How to Do a COSHH Risk Assessment: 5 Steps

A COSHH risk assessment is the process of identifying hazardous substances in your workplace, deciding who could be harmed and how, and putting controls in place to prevent or adequately control exposure. Under the Control of Substances Hazardous to Health Regulations 2002, employers must complete this assessment before work with hazardous substances begins.

This guide walks through the five practical steps, explains what “adequate control” actually means, and covers the mistakes that most often make an assessment worthless.

Is a COSHH assessment a legal requirement?

Yes. Regulation 6 of COSHH 2002 requires employers to carry out a suitable and sufficient assessment of the risks to health created by work involving hazardous substances — and to do so before that work starts.

If you have five or more employees, the significant findings must be recorded. Even below that threshold, recording your findings is sensible: it is the only practical way to show what you decided and why.

Step 1 — Identify the hazardous substances

Walk the job, not the stockroom. You are looking for two categories:

• Substances you bring in — cleaning chemicals, solvents, paints, adhesives, oils, disinfectants. These have labels and safety data sheets.
• Substances the work creates — silica dust from cutting or grinding, wood dust from sanding, welding fume, flour dust, exhaust fumes, legionella in water systems. These arrive with no label at all, and they are where serious long-term harm most often comes from.

Collect the safety data sheet for every purchased product. Suppliers must provide these free of charge.

Step 2 — Decide who might be harmed, and how

List the people, then the routes. People include employees, contractors, cleaners, maintenance staff, delivery drivers and visitors — anyone who could be in the area, not just the person doing the task.

There are four routes of exposure:

1. Inhalation — breathing in dust, fume, vapour, mist or gas. The most common route by far.
2. Absorption — through the skin, or through the eyes
3. Ingestion — swallowing, usually via contaminated hands, food or cigarettes
4. Injection — through broken skin, needles or high-pressure equipment

Give particular thought to anyone more vulnerable: young or new workers, pregnant workers, and anyone with existing respiratory or skin conditions.

Step 3 — Evaluate the risk and decide on controls

Risk depends on more than the substance itself. Consider:

• How much is used, and in what form (a solid block is very different from the same material as a fine powder)
• How often, and for how long
• Where — a well-ventilated workshop versus an enclosed room
• Whether the substance has a workplace exposure limit, published by HSE in EH40/2005

Then choose controls in strict order of preference — the hierarchy of control:

1. Eliminate — can the substance or process be removed entirely?
2. Substitute — a less hazardous product, or a less dusty form (pellets instead of powder, a wipe instead of a spray)
3. Engineering controls — enclosure, local exhaust ventilation (LEV), on-tool extraction, water suppression
4. Administrative controls — safe systems of work, job rotation, reducing the number of people exposed, restricting access
5. Personal protective equipment — respiratory protection, gloves, eye protection, coveralls

COSHH requires you to prevent exposure where reasonably practicable. Only where prevention is not reasonably practicable may you move to adequate control. PPE is the last line, never the first answer.

Step 4 — Record the findings and put them in place

Record what you found, the decisions you made, and the controls you are relying on. Then — the part that actually protects people — implement them:

• Make sure the controls physically exist and are available at the point of work
• Train people to use them, and supervise that they are used
• Maintain and test them. LEV systems require a thorough examination and test at least every 14 months in most cases
• Face-fit test tight-fitting respirators for each individual wearer

An assessment filed in a folder while the extraction unit stays switched off is not compliance — it is documentation of a hazard nobody controlled.

Step 5 — Review and update the assessment

Review whenever something changes:

• A new substance, product or supplier
• A change to the process, equipment or work location
• New information on the safety data sheet
• After any incident, near miss, or report of ill health
• If monitoring or health surveillance suggests controls are not working

Review periodically even when nothing appears to have changed — practices drift, and controls degrade quietly.

When is health surveillance needed?

Health surveillance is required where employees are exposed to substances linked to identifiable diseases and there is a reasonable likelihood the disease may occur under the conditions of the work. Common triggers include:

• Respiratory sensitisers — where occupational asthma is a risk
• Substances causing dermatitis — regular skin checks
• Work with substances that have specific statutory surveillance requirements

Health surveillance is not a substitute for control. It detects harm that is already beginning — the controls are what prevent it.

Five common COSHH assessment mistakes

1. Assessing the product, not the task. The safety data sheet describes the substance; your assessment must describe how your people use it.
2. Missing process-generated substances. Dust and fume have no label and cause much of the serious harm.
3. Jumping to PPE. It protects one person, only while worn correctly.
4. Never testing the controls. Untested LEV and unfitted masks are common findings.
5. Writing it once. An assessment that has not been reviewed in years describes a workplace that no longer exists.

Further reading

• HSE — COSHH assessment
• COSHH 2002, Regulation 6 — Assessment of health risks
• HSE — EH40/2005 Workplace exposure limits

---

COSHH training for your team

Our COSHH Awareness course gives workers the understanding behind these controls — why substitution beats PPE, what the hazard symbols mean, and how exposure actually happens.

Related reading: What is COSHH? · COSHH symbols explained

£9 per course. CPD accredited, 100 % online, verifiable e-certificate on completion. Pay for 2, get 3 — any 3 courses for £18.

Please note: this is a CPD awareness course. Where your role or scheme requires a regulated qualification or licence, that must come from an approved provider — always check your employer’s or scheme’s specific requirements.