If your business uses chemicals, cleaning products, dust, fumes, or any other hazardous substances, you are legally required to carry out a COSHH risk assessment. It is one of the most important health and safety duties UK employers have, yet it is also one of the most commonly misunderstood. This guide explains exactly what a COSHH risk assessment is, who needs one, and how to carry one out properly in 2026.
What Is a COSHH Risk Assessment?
A COSHH risk assessment is a structured evaluation of the hazardous substances used or produced in a workplace and the risks they pose to the health of workers and anyone else who might be affected. It identifies what substances are present, how people could be harmed by them, and what control measures need to be in place to prevent or adequately control that exposure.
COSHH risk assessments are required under the Control of Substances Hazardous to Health Regulations 2002. These regulations place a clear legal duty on every UK employer to assess the risks from hazardous substances before work with them begins and to put effective controls in place based on that assessment.
A COSHH risk assessment is not the same as a general workplace risk assessment. While a general risk assessment covers a wide range of workplace hazards such as slips, trips, and manual handling, a COSHH risk assessment focuses specifically on substances that could damage health through inhalation, skin contact, ingestion, or absorption.
COSHH Risk Assessment Abbreviation Explained
COSHH stands for Control of Substances Hazardous to Health. It refers specifically to the Control of Substances Hazardous to Health Regulations 2002, which is the primary piece of UK legislation governing how employers must manage exposure to hazardous substances in the workplace.
The COSHH risk assessment abbreviation is widely used across UK construction, manufacturing, cleaning, healthcare, and laboratory sectors. When a principal contractor, procurement team, or accreditation assessor asks for your COSHH risk assessment, they are asking for documented evidence that you have properly identified the hazardous substances in your work, assessed the risks, and put the right controls in place.
Substances covered by COSHH include:
- Chemicals and chemical products
- Fumes from welding, cutting, or grinding
- Dust from wood, silica, or grain
- Cleaning and disinfectant products
- Biological agents including bacteria and viruses
- Substances produced during work processes
What Are the Basic Rules of COSHH?
The basic rules of COSHH are built around a simple principle: prevent exposure to hazardous substances where possible, and where prevention is not reasonably practicable, adequately control it.
The eight overarching duties placed on employers by COSHH Regulations 2002 are:
- Assess the risks to health from hazardous substances at work
- Decide what precautions are needed
- Prevent or adequately control exposure
- Ensure that control measures are used and maintained properly
- Monitor exposure where necessary
- Carry out appropriate health surveillance
- Prepare plans and procedures for accidents and emergencies involving hazardous substances
- Ensure employees are properly informed, trained, and supervised
These rules apply to every UK employer regardless of business size or sector. Even a small cleaning company or a one-person construction contractor using chemical products must comply with COSHH.
Who Must Complete a COSHH Risk Assessment?
Every UK employer who exposes or is likely to expose employees or others to hazardous substances must complete a COSHH risk assessment. This applies to virtually every business sector in the UK, since hazardous substances appear in almost every workplace in some form.
Sectors where COSHH risk assessments are particularly critical include:
- Construction, where silica dust, wood dust, and chemical adhesives are common
- Manufacturing and engineering, where cutting fluids, lubricants, and metal fumes are routinely present
- Cleaning and facilities management, where strong chemical cleaning agents are used daily
- Healthcare, where biological agents and disinfectants present real exposure risks
- Laboratories, where a wide range of chemical and biological substances require careful assessment
- Security and guarding, where cleaning products and vehicle exhaust fumes may be relevant
Self-employed individuals are also required to comply with COSHH if their work exposes others to hazardous substances, even if they only harm themselves. In practice, any self-employed person working on a client site should have COSHH assessments in place for every substance they use.
Who Is Responsible for a COSHH Risk Assessment?
The employer is ultimately responsible for making sure COSHH risk assessments are carried out, are suitable and sufficient, and are kept up to date. This responsibility cannot be delegated away entirely, even when the day-to-day task of writing the assessment is passed to a health and safety officer, an external consultant, or a supervisor.
In practice, the person who carries out the COSHH assessment must be competent to do so. Competence in this context means having enough knowledge, training, and experience to understand the substances being assessed, the routes of exposure, relevant workplace exposure limits, and the controls available.
Employers should involve the workers who actually use the hazardous substances in the assessment process. They often have the most direct knowledge of how substances are used day to day, which makes their input genuinely valuable in identifying risks that might otherwise be missed.
Where a business lacks in-house competence, bringing in an external health and safety consultant with COSHH expertise is a practical and often more reliable option.
10 Steps of a COSHH Risk Assessment in the UK
Step 1: Identify All Hazardous Substances
Begin by creating a complete inventory of every hazardous substance used, stored, or produced in your workplace. Walk through every area of the business and look at what is being used, what is stored, and what substances are generated as by-products of work processes.
Do not overlook substances produced during work. Welding fumes, wood dust from cutting, silica dust from grinding concrete, and chemical vapours from heating adhesives are all hazardous substances that must be included in your assessment even if they are not purchased as chemical products.
Step 2: Gather Safety Data Sheets
For every hazardous substance identified, obtain the Safety Data Sheet from the supplier or manufacturer. Safety Data Sheets contain essential information about the health hazards associated with the substance, recommended exposure limits, routes of entry into the body, and guidance on appropriate control measures.
Safety Data Sheets are a crucial input to your COSHH assessment, but they are not a substitute for it. The SDS tells you what the substance can do. Your COSHH assessment uses that information to evaluate the specific risks in your particular workplace, with your specific workers, in your actual working conditions.
Step 3: Decide Who Might Be Harmed and How
Consider everyone who could be exposed to each hazardous substance. This includes your own employees, contractors working on your site, visitors, and members of the public in certain circumstances.
Consider all four main routes of exposure:
- Inhalation: breathing in fumes, dust, vapours, gases, or mists
- Skin contact: direct contact causing dermatitis or chemical burns
- Ingestion: accidental swallowing through contaminated hands, food, or drink
- Skin absorption: some substances pass through the skin into the bloodstream without causing obvious skin damage
Pay particular attention to vulnerable groups including young workers, and workers with existing health conditions such as asthma or dermatitis, who may be at greater risk from certain substances.
Step 4: Evaluate the Risks
For each substance and each potential route of exposure, evaluate the likelihood and severity of harm. Consider how much of the substance a worker is exposed to, how often, and for how long each day.
Where substances have Workplace Exposure Limits listed in the HSE’s EH40 publication, check whether current exposure levels are likely to exceed those limits. WELs are the maximum concentrations of airborne substances, averaged over a reference period, to which employees may be exposed without risk to their health. Exceeding a WEL is a significant compliance failure.
Step 5: Apply the Hierarchy of Controls
Once you have evaluated the risks, decide what controls are needed using the COSHH hierarchy of controls. This hierarchy runs from the most effective to the least effective approach:
- Eliminate the hazardous substance by stopping its use
- Substitute it with a less hazardous alternative
- Enclose the process to prevent exposure
- Apply engineering controls such as local exhaust ventilation to capture fumes at source
- Use administrative controls such as safe systems of work, job rotation, and reduced exposure times
- Provide personal protective equipment as a last resort
PPE should always be the last line of defence, not the first response. Controls higher up the hierarchy are more reliable because they do not depend on individual behaviour.
Step 6: Record Your Findings
Once you have identified hazards, assessed exposure risks, and decided on controls, you must record your findings. Employers with five or more employees are legally required to keep a written record of their COSHH assessment. Even for smaller businesses, a written record is strongly recommended.
The record should include:
- The substance assessed and its hazard classification
- Who might be exposed and how
- Current and proposed control measures
- Any workplace exposure limits relevant to the substance
- Actions required, who is responsible, and the target completion date
Step 7: Inform and Train Workers
Providing the right controls is not enough by itself. Workers must understand what hazardous substances they work with, what the health risks are, what controls are in place, and how to use them correctly.
Training must be practical and relevant to the actual work being done. A signing sheet confirming attendance at a generic COSHH awareness session is not sufficient. Workers need to know specifically what they are using, what it can do, and exactly how to protect themselves.
Step 8: Monitor Exposure Levels
Where significant risks of exposure exist, particularly for substances with established WELs, employers must monitor worker exposure. Air monitoring measures the concentration of substances in the workplace atmosphere and checks whether it remains within safe limits.
Monitoring records must be kept for at least five years, or for forty years where the monitoring relates to substances causing long-latency diseases such as asbestos or silica.
Step 9: Carry Out Health Surveillance
For certain substances and certain types of exposure, health surveillance is a legal requirement under COSHH. Health surveillance means regularly checking workers for early signs of work-related ill health caused by hazardous substance exposure.
Health surveillance is required when workers are exposed to substances linked to occupational diseases such as occupational asthma, dermatitis, or silicosis. Records from health surveillance must be kept for forty years minimum for long-latency diseases.
Step 10: Review and Update the Assessment
A COSHH risk assessment is not a one-off document. It must be reviewed regularly and updated whenever there are significant changes to the substances used, the work processes, the workplace, or the workforce.
COSHH Regulation 6 requires a review when the assessment is no longer valid, which in practice means reviewing after any incident or near miss, when substances or processes change, when health surveillance results suggest controls are not working, and at planned intervals, typically at least annually for higher-risk substances.
How to Write a COSHH Assessment
Writing a COSHH assessment does not require specialist software, but it does require genuine knowledge of the substances involved and the work being done. A well-written COSHH assessment should be:
- Specific to the actual substance and work activity being assessed
- Based on the Safety Data Sheet and relevant HSE guidance
- Written in clear, plain language that workers can understand
- Proportionate to the level of risk involved
- Reviewed and signed by a competent person
The assessment should record all the information gathered during the ten steps above in a structured, logical format that makes it easy for workers, supervisors, and auditors to understand what the risks are and what controls are in place.
Common Mistakes Businesses Make with COSHH Assessments
Many UK businesses produce COSHH assessments that do not satisfy either HSE inspectors or accreditation assessors. The most common mistakes are avoidable with the right approach.
Common mistakes include:
- Using Safety Data Sheets as a substitute for a proper COSHH assessment
- Failing to consider substances generated by work processes such as welding fumes or dust
- Relying on PPE as the primary control without first exploring higher-level controls
- Not reviewing assessments after incidents or changes to substances and processes
- Failing to involve workers who actually use the substances
- Missing health surveillance requirements for substances that legally require it
- Using generic templates not adapted to the specific substance or workplace
How COSHH Assessments Support ISO and Accreditation Compliance
COSHH risk assessments are directly relevant to several important UK compliance standards. ISO 45001 requires documented evidence of hazard identification and risk assessment across all work activities, which includes chemical and biological substance exposure. ISO 14001 requires businesses to identify and manage their environmental aspects, and many hazardous substances also present environmental risks that must be assessed alongside health risks.
For CHAS, SafeContractor, Constructionline, and CQMS accreditation, assessors expect to see COSHH risk assessments relevant to the actual work activities of the business. Generic or clearly outdated assessments are one of the most common reasons accreditation applications receive queries or are delayed.
How BizGrow Holdings Helps UK Businesses with COSHH Compliance
BizGrow Holdings supports UK businesses across construction, security, and facilities management with COSHH compliance as part of their wider health and safety and compliance consultancy service. The team helps businesses identify all relevant hazardous substances, produce task-specific and legally compliant COSHH assessments, and build the training and monitoring records needed to satisfy both legal requirements and accreditation assessors.
BizGrow Holdings also supports businesses with CHAS, SafeContractor, Constructionline, ISO 9001, ISO 14001, ISO 45001, SIA ACS approval, and Cyber Essentials, making them the complete compliance partner for UK businesses that want to get all their compliance needs right under one roof.
Conclusion
A COSHH risk assessment is a fundamental legal requirement for any UK business that uses or produces hazardous substances. Done properly, it protects workers from serious long-term health conditions, satisfies legal obligations, and supports accreditation applications across a wide range of schemes. Done poorly, it exposes businesses to enforcement action, unlimited fines, and reputational damage that can be very difficult to recover from.
With expert support from BizGrow Holdings, UK businesses can produce COSHH risk assessments that genuinely protect their people, satisfy regulators and accreditation assessors, and build a stronger, safer, and more compliant business for the long term.
Frequently Asked Questions
How to conduct a COSHH risk assessment step by step?
Start by identifying all hazardous substances, gathering Safety Data Sheets, and assessing who could be harmed and how. Then evaluate risks, apply the hierarchy of controls, and record your findings clearly. Train workers, monitor exposure where needed, and review the assessment regularly.
How to carry out a COSHH risk assessment properly?
Make sure the assessment is specific to the actual substances and work activities in your business, not a generic template. Involve the workers who use the substances and base the assessment on their real working conditions. Review it after any changes or incidents and keep records up to date.
Can anyone write a COSHH assessment in the UK?
The person writing it must be competent, meaning they have enough knowledge and experience to understand the substances and risks involved. There is no legal requirement for a specific qualification, but complex or high-risk substances may require specialist input. Many businesses use a health and safety consultant to ensure the assessment meets legal standards.
How often should a COSHH risk assessment be reviewed?
COSHH assessments must be reviewed whenever they are no longer valid, including after incidents, changes to substances or processes, or concerning health surveillance results. In practice, annual review is recommended as a minimum for most substances. Higher-risk substances may need more frequent review.
What happens if a business does not have a COSHH assessment?
The HSE can issue improvement or prohibition notices and pursue prosecution with unlimited fines. COSHH failures are among the most commonly identified breaches during HSE inspections. In serious cases involving carcinogens such as silica or asbestos, prosecution can result in custodial sentences.