COSHH places eight core duties on employers, and only one of them is “do a risk assessment”. The other seven — prevent or control exposure, maintain the controls, monitor, health surveillance, train, plan for emergencies, and keep it all under review — are where enforcement actually happens.
Most businesses that fail a COSHH inspection have assessments. What they do not have is evidence that the controls named in those assessments are being used, maintained and tested.
The eight duties, regulation by regulation
| Reg | Duty | What it means in practice |
|---|---|---|
| 6 | Assess the risk | A suitable and sufficient assessment before work starts |
| 7 | Prevent or adequately control exposure | Eliminate first; control only if you cannot |
| 8 | Ensure controls are used | Employer provides; employees must use them properly |
| 9 | Maintain, examine and test controls | LEV thoroughly examined at least every 14 months |
| 10 | Monitor exposure | Where the assessment requires it, or for Schedule 5 substances |
| 11 | Health surveillance | Where there is an identifiable disease and valid technique |
| 12 | Information, instruction and training | Everyone exposed must understand the risk and the controls |
| 13 | Emergency arrangements | Plans for spills, leaks and accidental release |
Regulation 6 — assess the risk
The assessment must be suitable and sufficient, made before the work begins, and reviewed regularly — and immediately if there is reason to think it is no longer valid, or if the work changes.
If you employ five or more people, the significant findings must be recorded. Below that threshold recording is not compulsory, but you still have to be able to show you assessed properly, which in practice means writing it down anyway.
An assessment is not a filed safety data sheet. It considers your substances, your quantities, your methods, your people. See how to do a COSHH risk assessment.
Regulation 7 — prevent, or adequately control
This is the heart of COSHH, and it is a strict order of preference. Exposure must be prevented where reasonably practicable. Only where prevention is not reasonably practicable may you move to control.
- Eliminate the substance or the process entirely
- Substitute with something less hazardous, or the same substance in a safer form — pellets instead of powder, ready-diluted instead of concentrate
- Engineering controls — enclosure, local exhaust ventilation, automation
- Organisational and procedural controls — safe systems of work, reducing numbers exposed, reducing duration
- Personal protective equipment — the last resort, never the first answer
Reaching for gloves and a mask before considering the four steps above is the most common COSHH failing there is. PPE protects one person, only while worn correctly, and fails silently. Engineering controls protect everyone in the room whether or not they are paying attention.
Schedule 2A sets out eight principles of good practice for control that must be applied — including designing processes to minimise emission, controlling exposure at source, and checking that control measures do not increase overall risk.
Carcinogens, mutagens and asthmagens
For these, the duty goes further: exposure must be reduced to as low as is reasonably practicable. Meeting the workplace exposure limit is not enough — you must keep pushing exposure down below it. See workplace exposure limits explained.
Regulation 8 — make sure controls are actually used
A two-way duty. The employer must take all reasonable steps to ensure controls are properly used and applied. Employees must use them, use PPE correctly, and report defects.
“We provided the extraction, they chose not to switch it on” is not a defence if you never checked, never supervised and never acted on what you saw.
Regulation 9 — maintain, examine and test
Controls must be kept in efficient working order and good repair. The number to remember:
Local exhaust ventilation must be thoroughly examined and tested at least once every 14 months (more often for certain processes listed in Schedule 4). Records of those examinations must be kept for at least five years.
Respiratory protective equipment must also be maintained, examined and — other than disposables — tested, with records kept for five years.
An LEV system that has never been examined is a straightforward, provable breach, which is why inspectors ask for the report early.
Regulation 10 — monitor exposure
Air monitoring is required where the risk assessment shows it is needed to protect health, where you cannot otherwise be sure controls are working, or for the substances and processes listed in Schedule 5 (which includes vinyl chloride monomer and certain chromium processes).
Records must be kept — 40 years where the monitoring relates to identifiable employees, otherwise 5 years.
Regulation 11 — health surveillance
Required where employees are exposed to a substance linked to an identifiable disease or health effect, there is a reasonable likelihood it will occur, and there is a valid technique for detecting it — or where the exposure is to a Schedule 6 substance.
Typical examples: skin checks for dermatitis, lung function testing for respiratory sensitisers, and audiometry-style programmes where relevant.
Health records must be kept for 40 years from the date of the last entry. Health surveillance is not the same as a general health check — it looks for specific effects of specific exposures, and its purpose is to catch harm early enough to act on it.
Regulation 12 — information, instruction and training
Anyone who may be exposed must be given suitable and sufficient information, instruction and training, covering the risks, the precautions, the results of any monitoring, and the collective results of health surveillance.
It must be adapted to the people receiving it — which means accounting for literacy, language and experience, not just handing over a document.
This is the duty a CPD-accredited awareness course helps evidence, alongside the site-specific instruction only you can give.
Regulation 13 — emergency arrangements
Procedures for accidents, incidents and emergencies: spill response, first aid, evacuation, warning and communication systems, and information available to emergency services. These must be tested at suitable intervals — a plan nobody has rehearsed is a document, not an arrangement.
What inspectors actually ask for
- The COSHH assessments — and whether they match what is happening on the floor
- The LEV examination report, and its date
- Training records for the people using the substances
- Health surveillance records where required
- Evidence that PPE is not being used as the primary control
- Whether the assessment has been reviewed since the process last changed
The gap between a written assessment and observable practice is where enforcement lands.
Further reading
- Control of Substances Hazardous to Health Regulations 2002
- HSE — COSHH
- HSE — Local exhaust ventilation
Evidence your Regulation 12 training
Our COSHH Awareness course covers the duties above, the hierarchy of control and what a COSHH assessment involves — the general training element expected under Regulation 12, alongside your own site-specific instruction.
Related reading: What is COSHH? · What does COSHH stand for? · How to do a COSHH risk assessment
£9 per course. CPD accredited, 100 % online, verifiable e-certificate on completion. Pay for 2, get 3 — any 3 courses for £18.
Please note: this is a CPD-accredited awareness course and general information, not legal advice. It is not an Ofqual-regulated qualification and does not replace the site-specific instruction and supervision employers must provide. Always check your employer’s and scheme’s specific requirements.