The employer is responsible for ensuring that a suitable and sufficient risk assessment is made. In Great Britain, regulation 7 of the Management Regulations defines a competent person by sufficient training and experience or knowledge and other qualities to provide the necessary assistance. Northern Ireland has separate corresponding legislation.
That definition is deliberately broad. It doesn't require a specific qualification. It doesn't require a registered profession. What it does require is that the person taking on the assessment has what it takes to do it well — and that the employer can demonstrate they took reasonable steps to verify that.
This page covers what competence means in practice, when an in-house assessor is enough, when an external specialist is required, and the specific competence frameworks for different verticals.
What "competent" actually means
The following qualities help establish whether someone is suitable for the particular work; competence is assessed in context rather than by a single credential.
Skills are the practical abilities required for the assessment — the ability to identify hazards in the relevant work, to evaluate risk levels, to design effective controls, and to document the assessment defensibly.
Knowledge is the technical understanding underlying those skills — knowledge of the relevant regulations, the recognised methodologies, the available control measures, and the typical failure modes in the work being assessed.
Experience is the accumulation of judgement that comes from carrying out similar assessments over time. An assessor who has carried out a hundred construction site assessments has internalised patterns that the textbook can't teach. An assessor doing their first construction site is competent only with appropriate support and supervision.
Other qualities is the catch-all in the regulations. It covers attributes like the authority to act on findings, the credibility to challenge the status quo, the communication skills to engage workers in the assessment, and the integrity to identify hazards that an employer would rather not hear about.
A qualification or long service does not establish competence for every situation. Check whether the person’s knowledge, experience and other qualities fit the actual hazards, and arrange support or specialist advice where needed.
A qualification is not the same as competence
This is the single most common misunderstanding in this area. A qualification — IOSH Managing Safely, NEBOSH General Certificate, NEBOSH Diploma — is evidence of underlying knowledge. It is not, in itself, evidence of competence for any specific assessment.
A NEBOSH General Certificate is a strong foundation for general workplace risk assessment in a non-specialist context. It does not on its own qualify the holder to assess a complex chemical manufacturing process, a higher-risk residential building's fire safety, or a major construction project's working at height arrangements.
An experienced person may be competent to assess routine risks without a formal qualification. The relevant test is their ability to help manage those risks effectively, not a universal expectation that every assessor hold a certificate.
The right way to read qualifications is as evidence of one component (knowledge) of the competence framework. The employer's reasonable steps to verify competence go beyond checking certificates — they include considering the relevance of the qualification to the specific work, the assessor's experience in similar work, and any professional registration that would suggest ongoing development.
Internal versus external assessors
Where competent employees are available, regulation 7 gives preference to appointing them over external help. Employers can often manage straightforward risks themselves, but must seek suitable help where their knowledge and experience are insufficient.
External assessors are typically used in five situations.
Where the work is technically complex
Some assessments require specialist knowledge that few employers maintain in-house — process safety in chemical manufacturing, complex water systems in healthcare, structural fire safety in high-rise buildings, hazardous-waste handling.
Where the assessment is contested or high-stakes
External expertise may help with complex or disputed issues, but an assessment does not carry greater legal weight simply because a consultant wrote it. Its suitability depends on the evidence, competence and controls.
Where internal capacity is limited
Smaller employers without dedicated H&S resource often engage external consultants to carry out the bulk of their assessment work, with internal staff maintaining the controls and recording day-to-day issues.
Where the assessment requires independence
Some specific assessments — particularly fire risk assessment for higher-risk premises, and legionella for complex commercial systems — benefit from independent professional verification.
Where the worker would be assessing their own work
Self-assessment has obvious limitations. Where a manager is the operator or the decision-maker for an activity, an independent assessor brings the challenge that self-assessment can't.
The decision isn't binary. Many organisations operate a hybrid model — internal assessors for routine work, external specialists for higher-risk activities or periodic deep-dive reviews. The right mix depends on the risk profile of the work, the in-house capability available, and the level of external scrutiny the assessment is likely to face.
Vertical-specific competence
Different categories of risk assessment carry different competence expectations.
For fire assessments, select someone whose competence matches the premises and risks. BS 8674:2025 provides a competence framework. Check relevant experience and the scope of any third-party certification or professional register; the National Fire Chiefs Council’s guidance helps with selection but is not itself an assessor register.
For legionella, appoint someone with the necessary competence, authority, knowledge of the system and experience. The Legionella Control Association operates a service-provider registration scheme, but membership is not a statutory requirement or a substitute for checking competence for the particular water system.
Asbestos surveyors must be competent for the survey required. HSE strongly recommends UKAS-accredited surveying organisations, while distinguishing that recommendation from the mandatory accreditation requirements for asbestos analysis. Licensing for some asbestos work is a separate issue.
Complex COSHH or exposure assessments may need a competent occupational hygienist. Relevant qualifications and experience can help demonstrate competence; membership of a professional body alone does not prove that someone can assess the particular process.
DSE and ergonomics competence is generally evidenced by training in DSE assessment methodology, often delivered alongside general H&S training. For more complex ergonomics work — repetitive strain injury, custom workstation design, return-to-work assessment — specialist ergonomists or occupational therapists are usually engaged.
Manual handling assessments require understanding of the actual task and relevant risk factors. HSE’s MAC, RAPP and ART tools support appropriate assessments. Patient handling may need specialist competence and individual care planning.
Work at height competence depends on the equipment, activity and risk. PASMA, IPAF and CISRS are examples of industry training routes; they are not universal statutory requirements and do not by themselves qualify someone to assess every height-related task.
For construction assessments and method statements, check relevant skills, knowledge, training and experience. Under CDM 2015, projects involving more than one contractor require a principal contractor; that duty is not triggered only by project value or notification thresholds.
Relevant qualifications
The qualifications most commonly relevant to risk assessment competence in the UK are:
IOSH describes its full Managing Safely course as three days. It covers risk assessment and management principles for managers and supervisors. Completion provides evidence of learning, rather than automatic competence for every specialist assessment.
NEBOSH General Certificate is a more substantial qualification covering the legal framework, hazard identification across common workplace categories, and risk assessment methodology. It's the standard expected of most in-house H&S advisers.
NEBOSH National Diploma is the higher-level qualification for those moving into specialist H&S practice. It's the typical underpinning for H&S managers in larger organisations.
Chartered membership of IOSH (CMIOSH) is the professional grade for experienced practitioners — combining qualifications, experience and continuing professional development.
Sector-specific awards and professional development may support competence in fire, legionella, asbestos, occupational hygiene and other fields. Organisations such as BOHS and IIRSM are professional bodies, not the names of individual qualifications.
Our Risk Assessment Training courses cover the methodological foundation that underpins all of the above, with options for general workplace assessment and for higher-risk vertical applications.
Liability when the assessor is unsuitable
Engaging an external assessor doesn't transfer legal responsibility from the employer. The employer remains the duty-holder under the regulations, and the duty includes taking reasonable steps to verify the assessor's competence.
"Reasonable steps" looks like:
- Checking qualifications relevant to the work.
- Confirming professional registration or membership of a relevant body where one exists.
- Verifying recent and relevant experience for the type of premises or activity.
- Requesting and checking references for similar work.
- Confirming professional indemnity insurance at appropriate cover levels.
- Reviewing a sample assessment by the same author, where possible.
Engaging an unsuitable consultant does not remove the employer’s duties. An inadequate assessment or failure to implement necessary controls may lead to enforcement, depending on the facts and legal duties involved.
Checking competence is an important part of appointing help, but it does not create immunity from liability or guarantee that the assessment is adequate. Employers must continue to manage the risks and act on the findings.
Building in-house competence
For organisations that carry out regular risk assessment work, building in-house competence is usually more cost-effective and produces better assessments than ongoing external engagement.
The case for in-house competence runs along several lines. The in-house assessor knows the work, the workforce and the culture in a way that no external consultant can match. They can revisit and update assessments routinely without commissioning new work. They build long-term knowledge that compounds across cycles. They're available for the day-to-day judgement calls that arise between formal assessment dates.
The case for external specialist input is for the work where in-house capability genuinely doesn't extend — major fire risk assessments, specialised legionella systems, complex industrial exposure work, contested or high-stakes assessments.
For most UK employers, the right model is a strong in-house capability supported by external specialists for specific high-risk or technically demanding assessments. Our Risk Assessment Training is built around developing exactly that in-house capability, with a methodology that translates into defensible practice.
Where this connects in the cluster
The competence question runs through every vertical. The depth and shape of competence required depends on the specific assessment — see the relevant vertical pages for the framework: fire, legionella, working at height, COSHH, manual handling, stress, DSE, pregnancy, young persons, lone working, and working from home. The general method is covered on our introduction to risk assessment and five steps pages.
Frequently asked questions
Can I carry out my own risk assessment?
Yes, if you have the competence for the work. Routine risks can often be assessed in-house. Specialist help may be internal or external; what matters is competence appropriate to the hazards and complexity.
What qualifications does an assessor need?
There's no specific qualification required by law. The Management of Health and Safety at Work Regulations 1999 require skills, knowledge, experience and other qualities appropriate to the work. Common qualifications underpinning competence include IOSH Managing Safely, NEBOSH General Certificate, NEBOSH Diploma and chartered membership of IOSH, plus sector-specific awards for verticals like fire, legionella and asbestos.
Who is competent for a fire risk assessment?
Someone whose knowledge, training and experience match the premises and risks. Check the scope of relevant certification or professional registration and experience of similar premises. BS 8674:2025 provides a competence framework; there is no NFCC-operated register implied by its selection guidance.
Who is competent for a legionella risk assessment?
Someone with the necessary competence, authority, system knowledge and experience. A landlord may assess a straightforward low-risk system if competent. Complex premises or water systems may need specialist help; LCA registration can inform selection but is not a statutory qualification.
Is the employer or the assessor legally liable for an inadequate assessment?
Both can be, depending on the circumstances. The employer remains the duty-holder under the regulations and must take reasonable steps to verify the assessor's competence. An external assessor providing a professional service can also be liable in their own right — through their professional indemnity cover and potentially under the Health and Safety at Work etc. Act for breach of section 3. Engaging an external assessor doesn't transfer the legal duty from the employer.
Related guides
- How often should a risk assessment be reviewed?
- Risk assessment examples: three worked examples for UK workplaces
- Working from home risk assessment: the duty for home and hybrid workers
Sources & references
- HSE — Getting competent help
- Management Regulations, regulation 7
- HSE — Managing legionella risks
- HSE — Asbestos analysts and surveyors
- IOSH — Managing Safely course details
- HSE — Principal contractors
- Home Office — Fire safety responsibilities
Build the in-house competence to lead clear, defensible risk assessments with our RoSPA-approved, CPD-accredited course.
Explore the Risk Assessment Training course →
Mark writes about workplace health & safety, risk assessment and accredited online training for Risk Assessment Training, part of Online CPD Academy.