COSHH risk assessment: what it covers and what it doesn't

A COSHH risk assessment is a structured examination of the hazardous substances used or produced at work and the controls needed to prevent or reduce exposure. The duty sits under regulation 6 of the Control of Substances Hazardous to Health Regulations 2002, usually shortened to COSHH. The regulations apply to almost every UK workplace, but a surprising amount of what people think is covered by COSHH actually sits under separate, sometimes stricter, regulations.

This page covers what COSHH applies to, what it excludes, how the assessment works, and the specific obligations around exposure limits, ventilation and health surveillance that distinguish a competent COSHH assessment from a generic one.

What COSHH covers — and what it doesn't

COSHH covers substances that are hazardous to health. The Approved Code of Practice (ACOP L5, currently in its sixth edition) defines a hazardous substance as anything that can cause harm to people through inhalation, ingestion, skin or eye contact, injection, or skin absorption. That includes:

• Chemicals: cleaning products, solvents, paints, glues, inks, fuels, industrial chemicals.
• Dusts: silica dust from masonry, wood dust, flour dust, dust from cutting or grinding operations.
• Fumes and vapours: welding fume, solvent vapour, fumes from heated processes.
• Mists: spray paint, machine oil mist, agricultural sprays.
• Biological agents: bacteria, viruses, fungi, blood-borne pathogens, legionella (which has its own ACOP — L8 — but sits within the COSHH framework).
• Process-generated substances: anything created by the work itself, including dust from sanding, fume from welding, or by-products of chemical reactions.

What COSHH doesn't cover, despite common confusion:

Asbestos is covered by the Control of Asbestos Regulations 2012, not COSHH. The duties are similar in shape but the asbestos regulations are stricter — licensed work, formal medical surveillance, specific notification requirements.

Lead is covered by the Control of Lead at Work Regulations 2002. These mirror COSHH in structure but include specific biological monitoring (blood lead testing) and removal-from-exposure thresholds.

Ionising radiation is covered by the Ionising Radiations Regulations 2017 and the Justification of Practices Involving Ionising Radiation Regulations 2004. Radiation work has its own framework with employer notification, dose assessment, classified persons and radiation protection advisers.

Substances hazardous solely because of explosive, flammable or oxidising properties sit primarily under the Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR), though there can be COSHH overlap if the same substance also causes health harm.

The practical effect of these exclusions is that a workplace handling asbestos, lead or radiation needs assessments specific to those regulations on top of any other COSHH assessments. A workplace cleaning agent that happens to be flammable still needs a COSHH assessment because the flammability isn't the only hazard.

Identifying hazardous substances

The first step in a COSHH assessment is to identify the substances present. Three sources matter.

Labels and Safety Data Sheets (SDS). Suppliers of hazardous substances have a legal duty to provide an SDS — a structured 16-section document covering identification, hazards, composition, handling, exposure controls, physical properties, stability, toxicology, ecological information, disposal, transport and regulatory information. The SDS is the starting point for any COSHH assessment. The CLP Regulation (Classification, Labelling and Packaging) governs how the hazards are described on labels and in SDSs: pictograms, signal words (Danger/Warning), hazard statements (H-codes) and precautionary statements (P-codes).

The REACH Regulation governs the registration and authorisation of chemicals placed on the UK market. The regulation matters at the assessment stage because it limits which substances can lawfully be supplied and used.

Process-generated substances. Dust from cutting concrete. Welding fume. Vapour from heated solvent. These don't have SDSs because they aren't supplied — they're created by the work. The assessor has to identify them by understanding the process. Silica dust from masonry cutting is the obvious example: it has no SDS but is one of the most damaging occupational health hazards in the UK construction industry.

The HSE publishes COSHH essentials — control guidance sheets for specific tasks across many industries — which are a useful supplement when working out what's actually present in a process.

Routes of exposure

A COSHH assessment has to consider how workers could actually be exposed. Four routes matter.

Inhalation is by far the most common route at work — breathing in dust, fume, vapour, mist or gas. The lungs absorb hazardous substances quickly and over long working lifetimes, which is why most occupational diseases (asbestosis, silicosis, occupational asthma, work-related lung cancer) are respiratory.

Skin and eye contact is the second route. Some substances damage the skin directly (corrosives, irritants); some are absorbed through intact skin (solvents, pesticides, some pharmaceuticals); some sensitise the immune system on repeated contact (epoxy resins, certain metals).

Ingestion is less common but happens — typically through hand-to-mouth transfer when workers eat, drink or smoke without washing first.

Injection is relevant for needlestick injuries in healthcare and high-pressure equipment incidents in industry.

The assessment should specify, for each substance and each task, the realistic exposure routes — not just list every theoretical possibility.

Workplace exposure limits

Many hazardous substances have a Workplace Exposure Limit (WEL) — a maximum concentration in the breathing zone of a worker, averaged over a reference period. The reference is usually an 8-hour time-weighted average for chronic effects, with a separate 15-minute short-term exposure limit for substances with acute effects.

WELs are published in EH40 — the HSE's regularly updated list. The current edition should be consulted directly when carrying out an assessment because limits are periodically revised. An assessment that relies on an out-of-date WEL list isn't suitable and sufficient.

The legal duty under COSHH regulation 7 is to prevent exposure where reasonably practicable, and where that's not practicable, to control exposure adequately. Where a WEL exists, the controls have to keep exposure below the WEL. Where no WEL exists, the duty is to reduce exposure to a level that won't cause harm — judged on the toxicology of the substance.

The hierarchy of control under COSHH

COSHH regulation 7 sets out a control hierarchy similar to the general workplace hierarchy we cover on the five-steps page, but with COSHH-specific elements.

Elimination

Stop using the substance. Switch to a process that doesn't generate it.

Substitution

Use a less hazardous substance instead — water-based instead of solvent-based, granules instead of dust, lower-toxicity alternatives.

Engineering controls

Total enclosure of the process, local exhaust ventilation (LEV) capturing the substance at source, segregation of workers from the contaminated area, automation that removes the worker from the exposure zone.

Procedural and administrative controls

Permit-to-work systems for high-risk tasks, job rotation to limit exposure time, restricted access, decontamination procedures.

Personal protective equipment

Respiratory protective equipment (RPE), gloves, coveralls, eye protection. PPE is the last resort because it depends on the user wearing it correctly throughout the exposure period and on it being suitable for the specific hazard.

Where RPE is used, it must be tight-fitting where appropriate, fit-tested for the individual user (with documented evidence), and accompanied by training in correct use and maintenance.

Local exhaust ventilation and the 14-month rule

Where engineering controls take the form of local exhaust ventilation — a hood, duct and fan capturing contaminated air at the source and discharging it safely outside — COSHH regulation 9 requires a "thorough examination and test" at least every 14 months. The 14-month interval is specific and statutory; many people refer to it informally as "annual" but the legal interval is longer than that.

The examination is carried out by a competent person — typically a P601-qualified LEV specialist — and records the measured airflow at each hood, identifies any deterioration, and recommends remedial action. The records must be kept for at least five years.

The 14-month rule exists because LEV systems silently degrade. Filters clog, ducts develop deposits, fan motors lose efficiency, hood positions drift as equipment moves. A system installed correctly and tested at the start can be substantially less effective two years later without anyone noticing.

Health surveillance

Where COSHH assessment identifies an exposure that could cause an identifiable disease, regulation 11 requires health surveillance. Health surveillance is the structured monitoring of workers' health over time to detect early signs of harm.

The form of surveillance depends on the hazard. Lung function tests for workers exposed to silica or isocyanates. Skin checks for workers handling sensitisers. Audiometry for workers in noise (though this sits under separate regulations). Biological monitoring — measuring substances in blood or urine — for workers exposed to lead, certain pesticides, or other absorption-route substances.

Records of health surveillance must be kept for 40 years from the date of the last entry. This is one of the longest record-retention requirements in UK health and safety law, and it exists because occupational diseases often appear decades after exposure ceases. Asbestos-related disease can present 30 to 50 years after exposure.

The long retention is also a litigation reality: civil claims for occupational disease typically rely on documentary evidence of historical exposure and any health surveillance carried out at the time. Records that have been destroyed before the 40-year point can expose the employer to assumptions in the claimant's favour.

Information, instruction and training

Regulation 12 of COSHH is the often-overlooked third pillar. It requires the employer to provide workers with information, instruction and training on:

• The hazards of the substances they're exposed to.
• The risks identified in the assessment.
• The control measures in place and the worker's role in maintaining them.
• Any workplace exposure limits and the results of any monitoring.
• The collective and individual protection measures, including PPE and how to use it.
• Emergency procedures for spills, releases or exposure.

A COSHH assessment that records excellent controls but isn't communicated to the workers actually doing the work doesn't satisfy regulation 12. The training must be appropriate to the hazards and to the worker's role — generic "COSHH awareness" e-learning rarely satisfies the regulation for high-hazard work.

Records and review

The assessment itself must be recorded where the employer has five or more workers. The record should cover the substances, the workers and others affected, the controls, any monitoring required, any health surveillance required, the emergency arrangements, and the review date.

Review is required when there is reason to suspect the assessment is no longer valid, when significant change has occurred, or when monitoring results suggest the controls aren't working as expected. Significant change includes new substances, modified processes, new equipment, new workers in different roles, changes to workplace layout, or regulatory change such as a revised WEL in EH40.

Where the cluster connects

COSHH overlaps with several other vertical assessments. Legionella risk assessment sits within the COSHH framework as a biological-agent assessment. Pregnancy risk assessment requires specific consideration of chemical, biological and ionising-radiation hazards. Manual handling interacts with COSHH where the load being handled is itself hazardous. RAMS for construction typically includes COSHH content for specific high-hazard tasks.

For workplaces with significant hazardous-substance exposure, in-house competence pays for itself quickly. Formal Risk Assessment Training covers the general assessment method that underpins COSHH; specialised COSHH or occupational hygiene qualifications layer on top for industries where exposure is a material part of the work.

Frequently asked questions

What does COSHH stand for?

Control of Substances Hazardous to Health. The Control of Substances Hazardous to Health Regulations 2002 are the parent legislation, supported by ACOP L5 and a range of substance-specific HSE guidance.

Does COSHH cover asbestos?

No. Asbestos has its own regulations — the Control of Asbestos Regulations 2012 — with stricter duties around licensed work, medical surveillance and notification. Lead is similarly covered by the Control of Lead at Work Regulations 2002, and ionising radiation by the Ionising Radiations Regulations 2017. A workplace handling any of these needs assessments specific to those regulations.

How often does local exhaust ventilation need testing under COSHH?

At least every 14 months. The interval is set in regulation 9 of COSHH and is statutory, not advisory. The test must be carried out by a competent person, and the records must be kept for at least five years.

What is a workplace exposure limit?

A maximum concentration of a hazardous substance in the breathing zone of a worker, averaged over a reference period (usually 8 hours, with a separate 15-minute limit for some substances). WELs are published in EH40 by the HSE and updated periodically. Where a WEL exists, the COSHH controls must keep exposure below it.

Who needs a COSHH assessment?

Every employer whose work could expose workers (or others) to hazardous substances. That includes almost every UK workplace: offices use cleaning products, construction sites generate dust, salons use chemicals, restaurants use cleaning agents and gas. The intensity of the assessment scales with the level of risk, but the duty to carry one out is universal.

How long must health surveillance records be kept?

40 years from the date of the last entry. This is one of the longest record-retention requirements in UK health and safety law, reflecting the very long latency of many occupational diseases.