What a COSHH assessment actually has to contain

Start from the job, not the bottle

The single most common structural mistake is one assessment per chemical. It produces a folder that grows forever, says nothing about how the work is actually done, and leaves the genuinely risky steps — a transfer, a sonication, a spill during a weigh-out — described nowhere.

Assess the task. Name the activity, who does it, how often, for how long, and where. Then list every hazardous substance the task involves, including the ones nobody thinks of as substances: the dust from a powder, the fume from a heated reaction, the aerosol from a centrifuge, the waste at the end.

Identify the hazard properly — from the supplier's sheet

The supplier's safety data sheet is the authoritative hazard source, and section 2 of it (classification, hazard statements, pictograms, signal word) is the part the assessment needs. A public database is a useful cross-check and a good way to fill gaps quickly, but the sheet that came with the container you actually hold is what governs.

Record the hazard statements rather than a summary of them. "Toxic" is not an assessment; H331 with a route of exposure is the start of one, because it tells you which control you need.

• The hazard classification and statements for each substance in the task.
• The route that matters here — inhalation, skin, eyes, ingestion, injection.
• Anything generated by the work that isn't in a bottle: fume, dust, aerosol, waste.
• Whether anyone exposed is in a group needing extra thought — new or expectant mothers, young workers, anyone with a relevant sensitisation.

Prevent first, then control — in that order

COSHH asks you to prevent exposure where it is reasonably practicable, and only to control it where prevention isn't. That ordering is not decoration: an assessment that jumps straight to "wear gloves" without asking whether a less hazardous substance, a smaller scale or a closed system would do the job has skipped the step the regulations put first.

Where control is the answer, the order runs from engineering controls that protect everyone (containment, local exhaust ventilation, a cabinet) through ways of working that reduce exposure, and only then to personal protective equipment. PPE last is not a slogan — it is the only control that fails silently, on one person, without anyone noticing.

• Can the substance be eliminated, substituted, or used at a smaller scale?
• Can the process be enclosed, or the emission captured at source?
• What ways of working reduce exposure — batch size, order of operations, time limits?
• What PPE is required, and is it specified precisely enough to buy the right thing?

Specify PPE by what it must resist, not just by name. "Gloves" is not a control; a stated glove material with a breakthrough expectation for the substance in use is.

Say how the controls are kept working

A control measure that isn't maintained isn't a control measure. The assessment should name what has to be checked, by whom, and how often — the airflow on a cabinet, the face velocity on a fume cupboard, the seal on a rotor, the stock of a spill kit.

Engineered ventilation carries its own examination and testing duty at intervals set by the regulations, and those records are exactly what an inspector asks for. If your assessment references a cabinet, the assessment and the cabinet's service record should be one click apart, not in two different filing systems.

Cover the day it goes wrong

COSHH expects arrangements for accidents, incidents and emergencies where the work warrants them. In practice that means the assessment says what a foreseeable failure looks like — a spill of this size, a splash, a broken container — and what the lab does about it, using its own approved wording.

This is also where the assessment and the incident register meet. When something does happen, the investigation should be able to point back at the assessment that covered the task and ask the honest question: did we assess this correctly, and does the assessment need to change?

Name the training, and record that it happened

Everyone doing the task needs to know the hazards, the controls, and what to do if it goes wrong. An assessment that specifies training is only half done — the other half is a record that a named person received it, on a date, and that any refresher is still in date.

Tying the two together is what turns a folder of forms into something that can answer a question. "Who is currently signed off to do this?" should be answerable in seconds, not reconstructed from memory.

Review it when it stops being true

An assessment has to be kept up to date: reviewed when it is no longer valid, or when there has been a significant change in the work. A fixed annual date is a sensible backstop, but it is a backstop — the real triggers are a change of reagent, a change of scale, a new instrument, a new room, a new person, or an incident.

Practically, that means the review date needs to be visible, and the assessment needs to be filed somewhere that surfaces it. An assessment that expired eleven months ago and nobody noticed is the most common finding of the audits that go badly.

Where the written assessment ends

The last gap is the one no document closes. An assessment describes the job as it was imagined; the bench in front of you today may not match. A short point-of-work check — is the assessment still accurate, are the controls actually working, is the right PPE here, do I know what to do if it goes wrong — is what catches the difference, and it takes two minutes.