Article · Risk Assessment · 26 August 2026

What Is a COSHH Risk Assessment? The Substance-by-Substance Method

A COSHH risk assessment is the risk assessment for the chemical: the substance, the exposure, the hierarchy of controls, the score before and after — done per substance, and kept in the register. The COSHH Regulations 2002 put the duty on the employer, the method is the same five-step logic as the general assessment, and the difference is the unit: the substance, not the site. This article is the working method — what to assess, how to score the exposure, and the register that keeps the chemical side honest over the year.

What Is a COSHH Risk Assessment? The Substance-by-Substance Method — HSE article
The bottom line: A COSHH risk assessment is the risk assessment for the chemical: the substance, the exposure (route, group, amount), the controls in hierarchy order, the pre- and post-control scores, and the register line with the review date. Per substance, per area, per group — and the register that is not reviewed is the register that is decoration.

The duty, and the unit of the assessment

The Control of Substances Hazardous to Health Regulations 2002 require the employer to assess the exposure to the hazardous substances at work, and to take the control measures the assessment points to. The assessment is a risk assessment — the same logic as the general one — but the unit is the substance, not the site. One assessment per substance, per area, per group exposed: the solvent in the workshop is a different assessment from the same solvent in the lab, because the exposure and the group are different.

The assessment starts with the data source: the Safety Data Sheet (SDS), the 16-section document the supplier provides, and the label. The SDS tells you what the substance is — the hazards, the physical properties, the first aid, the spill response — and the assessment turns that data into the site document: the exposure at your site, the group exposed, the controls in place, the score, the review date. The COSHH data sheet is the site version of the SDS, and the two are the chemical record.

The register is the portfolio. Every significant substance on the site is a line in the COSHH register: the substance, the CAS number, the area, the main control, the last review, the next review. The register is the document the inspector asks for first, and the health surveillance hangs off it — the substance that is not in the register is the substance that is not assessed.

What the assessment covers: the exposure

The exposure is the heart of the COSHH assessment, and it has three questions. The route: how does the substance reach the person — inhalation (the dust, the mist, the vapour, the fume), skin contact, the eyes, ingestion? The route sets the control: the vapour is the ventilation and the respiratory, the skin is the glove and the washing, the dust is the wet method and the extraction.

The group: who is exposed, and for how long — the operator at the bench, the cleaner who comes through, the maintenance technician who opens the tank? The frequency and the duration set the likelihood: the daily exposure is a different risk from the weekly one, and the group of three is a different exposure from the one.

The amount: the concentration, the volume, the temperature, the state — the 99% solvent is a different exposure from the 10% solution, and the hot process is a different vapour from the cold one. The three questions — the route, the group, the amount — are the exposure, and the exposure is what the score is built from.

The hierarchy of controls, in the chemical order

The controls go in the hierarchy order, and the chemical order is fixed: eliminate the substance where you can — the task is not done, the substance is not used. Substitute — the less hazardous substance, the water-based for the solvent, the paste for the powder. Engineering — the local exhaust, the enclosure, the ventilation, the closed system. Administrative — the procedure, the training, the rotation, the monitoring. PPE — the last line, the glove, the respirator, the suit: the control that fails when it is forgotten.

The order is the point, and the inspector reads it in that order. The assessment that puts the respirator first and the ventilation last has the hierarchy reversed — the last line written first, and the control that fails when it is forgotten written as the first control. The substitution that removes the substance is the control the rest of the hierarchy exists because: the assessment that finds the substitution and does not take it has the duty, and the record, the same.

The pre-control score is what is there now; the post-control score is what the control moves it to. Write both — the residual is what the review reads, and the ALARP argument is the post-control, written down per substance.

Worked example: the paint-thinning task

A paint-thinning task at the bench, assessed per substance, scored before and after.

LineValue
SubstanceAcetone 99% (CAS 67-64-1)
ExposureInhalation of vapour, skin contact; 3 operators, daily, 2 hours
Pre-controlLikelihood 3 × consequence 3 = 9 (Medium)
Controls (hierarchy)Local exhaust at the bench (engineering); procedure + training (administrative); nitrile gloves (PPE, last line)
Post-controlLikelihood 2 × consequence 2 = 4 (Low)
Register lineMain control: local exhaust + gloves; review: 24 months, or on the change

The pre-control 9 is the medium that needs the ALARP argument; the post-control 4 is the residual the review reads. The hierarchy did the work — the exhaust is the engineering control that moved the likelihood, and the gloves are the PPE that is the last line, written last. The register line carries the main control and the review date, and the health surveillance hangs off the line: the skin check, the breathing check, the date. The substance is assessed, the exposure is controlled, and the register is the record.

The register, and the review

The register is the site view of the assessment: one line per significant substance, with the substance, the CAS number, the area, the main control, the last review and the next review. The register is the document that keeps the chemical side honest over the year — the substance that arrives with the new product is the line that is added, and the substance that leaves is the line that is retired, with the date.

The review is per substance, at least every two years, and on the event: the incident, the change to the substance, the change to the process. The review checks the three things — is the exposure still the one assessed (the route, the group, the amount), is the control still in place (the exhaust, still running?), is the residual still acceptable (the post-control, still the case?). The review that finds the control has gone, or the exposure has changed, is the review that starts the re-assessment.

The health surveillance is the line that proves the control worked: the skin check for the dermatitis, the breathing check for the asthma, the date. The surveillance is not the assessment — it is the check on the assessment, the evidence that the exposure the control moved is the exposure the worker is actually in. The assessment, the register and the surveillance are the chemical record, in the three documents the duty needs.

The mistakes that fail the chemical assessment

The COSHH assessment that fails the review fails for a small set of repeatable reasons. The substance not in the register: the product that arrived with the new order, and the register that does not see it — the line that is not written is the substance that is not assessed. The exposure not assessed: the route, the group, the amount — the assessment that names the substance and stops there, without the exposure, is the label, not the assessment.

The hierarchy reversed: the PPE first, the engineering last — the last line written first. The SDS not read: the assessment written from the memory, not the 16 sections — the hazard that the SDS names and the assessment does not. The review not done: the two years pass, and the register that is not reviewed is the register that is decoration. The surveillance not hung off the line: the check that is not tied to the substance is the check that does not prove the control.

The chemical assessment is the substance, the exposure, the hierarchy, the score and the register — per substance, per area, per group. Where the substance is the significant one, the template is the preparation and the competent person is the sign-off: the chemical record, in the documents the duty needs.

Practical use of what is a coshh risk assessment? the substance-by-substance method in the workplace

Need the sign-off, not just the article?

The article is the preparation; the sign-off is the professional. For the statutory assessments, the audits, the ISO 45001 implementation and the training that comes with them, ask Muhammad Umer — 8+ years across Iraq, KSA and Pakistan, and the programme runs through umer-hse.pro. One message gets the written scope.

Common questions

What Is a COSHH Risk Assessment? The Substance-by-Substance Method — answered

What is a COSHH risk assessment?

The risk assessment for the hazardous substances at work, done per substance: the exposure (the route, the group, the amount), the controls in hierarchy order from elimination to PPE, and the pre- and post-control scores. It is the chemical version of the general risk assessment, required by the COSHH Regulations 2002.

Who needs to do a COSHH assessment?

The employer, or a competent person they appoint, where people are exposed to hazardous substances at work. The duty is on the employer under the COSHH Regulations 2002 in the UK, and the OSHA HazCom 2012 standard carries the US equivalent.

What is the difference between a COSHH assessment and a general risk assessment?

The unit. The general risk assessment is per site or per area; the COSHH assessment is per substance, per area, per group exposed. The same five-step logic, the same matrix — but the chemical side is done substance by substance, and the register is the portfolio of the significant substances.

How often should a COSHH assessment be reviewed?

At least every two years per substance, and on the event: the incident, the change to the substance, the change to the process. The register carries the last and next review date per line, and the review that finds the control has gone starts the re-assessment.

What is the hierarchy of controls in COSHH?

Eliminate the substance, substitute the less hazardous one, engineer (the ventilation, the enclosure), manage (the procedure, the training), and PPE as the last line. The order is fixed, and the inspector reads it in that order — the PPE first is the hierarchy reversed.

What is a COSHH register?

The site portfolio of the significant hazardous substances: one line per substance, with the substance, the CAS number, the area, the main control, the last review and the next review. It is the document the inspector asks for first, and the health surveillance hangs off it.

Safety disclaimer

The articles on this blog are practical guidance, built to the UK baseline with the US equivalents named in the text. They do not replace a competent person assessment for high-risk work, a statutory assessment, or the advice of your insurer. Where a duty has legal force — the fire risk assessment, the risk assessment, the COSHH register — the responsible person owns it. Read the article as the preparation, and take the sign-off from the competent person.