Chapter 6: Control the risk
6.1 Why are we looking at control before assessment?
In chapter 4 I explained that in the latest version of the five steps to risk assessment (2019) the HSE list steps 2 and 3 as:
- Step 2: Assess the risk
- Step 3: Control the risk
So why am describing Step 3: Control the risk, before we’ve finished talking about Step 2: Assess the risk? Try the next exercise to see why.
Ask yourself:
You think that work at height might be a hazard in a retail environment. You’ve asked someone to draw up a list of specific situations where height is a problem. This is their list:
a) Walking up the stairs to the staff room
b) Standing on a ladder to reach a shelf
c) Using a scaffold tower to change lightbulbs
On a simple low-medium-high scale, how would you assess the risk of each of these tasks? What information do you need to assess the risk?
You might have made a quick decision. Walking up stairs is a daily activity for most of us, so feels low risk, while a ladder seems a bit higher, and using a scaffold tower seems even higher. You might have refused to make a judgement without more information. What information did you want? You probably wanted to know what controls were in place: who would be doing the job, and under what conditions, and what what equipment? If the scaffold work was better planned and managed, while the ladder work was ad hoc, you might decide the ladder work was higher risk than the job using the scaffold tower.
To assess the hazard, you needed to know about the controls.
In ‘Good practice and pitfalls in risk assessment‘ (R151, HSE 2003) the HSE explains a consequence of applying controls from good practice and guidance:
if relevant good practice exists and is adopted for all workplace hazards, explicit evaluations of risk rarely need to be made in relation to day-to-day hazards; in these situations the risk assessment duty can be said to be discharged by the appropriate adoption of relevant good practice.
In other words, if we apply all the controls suggested by good practice and guidance, in some situations you can skip all the chapters in this book on assessing risk.
6.2 Regulation v Guidance
In some cases prescriptive controls are set in the legislation itself; in other cases, controls are recommended in guidance. Guidance is not mandatory, although it is sometimes treated as such. Approved codes of practice (ACoPs) are especially venerated in this sense, but if you ignore any widely available guidance (whether from the HSE or a relevant industry body you should have known about), and someone is harmed, the onus will be on you to explain what you did that you thought was better than the guidance. In the rest of this chapter, therefore, we will look at examples of controls in both the legislation and the guidance.
Some caution is needed in selecting controls. When someone tells you that something must be done, ask:
Where does it say I must do this? For example, is it directly lifted from legislation, is it guidance from the HSE or other regulator, or is it industry guidance?
Does it apply to your industry? For example, guidelines suggest different frequencies of checks for electrical equipment in construction compared to an office.
Who is telling you? In particular, I’ve seen manual handling training adverts claiming that ‘under the Manual Handling Regulations, if your workplace requires manual handling activities then it’s essential that everyone receives manual handling training’ and electrical services companies claiming ‘portable appliance testing must be carried out annually.’ Neither claim is true.
6.3 Identify hazards with mandatory controls
For each hazard you have identified in the first step, find out if there are any controls you ought to have in place before you start assessing the risk.
Table 6.1 provides some examples of hazards with mandatory controls, regardless of how low you assess the risk to be. The table includes the related legislation, and HSE guidance where applicable. While I’ve given examples of requirements, never rely on second-hand sources for legislation: look up the latest original text.
If you’d rather read a story, take a look at the unfortunate case of Wallace v Glasgow City Council (2010).
You have to iterate the control – assess – control – assess loop. Competence is required by several pieces of legislation, but deciding what combination of skills, knowledge and experience is needed, and how these are to be acquired takes us back to Step 1 – what are the hazards – and through step 2 and 3 – what controls are needed, what competence is needed to apply the controls, what is the risk if the controls are applied effectively?
Table 6.1: Controls that MUST be in place whatever your assessment of risk
| Hazard topic | Prescriptive legislation | Example of required controls |
|---|---|---|
| Asbestos | Control of Asbestos Regulations (2012) L143 | Where asbestos is (or could be) present, there must be a written plan to manage the asbestos and to prevent exposure. Jobs involving deliberate work with asbestos have specific prescriptive requirements regarding what has to be notified, who can carry out what types of work, and how it must be done. |
| Harmful substances | Control of Substances Hazardous to Health (2002) L5 | If a substance is supplied with a safety data sheet, you must apply, maintain and monitor the controls specified. If precautions rely on Local Exhaust Ventilation (LEV), the system must be thoroughly examined and tested at least once in 14 months (more often if used for particular processes). |
| Noise | Control of Noise at Work Regulations 2005 L108 | Hearing protection must be provided if average noise exposure is 85 decibels (dB) or more, and this must reduce exposure to less than 87 dB (A-weighted). |
| Work at height | The Work at Height Regulations INDG 401 | Work at height must not be done if it is reasonably practicable to do the job a different way; where it can’t be avoided it must be planned. Specific requirements for work on fragile roofs, using collective and personal controls to prevent or limit a fall. Inspection of work equipment used in construction where a person could fall 2 metres or more is mandatory. |
| Machinery, plant and equipment | Provision and Use of Work Equipment Regulations 1998 (PUWER) L22 | You must prevent access to dangerous parts of machinery, and there is a prescribed order in which you must consider the ways to do this. There are requirements for the controls needed, and how these should be labelled and positioned. |
| Pressure systems | Pressure Systems Safety Regulations 2000 L122 | A written scheme of examination must be produced for defined pressure systems (such as chemical reaction vessels). |
| Confined spaces | Confined Spaces Regulations 1997 L101 | Don’t allow someone to work in a confined space if there is a reasonably practicable way of doing the job without entering. A rescue plan must be prepared before anyone enters a confined space. Resuscitation equipment must be available and maintained if is likely to be needed. |
| Lifts and lifting equipment | Lifting Operations and Lifting Equipment Regulations 1998 (LOLER) L113 | Machinery and accessories for lifting loads must be clearly marked to indicate their safe working loads. Lifting equipment must be thoroughly examined every 12 months, or every 6 months if for lifting people. |
6.4 Link controls to hazards
RR151 points out another common failure in risk assessments – failing to link controls to hazards. An example is given of a generic risk assessment with long lists of hazards, and lists of control measures, but without any links that helped workers to prioritise which controls were needed for a specific situation. An accident in a bus depot in 2019 was a reminder of this problem of overly generic risk assessments, which lack guidance on how to identify for a given situation which hazards exist, and which controls are therefore needed.
If you have identified a hazard, you must be able to show you have considered the controls. The HSE will not prosecute for getting the wrong number in an assessment grid, but they will prosecute if you identified a hazard and did not ensure that all required controls (as in Table 6.1) and all reasonably practicable controls are in place.
6.5 Next steps
Don’t fall into the trap of thinking compliance is sufficient – if you meet the 87 dB (A) noise requirement in the legislation, but it would have been reasonably practicable to reduce the noise further (for example, through design or maintenance) then you need to do that. See Baker v Quantum Clothing (2011).
You must have the statutory controls in place first. Then you can think about the problems of assessing the risk, which we’ll do in the next few chapters:
Chapter 7a: The theory of risk assessment, probability and numbers
Chapter 7b: What’s wrong with risk assessment (mostly a critique of the use of risk matrices)
Chapter 8: Assessment without a matrix
Chapter 9: Assessment with a better matrix (if you insist!)
Chapter 10: Assessment – test your matrix
You can use the Contact form to send me feedback. If you’d like to receive an email when I add or update a chapter, please subscribe to my ‘book club’
Alternatively, go back to the book contents page
Appendix 1: Case studies by year
Appendix 2: Answers to questons posed in each chapter
Appendix 3: Lost HSE references