A step-by-step guide to assessing the risks from hazardous substances at work, with three worked examples from cleaning, hairdressing and construction.

A COSHH assessment identifies hazardous substances, who could be harmed and the controls needed. Regulation 6 of the Great Britain COSHH Regulations 2002 requires a suitable and sufficient assessment before work liable to expose employees begins. Northern Ireland has its own COSHH regulations.

This page walks through how to carry out a COSHH risk assessment properly. If you’re looking for the form to fill in afterwards, see the COSHH risk assessment template. If you want the wider context on what COSHH covers, see what COSHH is.

What a COSHH risk assessment is for

A COSHH risk assessment has two purposes. The first is legal: you need it to comply with Regulation 6. The second, and more important in day-to-day terms, is operational: it’s the document that tells your supervisors and workforce what to do with a substance, what controls to use, and what to do if something goes wrong. A good assessment makes the work safer. A bad one is paperwork.

The assessment is specific to hazardous substances — it sits alongside, but doesn’t replace, the more general workplace risk assessment required under the Management of Health and Safety at Work Regulations 1999. In practice, many businesses combine them, with a section in the general risk assessment covering hazardous substances at a high level and individual COSHH assessments for each substance or substance group.

Who must do it

The legal duty sits with the employer. The employer can delegate the practical work of carrying out an assessment, but the duty itself can’t be delegated — if the assessment is wrong, the employer is still in breach. Self-employed people have the same duty for their own work.

The person who actually does the assessment must be “competent” — they must have sufficient training, experience and knowledge to identify the hazards, evaluate the risks, and decide what controls are appropriate. There’s no formal qualification required, but a person carrying out COSHH assessments who’s never been trained on the substances, never read a safety data sheet, and never seen the work being done isn’t competent for the task. For most small and medium employers, competence comes from a combination of COSHH Training, familiarity with the work, and access to specialist advice when needed.

Complex substances or processes may require specialist occupational hygiene or occupational health advice. Choose help with the competence needed for the actual assessment, whether that expertise is internal or external.

Five steps or eight steps?

You’ll see different framings for the COSHH risk assessment process. Some sources describe a five-step process drawn from HSE’s generic risk assessment template (“Identify hazards, decide who might be harmed, evaluate risk, record, review”). Others list eight steps for full COSHH compliance, including monitoring, health surveillance and emergency planning.

These are practical ways to organise the work, not legally prescribed step counts. This page uses six assessment headings. The separate eight-step guide covers the principal supporting duties, but particular activities may involve additional requirements.

The six steps of a COSHH risk assessment

Step 1 — Identify the hazardous substances

Start by listing every substance in your workplace that could harm health. The obvious sources are:

  • Substances you buy in — chemicals, paints, cleaners, fuels, adhesives. Read the labels and ask for the safety data sheet from the supplier
  • Substances you produce — fumes from welding or soldering, dust from cutting or sanding, gases released by a reaction, biological agents in waste handling
  • Substances present in the work environment — Legionella in cooling towers, mould in damp buildings, agricultural pathogens

Chemical labels and safety data sheets help identify hazards. The nine CLP pictograms include physical and environmental hazards as well as health hazards, so check what each warning means and which controls or regulations apply. GB CLP applies in Great Britain; EU CLP continues in Northern Ireland.

Unlabelled substances can still be hazardous. Regulation 2 includes dust at specified airborne concentrations, substances with a WEL, biological agents and other substances creating comparable health risks. Dust can be harmful below those generic concentrations; they are not safe limits for every dust.

The safety data sheet is your main reference document for each substance. The Sections that matter most for the assessment are Section 2 (Hazards identification — what the substance can do), Section 8 (Exposure controls and PPE — what controls the supplier recommends), and Section 11 (Toxicological information — what the substance does to the body). For the full detail of how to read an SDS, see COSHH safety data sheets.

The output of Step 1 is a list — sometimes called the COSHH inventory or COSHH register — of every hazardous substance in the workplace, with the supplier, the SDS reference, and the dates of use.

Step 2 — Decide who could be harmed and how

For each substance, identify who could be exposed. The categories are usually:

  • The workers who use the substance directly
  • Other workers in the same area (passive exposure)
  • Cleaners and maintenance staff, including exposure during cleaning, opening equipment or handling residues
  • Contractors and visitors
  • Members of the public, where applicable
  • Vulnerable groups — pregnant or breastfeeding workers, young workers under 18, workers with specific medical conditions

The “how” matters because it determines which controls are appropriate. There are five routes of exposure to consider:

  • Inhalation — breathing in dust, fume, mist, vapour or gas
  • Skin contact — local damage or, for some substances, absorption through the skin
  • Eye contact — splashes or vapour reaching the eyes
  • Ingestion — usually accidental, often via contaminated hands at break times
  • Injection or puncture — accidental needlestick injuries in healthcare, contaminated sharp objects in waste handling

Choose controls for all relevant exposure routes. Prevent contact or releases where practicable, then select suitable engineering measures, working methods and PPE. Gloves and skin-care products alone do not replace prevention of avoidable exposure.

Step 3 — Evaluate the level of risk

Risk is the combination of how likely exposure is and how serious the harm would be. For each substance and each exposure route, work out:

  • The frequency of exposure — daily, weekly, occasionally?
  • The duration of each exposure — minutes, hours, a full shift?
  • The amount or concentration involved — a few millilitres or several litres?
  • The current control measures and how effective they are
  • The workplace exposure limit (WEL), where one exists, from HSE’s EH40 publication

Applicable WELs must not be exceeded, using their specified reference periods. Adequate control also requires the principles of good practice; carcinogens, mutagens and asthmagens require exposure reduced as low as reasonably practicable. A measurement below a WEL alone does not prove adequate control.

HSE’s COSHH Essentials guidance can help identify appropriate control approaches for suitable tasks and substances. Check its scope and limitations: it does not replace the workplace assessment or specialist advice where needed, and is not limited to substances without a WEL.

The output of Step 3 is a risk rating for each substance and exposure route, with a clear judgement on whether existing controls are adequate.

Step 4 — Decide what to do (the hierarchy of control)

If existing controls are adequate, document them. If they’re not, decide what controls to add or improve. COSHH Regulation 7 sets out the order: substitution first, then engineering controls, then control of exposure at source, then PPE only as a last resort.

A worked summary of each level:

  • Elimination or substitution — remove the hazardous process or choose a less hazardous substance or form where reasonably practicable. Assess any hazards introduced by the alternative
  • Engineering controls — enclosure, extraction or other equipment designed to reduce exposure, with suitable maintenance and correct use
  • Organisational controls — restrict access and minimise unnecessary exposure. Do not rotate more people through an uncontrolled hazard as a substitute for controlling it
  • PPE — Gloves, eye protection, respiratory protection. Always in addition to other controls, never instead of them

The COSHH hierarchy of control explains the structure in more detail.

Step 5 — Record the findings

With five or more employees, record the significant findings and steps taken to comply under Regulation 6(4). A written record is also useful with fewer employees, although that threshold does not remove the assessment duty.

The record needs to show the substances assessed, the hazards, who could be harmed, the controls in place, the residual risk level, the review date, and the name of the person who made the assessment. The COSHH risk assessment template page covers the fields in detail.

Step 6 — Review

Assessments aren’t a one-off exercise. Regulation 6(3) requires review whenever there’s reason to believe the assessment is no longer valid. Specific triggers include:

  • A new substance is brought into the workplace, or an existing one is removed
  • The process changes — different equipment, different production volume, different working pattern
  • An incident occurs — a spillage, a near miss, a worker complaint of symptoms
  • Monitoring shows exposure is higher than expected, or health surveillance picks up a problem
  • A workplace exposure limit changes (EH40 is updated periodically)
  • Regular review at an interval appropriate to the work and risk; COSHH sets no universal annual period

The review doesn’t always mean rewriting the assessment. Often it means confirming that nothing has changed and signing off the existing assessment for another period.

Worked example: a commercial cleaning operative

UK commercial cleaning operative in PPE applying sanitising spray.

A cleaning company has cleaners working in a mix of office buildings, schools and small healthcare premises. The substances in use include a multi-surface cleaner, a chlorine-based bleach for sanitary areas, a limescale descaler, and a glass cleaner. The COSHH assessment identifies the following.

This illustrative assessment uses the actual labels and SDSs for each cleaning product. Classification varies by formulation and concentration. A product without a hazard pictogram still needs consideration if the way it is used could harm health.

The people at risk are the cleaning operatives directly. Building occupants are also potentially exposed during cleaning. Members of the public are exposed in retail premises during opening hours. The exposure routes are skin contact (the operatives’ hands), inhalation of vapours (particularly the bleach in enclosed sanitary areas), and eye contact from splashes.

First consider whether less hazardous products or non-spray methods can do the job. Follow the product’s dilution and application instructions, provide adequate ventilation and choose gloves and eye protection for the actual formulation. Never mix bleach with other cleaners. A particle-filter mask does not protect against chlorine gas, and an enclosed toilet is not made safe simply by adding a mask. Assess wet work and arrange appropriate skin checks.

Set review and refresher arrangements according to the risk, and review promptly after relevant changes or problems. Brief operatives before the task and check that they can use the controls.

Worked example: a small hair salon

UK hair salon stylist applying colour treatment with gloves.

In this illustrative salon, assess colouring, bleaching, perming and cleaning products alongside wet work. Persulphates in some bleach products can cause asthma; other ingredients can irritate or sensitise the skin. Use the actual formulation’s safety information rather than assigning one classification to every product.

Consider stylists, apprentices, cleaners and clients, including exposure during mixing and application. Do not assume clients’ risk is low solely because their contact is less frequent.

Minimise dust and skin contact, provide suitable ventilation and use appropriate disposable non-latex gloves. Arrange skin checks and any other surveillance indicated by the assessment, with competent occupational health advice where needed. Workers should report skin or breathing symptoms promptly at any stage of employment; there is no six-month reporting window.

Worked example: a small construction site

UK construction worker wet-cutting concrete with dust extraction.

A construction assessment should consider cement, solvents, engine exhaust and dust from cutting materials. Wet cement can cause burns and dermatitis; chromium VI can cause allergic contact dermatitis. Concrete or brick cutting can release respirable crystalline silica. Its Great Britain WEL is 0.1 mg/m³ averaged over eight hours, with exposure also reduced as low as reasonably practicable.

The people at risk are the workers themselves, plus the building’s occupants who may return during the works.

Consider pre-mixed materials and methods that reduce cutting or dust. Use suitable water suppression or on-tool extraction for the task, and adequate RPE where required; tight-fitting RPE needs fit testing regardless of how regularly the task occurs. Select cement-resistant gloves and clothing, provide washing facilities and avoid dry sweeping. Do not use petrol-powered equipment in enclosed or poorly ventilated spaces where exhaust can accumulate.

Frequently asked questions

When do I need a COSHH assessment?

You need a COSHH assessment before any work that could expose employees to a substance hazardous to health begins. In practice, that means before bringing any new substance into use, before starting any process that creates a hazardous by-product, or before significant changes to existing work.

How often must I review my COSHH assessment?

Review regularly at a suitable interval, and immediately if the assessment may no longer be valid, work changes significantly, or monitoring or health surveillance shows a need. An annual date can be an organisational choice, but it is not a universal COSHH rule.

Who can carry out a COSHH assessment?

The assessor needs sufficient knowledge, training and experience for the work and hazards. A course certificate alone does not establish competence. Obtain specialist help where the assessment exceeds available expertise.

Do I need to record my assessment if I’m self-employed?

If you employ five or more employees, you must record significant findings and the steps taken to comply. Below that threshold a record is still useful, but the duty to make a suitable assessment applies regardless.

What’s the difference between a COSHH assessment and a general risk assessment?

A general assessment addresses workplace risks broadly. COSHH adds specific hazardous-substance requirements. The assessments can be combined if all relevant duties are addressed; a separate form is not mandatory.

Make sure your team can recognise hazardous substances and apply the right control measures.

Explore the COSHH Training course →

Sources & references

Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about workplace health & safety, COSHH and accredited online training for COSHH Training, part of Online CPD Academy.