Principles and guidelines to assist HSE in its judgements that duty-holders have reduced risk as low as reasonably practicable

These pages set out the approach that Health and Safety Executive (HSE) inspectors use to evaluate risks. It is not something we would expect the average dutyholder to look at.

Our guidance on Managing risks and risk assessment at work will help businesses control risks and protect their workers.

We are publishing the pages in the interests of openness and because we know it is useful to some health and safety professionals and academics.

Contents

Introduction

The Health and Safety Executive is responsible for making adequate arrangements for enforcement. In fulfilment of its duty the Executive provides guidance to its regulatory staff who have to judge whether measures put in place or proposed, by those who are under a duty to control and reduce risks "as low as is reasonably practicable" (ALARP), are acceptable.

The principles and guidelines set out below are based on what the courts have decided is required of duty-holders, and are intended to help HSE regulatory staff reach decisions about the control of risks and make clear what they should expect from duty-holders.

Ultimately, it is for the courts to decide whether or not duty-holders have complied with the law. However, HSE needs to have a coherent view of its own, consistent with relevant case law, as to what the law requires from duty-holders, both as a basis for any action it may wish to take and to provide guidance to staff on what they should expect from duty-holders.

This guidance for staff therefore sets out in plain terms what HSE believes the law requires of those who are under a duty to reduce risks as low as is reasonably practicable. It is not intended to cover all possible circumstances which might arise when these judgements are made, or usurp the fundamental role of individual inspectors of having to make professional judgements in particular circumstances. It aim is to give clarity to HSE's interpretation of the law and thus lead to consistent and transparent decision-making by HSE's staff.

[back to top]

'SFAIRP' and 'ALARP'

In terms of what they require of duty-holders, HSE considers that duties to ensure health and safety so far as is reasonably practicable ("SFAIRP") and duties to reduce risks as low as is reasonably practicable ("ALARP") call for the same set of tests to be applied. However, SFAIRP and ALARP are not always interchangeable because legal proceedings will have to employ (for example, in complaints or informations) the particular term cited in the relevant legislation.

[back to top]

What does HSE expect from duty-holders who have to reduce risks ALARP?

There is little guidance from the courts as to what reducing risks as low as is reasonably practicable means. The key case is Edwards v. The National Coal Board1. In that case, the Court of Appeal considered whether or not it was reasonably practicable to make the roof and sides of a road in a mine secure. The Court of Appeal held that -

, "... in every case, it is the risk that has to be weighed against the measures necessary to eliminate the risk. The greater the risk, no doubt, the less will be the weight to be given to the factor of cost."2

and

"'Reasonably practicable' is a narrower term than 'physically possible' and seems to me to imply that a computation must be made by the owner in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time or trouble) is placed in the other, and that, if it be shown that there is a gross disproportion between them - the risk being insignificant in relation to the sacrifice - the defendants discharge the onus on them."3

The Courts will look at all the relevant circumstances of the particular case when reaching decisions.

[back to top]

Determining that risk has been reduced ALARP

Thus, determining that risks have been reduced ALARP involves an assessment of the risk to be avoided, of the sacrifice (in money, time and trouble) involved in taking measures to avoid that risk, and a comparison of the two.

This process can involve varying degrees of rigour which will depend on the nature of the hazard, the extent of the risk and the control measures to be adopted. The more systematic the approach, the more rigorous and more transparent it is to the regulator and other interested parties. However, duty-holders (and the regulator) should not be overburdened if such rigour is not warranted. The greater the initial level of risk under consideration, the greater the degree of rigour HSE requires of the arguments purporting to show that those risks have been reduced ALARP.

[back to top]

Risk

The assessment of risk is confined to those matters with which the legislation in question is concerned. It is risks to health, safety and welfare that are covered by the Health and Safety at Work Act 19744, and its subordinate legislation such as the Management of Health and Safety at Work Regulations 19995.

Other legislation for which HSE is responsible may include other risks, such as the Control of Major Accident Hazards Regulations 1999 (COMAH) which include environmental risks6. Requirements for environmental protection may constrain the options available to duty-holders for controlling health and safety risks7.

The risks must be only those over which duty-holders can exercise control or mitigate the consequences through the conduct of their undertaking. Some risks arise from external events or circumstances over which the duty-holder has no control, but whose consequences duty-holder can mitigate. Such risks should be included in the assessment.

In any given workplace there would be a large number of hazards which duty-holders could address. However, requiring duty-holders formally to address them all would place an excessive and largely useless burden on them. So as not to impose unnecessary burdens on duty-holders, HSE will not expect them to take account of hazards other than those which are a reasonably foreseeable cause of harm, taking account of reasonably foreseeable events and behaviour8.

The risk will be not only to the duty-holders' employees but may also affect other workers and members of the public, including the local community which would be affected by an accident or incident such as an explosion on site.

Risk should be assessed in relation to a hypothetical person9, eg. the person most exposed to the hazard, or a person living at some fixed point or with some assumed pattern of life, such as a person who is in good health and works exactly forty hours a week with the hazard, or a child present continuously in a house sited at the closest point to a major hazard. To ensure that all significant risks for a particular hazard are covered, it may be necessary to construct a number of hypothetical persons, to cover the different populations exposed, such as 'a person who is in good health', 'young persons'.

The actual persons who are to be exposed to the risk will have to be considered when the control measures determined via risk assessment are applied in practice because these measures may need to be adapted to meet the particular abilities of these persons, for example, their ability to read instructions, or whether they are colour-blind.

Risks should be assessed in an integrated manner by duty-holders. It is important that duty-holders consider the 'full picture' when assessing risk and not a partial view from considering hazards in isolation, or in a slice of time, or location by location rather than across the whole system.

Location by location consideration of risks should however be carried out to determine whether, even if application of a control measure system-wide would be ruled out on the grounds of excessive costs, application is reasonably practicable in certain locations, such as those that present a particularly high risk and/or low cost.

[back to top]

Sacrifice

The sacrifice under consideration here is that which would be incurred by duty-holders as a consequence of their taking measures to avert or reduce the risks identified. In the Edwards case, Asquith LJ referred to the sacrifice in terms of money, time or trouble. These costs which should be considered are only those which are necessary and sufficient to implement the measures to reduce risk.

For any particular measure, these might include the cost of installation, operation, and maintenance, and the costs due to any consequent productivity losses resulting directly from the introduction of the measure (for example, a new guard may cause a machine to operate less efficiently).

Temporary shutdown costs incurred during implementation must be included since these clearly constitute part of the duty-holders' 'sacrifice'. HSE will expect duty-holders to take full advantage of opportunities to reduce shutdown costs to a minimum, such as implementing control measures during planned maintenance. It may be reasonably practicable to implement control measures during shutdown for planned maintenance, even though not to shut down solely to implement control measures.

Individual duty-holders' ability to afford a control measure or the financial viability of a particular project is not a legitimate factor in the assessment of its costs. HSE must present duty-holders with a level playing field. Thus HSE cannot take into account the size and financial position of the duty-holder when making judgements on whether risks have been reduced ALARP.

Benefits gained by duty-holders as a result of their instituting a health and safety measure should be offset against the costs they incur.

[back to top]

Comparison

The basis on which comparison is made is provided by the Edwards case: the test of 'gross disproportion'. In any assessment as to whether risks have been reduced ALARP, measures to reduce risk can be ruled out only if the sacrifice involved in taking them would be grossly disproportionate to the benefits of the risk reduction.

That gross disproportion is required before a measure can be ruled out on the grounds of sacrifice can be interpreted as applying a bias on the side of safety. From the statement of Tucker LJ, that -

"The greater the risk, no doubt, the less will be the weight to be given to the factor of cost",

we believe that the greater the risk, the more that should be spent in reducing it, and the greater the bias on the side of safety. This can be represented by a 'proportion factor', indicating the maximum level of sacrifice that can be borne without it being judged 'grossly disproportionate' -

sacrifice
benefits of risk reduction

Although there is no authoritative case law which considers the question, we believe it is right that the greater the risk: the higher the proportion may be before being considered 'gross'. But the disproportion must always be gross.

HSE has not formulated an algorithm which can be used to determine the proportion factor for a given level of risk. The extent of the bias must be argued in the light of all the circumstances. It may be possible to come to a view in particular circumstances by examining what factor has been applied in comparable circumstances elsewhere to that kind of hazard or in that particular industry.

Taking greater account of the benefits as the risk increases also compensates to some extent for imprecision in the comparison of costs and the benefits. It again errs on the side of safety, since the consequences of the imprecision have greater impact, in terms of the degree of unanticipated death and injury, as the level of risk rises11.

In measuring the risk to be reduced, and the sacrifice involved in measures to achieve that reduction, the starting point should be the present situation. If there are several options, therefore, they should each be considered as against the present situation. (See paragraph 47 for further discussion on choosing between options.)

In some situations, it will not be possible to assess options in this way. For example, where an installation is being built, it will not be possible to separate the costs of risk reduction measures from the costs of building. In such situations, the starting point should be an option which is known to be reasonably practicable (such as one which represents existing good practice). Any other options should be considered as against that starting point, to determine whether further risk reduction measures are reasonably practicable.

[back to top]

Societal concerns

Societal concerns can arise when the realisation of a risk impacts on society as a whole. The impact may produce an adverse socio-political response (which has its origins in the public aversion to certain characteristics of the hazards concerned). The harm which results is a loss of confidence by society in the provisions and arrangements in place for protecting people and, consequently, a loss of trust in the regulator and duty-holders with respect to control of the particular hazard and hazards more generally.

This might arise where large numbers of people are killed at one time (which we call "societal risk"), where potential victims are particularly vulnerable (such as children), or where the nature of the risks inspire dread (such as long-term or irreversible effects).

There is no guidance from the courts as to whether societal concerns should be taken into account by duty holders in deciding what is grossly disproportionate. In deciding whether to propose regulations, or in setting enforcement priorities, HSC considers that risk and sacrifice must be assessed in its social context. As well as taking account of individual risk, HSC considers societal concerns.

We believe it is right that, in all cases, the judgment as to whether measures are grossly disproportionate should reflect societal risk, that is to say, large numbers of people (employees or the public) being killed at one go. This is because society has a greater aversion to an accident killing 10 people than to 10 accidents killing one person each.

Where HSC considers that duty-holders should take other societal concerns into account, Regulations, ACOPs or other HSE guidance will state how duty-holders should take such concerns into account and what those concerns are.

[back to top]

Transfer of risks

Introduction of a health and safety measure to control a hazard may transfer risk to other employees or members of the public.

If the transferred risk arises from the same hazard, then it should be offset against the benefit from the measure under consideration. For example, the introduction of mechanical exhaust ventilation may transfer the risk from the same hazard (fumes) from the employee to the general public as the fumes are pumped outside the workplace. The added risk to the public should be offset against the benefits the measure otherwise brings to employees.

If the transferred risk arises from a different hazard, it should be treated as a separate matter for which control measures must be introduced to reduce its risk ALARP. For example, providing scaffold fans to protect members of the public from being struck by objects dropped from the scaffold will transfer some of the risk from the public to the scaffolders involved in erecting the fans. Since a different hazard is involved (ie. scaffolders falling from a height), the fans should be provided to reduce the risks to the public ALARP, but at the same time, the duty holder must ensure that the risks of the scaffolders' working methods are reduced ALARP. However, if the risks from the health and safety measure to be introduced (in this example, scaffolding fans) when properly controlled are still greater than the risks which it is sought to prevent (injury to members of the public) when properly controlled, the measure should not be introduced.

[back to top]

Changed circumstances

Duty-holders may wish to alter the conditions in which equipment is operated or to relax or otherwise alter some or all control measures in response to changed circumstances. This is permissible provided that the altered control measures continue to ensure that risks are reduced ALARP.

[back to top]

Good practice

The determination of control measures forms part of the statutory risk assessment duty-holders are required to undertake. Such assessments involve duty-holders identifying the hazards in their workplace, determining who might be harmed and how; evaluating the risk from the hazards and deciding whether the existing control measures are sufficient or whether more should be done.

In reality, there is often only a limited number of options for dealing with a particular health and safety issue and the optimum option is in many cases likely to have been already established as relevant good practice accepted by HSE as reducing risks ALARP. Often HSE staff will be able to rely on authoritative documented sources of good practice, such as HSC ACOPs12 and HSE Guidance, on legal standards which require risks to be reduced ALARP.

HSE staff should ensure that duty-holders are using good practice which is appropriate to their activities, relevant to the risks from their undertaking, and covering all the risks from that undertaking. Such documents may only deal with some of the risks which the duty-holder must consider. Good practice which covers all the risks which a duty-holder must address in order to reduce risks ALARP may not be available, and this is particularly likely to be so for major investments in safety measures or where hazards are regulated through safety case regimes.

A universal practice in the industry may not necessarily be good practice or reduce risks ALARP. Duty holders should not assume that it is. HSE must keep its acceptance of good practice under review since it may cease to be relevant with the passage of time; new legislation may make it no longer acceptable; new technology may make a higher standard REASONABLY PRACTICABLE. Similarly HSE expects duty-holders to keep relevant good practice under review.

Probably the majority of judgements made by HSE involves it in comparing duty-holders' actual or proposed practice against RELEVANT GOOD PRACTICE. Relevant good practice provides duty-holders with generic advice for controlling the risk from a hazard. In so far as they can adopt relevant good practice, this relieves duty-holders of the need (but not the legal duty) to take explicit account of individual risk, costs, technical feasibility and the acceptability of residual risk, since these will also have been considered when the good practice was established.

In practice therefore, explicit evaluations of risk rarely need to be made in relation to day-to-day hazards. However, duty-holders have to make them where there is no relevant good practice establishing clearly what control measures are required.

[back to top]

Choosing between options

A selection amongst options may be needed at any stage of a particular project: at the design stage, involving choice between different design concepts for the whole project, and, as the project is developed, between more detailed options. In making these options, duty-holders must consider the risks involved in the whole life-cycle of a project.

At the design stage, where safety cases or plans are required to be submitted to HSE, HSE will assess the option which duty-holders put before it, but where that option does not reduce risks ALARP, HSE may reject a safety case, ask duty holders to consider a different option, or use its enforcement powers to prevent further work (depending on the situation in question). HSE will make its judgement as to whether the design presented to it reduces risks ALARP based on its knowledge as a regulator, including its knowledge of good practice in that area, and its knowledge of other possible design options. Where the option put forward does not reduce risks ALARP, HSE may intervene according to the situation in question - for example, to prevent further work or to inform the duty-holder of its opinion.

The reason for the design chosen will be a relevant factor in considering what it is reasonably practicable to do. Depending on the particular legal context and the circumstances in question, where the very essence or ethos of the business could not be achieved without following the design suggested, then HSE could not reject the option so as to prevent the undertaking proceeding. The question would be how to reduce the risks of that option ALARP. But such situations will be rare. In most cases, there will be several options for achieving the essence of the business in question.

At a more detailed level, HSE would consider judgements as to whether risks are or will be controlled ALARP as central to deciding between options, though again the reason for the option chosen may still be a relevant factor. For example, HSE may have to accept a process using intrinsically more dangerous components since only these components will provide the products essential to the duty-holder's undertaking.

In practice, duty-holders may have a number of options where an assessment would show that costs are not grossly disproportionate. The option, or combination of options which achieves the lowest level of residual risk should be implemented, provided grossly disproportionate costs are not incurred. The legal requirement to reduce risks as low as is reasonably practicable rules out HSE accepting a less protected but significantly cheaper option.

[back to top]

New versus existing plant

It should be borne in mind that reducing the risks from an existing plant ALARP may still result in a level of residual risk which is higher than that which would be achieved by reducing the risks ALARP in a similar, new plant. Factors which could lead to this difference include the practicability of retrofitting a measure on an existing plant, the extra cost of retrofitting measures compared to designing them in on the new plant, the risks involved in installation of the retrofitted measure (which must be weighed against the benefits it provides after installation) and the projected lifetime of the existing plant.

All this may mean, for example, that it is not reasonably practicable to apply retrospectively to existing plant, what may be demanded by reducing risks ALARP for a new plant (and what may have become good practice for every new plant).

[back to top]

  1. [1949] 1 KB 704; [1949] 1 All ER 743. Back
  2. Tucker LJ. Back
  3. Asquith LJ. Back
  4. The Court of Appeal, in R v. Board of Trustees of the Science Museum [1993] 3 All ER 853, held that the term "risk" in s.3, HSWA, means the possibility of danger rather than actual danger. Back
  5. SI 1999/. Back
  6. SI 1999/743. Reg. 4 requires "all necessary measures" to be taken to prevent major accidents and limit their consequences to persons and the environment. HSE regards this as equivalent to a requirement to reduce the risk of a major accident ALARP. Back
  7. The relationship between health and safety and environmental legislation may depend on the terms of the particular legislation in question. Back
  8. Whether a reasonably foreseeable, but unlikely, event - such as an earthquake - should be considered depends on the consequences for health and safety of such an event. Back
  9. See Annex 1 to Reducing Risks, Protecting People for a fuller discussion. Back
  10. n/a
  11. It should be noted, however, that the greatest uncertainties generally occur for the less likely but higher consequence events. Back
  12. Approved Codes of Practice have a special status under s.17, HSWA, and therefore a special status as good practice. If it is proved that a duty-holder did not follow the relevant provisions of an ACOP, he will need to show that he complied with the law in some other way or he will be found in breach of the law on which the ACOP gives guidance. Back

Added to HSE website 13 December 2001

See also

Is this page useful?

Updated 2023-04-25