Management of Health and Safety at Work Regulations 1999: what they require

The Management of Health and Safety at Work Regulations 1999 (MHSWR 1999) set out how employers in England, Wales and Scotland must organise health and safety. Regulation 3 of MHSWR 1999 requires a suitable and sufficient risk assessment, with its significant findings recorded once you employ five or more. Regulation 7 of MHSWR 1999 requires one or more competent persons to assist you, and prefers a competent employee where you have one.

The Regulations came into force on 29 December 1999, replacing Regulations of the same name from 1992, and were made under the Health and Safety at Work etc. Act 1974, which sets the general duties. Northern Ireland has its own Management of Health and Safety at Work Regulations (Northern Ireland) 2000.

What do the Management of Health and Safety at Work Regulations 1999 require?

The main duties, in the order they appear:

Provision	What it requires
Regulation 3 of MHSWR 1999	A suitable and sufficient assessment of the risks to your employees and to anyone else affected by your work, reviewed when it may no longer be valid or what it covers has changed significantly
Regulation 4 of MHSWR 1999	Preventive and protective measures based on the principles of prevention in Schedule 1 to MHSWR 1999
Regulation 5 of MHSWR 1999	Arrangements for planning, organising, controlling, monitoring and reviewing those measures, recorded once you employ five or more
Regulation 6 of MHSWR 1999	Health surveillance where the risks identified by the assessment make it appropriate
Regulation 7 of MHSWR 1999	One or more competent persons appointed to help you comply
Regulation 8 of MHSWR 1999	Procedures for serious and imminent danger, enough competent people nominated to run an evacuation, and restricted access to danger areas
Regulation 9 of MHSWR 1999	Contacts with external services arranged, particularly for first aid, emergency medical care and rescue work
Regulation 10 of MHSWR 1999	Comprehensible and relevant information for employees on the risks, the controls and the emergency procedures
Regulation 11 of MHSWR 1999	Co-operation and co-ordination with other employers and self-employed people sharing your workplace
Regulation 13 of MHSWR 1999	Each employee's capabilities taken into account when giving them tasks, and training on recruitment and when they face new or increased risks
Regulation 14 of MHSWR 1999	Duties on employees: use equipment as trained and instructed, and report serious danger and gaps in protection
Regulation 16 of MHSWR 1999	Risks to new and expectant mothers assessed, and their conditions or hours altered, or the employee suspended, where the risk cannot otherwise be avoided
Regulation 19 of MHSWR 1999	Young persons protected from risks that come from inexperience or immaturity, and kept from listed kinds of work

The duties fall mostly on employers. Self-employed people within the scope of health and safety law, broadly those whose work could put others at risk, also have to assess the risks under regulation 3(2) of MHSWR 1999.

Risk assessment under MHSWR 1999

Regulation 3 of the Management of Health and Safety at Work Regulations 1999 applies from your first employee. It covers the risks to your employees while they are at work and the risks your work creates for anyone else, such as contractors or members of the public. Its purpose is to identify the measures you need to take to comply with health and safety law, and regulations 4, 5, 6 and 10 of MHSWR 1999 build on what it finds.

Every employer must assess, and the five-employee threshold applies only to the record. With five or more employees you also record the significant findings and any group of employees identified as especially at risk, under regulation 3(6) of MHSWR 1999. HSE's guidance warns against relying purely on paperwork, because the priority is controlling the risks in practice.

Review the assessment when there is reason to suspect it is no longer valid, or after a significant change in what it covers. HSE also suggests one after an accident or near miss, or when workers spot problems. On-the-spot judgements as conditions change, often called a dynamic risk assessment, work within this assessment.

The principles of prevention

Regulation 4 of MHSWR 1999 requires the measures you put in place to follow the nine general principles of prevention in Schedule 1 to MHSWR 1999:

• avoid risks
• evaluate the risks that cannot be avoided
• combat risks at source
• adapt the work to the individual, especially in workplace design and the choice of equipment and working methods
• adapt to technical progress
• replace the dangerous with the non-dangerous or less dangerous
• develop a coherent overall prevention policy
• give collective protective measures priority over individual ones
• give appropriate instructions to employees

Read together, the first two mean you ask whether a risk can be removed before you evaluate it. On a roof, the eighth puts a guard rail, which protects everyone at the edge, ahead of a harness, which protects only the person wearing it. Regulation 7 of the Work at Height Regulations 2005 applies the same priority when you choose equipment for work at height.

Regulation 5 of MHSWR 1999 then requires arrangements for the effective planning, organisation, control, monitoring and review of those measures, suited to the nature of your activities and the size of your business, and recorded once you employ five or more.

Health surveillance

Regulation 6 of MHSWR 1999 requires health surveillance where the risks identified by the assessment make it appropriate. HSE's guidance says the law requires it when workers stay exposed to a health risk after controls are in place, because controls can fail even when they are checked and maintained. Its examples are noise, vibration and substances hazardous to health, and the regulations for each carry their own surveillance duty. A health surveillance programme matches each test to the exposure that calls for it.

Who can be your competent person?

Regulation 7 of the Management of Health and Safety at Work Regulations 1999 requires you to appoint one or more competent persons to assist you in undertaking the measures you need to take to comply with health and safety law. The competent person assists you, and the duties stay yours.

Regulation 7(5) of MHSWR 1999 sets the test. A person is competent where they have "sufficient training and experience or knowledge and other qualities" to enable them properly to assist. The law names no qualification, and HSE's guidance says formal qualifications are not usually essential, though they can help.

The order of choice is in regulation 7(8) of MHSWR 1999. Where there is a competent person in your employment, that person "shall be appointed ... in preference to a competent person not in his employment". HSE's guidance gives two reasons to look outside: a business that is large, complex or high risk, or one without the competence in-house.

You can appoint more than one person, for example an in-house manager running things day to day and an outside consultancy for specialist assessments, as in our guide to supporting an in-house health and safety manager. Regulation 7 of MHSWR 1999 then requires adequate co-operation between them, and enough people, time and means for the size of the business and its risks. An outside competent person must be told the factors you know or suspect affect the health and safety of anyone your work may affect, and have access to the information you give under regulation 10 of MHSWR 1999.

A self-employed employer with no partners who has the competence, or a partnership where at least one partner has it, can do the work without appointing anyone else, under regulations 7(6) and 7(7) of MHSWR 1999.

Under regulation 21 of MHSWR 1999, an act or default of an employee, or of a competent person you appointed, gives you no defence in criminal proceedings. If your business lacks the competence, an outsourced competent person is one way to meet the duty, and we have written about whether you need one at all.

What else do the 1999 Regulations require?

Serious and imminent danger

Regulation 8 of MHSWR 1999 requires procedures for serious and imminent danger, and enough competent people nominated to implement them for an evacuation. The procedures must let people exposed to serious, imminent and unavoidable danger stop work and go straight to a place of safety. Except in exceptional cases the procedures specify, they also keep people from resuming work while the danger remains. Employees need adequate health and safety instruction before entering any area where access is restricted on health and safety grounds.

Regulation 9 of MHSWR 1999 requires the contacts you need with external services to be arranged, particularly for first aid, emergency medical care and rescue work.

Information, co-operation and training

Regulation 10 of MHSWR 1999 requires comprehensible and relevant information for employees on the risks identified by the assessment, the controls, the emergency procedures and who the evacuation nominees are.

Where two or more employers share a workplace, temporarily or permanently, regulation 11 of MHSWR 1999 requires each to co-operate with the others, and to take all reasonable steps to co-ordinate measures and share information on the risks their work creates. Under regulation 12 of MHSWR 1999, contractors and other outside workers in your business, and their employers, receive information on the risks, your controls and who runs an evacuation.

Regulation 13 of MHSWR 1999 requires you to take each employee's capabilities into account when giving them tasks, and to provide adequate health and safety training when they are recruited and when they are exposed to new or increased risks because of:

• a transfer or a change of responsibilities
• new work equipment, or a change to equipment already in use
• new technology
• a new system of work, or a change to an existing one

The training is repeated periodically where appropriate, adapted to new or changed risks, and given during working hours.

New and expectant mothers

Where the people working in your business include women of child-bearing age and the work could put a new or expectant mother or her baby at risk, regulation 16 of MHSWR 1999 requires your risk assessment to include that risk. A new or expectant mother is an employee who is pregnant, has given birth within the previous six months, or is breastfeeding.

If an individual employee would still be at risk after your other controls, you alter her working conditions or hours, where that is reasonable and would avoid the risk. Where it is not reasonable, or would not avoid the risk, you suspend her for as long as necessary, subject to her right under section 67 of the Employment Rights Act 1996 to be offered any suitable alternative work you have available first. Those steps are required once she has told you in writing, under regulation 18 of MHSWR 1999, and HSE's guidance says to carry out an individual risk assessment then.

Young persons

A young person is anyone under 18. Before you employ one, regulation 3(4) of MHSWR 1999 requires you to make or review your assessment for the risks to young persons, taking particular account of factors that include their inexperience, lack of awareness of risks and immaturity.

Regulation 19 of MHSWR 1999 then keeps young persons from work beyond their physical or psychological capacity, harmful exposure to radiation or to agents that are toxic, carcinogenic or otherwise chronically harmful to health, accident risks they cannot reasonably be expected to recognise or avoid, and risks to health from extreme cold or heat, noise or vibration. A young person over school age can do that work where it is necessary for their training, they are supervised by a competent person, and the risk is reduced to the lowest level reasonably practicable.

Frequently asked questions

What does MHSWR stand for? The Management of Health and Safety at Work Regulations 1999, statutory instrument 1999/3242. They came into force on 29 December 1999 and apply in England, Wales and Scotland.

Does a risk assessment have to be written down? Only the significant findings, and only once you employ five or more people, under regulation 3(6) of MHSWR 1999. Below five you still have to carry out the assessment.

Can an outside consultant be your competent person? Yes. Regulation 7(8) of MHSWR 1999 gives a competent employee preference where you have one, and you can appoint both. Without one, an outside consultant can take the role, and the duty to comply stays with you.

What are employees' duties under the Management of Health and Safety at Work Regulations 1999? Regulation 14 of MHSWR 1999 requires employees to use machinery, equipment, dangerous substances and safety devices in line with their training and instructions. They must also report serious and immediate danger, and any shortcoming in your protection arrangements.

How often does health and safety training have to be repeated? Periodically where appropriate, under regulation 13(3) of MHSWR 1999, which sets no fixed interval. Training is also due when someone faces new or increased risks, for example after a change of job or equipment.

What is the difference between the 1974 Act and the 1999 Regulations? The Health and Safety at Work etc. Act 1974 sets general duties, such as ensuring your employees' health, safety and welfare at work so far as is reasonably practicable. The 1999 Regulations set out how to manage those duties, and regulations for particular hazards add their own.

What is the penalty for breaching the Regulations? Contravening health and safety regulations is an offence under section 33(1)(c) of the Health and Safety at Work etc. Act 1974. For a conviction on indictment, Schedule 3A to the Health and Safety at Work etc. Act 1974 sets a maximum of two years' imprisonment, a fine, or both.

Can an employee sue for a breach of the Regulations? For a breach on or after 1 October 2013, only under the new and expectant mothers duties. Section 47(2) of the Health and Safety at Work etc. Act 1974, as substituted in 2013, makes a breach of health and safety regulations actionable only where regulations provide for it. Regulation 22 of MHSWR 1999 provides for it only for those duties, and the claim is the mother's. A negligence claim is a separate route, which section 47(4) of the Health and Safety at Work etc. Act 1974 preserves.

Where to start

Take your risk assessment and compare two dates: its last review, and the last significant change to the work it covers. If the change came later, regulation 3(3) of MHSWR 1999 makes the review due, and regulation 13 of MHSWR 1999 may require training for the people affected.

Then check who your competent person is, and what they cover. Many of our consultants are former HSE and local authority regulators. If you need that competence from outside your business, we can be appointed as your competent person, working alongside any manager you already have.