COSHH assessment: what it is and how to do one properly

A COSHH assessment is a written assessment of the health risks created by the hazardous substances in your workplace, and of the controls that manage them. It is required by Regulation 6 of the Control of Substances Hazardous to Health Regulations 2002, which applies in England, Wales and Scotland. Northern Ireland has its own equivalent regime.

Two things it is not. It is not a safety data sheet: the sheet describes the substance, the assessment describes what happens when your people use it in your building. And it is not a one-off form. Regulation 6 of those Regulations requires the assessment to be reviewed, and an inspector may ask when you last did.

What counts as a substance hazardous to health

Wider than most people assume. The drums with hazard pictograms are the obvious part, and the smallest part.

The middle row is where most businesses come unstuck. Nobody bought the wood dust, so nobody assessed it. HSE prosecutions for wood dust exposure are among the most common enforcement outcomes in the merchanting and manufacturing sectors, and the breach is usually a missing or inadequate assessment rather than a missing extraction unit.

Asbestos, lead and radioactive substances have their own regulations and sit outside COSHH.

The six steps of a COSHH assessment

1. Identify what you use and what your work creates

Walk the site with a list. Every store, every workshop, every cleaning cupboard. Then add the substances your processes generate, which will not appear on any purchase record.

2. Get the hazard information

For supplied products, the safety data sheet from the supplier. Sections 2, 8 and 11 carry the hazard classification, the exposure controls and the toxicological information. For process-generated substances, HSE guidance and, where one exists, the workplace exposure limit.

3. Assess who is exposed, to what, and how much

This is the part that makes it your assessment rather than the supplier's. Which roles, how often, for how long, by what route, and in what space. A solvent used for two minutes in an open yard is a different assessment from the same solvent used for an hour in a windowless store.

4. Decide the controls, in the order the law requires

Regulation 7 of the Control of Substances Hazardous to Health Regulations 2002 sets a hierarchy, and it is a hierarchy rather than a menu. Prevention comes first: can you stop using the substance, or substitute something less hazardous? Only where prevention is not reasonably practicable do you move to control, and personal protective equipment is the last resort rather than the first purchase.

That order matters at an inspection. Issuing masks for a dust problem an extraction unit would solve is the most common finding in this area.

5. Record it, and tell people

Write it down. Then meet Regulation 12 of the Control of Substances Hazardous to Health Regulations 2002, which requires information, instruction and training for anyone who may be exposed. An assessment nobody has read protects nobody, and an inspector will ask the person doing the work, not the person who wrote the document.

6. Review it

Review when the substance changes, the process changes, the volume changes, or something goes wrong. Set a review date as well, because a review interval is the easiest thing to evidence and the easiest thing to forget.

When monitoring and health surveillance become duties too

Two further duties sit alongside the assessment, and both are triggered by what the assessment finds.

Regulation 10 of the Control of Substances Hazardous to Health Regulations 2002 requires exposure monitoring where it is needed to check that controls are working, or where failure of a control could cause serious harm. Measuring, not assuming.

Regulation 11 of the same Regulations requires health surveillance where employees are exposed to a substance and a disease linked to that exposure is identifiable. In practice that means spirometry for respiratory sensitisers such as wood dust and flour, skin checks for dermatitis risks, and audiometry where noise sits alongside a chemical exposure.

Health surveillance is usually the duty businesses find out about last, because it is the one the assessment creates rather than the one they started with. Our health surveillance and spirometry services exist for exactly this reason.

What an inspector looks for in a COSHH assessment

Having been on the other side of this conversation, the pattern is consistent:

• An assessment for each substance and process, not one document covering "chemicals" as a category.
• Evidence the hierarchy was followed, with a reason recorded where a higher control was rejected.
• Controls in use on the day, not controls described in a folder. Extraction switched on, lids closed, the right gloves for the right substance.
• Training records that match the people doing the work, including agency and seasonal staff.
• A review date, and evidence the last review happened.
• Health surveillance in place where the assessment identified the need.

The last two are where otherwise well-run businesses fail. The assessment was done properly, two years ago, by someone who has since left.

Frequently asked questions

Is a safety data sheet a COSHH assessment? No. A safety data sheet is information from the supplier about the substance. A COSHH assessment is your record of the risk that substance creates in your workplace, for your people, and the controls you have put in place. You need the sheet in order to write the assessment.

Who can carry out a COSHH assessment? Anyone competent to do it. There is no licence or mandated qualification. What matters is that the person understands the substances, the processes and the control options well enough to reach sound conclusions. For a small office using ordinary cleaning products, that is often someone in-house. For process-generated dust or fume, it usually is not.

Does a COSHH assessment have to be written down? If you employ five or more people, yes, record the significant findings. Below five, recording is not required, though it remains the only practical way to show compliance, brief your staff, or answer an inspector.

How often should a COSHH assessment be reviewed? Whenever the substance, process, volume or personnel change, and whenever something goes wrong. Many businesses also set an annual review. There is no fixed statutory interval, which is precisely why an inspector will ask when yours was last reviewed.

Do we need a COSHH assessment for cleaning products? Usually yes, if they are used at work and carry a hazard classification. The assessment may be short. A brief, accurate assessment concluding that normal use of a diluted detergent with gloves is adequately controlled is a valid assessment.

What happens if we do not have one? Failing to assess is a breach of Regulation 6 of the Control of Substances Hazardous to Health Regulations 2002 and is enforceable in its own right, without anyone being harmed. In practice it is often found during an inspection prompted by something else, and it tends to arrive alongside an improvement notice. Our enforcement support service covers that situation.

Getting it right without building a paperwork exercise

Most businesses do not need more documents. They need assessments that match what actually happens on site, controls people use because they work, and a review that happens without someone remembering to schedule it.

Once the assessment is done, the controls have to survive contact with a busy site. Our guide to safe chemical handling and storage covers the labelling, storage and handling side of that.

If you want to know where you stand before an inspector tells you, a COSHH risk assessment from a consultant who has served notices is the fastest route. If the wider system is the question rather than one substance, start with a gap analysis.