COSHH and Risk Assessment: Legal Duties, Steps & Worked Example

Many UK employers treat COSHH assessments and general risk assessments as either the same document or entirely separate exercises. Neither approach is quite right. This page maps the two legal duties onto each other precisely, shows where one structured document can satisfy both, and provides a worked example and nine-point checklist to help you produce a PC review-ready assessment. Review and adapt everything here to your specific site, task and workforce.

---

COSHH and Risk Assessment: What the Law Actually Requires

Two separate legal duties arise whenever employees are exposed — or liable to be exposed — to hazardous substances.

Duty 1 — COSHH 2002, regulation 6: An employer shall not carry out work liable to expose any employees to a substance hazardous to health unless they have made a suitable and sufficient assessment of the risk created by that work and of the steps needed to meet the requirements of the Regulations, and have implemented those steps. (COSHH 2002, reg 6)

Duty 2 — Management of Health and Safety at Work Regulations 1999, regulation 3: Every employer shall make a suitable and sufficient assessment of the risks to the health and safety of employees whilst at work, and of persons not in employment affected by the undertaking, for the purpose of identifying measures needed to comply with relevant statutory provisions. (Management Regs 1999, reg 3)

These are parallel duties with different scopes. COSHH reg 6 is specific: it focuses on health risks from hazardous substances and requires the assessment to feed directly into the controls mandated by COSHH reg 7. Management Regs reg 3 is broader: it covers all health and safety risks, including physical hazards, ergonomics, and working environment factors that fall outside COSHH entirely. A single document can satisfy both — but only if it is structured to address the substance-specific requirements of COSHH reg 6(2) and the broader risk identification required by reg 3. Where non-substance hazards exist in the same task, those must also be covered for reg 3 compliance.

---

Dual-Duty Compliance Map

The table below shows how the two duties align — and where they diverge.

Requirement	COSHH 2002, reg 6	Management Regs 1999, reg 3	Satisfied by one document?
Identify hazardous substance / hazard	✓ Substance-specific (reg 6(2)(a)–(b))	✓ All workplace hazards	✓ Yes — if assessment covers all hazards
Assess exposure routes and duration	✓ Mandatory (reg 6(2)(c))	Implied within risk assessment	✓ Yes — include route, frequency, duration
Consider existing and planned controls	✓ Mandatory (reg 6(2)(g))	✓ Mandatory	✓ Yes
Reference any relevant WEL	✓ Mandatory (reg 6(2)(f))	Not specified	✓ Yes — include WEL reference in substance section
Record significant findings	✓ Mandatory for 5+ employees (reg 6(4))	✓ Mandatory for 5+ employees (reg 3(6))	✓ Yes — one record satisfies both
Record steps taken to meet reg 7 controls	✓ Mandatory (reg 6(4))	Not specified	✓ Yes — include in the same document
Identify groups especially at risk	Implied	✓ Explicit (reg 3(6)(b))	✓ Yes — add a named-group field
Review triggers	Significant change; monitoring results; reason to suspect invalid (reg 6(3))	Significant change; reason to suspect invalid (reg 3(3))	✓ Yes — COSHH triggers are the more demanding set
Non-substance hazards (e.g. manual handling, noise)	✗ Out of scope	✓ In scope	✗ No — substance assessment alone is insufficient for reg 3

Key takeaway: A well-structured COSHH risk assessment document can satisfy COSHH reg 6 and the substance-related elements of Management Regs reg 3(1). It cannot satisfy reg 3 in full where the same task involves non-substance hazards — those must be assessed separately or within a combined task risk assessment.

---

What Counts as a Hazardous Substance — Including Process-Generated Substances

Hazardous substances are not limited to products that carry a hazard label. As HSE makes clear, harmful substances can be produced by the work process itself — for example wood dust from sanding, silica dust from tile cutting, and fumes from welding. (HSE — COSHH basics: assessment)

The starting point for identification is reading product labels and safety data sheets (SDS). Where doubt remains, the employer should contact the supplier. (HSE — COSHH basics: assessment) Substances with workplace exposure limits (WELs) are hazardous to health under COSHH. (HSE — COSHH basics: assessment)

Process-generated substance prompt list (use during hazard identification):

• Sanding or abrading wood → wood dust
• Cutting, grinding or drilling concrete, stone or ceramic tiles → respirable crystalline silica (RCS)
• Welding, cutting or brazing metal → welding fume / metal fume
• Spraying paints or coatings → isocyanates / VOC vapours
• Using cleaning products in confined or poorly ventilated spaces → product-specific vapours / chlorine compounds
• Mixing cement or plaster → cement dust / alkaline skin hazard

Note: The SDS is a hazard information tool supplied by the manufacturer or importer. It is not the COSHH assessment — the assessment is a separate document the employer must produce, drawing on SDS information alongside workplace-specific exposure factors.

---

The Five Steps of a COSHH Risk Assessment

The HSE five-step risk management process — identify hazards, assess the risks, control the risks, record your findings, and review the controls (HSE — Risk assessment: steps needed to manage risk) — maps directly onto a COSHH reg 6 assessment:

1. Identify hazards → Read SDS, product labels; consider process-generated substances.
2. Assess the risks → Apply reg 6(2): exposure routes, duration, amounts, vulnerable workers, combination effects, relevant WEL.
3. Control the risks → Apply the reg 7 hierarchy (see below).
4. Record your findings → Document significant findings and control steps per reg 6(4) / Management Regs reg 3(6).
5. Review the controls → Trigger review per reg 6(3) conditions.

---

Workplace Exposure Limits (WELs): What They Are and When They Apply

WELs are GB occupational exposure limits approved by HSE. They are concentrations of hazardous substances in air, averaged over a set period of time, and are published in EH40. (HSE — EH40 workplace exposure limits) The EH40 list is legally binding under COSHH.

Where a substance has a WEL, COSHH reg 6(2)(f) requires that it be considered in the assessment. Keeping exposure below the WEL is a benchmark, not a guarantee of safety — where substances are classified as carcinogens, mutagens or asthmagens, exposure must additionally be reduced to as low as is reasonably practicable (ALARP), regardless of whether it sits below the WEL. (HSE — EH40)

Exposure itself is defined as uptake into the body by breathing fume, dust, gas or mist; skin contact; injection into the skin; or swallowing. (HSE — EH40) Your assessment must address every applicable route, not only inhalation.

---

Control Measures: The Prevention-First Hierarchy Under COSHH 2002 Reg 7

COSHH reg 7(1) requires employers to prevent exposure or, where that is not reasonably practicable, adequately control it. (COSHH 2002, reg 7(1)) The hierarchy is:

1. Substitution (preferred) — Replace the hazardous substance with one that eliminates or reduces the risk, so far as is reasonably practicable. (COSHH reg 7(2))
2. Engineering and process controls — Appropriate work processes, systems, engineering controls, suitable equipment and materials. (COSHH reg 7(3)(a))
3. Control at source — Adequate ventilation systems and organisational measures. (COSHH reg 7(3)(b))
4. PPE — last resort — Provided in addition to the measures above, only where adequate control cannot otherwise be achieved. (COSHH reg 7(3)(c))

Additional measures apply for carcinogens and mutagens under reg 7(5), including total enclosure where practicable, prohibiting eating/drinking/smoking in contaminated areas, regular cleaning, designated warning signs, and safe storage and disposal. (COSHH reg 7(5))

---

Principles of Good Practice Under COSHH 2002 Schedule 2A

Schedule 2A of COSHH 2002 sets out the principles of good practice for the control of exposure to substances hazardous to health. They carry legal weight through regulation 7(7): control of exposure is only treated as adequate if these principles are applied. (COSHH 2002, Schedule 2A) They include:

• Design processes to minimise emission, release and spread of hazardous substances.
• Take account of all relevant exposure routes — inhalation, skin absorption and ingestion.
• Choose control measures proportionate to the health risk.
• Select the most effective and reliable control options.
• Use PPE only in combination with other measures where adequate control cannot otherwise be achieved.
• Regularly check and review all control elements for continuing effectiveness.
• Inform and train all employees on hazards, risks and controls.
• Ensure that introducing controls does not increase overall risk to health and safety.

When completing your COSHH assessment, use the Schedule 2A principles as a practical checklist for the quality of your control strategy, rather than treating them as separate boxes to tick.

---

Worked Example: Cleaning Operative and Chlorine-Based Disinfectant

Scenario context: A cleaning operative in a commercial kitchen uses a chlorine-based disinfectant (sodium hypochlorite solution) to sanitise work surfaces daily. The product is supplied in a ready-to-use trigger-spray bottle and used for approximately 45 minutes per shift in a room with windows but no mechanical ventilation.

Assessment element (COSHH reg 6(2))	Detail for this scenario
(a) Hazardous properties	Chlorine-releasing agent; corrosive to skin and eyes; releases chlorine vapour on contact with acids or at high concentrations
(b) Supplier information / SDS	SDS reviewed — product classified as irritant; skin and eye corrosion/irritation category noted; inhalation hazard from vapour confirmed
(c) Level, type and duration of exposure	Daily use; 45 min per shift; spray application generates fine mist droplets; confined kitchen environment
(d) Circumstances / amount	One operative; approximately 500 ml used per session; standard trigger-spray bottle
(e) High-exposure activities	Cleaning of drain channels and enclosed surfaces increases contact time and mist generation
(f) Relevant WEL	Substance has a WEL — refer to current EH40 for the applicable value; ALARP does not apply (not classified as carcinogen/mutagen/asthmagen on current evidence)
(g) Control measures in place / planned	See control hierarchy decision below
(h)–(i) Health surveillance / monitoring	Not currently in place; review if operative reports symptoms
(j) Combination effects	Cleaning schedule reviewed — acid-based descaler used separately; timing separation documented to prevent chlorine gas generation

Exposure routes identified: Inhalation of vapour/mist (primary); skin contact with spray droplets (secondary); eye contact if spray misdirected.

Control hierarchy decision (COSHH reg 7):

1. Substitution considered — Lower-concentration product evaluated; supplier confirmed no equivalent efficacy at lower active-chlorine content for food-surface sanitation. Substitution not reasonably practicable in this case.
2. Engineering controls — Windows opened fully during and after application (natural ventilation). Proprietary local exhaust ventilation (LEV) not installed; trigger-spray format selected over pressurised aerosol to reduce airborne mist generation (process modification).
3. Organisational measures — Restrict task to one operative at a time; other kitchen staff absent during spraying; application technique briefing given.
4. PPE (in addition to above) — Nitrile gloves (barrier against skin contact); safety goggles where spray is directed overhead or into enclosed cavities; disposable apron. PPE issued as last resort layer, not primary control.

Review trigger for this assessment: Introduction of new cleaning product, change of application method, change to ventilation in the kitchen, or any report of skin/eye/respiratory symptoms from the operative.

---

Nine-Point COSHH Risk Assessment Checklist

Use this checklist to structure your assessment and verify it satisfies COSHH reg 6. Tick each point as complete before issuing the document.

• 1. Substance identification — Product name, CAS number (where applicable), SDS reviewed and dated.
• 2. Process-generated hazards checked — Have you considered whether the work itself produces a hazardous substance (dust, fume, vapour, mist)?
• 3. Exposure routes assessed — Inhalation, skin contact, ingestion and (where relevant) injection all considered.
• 4. Who is exposed — Named roles, frequency and duration of exposure recorded; contractors, visitors and maintenance workers considered.
• 5. WEL checked — Relevant WEL identified in EH40 (or confirmed none applicable); ALARP noted if substance is a carcinogen, mutagen or asthmagen.
• 6. Combination effects considered — Where more than one hazardous substance is used in the same area or task, combined exposure risk assessed.
• 7. Control hierarchy applied — Substitution first, then engineering/process controls, then organisational measures, then PPE as last resort (COSHH reg 7 order).
• 8. Significant findings recorded — Written record produced (mandatory for employers with five or more employees under COSHH reg 6(4) and Management Regs reg 3(6)).
• 9. Review date set — Scheduled review date recorded; early review triggers documented (substance change, process change, monitoring results, reported symptoms or near misses).

This checklist is designed to reduce COSHH assessment rework. It is not a substitute for site-specific review by a competent person.

---

Recording, Communicating and Reviewing Your COSHH Assessment

Recording: Employers with five or more employees must record the significant findings of the COSHH assessment and the steps taken to meet regulation 7 as soon as practicable after completing it. (COSHH reg 6(4)) The same threshold applies under Management Regs reg 3(6). (Management Regs 1999, reg 3(6)) Even below five employees, recording is good practice.

Communicating: Workers must be told what the hazards and risks are, what WELs apply, and what they need to do to protect themselves. Workers should also be informed of any monitoring results and collective health surveillance outcomes. Contractors working on your premises need the same information, and you need to know what substances they bring onto site.

Reviewing: COSHH reg 6(3) requires the assessment to be reviewed forthwith if there is reason to suspect it is no longer valid, if there has been a significant change in the work, or if exposure monitoring results make it necessary. (COSHH reg 6(3)) Management Regs reg 3(3) sets equivalent triggers. (Management Regs 1999, reg 3(3)) A scheduled periodic review is good practice even where none of these triggers fires.

---

How RamsDocs Automates COSHH Risk Assessment Documentation

RamsDocs generates structured COSHH risk assessment documentation built around the reg 6(2) mandatory considerations, the reg 7 control hierarchy, and the Management Regs reg 3 recording requirements — so the same document addresses both legal duties in a single workflow.

Every output is PC review-ready and designed to reduce RAMS rework. You still need to review and adapt each assessment to your specific site, task, substances and workforce before use.

Start from the COSHH risk assessment template, or read COSHH assessment vs RAMS — what's the difference?

---

Frequently Asked Questions

What is the difference between a COSHH assessment and a general risk assessment? A COSHH assessment is a specific legal duty under COSHH 2002 reg 6 focused on health risks from hazardous substances. A general risk assessment under Management Regs 1999 reg 3 covers all health and safety risks in a workplace or task. The two overlap where hazardous substances are involved; they diverge for non-substance hazards such as manual handling or physical injury.

When is a COSHH risk assessment legally required? Before carrying out any work that is liable to expose employees to a substance hazardous to health — that is the trigger regulation 6(1) sets. The duty turns on the risk of exposure created by the work, not on any minimum quantity of substance used.

What must a COSHH risk assessment include? COSHH reg 6(2) lists the matters the assessment must consider, including hazardous properties, SDS information, exposure levels and routes, work circumstances, high-exposure activities, relevant WELs, planned control measures, health surveillance results, monitoring results, combination effects and biological agent classifications.

How do you identify which substances trigger a COSHH assessment? Read product labels and SDS for supplied chemicals. Also consider substances produced by the work process — wood dust, silica, welding fume. Substances with WELs are hazardous under COSHH. When in doubt, contact the supplier.

What are WELs and how do they affect the assessment? WELs are GB occupational exposure limits approved by HSE, published in EH40 as legally binding concentrations in air averaged over a set period. They must be referenced in the assessment where applicable. For carcinogens, mutagens and asthmagens, ALARP applies in addition to the WEL.

What controls must be put in place? COSHH reg 7 requires prevention first (substitution preferred), then engineering and process controls, then ventilation and organisational measures, with PPE only as a last resort in addition to other controls — not as a standalone solution.

How often must a COSHH assessment be reviewed? Regularly, and immediately if the assessment may no longer be valid, if the work changes significantly, or if monitoring results make it necessary (COSHH reg 6(3)). Set a review date and document the triggers.

Can one document satisfy both COSHH reg 6 and Management Regs reg 3? Yes, for the substance-related elements — provided the document addresses all of reg 6(2) and records significant findings as required by both sets of regulations. Where the same task involves non-substance hazards, those must be covered separately or within a broader task risk assessment to satisfy reg 3 in full.

When is health surveillance legally required under COSHH? COSHH reg 11(1) requires an employer to ensure that employees who are, or are liable to be, exposed to a substance hazardous to health are under suitable health surveillance where it is appropriate for their protection. Under COSHH reg 11(2), surveillance is appropriate where either the employee is exposed to a substance and process listed in Schedule 6 with a reasonable likelihood of an identifiable disease or adverse health effect resulting, or where an identifiable disease or effect may be related to the exposure, there is a reasonable likelihood it may occur under the particular conditions of work, and valid low-risk detection techniques exist. Where Schedule 6 applies, COSHH reg 11(5) additionally requires medical surveillance under a relevant doctor at intervals of no more than 12 months. Health records must be kept for at least 40 years from the date of the last entry (COSHH reg 11(3)).

What action must an employer take if health surveillance reveals a work-related disease or adverse effect? COSHH reg 11(9) sets out a chain of mandatory responses: the affected employee must be informed by a suitably qualified person and given advice on further surveillance; the risk assessment must be reviewed; control measures under reg 7 must be reviewed in light of any medical advice; assigning the employee to alternative work away from the substance must be considered; and the health of any other similarly exposed employees must be reviewed, including medical examination where a relevant doctor recommends it. These obligations make health surveillance an active management tool rather than a tick-box exercise — findings must feed back into your COSHH risk assessment directly.

How does biological monitoring differ from air monitoring as an exposure measurement tool? Air monitoring, addressed under COSHH reg 10, measures the concentration of a hazardous substance in the workplace atmosphere to assess whether inhalation exposure is being adequately controlled relative to any applicable WEL. Biological monitoring instead measures the substance itself, or a metabolite or biological effect marker, in a worker's blood, urine or exhaled breath, reflecting actual uptake into the body across all exposure routes — including skin absorption and ingestion as well as inhalation. Where a substance is readily absorbed through the skin (for example, certain solvents or pesticides), air monitoring alone may significantly underestimate total body burden, making biological monitoring a valuable complementary tool in your COSHH assessment.

Does the COSHH risk assessment need to specify whether health surveillance or biological monitoring will be used? As a matter of sound practice, the assessment should record the arrangements for health surveillance wherever reg 11 applies, since COSHH reg 11(9) requires surveillance findings to trigger a review of both the risk assessment and the reg 7 controls. Similarly, where biological monitoring forms part of your exposure evaluation strategy — particularly for substances with significant skin absorption potential — documenting it in the assessment provides a clear audit trail showing how you are satisfying your ongoing duty to maintain adequate control under COSHH reg 7(1). Both monitoring approaches should be treated as live inputs that can require the assessment to be revisited under the reg 6(3) review triggers.

---

Disclaimer: This page is for general information only. All COSHH risk assessments must be reviewed and adapted to the specific site, task, substances and workforce by a competent person before use. RamsDocs documentation is designed to reduce assessment rework; it does not remove the need for site-specific professional review.