COSHH assessment: the five steps, and the checks that keep it true

01

What a COSHH assessment is, and the law behind it

COSHH stands for Control of Substances Hazardous to Health, from the Control of Substances Hazardous to Health (COSHH) Regulations 2002, which apply in England, Scotland and Wales. Northern Ireland has its own Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003, enforced by the Health and Safety Executive for Northern Ireland and, in premises such as offices, shops and hotels, by the district councils. The assessment itself is required by regulation 6 of the COSHH Regulations, which says an employer "shall not carry out work which is liable to expose any employees to any substance hazardous to health" unless it has made "a suitable and sufficient assessment of the risk created by that work to the health of those employees" and of the steps needed to meet the Regulations, and has put those steps in place.

Three parts of regulation 6 shape the document most people mean when they say "COSHH assessment":

• What it must consider (regulation 6(2)): among other things, the substance's hazardous properties and the supplier's health information, the level, type and duration of exposure, the circumstances of the work, any workplace exposure limit and the effect of the controls.
• When it must be reviewed (regulation 6(3)): "regularly and forthwith" if there is reason to suspect it is no longer valid, if the work has changed significantly, or if exposure monitoring shows a review is needed.
• What must be written down (regulation 6(4)): where the employer has five or more employees, the significant findings of the assessment, recorded as soon as is practicable, and the steps taken to prevent or control exposure under regulation 7.

A "substance hazardous to health" is defined in regulation 2. It includes anything classified as hazardous to health under the CLP Regulation, anything with a workplace exposure limit, biological agents, significant concentrations of dust, and anything else that creates a risk to health by the way it is used. HSE's page What is a substance hazardous to health? lists chemicals, products containing chemicals, fumes, dusts, vapours, mists, gases and biological agents (germs), and says COSHH does not cover lead, asbestos or radioactive substances, which have their own regulations.

The Health and Safety Executive explains how to comply in the free Approved Code of Practice Control of substances hazardous to health (L5, sixth edition, 2013), which gives practical advice on compliance. The Code has special legal status: an employer prosecuted for a breach who did not follow it must show they complied in some other way.

02

What a COSHH assessment covers in practice

L5 says the assessment should take into account the substances that are brought in and used, those produced by the work or by an accident, those "used for, or arising from, maintenance, cleaning and repair work", wastes and residues, and substances produced by another employer's people working nearby. In a cleaning operation that usually means:

• The products themselves: HSE's information sheet Safe use of cleaning substances in the hospitality industry (CAIS22) lists washing-up liquids, dishwasher detergents and rinse aids, drain cleaners, oven cleaners, disinfectants, toilet cleaners, bleach, sanitisers and descalers. Floor strippers, polishes and carpet shampoos belong on the same list.
• Concentrates and dilution: the moment of greatest exposure is often filling a spray bottle or a mop bucket from a concentrate, not the cleaning itself.
• Mixing and reactions: CAIS22 warns that products containing bleach mixed with acidic toilet cleaners or ammonia give off harmful gases.
• Wet work: HSE's COSHH and cleaners – key messages says that having hands wet for a long time, or frequently wet during the day, can irritate the skin and lead to dermatitis, that some ingredients can cause skin allergies and asthma, and that some products are corrosive. HSE's brief guide to COSHH adds that wet work in cleaning can cause dermatitis, and that some diseases take years to develop.
• Biological agents: cleaning up bodily fluids and heavily soiled washrooms can expose staff to germs, which COSHH covers as well as chemicals.
• Storage and spills: the chemical store, the cleaners' cupboard and a split container.

The assessment is also about people. L5 names office staff, night cleaners and security guards among the groups who could be exposed, and asks for particular care for those at greater risk, such as inexperienced trainees, young people under 18, pregnant workers, disabled workers and anyone known to be susceptible to dermatitis or asthma.

03

The five steps of a COSHH risk assessment

The five steps commonly quoted for a COSHH assessment are HSE's general steps for managing risk, set out in Risk assessment: steps needed to manage risk, applied to hazardous substances. HSE's own page How to carry out a COSHH risk assessment follows the same order.

1. Identify the hazards. List the substances in use and produced, and read the product labels and safety data sheets. HSE says to think about processes that give off dust, fume, vapour, mist or gas, and skin contact with liquids, pastes and dusts.
2. Assess the risks: who might be harmed, and how. Consider how people could be exposed (breathing it in, skin contact, swallowing, splashes to the eyes), how often and for how long, and anyone else who could be exposed, including maintenance workers, contractors, visitors and members of the public.
3. Control the risks. Regulation 7 requires exposure to be prevented or, where that is not reasonably practicable, adequately controlled. Prevention comes first, by preference through substituting a safer product. Then come work processes and engineering controls, control at source including ventilation, and personal protective equipment only where adequate control cannot be achieved by other means.
4. Record your findings. With five or more employees, write down the significant findings and the steps taken. HSE adds that even with fewer than five it makes sense to write down what you have done.
5. Review the controls. Check that the controls are working, and review the assessment when something changes: new staff, a new process, a new product, a problem spotted by the workers, or an accident or near miss.

Between the third and fourth steps sits a duty that is easy to miss. Regulation 12 requires information, instruction and training for everyone exposed, including the significant findings of the assessment, access to the safety data sheets and the precautions to take. An assessment in a file the cleaning team has never seen does not meet it.

L5 says the record should be proportionate to the risk. For substances posing little or no risk, such as many found in small quantities in offices, it may be enough to record the substances, the controls and a statement that no further detailed assessment is needed, and low-risk substances can share one record. Work that presents more of a risk needs a fuller one.

04

A COSHH assessment for cleaning products

HSE's COSHH essentials sets out basic advice on controlling exposure, and its service and retail sheets describe good control practice for common cleaning tasks: SR2 Diluting chemical concentrates, SR4 Manual cleaning and disinfecting surfaces and SR24 Storing chemical products (small scale). HSE says that following all the points in a sheet, or using equally effective measures, achieves adequate control. Between them they give the controls a cleaning assessment usually records:

• Choose the product first. Stop using products that are not needed and ask the supplier whether a safer alternative exists (CAIS22). SR2 and SR4 advise avoiding products containing hydrofluoric acid, and avoiding biocides classed as toxic or sensitising unless the cleaning programme truly requires them.
• Dilute safely. Add the concentrate to the water, never the other way round unless the instructions say so; make up solutions for immediate use only; never decant a concentrate into an unlabelled container; and never add another chemical to a concentrate containing bleach, because it can give off chlorine gas (SR2).
• Label and decant properly. Keep products in their original containers where possible, and never put a cleaning product in a food or drink container (CAIS22).
• Store safely. Keep only the amount you need, in a cool, dry, dark, ventilated place that can hold a spill; keep acids and alkalis apart; store labels facing forwards and corrosive products on lower shelves; restrict access to trained people; and keep a spill kit and an in-date eyewash nearby (SR24).
• Protect skin and eyes. Provide protective gloves (SR4 says single-use nitrile gloves are acceptable), goggles and waterproof slip-resistant footwear, with warm water, mild skin cleansers and after-work creams, which are not a substitute for gloves. With good general ventilation, respiratory protection is not normally needed.
• Watch for ill health. SR4 says employers are required to carry out health surveillance if workers use a product labelled "May cause sensitisation by skin contact" or "May cause sensitisation by inhalation", and to provide surveillance for dermatitis or asthma where either is reasonably likely. HSE's cleaning page on work-related contact dermatitis asks workers to check their hands for itchy, dry or red skin and report it to a supervisor.

Contract cleaning adds a second employer. L5 says the two should co-operate so that every COSHH duty is met: the occupier tells the contractor about substances used or produced in the building, and the contractor tells the occupier what it brings in, as regulation 11 of the Management of Health and Safety at Work Regulations 1999 requires of employers sharing a workplace. The cleaning company assesses its own work and products; the client makes sure its own chemicals, in a laboratory, workshop or pool plant, are known to the cleaners.

05

The COSHH register, who does the assessment, and keeping it alive

The Regulations do not use the words "COSHH register", but most organisations keep one: a list of every hazardous substance on site with what it is used for, where it is stored, its hazard and its safety data sheet. CAIS22 tells employers to list all the hazardous substances used and, for each, to record a description of its use and the type of hazard, and L5 accepts a record that is kept electronically, so long as it is readily accessible for reviews and for a safety representative or an inspector. A register is the backbone of the assessment, not a substitute for it: it says what is on the shelf, and the assessment says how people use it safely.

Whoever carries out the assessment must be competent. L5 says they should know how the work uses or creates hazardous substances, have the knowledge, skills, training and experience to judge the risk and the controls, and have the authority to gather the information needed. For a cleaning contract that is often the contract manager or a health and safety adviser, working with the site supervisor, who knows which products are actually used; HSE suggests professional advice, such as an occupational hygienist's, where you are not sure. Employees and their safety representatives must be consulted on measures that affect their health.

Controls drift. L5 says their effectiveness should be checked regularly, and that controls relying on routine human behaviour are less reliable than engineering controls such as extraction. In cleaning, almost every control relies on behaviour. Routine checks that keep the assessment true include:

• the chemical store: lids on, labels intact and facing forwards, acids and alkalis apart, nothing in an unlabelled bottle, the spill kit complete;
• the eyewash: in date and replenished;
• personal protective equipment: gloves and goggles in stock, stored properly and replaced when damaged, which regulation 9 requires to be checked at suitable intervals;
• the dilution point: working, not leaking, and set to the product's instructions;
• the safety data sheets: current, and kept where staff can find them;
• the people: new starters trained before they use a product, and sore hands reported and followed up.

Regulation 9 also requires a record of the statutory examinations and tests of engineering controls, such as local exhaust ventilation tested at least every 14 months, kept for at least five years. Where health surveillance is needed, regulation 11 requires a health record for each employee under surveillance, kept for at least 40 years. Training records are not required by COSHH, but L5 says employers may find them helpful.

06

Where the record fails, and what SiteClara does about it

Most COSHH failures in cleaning are not failures of the assessment, which is in the file, signed and dated. What fails is the routine it relies on: the cupboard that has collected unlabelled spray bottles, the eyewash that ran out in spring, the new starter on nights never shown the dilution chart. Nobody notices until a splash, a rash or an inspection, and then nobody can show when the store was last checked or by whom.

SiteClara records those routine checks where they happen. A printed QR poster, with an NFC tag behind it if staff prefer to tap, sits at each place a check is scheduled: the chemical store, the dilution point, the cleaners' cupboard on each floor. Staff scan or tap with their own phone, with no app to install, and see the checks due there. They mark each one done or explain what stopped them, with a photo when one is asked for, such as the store shelf or the eyewash date. The time and the named person are recorded as it happens. A problem found on a check, such as a leaking container or an empty spill kit, is reported there and goes onto the team's list of jobs until someone closes it.

The supervisor sees which checks are due, done and missed, and records the reason one was missed. Each day they approve a report that goes to nominated management or client contacts the next morning, showing what was completed, what was reported and what is still open: a working record made at the time, rather than a sheet filled in before the audit.

07

Questions people ask

What is a COSHH assessment for?

The Approved Code of Practice L5, Control of substances hazardous to health says its purpose is "to enable employers to make valid decisions about the measures needed to prevent or adequately control the exposure of their employees to substances hazardous to health arising from the work". HSE's page How to carry out a COSHH risk assessment says it "concentrates on the hazards and risks from hazardous substances in your workplace".

Can anyone do a COSHH assessment?

No. L5, Control of substances hazardous to health says employers must ensure that whoever carries out the assessment is competent to do so, under regulation 7 of the Management of Health and Safety at Work Regulations 1999 and regulation 12(4) of COSHH. The competent person should know how the work uses or creates hazardous substances, have the knowledge, skills, training and experience to judge the level of risk and the control measures needed, and have the employer's authority to gather the information. The duty to make the assessment stays with the employer under regulation 6 of the COSHH Regulations.

What substances does COSHH cover?

HSE's page What is a substance hazardous to health? lists chemicals, products containing chemicals, fumes, dusts, vapours, mists, nanotechnology, gases and asphyxiating gases, and biological agents (germs), including germs that cause diseases such as leptospirosis or legionnaires' disease. COSHH does not cover lead, asbestos or radioactive substances, which have their own regulations.

What is a COSHH register?

It is a list of the hazardous substances on site; the Regulations do not use the name and prescribe no template. HSE's information sheet Safe use of cleaning substances in the hospitality industry (CAIS22) tells employers to list all the hazardous substances used and, for each, to record a description of its use, such as oven cleaner, and of the type of hazard it represents, such as irritant, corrosive or toxic, from the safety data sheet or label. Most registers also give each product's storage location and its safety data sheet, and a register maintained this way sits alongside the COSHH assessments, which set out the control measures for each use.

08

Further reading, and a list to take away

The Health and Safety Executive publishes L5, the short leaflet Working with substances hazardous to health: a brief guide to COSHH (INDG136), the COSHH essentials sheets and its cleaning industry pages, all free. The Regulations are on legislation.gov.uk.

For a COSHH assessment that holds up, check that:

• every hazardous substance on site is listed, with its use, its hazard, where it is kept and a current safety data sheet;
• the assessment covers how each product is actually used, including dilution, wet work and spills, and who could be exposed;
• safer products were considered before gloves and goggles;
• the significant findings are written down if you employ five or more people, and the cleaning team has been told what they say;
• contractors and clients have exchanged information about the substances each brings or uses;
• the store, eyewash, spill kit and protective equipment are checked on a schedule, and a missed check is recorded with a reason;
• health surveillance is in place where a product is labelled as a sensitiser or dermatitis or asthma is reasonably likely;
• the assessment has a review date, and is reviewed sooner when a product, process or person changes.