An eight-step practical framework for the main COSHH duties in Great Britain, with the legal basis and checks needed to put each into practice.

There is no legally prescribed number of COSHH compliance steps. This page uses eight practical headings to organise the principal duties in Regulations 6 to 13. Northern Ireland has separate COSHH regulations, and particular substances or activities may also bring additional requirements.

A five-step risk-assessment process helps organise assessment, while a wider compliance framework also covers maintaining controls, monitoring, surveillance, emergencies and training. The eight headings below are an aid to applying the duties, not an exhaustive legal checklist or a one-to-one mapping of regulations.

This page walks through each step. For the broader picture, see what COSHH is. For the regulations themselves, see the COSHH Regulations 2002 walkthrough.

Step 1 — Assess the risks (Regulation 6)

The COSHH risk assessment is the keystone of compliance. Before any work that could expose employees to a hazardous substance begins, Regulation 6 requires a “suitable and sufficient” assessment of the risk. The assessment identifies the substances present, evaluates the level of risk, and sets out the controls that will be used.

Employers with five or more employees must record the significant findings and the steps taken to comply. All employers must assess risk before the relevant work. A useful record identifies exposure, people at risk, controls, further actions and review arrangements.

Review regularly, with the interval based on the work and risk. Review immediately where the assessment may no longer be valid, work changes significantly or monitoring or health surveillance shows a need. COSHH does not impose a universal annual review date.

For the practical method of carrying out the assessment, including worked examples from cleaning, hairdressing and construction, see how to carry out a COSHH risk assessment. For knowing which substances need assessing in the first place, see what substances are covered by COSHH.

Step 2 — Decide what precautions are needed (Regulation 7)

Once the risks are assessed, the next step is choosing the controls. Regulation 7 sets a strict order. Substitution comes first under Regulation 7(2) — wherever reasonably practicable, the hazardous substance must be replaced with something less hazardous, or the process changed to eliminate the need for it. Where substitution isn’t possible, Regulation 7(3) establishes a hierarchy: engineering controls first, then control of exposure at source and organisational measures, then PPE only as a last resort and in combination with other controls.

The COSHH hierarchy of control walks through each level with worked examples.

For some substances, the standard goes higher than Regulation 7(3). For carcinogens, mutagens and substances that cause occupational asthma, exposure must be reduced as low as is reasonably practicable (ALARP), regardless of whether a workplace exposure limit applies or has been met. The ALARP standard means controls must continue to be improved as long as the cost isn’t grossly disproportionate to the reduction in risk.

Step 3 — Prevent or adequately control exposure (Regulation 7)

Step 2 decides the controls; Step 3 puts them in place and demonstrates they work. The two are split here because Regulation 7’s duty is dual — deciding what to do, and actually doing it. A decision to use engineering controls that’s never implemented is no better than no decision at all.

Implementation usually means a combination of equipment, procedures and training. Engineering controls — local exhaust ventilation, fume cupboards, enclosed handling — need to be installed, commissioned and tested before they’re relied on. Organisational measures need to be written up as procedures and built into the work. Administrative controls — signage, restricted access, supervision — need to be in place and maintained.

Adequate control requires the Schedule 2A principles of good practice, compliance with any applicable workplace exposure limit, and additional reduction as low as reasonably practicable for carcinogens, mutagens and asthmagens. A result below a limit does not, on its own, establish adequate control. Substances without limits still need risk assessment and effective controls.

Step 4 — Ensure that control measures are used and maintained (Regulations 8 and 9)

Controls only work if they’re used, and they only stay effective if they’re maintained. Regulation 8 requires the employer to ensure controls are properly used and that workers cooperate with them. Regulation 9 requires the employer to maintain controls in efficient working order, in good repair and in clean condition.

LEV normally requires thorough examination and testing by a competent person at intervals no longer than 14 months. Schedule 4 specifies shorter intervals for certain processes. Keep examination and test records for at least five years and carry out appropriate routine checks between tests.

Other categories of control measure have appropriate maintenance intervals defined in the L5 Approved Code of Practice or by manufacturer specification. PPE needs visual inspection before each use, with formal periodic checks for items like respirators. COSHH storage requirements covers the inspection regime for storage cabinets.

Controls must be used as intended. If workers bypass extraction or cannot use it effectively, investigate the equipment, task and working arrangements and correct the problem.

Step 5 — Monitor exposure (Regulation 10)

Exposure monitoring may use personal sampling, static sampling or direct-reading equipment, depending on the question being investigated. A competent person should choose methods representative of the relevant exposure.

Regulation 10 requires monitoring where necessary to maintain adequate control or protect health, unless another method demonstrates adequate control. Schedule 5 specifies additional monitoring requirements for particular substances and processes.

Keep records representative of identifiable employees’ personal exposure for at least 40 years from the last entry. Keep other monitoring records for at least five years. The longer period does not depend on the employee also receiving health surveillance.

Step 6 — Carry out appropriate health surveillance (Regulation 11)

Health surveillance is required where the Regulation 11 criteria are met: there is a reasonably likely identifiable health effect from the exposure and a valid, low-risk method of detection. Schedule 6 adds medical surveillance requirements for specified substance-and-process combinations.

The form of surveillance varies. For workers exposed to substances that cause dermatitis, it’s usually skin inspections by an appropriately trained person at defined intervals. For workers exposed to asthmagens, it’s questionnaires, lung function tests and clinical assessment by an occupational health professional. For workers exposed to certain specified processes, it includes biological monitoring or biological effect monitoring.

Keep the employer’s required health record for at least 40 years after its last entry. It documents relevant work and surveillance outcomes; confidential clinical details belong in the occupational health professional’s medical record. Disease latency varies, so a single example cannot describe every exposure.

Employees must be allowed access to their own health record on reasonable notice, and records must be available to HSE as required. If the business ceases trading, notify HSE and make the records available.

Step 7 — Plan for accidents, incidents and emergencies (Regulation 13)

Regulation 13 requires employers to prepare for foreseeable emergencies involving hazardous substances. The arrangements have to include emergency procedures (evacuation, decontamination, first aid suitable to the substances), provision of information to the emergency services, and any alarms or warning systems the risk warrants.

Scale arrangements to the substances, quantities and foreseeable consequences. A low-risk office and a major chemical installation do not need identical equipment or plans. Regulation 13 includes a slight-risk exception where other controls are sufficient; separate regimes such as COMAH may add duties at qualifying sites.

Arrangements have to be exercised. A written plan that has never been tested is more likely to fail at the moment it’s needed. Periodic drills — evacuation, spill response, casualty handling — are how the planning gets turned into real capability.

Step 8 — Inform, instruct and train employees (Regulation 12)

Regulation 12 closes the loop. None of the previous seven steps work unless the workers who use the substances, operate the controls, follow the procedures and respond to emergencies actually know what they’re doing. The training duty requires the employer to provide information, instruction and training that’s “suitable and sufficient” for the work.

Cover the substances, significant assessment findings, controls, relevant monitoring results, collective surveillance findings and emergency action. Protect personal medical confidentiality and check that workers can use the controls required for their job.

This is the step where the regulation meets the workforce. Structured COSHH Training is how most UK employers meet the duty for the substances workers commonly encounter, supplemented by specific instruction on the substances and controls at their own workplace. Workers also have duties under Regulation 8(2) and Section 7 of the Health and Safety at Work Act — see COSHH responsibilities for employers and employees for the full picture.

Putting the eight steps together: the compliance audit

The eight steps double as the structure of a COSHH compliance audit. Working through them in order, an auditor can confirm:

  • Whether assessments exist for all hazardous substances in use
  • Whether the controls in place reflect the hierarchy and follow Reg 7
  • Whether controls are used and maintained, including the applicable LEV examination and test interval
  • Whether monitoring and health surveillance happen on schedule
  • Whether emergency arrangements are documented and tested
  • Whether training records are current and align with the substances in use

An audit can identify an assessment missed after a change, an overdue extraction test or training that no longer matches the work. Check actual practice as well as the paperwork, and assign responsibility for correcting gaps.

Fees for Intervention

HSE’s Fee for Intervention scheme recovers relevant regulatory costs where a material breach within the scheme is identified and notified in writing. Charges depend on the work undertaken and the current published rate.

FFI may accompany notices or other enforcement. Prosecution costs are dealt with separately under the applicable rules; FFI is not a substitute for enforcement.

Use the framework to manage risks and check compliance in practice. Documentation supports that work, but completing a checklist does not guarantee compliance or rule out enforcement.

Frequently asked questions

How many steps are there to COSHH compliance?

This guide uses eight practical headings for the principal operational duties. COSHH does not prescribe an eight-step method, and the headings are not one step per regulation. Particular activities may have additional requirements.

Are the 8 steps a legal requirement?

The steps themselves aren’t named in the regulations — they’re a framework for navigating the duties. The underlying duties (assess, control, maintain, monitor, surveille, plan, train) are legal requirements under Regulations 6 to 13. Working through eight steps is one way to make sure none is missed.

What’s the difference between the 5 steps and the 8 steps?

The five-step framing comes from HSE’s general risk assessment template and covers the assessment process: identify hazards, decide who could be harmed, evaluate risk, record findings, review. The eight-step framing adds the duties that come after the assessment — implementing controls, maintaining them, monitoring exposure, health surveillance, emergency planning and training.

What happens in a COSHH audit?

An audit checks assessments, actual controls, maintenance, monitoring, surveillance, emergency arrangements and training. It should identify gaps and actions. Internal reviews follow the organisation’s needs; HSE inspections may be announced or unannounced.

Make sure your team is trained to recognise hazardous substances and work safely under COSHH.

Explore the COSHH Training course →

Sources & references

Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about workplace health & safety, COSHH and accredited online training for COSHH Training, part of Online CPD Academy.