COSHH Assessments – 7 key questions


In my last post I discussed the main problems that I often encounter with how COSHH assessments are carried out in practice. These were

  • concentrating on the hazards rather than the risks
  • neglecting to include process generated substances
  • concentrating on inhalation exposures and neglecting other routes
  • lack of emphasis on controls
  • failure to consider measures needed to ensure continued effectiveness of controls

To be “suitable and sufficient” a COSHH assessment needs to address the risks associated with the use of hazardous substances and decide on what measures are needed to reduce them to an acceptable level. The best way to achieve this is to base the assessment on the work. COSHH assessments should be focused on the process or task rather than the substance.

Guidance on risk assessments typically outlines a number of key steps as illustrated in the following flow chart




Although this provides a good overview of the process it is a little vague. In particular, it doesn’t really set out what is involved in the crucial third step – evaluating significant risks.

Some time ago, I sat down and tried to work out exactly what I do when I carry out a COSHH assessment. I concluded that I ask myself a series of questions:

  1. What substances are workers (and others) exposed to?
  2. What harm can these substances cause?
  3. Is exposure significant?
  4. What is currently being done to control exposure?
  5. Is that good enough?
  6. What needs to be done to improve control?
  7. What else needs to be done to ensure that adequate control is maintained? (e.g. testing controls, air monitoring, health surveillance, training etc.)

Let’s have a look at these in a little more detail

1. What substances are workers (and others) exposed to?

  • Starting with the task or process work out what substances are present – including both those substances bought in and those generated by the process (the latter often present the most significant risks).
  • Consider who could be exposed and how – i.e. by what routes (inhalation, skin, ingestion, injection)

2. What harm can these substances cause?

  • For substances bought it should be possible to determine the hazards they can present to health by looking at the label on their containers and the safety data sheet that suppliers must provide.
  • Information on process generated substances might be more difficult to locate, but the Health and Safety Executive publications and their website are often a good place to start.

For many people this is the end of the assessment, but if you stop here you have only identified hazards and haven’t addressed the risks. You need to continue to consider the other questions.

3. Is exposure significant?

This is probably the most difficult question to answer! Bear in mind that with hazardous substances the risk can be represented by the following equation :-


So the key is to try and quantify or estimate the degree of exposure. There are various ways this can be achieved, for example

  • personal air sampling
  • use of direct reading instruments
  • semi-quantitative measurements (e.g. direct reading dust monitors)
  • visualisation techniques (e.g. dust lamp or smoke tubes)
  • observations


The methods used will depend on circumstances. Sometimes observation is enough where it is obvious that improved controls are needed.


Whatever methods are used, a judgement has to be made on whether exposure is “significant” or not. Essentially you need to ask yourself “does something need to be done to reduce exposure?”. If the answer is “yes” then exposure is significant. (This is something I’ll return to in a future post)

4. What is currently being done to control exposure?

This question may be combined with the previous one. In most cases a COSHH assessment will be undertaken for an existing process where there are likely to be controls in place. You’ll need to identify what they are.

With a new process, the initial COSHH assessment should be carried out before the process starts. In that case you’ll need to identify what control options are available.

5. Is that good enough?

This may be asked in conjunction with questions 3 and 4. Once it’s been established what controls are available a judgement needs to be made on whether they are reducing exposure to a low enough level.

6. What needs to be done to improve control?

If existing controls aren’t good enough then, clearly, improvements will need to be made. A COSHH assessment should identify what measures are needed to control exposure.

Even where exposure is below exposure limits if there are ways of improving control they should be considered. For example, if personal protection is being used, even if it is adequate to reduce exposure below exposure limits, an attempt should be made to identify alternative controls.

Also if workers are exposed to carcinogens, mutagens or asthmagens, COSHH requires that exposure should be reduced to the lowest level reasonably practicable below any relevant limit. So in such cases it is particularly important to try to identify any additional controls.

7. What else needs to be done to ensure that adequate control is maintained?

This is probably the most neglected aspect of COSHH assessments even though the Regulations are quite explicit in requiring the assessment to consider what measures are needed to ensure compliance with all the regulations.

There are many examples in industry where expensive control measures are installed only for them to remain unused, used infrequently or used incorrectly thereby rendering them ineffective. To overcome these problems, effective management measures need to be put into place. COSHH Regulations 8 to 12 are about the things employers can and should do to ensure the controls they implement continue to work effectively. So once appropriate controls have been identified, the assessor needs to ask:

  • what needs to be done to ensure that the controls are used properly
  • what maintenance and testing is needed to ensure that engineering controls and personal protective equipment continue to operate effectively and what auditing should be carried out to ensure that the procedures and safe working methods are followed
  • is exposure monitoring and health surveillance needed as additional checks that the controls are effective
  • what information, instruction and training is required to ensure workers know why the controls are needed, how to use them correctly, procedures for reporting faults etc.

Common problems with COSHH assessments

The Control of Substances Hazardous to Health Regulations (COSHH) are undoubtedly the most important legal requirements for occupational hygienists working in Great Britain. They’ve been around for a long time now – the first version being enacted in 1988 – yet, in my experience, there are still many organisations that haven’t completely got to grips with them. One of the main problems is that many employers do not fully understand the Regulations and what they require and often misinterpret them.

In essence, COSHH is relatively straightforward. It simply sets out a framework for the management of risks created by using hazardous substances at work. I’ve often used the following diagram to summarise the main requirements of the Regulations


Employers whose operations involve the use of hazardous substances have to undertake a risk assessment in order to decide on what controls are appropriate. The other measures are then about they need to do to ensure that the controls remain effective (they’re the management controls that I’ve discussed in a previous post).

1. COSHH is about CONTROL

The first mistake employers often make is to forget the real objective of COSHH – i.e. controlling  the risks. They put a lot of work into the assessment, often generating a lot of paperwork, but don’t follow through to implement effective control regimes. The assessment is important – it is needed to establish priorities by deciding on which are the most significant risks, but it is primarily meant to be a tool to allow the employer to develop an action plan. It’s a means to an end not an end in itself.

2. Assess the RISK not the HAZARD

The second common problem is that many employers do not understand how to undertake the assessment.  It is quite common to focus on the substances used taking information from the safety data sheets provided by the suppliers and transferring it to a standard form , in effect, producing a summarised data sheet. This often involves a lot of time and resources, and although such summarised data sheets can be a useful information tool  they are not a risk assessment.

To see why this is the wrong approach it’s useful to take a look at the wording of COSHH regulation 6 which sets out the requirements for the assessment.

‘An employer shall not carry out work which is liable to expose any employees to any substance hazardous to health unless he has

a}made a suitable and sufficient assessment of the risks created by that work to the health of those employees and of the steps that need to be taken to meet the requirements of these Regulations

b) `implemented the steps referred to in sub-paragraph a.”

The key words that I’ve highlighted are “the risks created by the work”. The substances present hazards but, as the Regulations clearly state,  the risks are associated with the use of the substances.

I’ve heard many people state that they have carried out the assessments for all their substances. This normally indicates that they haven’t got it right. It’s not the substances that need to be assessed, but the work involving their use. For example, take a simple case where solvent is used for cleaning purposes. The risks, and the necessary controls,  associated with using a few millilitres applied with a cotton bud are clearly quite different than using several litres of hot solvent in a vapour degreasing bath. It is inappropriate to carry out a risk assessment of the substance – two assessments of two quite different processes are needed.

So the assessment should focus on the process. It should also concentrate on the risk not just the hazard. Risk is often defined as “the probability of harm occurring in practice”. For occupational hygienists it is best summed up by the following equation:


So the hazardous properties are important, but they are only half the story. The key to effective risk assessment, which s often neglected, is understanding the exposure of employees (and anyone else who could be affected by the work).

3. Identify ALL hazardous substances

Most COSHH assessments I’ve seen concentrate only on the substances that are bought in by the company. Yet there can be other substances present which need to be considered such as fumes, dusts and other airborne contaminants generated by the process or reaction products and intermediates in chemical manufacturing. In many cases it is these process generated substances that present the most significant risks, but they are often neglected.

Silica containing dust generated during cutting of paving slabs

4. Consider ALL routes of exposure

Many people carrying out assessments only focus on substances that can be inhaled. But there are other routes by which substances can come into contact with the body and be absorbed. All of these need to be considered.

Skin exposure by immersion (picture source:

Skin exposure is a common problem in industry leading to direct effects on the skin such as irritation, chemical burns and dermatitis and some substances can be absorbed through intact skin (this is something I’ve addressed in a previous post). Ingestion of hazardous substances can sometimes occur – normally due to contamination of foodstuffs, often following skin exposure. Penetration through the skin can occur by injection where workers are handling needles (e.g. healthcare workers) or where the skin has been abraded or otherwise damaged.

5. Identify controls and other management measures

The other common mistake is that employers often do not properly consider the measures needed to control the risks. They forget that controlling risk is the objective of COSHH and that the Regulations specifically require that the assessment must set out “the steps that need to be taken to meet the requirements of …. (the)…Regulations””.  This means that they need to decide on what controls are needed and what other measures might be needed (i.e. on the use, maintenance and testing of controls, air monitoring, health surveillance and information, instruction and training)

The first step in solving a problem is to recognise that it exists, but we then need to decide how to resolve it. I’ve set out some of the common problems with COSHH that I come across; I’ll consider how to avoid them when carrying out a COSHH assessment in my next post.