%201.svg)
The short legal answer is that the employer is responsible for ensuring a risk assessment is carried out, and the person who actually does the work has to be "competent". Competence is defined in the Management of Health and Safety at Work Regulations 1999 as having sufficient training, knowledge, experience and other qualities to enable the person to assist the employer properly in carrying out the duty.
That definition is deliberately broad. It doesn't require a specific qualification. It doesn't require a registered profession. What it does require is that the person taking on the assessment has what it takes to do it well — and that the employer can demonstrate they took reasonable steps to verify that.
This page covers what competence means in practice, when an in-house assessor is enough, when an external specialist is required, and the specific competence frameworks for different verticals.
What "competent" actually means
The four elements in the regulatory definition matter individually and in combination.
Skills are the practical abilities required for the assessment — the ability to identify hazards in the relevant work, to evaluate risk levels, to design effective controls, and to document the assessment defensibly.
Knowledge is the technical understanding underlying those skills — knowledge of the relevant regulations, the recognised methodologies, the available control measures, and the typical failure modes in the work being assessed.
Experience is the accumulation of judgement that comes from carrying out similar assessments over time. An assessor who has carried out a hundred construction site assessments has internalised patterns that the textbook can't teach. An assessor doing their first construction site is competent only with appropriate support and supervision.
Other qualities is the catch-all in the regulations. It covers attributes like the authority to act on findings, the credibility to challenge the status quo, the communication skills to engage workers in the assessment, and the integrity to identify hazards that an employer would rather not hear about.
The combination matters. A NEBOSH-qualified consultant new to a specific industry may have the knowledge but not the experience. An experienced site manager may have the skills and experience but not the underlying knowledge of changes to the regulations. Neither is competent alone for the relevant work, and the employer's duty is to verify the combination is right.
A qualification is not the same as competence
This is the single most common misunderstanding in this area. A qualification — IOSH Managing Safely, NEBOSH General Certificate, NEBOSH Diploma — is evidence of underlying knowledge. It is not, in itself, evidence of competence for any specific assessment.
A NEBOSH General Certificate is a strong foundation for general workplace risk assessment in a non-specialist context. It does not on its own qualify the holder to assess a complex chemical manufacturing process, a higher-risk residential building's fire safety, or a major construction project's working at height arrangements.
This works the other way around too. An experienced operator with years of practical knowledge may be competent to assess routine workplace risks in their domain without a formal qualification — although in modern workplaces, the qualification is usually expected for documentation and credibility reasons, even where the underlying competence already exists.
The right way to read qualifications is as evidence of one component (knowledge) of the competence framework. The employer's reasonable steps to verify competence go beyond checking certificates — they include considering the relevance of the qualification to the specific work, the assessor's experience in similar work, and any professional registration that would suggest ongoing development.
Internal versus external assessors
For most UK workplaces, the assessment is carried out internally. A line manager, site supervisor, facilities manager or HR lead — depending on the type of assessment — completes the work with appropriate training and reference materials. The HSE's expectation is that most general workplace risk assessment can be carried out competently by trained internal staff.
External assessors are typically used in five situations.
Where the work is technically complex
Some assessments require specialist knowledge that few employers maintain in-house — process safety in chemical manufacturing, complex water systems in healthcare, structural fire safety in high-rise buildings, hazardous-waste handling.
Where the assessment is contested or high-stakes
Where an assessment is likely to be scrutinised — by inspectors, by the courts, by an insurer, by another regulator — an external specialist's assessment carries weight that an internal one may not.
Where internal capacity is limited
Smaller employers without dedicated H&S resource often engage external consultants to carry out the bulk of their assessment work, with internal staff maintaining the controls and recording day-to-day issues.
Where the assessment requires independence
Some specific assessments — particularly fire risk assessment for higher-risk premises, and legionella for complex commercial systems — benefit from independent professional verification.
Where the worker would be assessing their own work
Self-assessment has obvious limitations. Where a manager is the operator or the decision-maker for an activity, an independent assessor brings the challenge that self-assessment can't.
The decision isn't binary. Many organisations operate a hybrid model — internal assessors for routine work, external specialists for higher-risk activities or periodic deep-dive reviews. The right mix depends on the risk profile of the work, the in-house capability available, and the level of external scrutiny the assessment is likely to face.
Vertical-specific competence
Different categories of risk assessment carry different competence expectations.
Fire risk assessment has the most clearly defined competence framework. BS 8674:2025, published in 2025, is the British Standard for the competence of fire risk assessors. The standard sets out the knowledge, experience and ongoing professional development expected of competent assessors. The National Fire Chiefs Council maintains guidance on competent fire risk assessor selection, including recognised third-party certification schemes. For higher-risk buildings — multi-occupied residential, healthcare premises with sleeping accommodation, large public buildings — engaging an assessor with credible competence credentials isn't optional in practice.
Legionella risk assessment has the Legionella Control Association as the recognised industry body. LCA-accredited members are subject to a code of conduct and a competence framework. Specific qualifications such as City & Guilds 6042 (Legionella Risk Assessment) provide individual evidence of knowledge. For complex commercial water systems — and certainly for healthcare premises — an LCA-accredited assessor is the practical standard.
Asbestos is governed by the Control of Asbestos Regulations 2012 with a specific licensing regime for higher-risk work. Asbestos surveys for management or refurbishment-and-demolition purposes should be carried out by accredited surveyors — UKAS-accredited inspection bodies under BS EN ISO/IEC 17020 are the recognised standard.
COSHH and occupational hygiene competence for complex industrial exposure assessment is usually evidenced by membership of the British Occupational Hygiene Society (BOHS) and qualifications such as the BOHS Diploma. For routine COSHH assessment in less hazardous environments, general H&S qualifications and sector-specific training are usually enough.
DSE and ergonomics competence is generally evidenced by training in DSE assessment methodology, often delivered alongside general H&S training. For more complex ergonomics work — repetitive strain injury, custom workstation design, return-to-work assessment — specialist ergonomists or occupational therapists are usually engaged.
Manual handling competence for general workplace assessment is covered by training and the HSE's published tools (TILE, MAC, RAPP, ART). For complex patient handling in healthcare, qualified manual handling trainers and physiotherapists are usually involved.
Working at height competence depends on the type of equipment and the level of risk. Equipment-specific certification (PASMA for tower scaffolds, IPAF for MEWPs, CISRS for scaffolders) covers the operative level; assessor-level competence usually requires broader H&S qualification combined with sector experience.
Construction RAMS competence is usually evidenced by SMSTS or SSSTS qualifications combined with construction sector experience. For high-value or notifiable projects, the Construction (Design and Management) Regulations 2015 place specific duties on the Principal Contractor that imply professional H&S capability — often delivered through an in-house H&S manager or external consultant.
Relevant qualifications
The qualifications most commonly relevant to risk assessment competence in the UK are:
IOSH Managing Safely is a four-day qualification widely used as the baseline for managers carrying out general workplace risk assessment. It covers the principles, the method and the documentation, without going deep into any specific sector.
NEBOSH General Certificate is a more substantial qualification covering the legal framework, hazard identification across common workplace categories, and risk assessment methodology. It's the standard expected of most in-house H&S advisers.
NEBOSH National Diploma is the higher-level qualification for those moving into specialist H&S practice. It's the typical underpinning for H&S managers in larger organisations.
Chartered membership of IOSH (CMIOSH) is the professional grade for experienced practitioners — combining qualifications, experience and continuing professional development.
Sector-specific qualifications include CIEH for environmental health, BOHS for occupational hygiene, IIRSM for risk management, and a range of vertical-specific awards for fire, legionella, asbestos and others.
Our Risk Assessment Training courses cover the methodological foundation that underpins all of the above, with options for general workplace assessment and for higher-risk vertical applications.
Liability when the assessor is unsuitable
Engaging an external assessor doesn't transfer legal responsibility from the employer. The employer remains the duty-holder under the regulations, and the duty includes taking reasonable steps to verify the assessor's competence.
"Reasonable steps" looks like:
- Checking qualifications relevant to the work.
- Confirming professional registration or membership of a relevant body where one exists.
- Verifying recent and relevant experience for the type of premises or activity.
- Requesting and checking references for similar work.
- Confirming professional indemnity insurance at appropriate cover levels.
- Reviewing a sample assessment by the same author, where possible.
Where an assessment turns out to be inadequate and the employer can't show they took reasonable steps to verify the assessor, the employer's exposure increases. The HSE has been clear in enforcement that engaging the wrong consultant doesn't absolve the duty-holder; it adds the failure-to-verify as a separate factor in any prosecution.
The flip side is that an employer who has taken reasonable steps and engaged a credibly competent assessor is in a defensible position even if the assessor later proves to have been wrong on a specific point. Reasonable steps are what the law requires, not a guarantee of perfect outcomes.
Building in-house competence
For organisations that carry out regular risk assessment work, building in-house competence is usually more cost-effective and produces better assessments than ongoing external engagement.
The case for in-house competence runs along several lines. The in-house assessor knows the work, the workforce and the culture in a way that no external consultant can match. They can revisit and update assessments routinely without commissioning new work. They build long-term knowledge that compounds across cycles. They're available for the day-to-day judgement calls that arise between formal assessment dates.
The case for external specialist input is for the work where in-house capability genuinely doesn't extend — major fire risk assessments, specialised legionella systems, complex industrial exposure work, contested or high-stakes assessments.
For most UK employers, the right model is a strong in-house capability supported by external specialists for specific high-risk or technically demanding assessments. Our Risk Assessment Training is built around developing exactly that in-house capability, with a methodology that translates into defensible practice.
Where this connects in the cluster
The competence question runs through every vertical. The depth and shape of competence required depends on the specific assessment — see the relevant vertical pages for the framework: fire, legionella, working at height, COSHH, manual handling, stress, DSE, pregnancy, young persons, lone working, and working from home. The general method is covered on our introduction to risk assessment and five steps pages.
Frequently asked questions
Can I carry out my own risk assessment?
Yes, where you have the competence for the specific work. For routine workplace risk assessment in less hazardous environments, an appropriately trained manager can typically carry out the assessment in-house. For higher-risk activities and specialist areas, external competent assistance is usually needed.
What qualifications does an assessor need?
There's no specific qualification required by law. The Management of Health and Safety at Work Regulations 1999 require skills, knowledge, experience and other qualities appropriate to the work. Common qualifications underpinning competence include IOSH Managing Safely, NEBOSH General Certificate, NEBOSH Diploma and chartered membership of IOSH, plus sector-specific awards for verticals like fire, legionella and asbestos.
Who is competent for a fire risk assessment?
For simple premises, a manager with appropriate training. For higher-risk premises — multi-occupied residential, healthcare, large public buildings — an external assessor with credible competence credentials, ideally listed on a recognised competence register such as the National Fire Chiefs Council's. BS 8674:2025 sets out the competence framework for fire risk assessors.
Who is competent for a legionella risk assessment?
For typical domestic rental properties, a landlord who has reviewed the HSE guidance can usually carry out their own assessment. For commercial premises, healthcare, multi-let buildings or buildings with cooling towers, an assessor with relevant qualifications (such as City & Guilds 6042) and ideally affiliated with the Legionella Control Association is the practical standard.
Is the employer or the assessor legally liable for an inadequate assessment?
Both can be, depending on the circumstances. The employer remains the duty-holder under the regulations and must take reasonable steps to verify the assessor's competence. An external assessor providing a professional service can also be liable in their own right — through their professional indemnity cover and potentially under the Health and Safety at Work etc. Act for breach of section 3. Engaging an external assessor doesn't transfer the legal duty from the employer.
