BOSH SO2 cheat sheet

Hierarchy of legal sources in the UK: statute (e.g. Health and Safety at Work etc. Act 1974) > regulations made under statute > approved codes of practice (special evidential status) > guidance (no evidential weight).

HSWA 1974 s.2 general duty: employer must ensure, so far as is reasonably practicable (SFAIRP), the health, safety and welfare of employees; s.3 extends the duty to non-employees affected by the undertaking.

SFAIRP test: risk must be weighed against the sacrifice (time, trouble, cost) needed to avert it; gross disproportion is required before cost justifies tolerating the risk (Edwards v National Coal Board).

s.7 employee duties: take reasonable care of self and others; cooperate with the employer to enable compliance. s.8: no intentional or reckless interference with safety provisions.

s.37 corporate liability where an offence is committed with the consent, connivance or neglect of a director, manager, secretary or similar officer; the individual may also be prosecuted.

Regulatory bodies: HSE enforces in most sectors; local authorities enforce in retail, offices, leisure and hospitality. Enforcement options include improvement notices, prohibition notices and prosecution.

Sentencing Guideline (health and safety offences) sets fines by culpability (negligible, low, medium, high, very high) and by turnover-based harm categories; very high culpability offences can reach seven-figure fines.

Duty to consult: Safety Representatives and Safety Committees Regulations 1977 (recognised trade unions) and Health and Safety (Consultation with Employees) Regulations 1996 (non-unionised workforce).

Criminal law requires proof beyond reasonable doubt and imposes fines and imprisonment; civil claims for negligence require proof on the balance of probabilities and may be defended by contributory negligence.

ISO 45001 uses Plan-Do-Check-Act and requires context of the organisation, leadership and worker participation, planning, support, operation, performance evaluation and improvement.

Key ISO 45001 clauses: 5.4 consultation and participation of workers; 6.1.2 hazard identification and assessment of risks and opportunities; 8.1.2 eliminating hazards and reducing risks; 10.2 incident, nonconformity and corrective action.

ISO 45001 replaced OHSAS 18001; organisations certified to OHSAS 18001 had a three-year migration window ending 12 March 2021.

A documented policy must include the organisation's commitment to provide safe and healthy working conditions, to satisfy legal requirements and to continual improvement, and must be communicated and available.

Organisational roles, responsibilities and authorities must be assigned and communicated at all levels; top management retains accountability for the OH&S management system.

Management review inputs include audit results, incident data, worker consultation, legal compliance evaluation, objectives status and changing circumstances; outputs drive change and resourcing decisions.

Contractor and outsourced processes remain within the scope of the OH&S management system; the organisation must ensure outsourced functions and processes are controlled.

Legal compliance evaluation (compliance obligations) must be conducted at planned intervals and records retained; ISO 45001 clause 9.1.2.

Five steps: identify hazards; decide who might be harmed and how; evaluate risks and decide on controls; record significant findings; review and update.

Risk = likelihood x severity of harm. A risk matrix combines these to produce a rating; tolerability is then judged against criteria (e.g. ALARP).

Hierarchy of control (most to least effective): eliminate; substitute; engineering controls; administrative controls; PPE. PPE is the last resort and depends on correct use.

ALARP: risk must be reduced as low as reasonably practicable; the higher the hazard, the more that must be spent to reduce it.

Suitable and sufficient assessment (Management of Health and Safety at Work Regulations 1999 reg.3) must be recorded where five or more employees are employed.

Specific assessments are required for young persons, new and expectant mothers, and for hazardous substances (COSHH), noise, vibration, DSE and manual handling.

Residual risk is the risk remaining after controls; it must be judged acceptable before work proceeds, and communicated to those exposed.

Dynamic assessment: significant changes, new equipment, new processes, incidents or near misses trigger a review; assessments are living documents, not one-off paperwork.

Vulnerable groups (young workers, pregnant workers, disabled workers, lone workers, inexperienced staff) require tailored assessment and additional controls.

Noise: lower exposure action value 80 dB(A) daily / 135 dB(C) peak; upper action value 85 dB(A) / 137 dB(C); exposure limit value 87 dB(A) / 140 dB(C) measured at the ear.

HAVS: vibration exposure action value 2.5 m/s2 A(8); exposure limit value 5 m/s2 A(8).

COSHH hierarchy: eliminate or substitute; engineering controls (LEV, enclosure); safe systems and training; PPE (RPE, gloves). Workplace exposure limits (WELs) are set for airborne substances.

LEV must be thoroughly examined and tested at least every 14 months (or as specified) and records kept; RPE requires face-fit testing and records.

Manual handling: assess TILE (Task, Individual, Load, Environment); avoid, assess, reduce. DSE: assess workstation, breaks and eyesight testing on request.

Biological agents: control by containment, hygiene, vaccination where appropriate, disinfection and safe disposal; classify agents in risk groups 1-4.

Psychosocial: work-related stress managed via the HSE Management Standards (demands, control, support, relationships, role, change); bullying and fatigue are recognised hazards.

Slips, trips and falls account for a large share of reported injuries; controls include floor condition, housekeeping, lighting, footwear and drainage.

RIDDOR (Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013) requires reporting of deaths, specified injuries, over-7-day incapacitation, reportable diseases and dangerous occurrences.

Over-7-day injury: report within 15 days of the incident; over-3-day injury is recorded internally but not reported to the enforcing authority.

Specified injuries include fractures (other than fingers, thumbs, toes), amputation, dislocation, loss of sight, crush injury, burns covering more than 10% of the body and scalping.

Dangerous occurrences are near-miss events with high potential for serious harm (e.g. failure of lifting equipment, collapse of scaffolding); report to the enforcing authority.

Investigation aims to find underlying and root causes, not to apportion blame; use methods such as 5 Whys, fishbone (Ishikawa) or events and causal factors analysis.

Accident ratio: for every serious injury there are many minor injuries and near misses (Heinrich pyramid); near misses are leading indicators with high learning value.

Preserve evidence: scene, equipment, witness statements, CCTV, maintenance records; take statements promptly and separately.

Corrective actions must address root causes, be assigned an owner and due date, and be verified as effective; track to closure.

Emergency plan components: identified credible scenarios, alarm and warning, evacuation routes and assembly points, roles and responsibilities, communication, first aid, and recovery.

Fire: means of escape, fire detection and alarm, fire-fighting equipment, signage, drills and appointed competent persons (fire wardens/marshals).

Emergency drills must be carried out at planned intervals and recorded; results feed back into plan review.

First aid needs assessment determines numbers of first aiders and appointed persons and the first aid equipment required.

Business continuity: identify critical functions, recovery time objectives and alternate arrangements; test the plan.

Spill response: containment, absorbents, PPE, disposal and notification; COSHH assessment should specify emergency arrangements for hazardous substances.

Lone working and remote sites require specific emergency arrangements: check-in systems, communication, and defined response times.

Post-emergency review: debrief, record lessons learned, update the plan and train affected workers.

Reactive monitoring measures outcomes (incidents, near misses, ill health, claims); proactive (leading) monitoring measures activity (inspections, training completion, audit findings closed).

Audit vs inspection: audit is a systematic, independent, documented evaluation of the management system; inspection is a routine check of conditions and behaviours.

Key performance indicators should be SMART and linked to objectives; avoid single-metric targets that encourage under-reporting.

Accident frequency rate = (number of reportable accidents x 1,000,000) / total hours worked.

Accident incidence rate = (number of accidents x 1,000) / average number of workers employed.

Severity rate = (days lost x 1,000) / total hours worked (or per 1,000 workers).

Audit findings should be graded and tracked to closure with owners and due dates; effectiveness of corrective actions must be verified.

Benchmarking against sector data and legal compliance evaluation (ISO 45001 9.1.2) are core monitoring activities.

Health surveillance is required where a residual risk of work-related ill health remains (e.g. noise-induced hearing loss, HAVS, respiratory sensitisers, skin, lead).

Health surveillance is not the same as health screening; it detects early signs of work-related ill health and informs control measures.

Occupational health providers support fitness for work, rehabilitation, and return-to-work programmes; records are confidential medical records.

Mental health: risk factors include high demand, low control, poor support, bullying and long hours; controls include workload management, EAPs, training and early intervention.

Musculoskeletal disorders are a leading cause of sickness absence; controls include ergonomic design, task rotation, manual handling aids and early reporting.

Sickness absence management: return-to-work interviews, phased return, reasonable adjustments for disability (Equality Act 2010).

Wellbeing programmes (e.g. health promotion, fatigue management, shift design) support performance and reduce absence.

Contractor selection: pre-qualification checks include competence, resources, insurance, accident history, method statements and references.

Host and contractor must exchange information about hazards and controls (e.g. permits to work, site rules, emergency arrangements).

Principal contractor duties (CDM 2015): construction phase plan, site induction, coordination of contractors and welfare facilities.

Permit-to-work systems control high-risk activities (hot work, confined space entry, isolation, work at height).

Contractor performance must be monitored (site inspections, audits, incident reporting) and reviewed against agreed KPIs.

Supply chain: due diligence on subcontractors; contractual clauses should require compliance with the host's OH&S requirements and reporting of incidents.

Shared workplaces: clarify who controls what; the host retains duties to non-employees under HSWA s.3.

Environmental management system standard: ISO 14001; uses Plan-Do-Check-Act and requires environmental policy, aspects and impacts, legal compliance and objectives.

Aspects and impacts: identify environmental aspects (activities, products, services) and their impacts (e.g. emissions, waste, water use, energy).

Waste hierarchy (most to least preferred): prevent, reuse, recycle, recover (including energy recovery), dispose.

Duty of care (waste): ensure waste is stored safely, transferred only to authorised persons, accompanied by a waste transfer note, and described accurately.

Environmental permits and pollution prevention: controls on emissions to air, water and land; spill prevention (bunding, secondary containment).

Energy and carbon management: measure, set targets, improve efficiency and report; sustainability links to resource efficiency and cost.

Life-cycle thinking: consider environmental impacts from raw material through use to disposal; supports circular economy approaches.

Environmental incidents (spills, releases) should be investigated and reported similarly to safety incidents; regulatory notification may be required.

HSWA 1974 s.2: employer duty to ensure, so far as is reasonably practicable, the health, safety and welfare of employees.

s.3: duty to non-employees affected by the undertaking; s.4: duty of those in control of premises.

s.7: employee duty to take reasonable care and cooperate; s.8: no intentional or reckless interference.

SFAIRP: cost, time and trouble are weighed against risk; gross disproportion is needed to justify inaction.

Approved codes of practice have special evidential status; guidance does not.

Enforcement: improvement notice, prohibition notice, prosecution; HSE or local authority depending on sector.

Sentencing Guideline: fines set by culpability and turnover-based harm categories.

Consultation: SRSC Regulations 1977 (union reps) and HSCE Regulations 1996 (non-union employees).

Criminal standard: beyond reasonable doubt; civil standard: balance of probabilities.

ISO 45001 follows Plan-Do-Check-Act and requires context, leadership, planning, support, operation, evaluation and improvement.

Clause 5.4 requires consultation and participation of workers.

Clause 6.1.2 requires hazard identification and assessment of risks and opportunities.

Clause 8.1.2 requires eliminating hazards and reducing risks using the hierarchy of control.

Clause 9.1.2 requires evaluation of legal and other compliance obligations at planned intervals.

Clause 10.2 covers incident, nonconformity and corrective action.

Top management retains accountability; roles and authorities must be assigned and communicated.

Outsourced processes and contractors remain within the scope of the OH&S management system.

ISO 45001 replaced OHSAS 18001; migration deadline was 12 March 2021.

Risk = likelihood x severity; matrix ratings support tolerability decisions.

Hierarchy of control: eliminate, substitute, engineering, administrative, PPE.

PPE is the last resort; its effectiveness depends on fit, training and use.

ALARP: reduce risk as low as reasonably practicable; higher hazards justify greater cost.

Record significant findings where five or more employees are employed (MHSWR 1999 reg.3).

Specific assessments: young persons, new and expectant mothers, COSHH, noise, vibration, DSE, manual handling.

Residual risk must be judged acceptable and communicated before work starts.

Review triggers: change, new equipment, incidents, near misses, new information.

Vulnerable groups need tailored assessment and additional controls.

Noise action values: lower 80 dB(A)/135 dB(C); upper 85 dB(A)/137 dB(C); exposure limit 87 dB(A)/140 dB(C).

HAVS action value 2.5 m/s2 A(8); limit value 5 m/s2 A(8).

COSHH: eliminate/substitute, engineering controls, safe systems, PPE; WELs apply to airborne substances.

LEV thorough examination and test at least every 14 months; RPE requires face-fit testing.

Manual handling TILE: Task, Individual, Load, Environment.

Biological agents: containment, hygiene, vaccination, disinfection, safe disposal; risk groups 1-4.

Psychosocial: HSE Management Standards cover demands, control, support, relationships, role, change.

Slips and trips: floor condition, housekeeping, lighting, footwear and drainage are key controls.

RIDDOR 2013: report deaths, specified injuries, over-7-day injuries, reportable diseases and dangerous occurrences.

Over-7-day injury: report within 15 days; over-3-day injury is recorded but not reported.

Specified injuries include fractures (not fingers, thumbs, toes), amputation, loss of sight and burns over 10% of body.

Dangerous occurrences are high-potential near misses and must be reported.

Investigation seeks root causes, not blame; use 5 Whys, fishbone or events and causal factors analysis.

Heinrich pyramid: many near misses and minor injuries per serious injury.

Preserve evidence: scene, equipment, CCTV, maintenance records, witness statements.

Corrective actions need owner, due date and verification of effectiveness.

Emergency plan: scenarios, alarm, evacuation routes, assembly points, roles, communication, first aid, recovery.

Fire: escape routes, detection and alarm, extinguishers, signage, drills, fire wardens.

Drills at planned intervals with records; results feed plan review.

First aid needs assessment sets numbers of first aiders and equipment.

Business continuity: critical functions, recovery time objectives, alternate arrangements, testing.

Spill response: containment, absorbents, PPE, disposal, notification; specified in COSHH assessment.

Lone and remote workers: check-in systems, communication and defined response times.

Post-emergency debrief and lessons learned update the plan and training.

Reactive monitoring: incidents, near misses, ill health, claims. Proactive (leading): inspections, training completion, audit closure.

Audit is systematic, independent and documented; inspection is a routine check of conditions and behaviour.

KPIs should be SMART and linked to objectives; single-metric targets can encourage under-reporting.

Accident frequency rate = (reportable accidents x 1,000,000) / hours worked.

Accident incidence rate = (accidents x 1,000) / average workers employed.

Severity rate = (days lost x 1,000) / hours worked.

Audit findings graded and tracked to closure with owners and dates; verify effectiveness.

Benchmarking and legal compliance evaluation (ISO 45001 9.1.2) are core monitoring activities.

Health surveillance is required where residual risk of work-related ill health remains (noise, HAVS, sensitisers, skin, lead).

Health surveillance is not health screening; it detects early signs and informs controls.

Occupational health supports fitness for work, rehabilitation and return-to-work; records are confidential.

Mental health risk factors: high demand, low control, poor support, bullying, long hours.

MSDs are a leading cause of absence; controls include ergonomic design, rotation, aids and early reporting.

Absence management: return-to-work interviews, phased return, reasonable adjustments (Equality Act 2010).

Wellbeing programmes: health promotion, fatigue management and shift design.

Early intervention reduces long-term absence and supports retention.

Pre-qualification: competence, resources, insurance, accident history, method statements, references.

Host and contractor must exchange hazard and control information (site rules, permits, emergency arrangements).

CDM 2015 principal contractor: construction phase plan, induction, coordination, welfare.

Permit-to-work controls hot work, confined space entry, isolation and work at height.

Monitor contractor performance via inspections, audits, incident reporting and KPIs.

Supply chain due diligence on subcontractors; contract clauses require OH&S compliance and incident reporting.

Shared workplaces: clarify control boundaries; host retains HSWA s.3 duty to non-employees.

Contractor incidents must be reported into the host's system where relevant.

ISO 14001 uses Plan-Do-Check-Act and requires policy, aspects and impacts, legal compliance and objectives.

Aspects are activities, products or services; impacts are the resulting environmental effects.

Waste hierarchy: prevent, reuse, recycle, recover, dispose.

Duty of care: safe storage, authorised transferees, waste transfer notes, accurate descriptions.

Permits control emissions to air, water and land; spill prevention via bunding and secondary containment.

Energy and carbon: measure, target, improve efficiency and report.

Life-cycle thinking supports circular economy approaches.

Environmental incidents (spills, releases) are investigated and may require regulatory notification.

HSWA 1974 is the primary UK statute; regulations sit beneath it; ACOPs have special evidential status; guidance has no evidential weight.

s.2 employer duty SFAIRP to employees; s.3 to non-employees; s.4 to those in control of premises.

s.7 employee duty of reasonable care and cooperation; s.8 prohibits intentional or reckless interference.

SFAIRP: cost must be grossly disproportionate to the risk before it justifies inaction.

s.37: directors and managers can be prosecuted where an offence results from their consent, connivance or neglect.

Enforcement: improvement notice, prohibition notice, prosecution; HSE or local authority by sector.

Sentencing Guideline sets fines by culpability and turnover-based harm categories.

Consultation duties: SRSC Regulations 1977 and HSCE Regulations 1996.

Criminal proof is beyond reasonable doubt; civil proof is on the balance of probabilities.

ISO 45001: Plan-Do-Check-Act; clauses cover context, leadership, planning, support, operation, evaluation, improvement.

Clause 5.4: consultation and participation of workers.

Clause 6.1.2: hazard identification and assessment of risks and opportunities.

Clause 8.1.2: eliminate hazards and reduce risks using the hierarchy of control.

Clause 9.1.2: evaluate legal and other compliance obligations at planned intervals.

Clause 10.2: incident, nonconformity and corrective action.

Top management is accountable; roles and authorities must be assigned and communicated.

Outsourced processes and contractors remain in scope of the OH&S management system.

ISO 45001 replaced OHSAS 18001; migration deadline 12 March 2021.

Risk = likelihood x severity; matrix ratings support tolerability judgements.

Hierarchy of control: eliminate, substitute, engineering, administrative, PPE.

PPE is the last resort; effectiveness depends on fit, training and correct use.

ALARP: reduce risk as low as reasonably practicable; greater hazards justify greater cost.

MHSWR 1999 reg.3: record significant findings where five or more employees are employed.

Specific assessments: young persons, new and expectant mothers, COSHH, noise, vibration, DSE, manual handling.

Residual risk must be acceptable and communicated before work proceeds.

Review on change, new equipment, incidents, near misses or new information.

Vulnerable groups require tailored assessment and additional controls.

Noise: lower action 80 dB(A)/135 dB(C); upper action 85 dB(A)/137 dB(C); limit 87 dB(A)/140 dB(C).

HAVS: action value 2.5 m/s2 A(8); limit value 5 m/s2 A(8).

COSHH: eliminate/substitute, engineering controls, safe systems, PPE; WELs apply to airborne substances.

LEV thorough examination and test at least every 14 months; RPE requires face-fit testing.

Manual handling TILE: Task, Individual, Load, Environment.

Biological agents: containment, hygiene, vaccination, disinfection, safe disposal; risk groups 1-4.

Psychosocial: HSE Management Standards cover demands, control, support, relationships, role, change.

Slips and trips: floor condition, housekeeping, lighting, footwear and drainage are key controls.

RIDDOR 2013: report deaths, specified injuries, over-7-day injuries, reportable diseases and dangerous occurrences.

Over-7-day injury: report within 15 days; over-3-day injury is recorded but not reported.

Specified injuries include fractures (not fingers, thumbs, toes), amputation, loss of sight and burns over 10% of body.

Dangerous occurrences are high-potential near misses and must be reported.

Investigation seeks root causes, not blame; use 5 Whys, fishbone or events and causal factors analysis.

Heinrich pyramid: many near misses and minor injuries per serious injury.

Preserve evidence: scene, equipment, CCTV, maintenance records, witness statements.

Corrective actions need owner, due date and verification of effectiveness.

Emergency plan: scenarios, alarm, evacuation routes, assembly points, roles, communication, first aid, recovery.

Fire: escape routes, detection and alarm, extinguishers, signage, drills, fire wardens.

Drills at planned intervals with records; results feed plan review.

First aid needs assessment sets numbers of first aiders and equipment.

Business continuity: critical functions, recovery time objectives, alternate arrangements, testing.

Spill response: containment, absorbents, PPE, disposal, notification; specified in COSHH assessment.

Lone and remote workers: check-in systems, communication and defined response times.

Post-emergency debrief and lessons learned update the plan and training.

Reactive monitoring: incidents, near misses, ill health, claims. Proactive (leading): inspections, training completion, audit closure.

Audit is systematic, independent and documented; inspection is a routine check of conditions and behaviour.

KPIs should be SMART and linked to objectives; single-metric targets can encourage under-reporting.

Accident frequency rate = (reportable accidents x 1,000,000) / hours worked.

Accident incidence rate = (accidents x 1,000) / average workers employed.

Severity rate = (days lost x 1,000) / hours worked.

Audit findings graded and tracked to closure with owners and dates; verify effectiveness.

Benchmarking and legal compliance evaluation (ISO 45001 9.1.2) are core monitoring activities.

Health surveillance is required where residual risk of work-related ill health remains (noise, HAVS, sensitisers, skin, lead).

Health surveillance is not health screening; it detects early signs and informs controls.

Occupational health supports fitness for work, rehabilitation and return-to-work; records are confidential.

Mental health risk factors: high demand, low control, poor support, bullying, long hours.

MSDs are a leading cause of absence; controls include ergonomic design, rotation, aids and early reporting.

Absence management: return-to-work interviews, phased return, reasonable adjustments (Equality Act 2010).

Wellbeing programmes: health promotion, fatigue management and shift design.

Early intervention reduces long-term absence and supports retention.

Pre-qualification: competence, resources, insurance, accident history, method statements, references.

Host and contractor must exchange hazard and control information (site rules, permits, emergency arrangements).

CDM 2015 principal contractor: construction phase plan, induction, coordination, welfare.

Permit-to-work controls hot work, confined space entry, isolation and work at height.

Monitor contractor performance via inspections, audits, incident reporting and KPIs.

Supply chain due diligence on subcontractors; contract clauses require OH&S compliance and incident reporting.

Shared workplaces: clarify control boundaries; host retains HSWA s.3 duty to non-employees.

Contractor incidents must be reported into the host's system where relevant.

ISO 14001 uses Plan-Do-Check-Act and requires policy, aspects and impacts, legal compliance and objectives.

Aspects are activities, products or services; impacts are the resulting environmental effects.

Waste hierarchy: prevent, reuse, recycle, recover, dispose.

Duty of care: safe storage, authorised transferees, waste transfer notes, accurate descriptions.

Permits control emissions to air, water and land; spill prevention via bunding and secondary containment.

Energy and carbon: measure, target, improve efficiency and report.

Life-cycle thinking supports circular economy approaches.

Environmental incidents (spills, releases) are investigated and may require regulatory notification.