Chapter 6: Control the risk
6.1 Why are we looking at control before assessment?
In chapter 4 I explained that in the latest version of the five steps to risk assessment (2019) the HSE list steps 2 and 3 as:
- Step 2: Assess the risk
- Step 3: Control the risk
So why am describing Step 3: Control the risk, before Step 2: Assess the risk? Try the next exercise to see why.
Ask yourself:
You think that work at height might be a hazard in a retail environment. You’ve asked someone to draw up a list of specific situations where height is a problem. This is their list:
a) Walking up the stairs to the staff room
b) Standing on a ladder to reach a shelf
c) Using a scaffold tower to change lightbulbs
On a simple low-medium-high scale, how would you assess the risk of each of these tasks? What information do you need to assess the risk?
You might have made a quick decision. Walking up stairs is a daily activity for most of us, so feels low risk, while a ladder seems a bit higher, and using a scaffold tower seems even higher. You might have refused to make a judgement without more information. What information did you want? You probably wanted to know what controls were in place, who would be doing the job, and under what conditions. What condition was the equipment in?
While you will have made an initial “gut reaction” assessment to list the activity as (possibly) a hazard, a full assessment of the risk before you’ve looked at the controls doesn’t make sense.
The HSE explained a consequence of applying controls from good practice and guidance in this excellent piece of research produced in 2003 (R151, HSE 2003) titled ‘Good practice and pitfalls in risk assessment.’
if relevant good practice exists and is adopted for all workplace hazards, explicit evaluations of risk rarely need to be made in relation to day-to-day hazards; in these situations the risk assessment duty can be said to be discharged by the appropriate adoption of relevant good practice.
In other words, if we apply good practice and guidance, in some situation you can skip all the chapters in this book on assessing risk!
6.2 Regulation v Guidance
In some cases prescriptive controls are set in the legislation itself; in other cases, controls are recommended in guidance. Guidance is not mandatory, although it is sometimes treated as such. Approved codes of practice (ACoPs) are especially venerated in this sense, but if you ignore any widely available guidance, and someone is harmed, the onus will be on you to explain what you did that you thought was better than the guidance. In the rest of this chapter, therefore, we will look at examples of controls in both the legislation and the guidance.
Some caution is needed in selecting controls. When someone tells you that something must be done, ask:
Where does it say I must do this? For example, is it directly lifted from legislation, is it guidance from the HSE or other regulator, or is it industry guidance?
Does it apply to your industry? For example, guidelines on how often you check electrical equipment is different in construction compared to an office workplace.
Who is telling you? In particular, I’ve seen manual handling training adverts claiming that ‘under the Manual Handling Regulations, if your workplace requires manual handling activities then it’s essential that everyone receives manual handling training’ and electrical services companies claiming ‘portable appliance testing must be carried out annually.’ Neither claim is true.
6.3 Identify the hazards with controls you must have
For each hazard you have identified in the first step, find out if there are any controls you ought to have in place before you start assessing the risk.
Table 6.1 provides some examples of hazards that must have certain controls in place, regardless of how low you assess the risk to be. The table includes the related legislation, and HSE guidance where applicable. While I’ve given examples of requirements, never rely on second-hand sources for legislation: look up the original.
If a list of legislation bores you, and you’d rather read a story, take a look at the unfortunate case of Wallace v Glasgow City Council (2010).
Note that even here, you have to iterate around the control – assess – control – assess loop. Competence is required by several pieces of legislation, but deciding what combination of skills, knowledge and experience is needed, and how these are to be acquired takes us back to Step 1 – what are the hazards – and through step 2 and 3 – what controls are needed, what competence is needed to apply the controls, what is the risk if the controls are applied effectively?
| Hazard topic | Prescriptive legislation | Example of required controls |
|---|---|---|
| Asbestos | Control of Asbestos Regulations (2012) | Where asbestos is (or could be) present, there must be a written plan to manage the asbestos and to prevent exposure. Jobs involving deliberate work with asbestos have specific prescriptive requirements regarding what has to be notified, who can carry out what types of work, and how it must be done. |
| Harmful substances | Control of Substances Hazardous to Health (2002) | If a substance is supplied with a safety data sheet, you must apply, maintain and monitor the controls specified. If precautions rely on Local Exhaust Ventilation (LEV), the system must be thoroughly examined and tested at least once in 14 months (more often if used for particular processes). |
| Noise | Control of Noise at Work Regulations 2005 | Hearing protection must be provided if average noise exposure is 85 decibels (dB) or more, and this must reduce exposure to less than 87 dB (A-weighted). |
| Machinery, plant and equipment | Provision and Use of Work Equipment Regulations 1998 (PUWER) | You must prevent access to dangerous parts of machinery, and there is a prescribed order in which you must consider the ways to do this. There are requirements for the controls needed, and how these should be labelled and positioned. |
| Pressure systems | Pressure Systems Safety Regulations 2000 | A written scheme of examination must be produced for defined pressure systems (such as chemical reaction vessels). |
| Confined spaces | Confined Spaces Regulations 1997 | A rescue plan must be prepared before anyone enters a confined space. |
| Lifts and lifting equipment | Lifting Operations and Lifting Equipment Regulations 1998 | Machinery and accessories for lifting loads must be clearly marked to indicate their safe working loads. Lifting equipment must be thoroughly examined every 12 months, or every 6 months if for lifting people. |
Table 6.1: Controls that MUST be in place whatever your assessment of risk
6.4 Back around the control - assess loop
Don’t fall into the trap of thinking compliance is sufficient – if you meet the 87 dB (A) noise requirement in the legislation, but it would have been reasonably practicable to reduce the noise further (for example, through design or maintenance) then you need to do that. But you must have the statutory controls in place first. Then you can think about the problems of assessing the risk, which we’ll do in the next few chapters:
Chapter 7a: The theory of risk assessment, probability and numbers
Chapter 7b: What’s wrong with risk assessment (mostly a critique of the use of risk matrices)
Chapter 8: Assessment without a matrix
Chapter 9: Assessment with a better matrix (if you insist!)
Chapter 10: Assessment – test your matrix
You can use the Contact form to send me feedback. If you’d like to receive an email when I add or update a chapter, please subscribe to my ‘book club’
Alternatively, you can go back to the book contents page.