Who Can Carry Out a Risk Assessment? 8 Answers
This question is asked constantly, and the answer surprises people: in Great Britain, there is no licence, no register, and no qualification legally required to write a risk assessment.
That does not mean anybody should. The law asks a different question, and it is a harder one to answer than "do they have a certificate?"
Eight answers.
1. There is no licence or register
Nothing in British health and safety law creates a protected role for risk assessment, or a qualification you must hold.
That is unusual internationally, and it is deliberate. The British approach sets outcomes and leaves the employer to decide how to achieve them, which includes deciding who is capable of doing the work.
It also means anyone claiming a legal monopoly on risk assessment is overstating the position.
2. The duty belongs to the employer, whoever writes the document
The point that resolves most confusion about outsourcing.
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires the employer to make a suitable and sufficient assessment. You may have somebody else carry it out, and the duty stays with you.
The practical consequence: an assessment produced by a consultant that you have never read, do not act on and cannot explain has not discharged your duty. The document is not the compliance; the arrangements are.
3. What the law actually requires: a competent person
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
Regulation 7 requires the employer to appoint one or more competent persons to assist in undertaking the measures needed to comply with statutory duties.
The regulation treats a person as competent where they have sufficient training and experience or knowledge and other qualities to assist properly. Note the breadth: training or experience or knowledge, plus other qualities. It is not a qualification test.
Regulation 7 also prefers, where there is a choice, appointing somebody from among your own employees over an external appointment. That is a preference rather than a requirement, and it reflects the fact that people inside the organisation know the work.
4. What competence actually means in practice
Three components, and the third is the one that matters most.
Knowing the work. What is actually done, how, by whom, and where the shortcuts happen. This is why the person doing the job is often the most valuable contributor to an assessment.
Knowing the hazards and the law. What could cause harm, what controls exist, and what the relevant requirements are.
Knowing the limits of your own competence. A competent person recognises when something is beyond them and says so. HSE's guidance on competence treats this as central, and it is the difference between a competent generalist and somebody out of their depth.
5. When you can reasonably do your own
For a great many organisations, the answer is yes.
A single office, modern building, straightforward activities, no laboratory or workshop, and somebody internally who understands the work and has had reasonable training can produce a perfectly good general risk assessment. HSE's risk assessment guidance is written with that in mind.
Doing it yourself has a real advantage: involvement. An assessment written with the people who do the work is usually more accurate than one produced by a visitor in an afternoon.
6. When you should not
Five situations where internal capability usually runs out.
Specialist subject matter. Asbestos, legionella, fire in a complex building, hazardous substances beyond ordinary cleaning products, or anything in a laboratory or workshop.
Complex or unusual buildings. Period and listed premises, multi-tenant buildings, basements, sleeping accommodation, or buildings with suppression systems.
Organisational risks. Workload, hours, on-call, lone working and psychosocial risk are genuinely harder to assess objectively from inside, because the person assessing is usually subject to the same pressures.
Where independence matters. After an incident, before an audit, or where a board needs assurance it did not receive through the management line.
Overseas entities. Covered below.
7. Fire is now different
The exception to the general position, and it is recent.
Section 156 of the Building Safety Act 2022 amended the Fire Safety Order so that responsible persons must record the identity of any individual or organisation engaged to undertake or review the fire risk assessment. It also introduced a provision that where a responsible person appoints somebody to make or review the assessment, that person must be competent, with commentary at the time indicating that this particular provision would commence later than the October 2023 changes.
So for fire, you must now record who did it, and the direction of travel on competence is clear. Confirm the current commencement position, and in the meantime be able to evidence the competence of whoever produced your fire risk assessment.
Asbestos is another area with its own expectations: regulation 4 of the Control of Asbestos Regulations 2012 imposes the duty to manage, and surveys are specialist work.
8. Record who did it, and what they knew
Good practice regardless of the legal minimum.
Record the assessor's name, their relevant training or experience, the date, and what they looked at. Where an external firm did it, record the individual as well as the company.
Two reasons. It demonstrates that the appointment under regulation 7 was considered rather than assumed. And where an assessment is questioned later, the first question is usually who produced it and on what basis.
The eight, in short
| Question | Answer |
|---|---|
| Is a licence required | No, in Great Britain |
| Whose duty is it | The employer's, whoever writes it |
| What the law requires | A competent person under regulation 7 |
| What competence means | The work, the hazards, and knowing your limits |
| Can you do your own | Often yes, for a straightforward office |
| When not to | Specialist topics, complex buildings, organisational risk, independence, overseas |
| Fire | Record who did it; competence provision to confirm |
| Records | Name, basis, date, scope |
Row four is the practical test. Somebody who knows what they do not know is more useful than somebody with a certificate and no sense of the boundary.
For international groups
The British position is the outlier, and assuming it applies abroad is a common and expensive error.
Several jurisdictions covered in this series prescribe who may produce a risk assessment. Hungary reserves it to prescribed qualifications. Greece expects the appointed safety technician to author it. Lithuania requires specialists to hold higher education and pass a state examination. Latvia certifies competent specialists and requires them to carry professional liability insurance. Croatia, Slovenia and North Macedonia license the firms providing the service. Kenya requires an approved advisor whose report goes to the regulator.
In those countries an assessment produced by a capable group manager does not satisfy the requirement, however good it is.
Holding one methodology while each entity's assessment is produced by somebody entitled to produce it is where health and safety consultants and software are worth more together than either alone, and periodic health and safety audits establish whether what you hold would satisfy the local requirement.
Where Arinite fits
Arinite is straightforward about this: many organisations can and should do their own general risk assessments, and our value is in the areas where that runs out. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years.
Our health and safety consultants work extensively with legal, finance and banking and IT and software organisations, and our fire risk assessment and asbestos work covers the specialist areas most internal teams do not attempt.
Where entities sit in several countries, our global health and safety consultants coordinate practitioners entitled to produce the assessment locally, and our international health and safety consultants keep that current.
If you are unsure whether your internal assessment would stand up, a free gap analysis will tell you which parts are fine and which are not.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
