually does the assessment must be "competent" — they must have sufficient training, experience and knowledge to identify the hazards, evaluate the risks, and decide what controls are appropriate. There's no formal qualification required, but a person carrying out COSHH assessments who's never been trained on the substances, never read a safety data sheet, and never seen the work being done isn't competent for the task. For most small and medium employers, competence comes from a combination of COSHH Training, familiarity with the work, and access to specialist advice when needed.

For complex situations — heavy industrial chemistry, biological agents, work with carcinogens — competent assessment usually means an occupational hygienist or an external consultant. The Management Regulations 1999 require employers to appoint a competent person to help with health and safety; for COSHH-heavy industries, that appointment often includes specific responsibility for COSHH assessments.

Five steps or eight steps?

You'll see different framings for the COSHH risk assessment process. Some sources describe a five-step process drawn from HSE's generic risk assessment template ("Identify hazards, decide who might be harmed, evaluate risk, record, review"). Others list eight steps for full COSHH compliance, including monitoring, health surveillance and emergency planning.

Both framings can be defended. The five-step model applies the standard risk-assessment thinking to hazardous substances specifically. The eight-step model covers the whole of Regulations 6 to 13 — every duty an employer has under COSHH, not just the assessment itself. This page uses six steps that cover the assessment process from end to end. The wider compliance duties beyond the assessment proper are covered separately in the eight steps to COSHH compliance.

Step 1 — Identify the hazardous substances

Start by listing every substance in your workplace that could harm health. The obvious sources are:

• Substances you buy in — chemicals, paints, cleaners, fuels, adhesives. Read the labels and ask for the safety data sheet from the supplier
• Substances you produce — fumes from welding or soldering, dust from cutting or sanding, gases released by a reaction, biological agents in waste handling
• Substances present in the work environment — Legionella in cooling towers, mould in damp buildings, agricultural pathogens

The hazard symbols on a label are the first signal that a substance is in scope. There are nine pictograms in current UK use, defined under the GB CLP Regulation. Where you see any of them, the substance is hazardous and needs to be assessed. COSHH symbols and their meanings covers each one.

Some substances are hazardous without carrying a CLP label. Workplace dust above the airborne dust limits in COSHH Schedule 1 is in scope regardless of what generated it. Biological agents that aren't sold commercially won't have a supplier label but are still covered. And substances that have a workplace exposure limit (WEL) in EH40 are by definition substances hazardous to health.

The safety data sheet is your main reference document for each substance. The Sections that matter most for the assessment are Section 2 (Hazards identification — what the substance can do), Section 8 (Exposure controls and PPE — what controls the supplier recommends), and Section 11 (Toxicological information — what the substance does to the body). For the full detail of how to read an SDS, see COSHH safety data sheets.

The output of Step 1 is a list — sometimes called the COSHH inventory or COSHH register — of every hazardous substance in the workplace, with the supplier, the SDS reference, and the dates of use.

Step 2 — Decide who could be harmed and how

For each substance, identify who could be exposed. The categories are usually:

• The workers who use the substance directly
• Other workers in the same area (passive exposure)
• Cleaners and maintenance staff (who often have higher exposure than process workers, because they're cleaning up residues)
• Contractors and visitors
• Members of the public, where applicable
• Vulnerable groups — pregnant or breastfeeding workers, young workers under 18, workers with specific medical conditions

The "how" matters because it determines which controls are appropriate. There are five routes of exposure to consider:

• Inhalation — breathing in airborne substances. The most common route for most workplace exposures
• Skin absorption — substances passing through the skin into the bloodstream. Many solvents do this readily
• Eye contact — splashes or vapour reaching the eyes
• Ingestion — usually accidental, often via contaminated hands at break times
• Injection or puncture — accidental needlestick injuries in healthcare, contaminated sharp objects in waste handling

Each route has different controls. A volatile solvent that exposes workers by inhalation needs ventilation; a substance absorbed through the skin needs gloves and skin care; a sharps risk needs sharps bins and safe disposal procedures.

Step 3 — Evaluate the level of risk

Risk is the combination of how likely exposure is and how serious the harm would be. For each substance and each exposure route, work out:

• The frequency of exposure — daily, weekly, occasionally?
• The duration of each exposure — minutes, hours, a full shift?
• The amount or concentration involved — a few millilitres or several litres?
• The current control measures and how effective they are
• The workplace exposure limit (WEL), where one exists, from HSE's EH40 publication

Workplace exposure limits matter because they're legally enforceable thresholds. Approximately 500 substances have WELs listed in EH40. For these substances, exposure must be kept below the WEL — and for carcinogens, mutagens and asthmagens, exposure must be reduced as low as reasonably practicable regardless of the WEL.

For substances without a WEL — which is most of them — HSE provides a tool called COSHH Essentials. It uses a control banding approach, grouping substances by hazard severity (groups A through E) and suggesting appropriate control measures for each band. It's the right starting point for low-volume, lower-hazard substances where commissioning quantitative exposure monitoring would be disproportionate.

The output of Step 3 is a risk rating for each substance and exposure route, with a clear judgement on whether existing controls are adequate.

Step 4 — Decide what to do (the hierarchy of control)

If existing controls are adequate, document them. If they're not, decide what controls to add or improve. COSHH Regulation 7 sets out the order: substitution first, then engineering controls, then control of exposure at source, then PPE only as a last resort.

A worked summary of each level:

• Elimination or substitution — Can the hazardous substance be removed entirely, or replaced with something less hazardous? A solvent-based product replaced with a water-based one. A powder replaced with a pellet form that doesn't generate dust. The most reliable form of control because it removes the problem
• Engineering controls — Total enclosure, partial enclosure, local exhaust ventilation (LEV), spray booths. Controls that don't depend on the worker doing anything different
• Organisational controls — Restricting access, rotating workers to reduce individual exposure, separating clean and dirty areas, scheduling high-exposure tasks for times when fewer people are present
• PPE — Gloves, eye protection, respiratory protection. Always in addition to other controls, never instead of them

The COSHH hierarchy of control explains the structure in more detail.

Step 5 — Record the findings

If you have five or more employees, the assessment must be recorded in writing — this comes from Regulation 6(4) of COSHH. Even with fewer employees, recording the assessment is the only practical way to demonstrate compliance.

The record needs to show the substances assessed, the hazards, who could be harmed, the controls in place, the residual risk level, the review date, and the name of the person who made the assessment. The COSHH risk assessment template page covers the fields in detail.

Step 6 — Review

Assessments aren't a one-off exercise. Regulation 6(3) requires review whenever there's reason to believe the assessment is no longer valid. Specific triggers include:

• A new substance is brought into the workplace, or an existing one is removed
• The process changes — different equipment, different production volume, different working pattern
• An incident occurs — a spillage, a near miss, a worker complaint of symptoms
• Monitoring shows exposure is higher than expected, or health surveillance picks up a problem
• A workplace exposure limit changes (EH40 is updated periodically)
• A reasonable period has elapsed since the last review — most workplaces operate on an annual review cycle

The review doesn't always mean rewriting the assessment. Often it means confirming that nothing has changed and signing off the existing assessment for another period.

Worked example: a commercial cleaning operative

A cleaning company has cleaners working in a mix of office buildings, schools and small healthcare premises. The substances in use include a multi-surface cleaner, a chlorine-based bleach for sanitary areas, a limescale descaler, and a glass cleaner. The COSHH assessment identifies the following.

The hazardous substances are the bleach (corrosive, signal word Danger, contains sodium hypochlorite), the descaler (irritant, contains a dilute acid), and the multi-surface cleaner (irritant, lower hazard). The glass cleaner is not classified as hazardous and doesn't need a COSHH assessment, although the company decides to assess it anyway for consistency.

The people at risk are the cleaning operatives directly. Building occupants are also potentially exposed during cleaning. Members of the public are exposed in retail premises during opening hours. The exposure routes are skin contact (the operatives' hands), inhalation of vapours (particularly the bleach in enclosed sanitary areas), and eye contact from splashes.

The current controls include nitrile gloves issued to operatives, the bleach being supplied pre-diluted to a fixed strength, and training on what not to mix (the assessment notes the risk of chlorine gas if bleach is mixed with an acidic descaler). The residual risk is judged low for the multi-surface cleaner and descaler, and medium for the bleach because of the inhalation route in poorly-ventilated toilets. Additional controls are added: a procedure to keep doors open during bleach use, a requirement to wear a vapour mask (BS EN 405) in any toilet without an opening window, and a written instruction to never mix bleach with the descaler. The wet work risk to cleaners' hands triggers an additional control on hand care — issue of an emollient cream, monitoring for skin signs.

The assessment is reviewed annually and immediately if a new substance is introduced. Operatives are trained on the assessment as part of their induction and refreshed annually.

Worked example: a small hair salon

A salon with four stylists uses bleach products for highlights, permanent and semi-permanent colour treatments, perm solutions, and a range of cleaning products. The COSHH assessment identifies that the bleach products and the perm solutions are the highest-hazard substances — both carry the GHS07 health hazard pictogram, and the bleach contains persulphates that are classified as respiratory sensitisers and skin sensitisers.

The people at risk are the stylists (frequent exposure across the day, wet work risk plus chemical contact), apprentices doing the mixing (concentrated exposure during preparation), and clients (lower-level exposure during application).

The current controls include nitrile gloves for the stylists during application, a dedicated ventilated colour bar for mixing, and apron use. The residual risk for skin and respiratory effects is judged medium. Additional controls are added: a requirement to use the colour bar for all mixing rather than at individual workstations, replacement of the bowl-and-brush colour application with sealed bottle application where possible to reduce vapour, and routine health surveillance for skin signs (checking the stylists' hands every two months). Newly hired stylists who develop dermatitis or respiratory symptoms during the first six months are referred to occupational health.

Worked example: a small construction site

A four-person construction firm doing domestic refurbishment uses cement and mortar, solvent-based paints, white spirit for clean-up, and a petrol-driven cement mixer. The cement contains chromium VI which is a skin sensitiser and a respiratory sensitiser. The solvents contain organic compounds with workplace exposure limits in EH40. Cutting concrete and bricks generates silica dust — respirable crystalline silica is classified as a carcinogen and has a tightened workplace exposure limit.

The people at risk are the workers themselves, plus the building's occupants who may return during the works.

The cement work uses the standard precautions: gloves, dust mask FFP3 during dry handling, washing skin before breaks. The solvent work uses gloves and is done in well-ventilated areas. The silica work is the highest-risk activity and gets the most attention: wet cutting wherever possible, on-tool dust extraction for any dry cutting, FFP3 respiratory protection with face-fit testing for workers who do regular cutting, and a written instruction to avoid dry sweeping. The assessment notes that workplace exposure to silica must be reduced as low as reasonably practicable because it's a carcinogen, not merely controlled below the WEL.

Frequently asked questions

When do I need a COSHH assessment?

You need a COSHH assessment before any work that could expose employees to a substance hazardous to health begins. In practice, that means before bringing any new substance into use, before starting any process that creates a hazardous by-product, or before significant changes to existing work.

How often must I review my COSHH assessment?

There's no fixed review interval in the regulations. You must review when there's reason to believe the assessment is no longer valid, when work changes, after incidents, or when monitoring or health surveillance suggests controls aren't working. Most workplaces review annually as a default.

Who can carry out a COSHH assessment?

A competent person — someone with sufficient training, experience and knowledge for the substances and the work. For most small employers, that's an internal manager who's been on COSHH training and is familiar with the workplace. For complex situations, an occupational hygienist or external consultant.

Do I need to record my assessment if I'm self-employed?

If you employ five or more people, you must record it in writing. With fewer than five, you're not legally required to record it but it's strongly recommended — it's the only practical way to demonstrate compliance if HSE inspects.

What's the difference between a COSHH assessment and a general risk assessment?

A general risk assessment under the Management Regulations 1999 covers all workplace risks. A COSHH assessment is specific to hazardous substances and goes further — it covers monitoring, health surveillance and substance-specific control measures that a general risk assessment doesn't. Many employers combine them in a single document, with substance-specific assessments as appendices.