Principles and guidelines to assist HSE in its judgements that
duty-holders have reduced risk as low as reasonably practicable
The Health and Safety Executive is responsible for making adequate
arrangements for enforcement. In fulfilment of its duty the Executive
provides guidance to its regulatory staff who have to judge whether
measures put in place or proposed, by those who are under a duty to
control and reduce risks "as low as is reasonably practicable"
(ALARP), are acceptable.
The principles and guidelines set out below are based on what the
courts have decided is required of duty-holders, and are intended to
help HSE regulatory staff reach decisions about the control of risks
and make clear what they should expect from duty-holders.
Ultimately, it is for the courts to decide whether or not duty-holders
have complied with the law. However, HSE needs to have a coherent view
of its own, consistent with relevant case law, as to what the law requires
from duty-holders, both as a basis for any action it may wish to take
and to provide guidance to staff on what they should expect from duty-holders.
This guidance for staff therefore sets out in plain terms what HSE
believes the law requires of those who are under a duty to reduce risks
as low as is reasonably practicable. It is not intended to cover all
possible circumstances which might arise when these judgements are made,
or usurp the fundamental role of individual inspectors of having to
make professional judgements in particular circumstances. It aim is
to give clarity to HSE's interpretation of the law and thus lead
to consistent and transparent decision-making by HSE's staff.
[back to top]
'SFAIRP' and 'ALARP'
In terms of what they require of duty-holders, HSE considers that
duties to ensure health and safety so far as is reasonably practicable
("SFAIRP") and duties to reduce risks as low as is reasonably
practicable ("ALARP") call for the same set of tests to be
applied. However, SFAIRP and ALARP are not always interchangeable because
legal proceedings will have to employ (for example, in complaints or
informations) the particular term cited in the relevant legislation.
[back to top]
What does HSE expect from duty-holders who have to reduce risks ALARP?
There is little guidance from the courts as to what reducing risks
as low as is reasonably practicable means. The key case is Edwards v. The National Coal Board.1 In that
case, the Court of Appeal considered whether or not it was reasonably
practicable to make the roof and sides of a road in a mine secure. The
Court of Appeal held that -
, "... in every case, it is the risk that has to be weighed
against the measures necessary to eliminate the risk. The greater
the risk, no doubt, the less will be the weight to be given to the
factor of cost."2
"'Reasonably practicable' is a narrower term than
'physically possible' and seems to me to imply that a computation
must be made by the owner in which the quantum of risk is placed on
one scale and the sacrifice involved in the measures necessary for
averting the risk (whether in money, time or trouble) is placed in
the other, and that, if it be shown that there is a gross disproportion
between them - the risk being insignificant in relation to the sacrifice
- the defendants discharge the onus on them."3
The Courts will look at all the relevant circumstances of the particular
case when reaching decisions.
[back to top]
Determining that risk has been reduced ALARP
Thus, determining that risks have been reduced ALARP
involves an assessment of the risk to be avoided, of the sacrifice (in money, time and trouble) involved in taking measures to avoid that
risk, and a comparison of the two.
This process can involve varying degrees of rigour which
will depend on the nature of the hazard, the extent of the risk and
the control measures to be adopted. The more systematic the approach,
the more rigorous and more transparent it is to the regulator and other
interested parties. However, duty-holders (and the regulator) should
not be overburdened if such rigour is not warranted. The greater the
initial level of risk under consideration, the greater the degree of
rigour HSE requires of the arguments purporting to show that those risks
have been reduced ALARP.
[back to top]
The assessment of risk is confined to those matters with which
the legislation in question is concerned. It is risks to health, safety
and welfare that are covered by the Health and Safety at Work Act 1974,4 and its subordinate legislation such as the Management of Health and
Safety at Work Regulations 1999.5
Other legislation for which HSE is responsible may include other
risks, such as the Control of Major Accident Hazards Regulations 1999
(COMAH) which include environmental risks.6 Requirements for environmental protection may constrain the options
available to duty-holders for controlling health and safety risks.7
The risks must be only those over which duty-holders can exercise
control or mitigate the consequences through the conduct of their undertaking.
Some risks arise from external events or circumstances over which the
duty-holder has no control, but whose consequences duty-holder can mitigate.
Such risks should be included in the assessment.
In any given workplace there would be a large number of hazards
which duty-holders could address. However, requiring duty-holders formally
to address them all would place an excessive and largely useless burden
on them. So as not to impose unnecessary burdens on duty-holders, HSE
will not expect them to take account of hazards other than those which
are a reasonably foreseeable cause of harm, taking account of reasonably
foreseeable events and behaviour.8
The risk will be not only to the duty-holders' employees but
may also affect other workers and members of the public, including the
local community which would be affected by an accident or incident such
as an explosion on site.
Risk should be assessed in relation to a hypothetical person,9 eg. the person most exposed to the hazard, or a person living at some
fixed point or with some assumed pattern of life, such as a person who
is in good health and works exactly forty hours a week with the hazard,
or a child present continuously in a house sited at the closest point
to a major hazard. To ensure that all significant risks for a particular
hazard are covered, it may be necessary to construct a number of hypothetical
persons, to cover the different populations exposed, such as 'a
person who is in good health', 'young persons'.
The actual persons who are to be exposed to the risk will have
to be considered when the control measures determined via risk assessment
are applied in practice because these measures may need to be adapted
to meet the particular abilities of these persons, for example, their
ability to read instructions, or whether they are colour-blind.
Risks should be assessed in an integrated manner by duty-holders.
It is important that duty-holders consider the 'full picture' when assessing
risk and not a partial view from considering hazards in isolation, or
in a slice of time, or location by location rather than across the whole
Location by location consideration of risks should however be carried
out to determine whether, even if application of a control measure system-wide
would be ruled out on the grounds of excessive costs, application is
reasonably practicable in certain locations, such as those that present
a particularly high risk and/or low cost.
[back to top]
The sacrifice under consideration here is that which would be incurred
by duty-holders as a consequence of their taking measures to avert or
reduce the risks identified. In the Edwards case, Asquith LJ
referred to the sacrifice in terms of money, time or trouble. These
costs which should be considered are only those which are necessary
and sufficient to implement the measures to reduce risk.
For any particular measure, these might include the cost of installation,
operation, and maintenance, and the costs due to any consequent productivity
losses resulting directly from the introduction of the measure (for
example, a new guard may cause a machine to operate less efficiently).
Temporary shutdown costs incurred during implementation must be
included since these clearly constitute part of the duty-holders' 'sacrifice'.
HSE will expect duty-holders to take full advantage of opportunities
to reduce shutdown costs to a minimum, such as implementing control
measures during planned maintenance. It may be reasonably practicable
to implement control measures during shutdown for planned maintenance,
even though not to shut down solely to implement control measures.
Individual duty-holders' ability to afford a control measure
or the financial viability of a particular project is not a legitimate
factor in the assessment of its costs. HSE must present duty-holders
with a level playing field. Thus HSE cannot take into account the size
and financial position of the duty-holder when making judgements on
whether risks have been reduced ALARP.
Benefits gained by duty-holders as a result of their instituting
a health and safety measure should be offset against the costs they
[back to top]
The basis on which comparison is made is provided by the Edwards
case: the test of 'gross disproportion'. In any assessment as
to whether risks have been reduced ALARP, measures to reduce risk can
be ruled out only if the sacrifice involved in taking them would be
grossly disproportionate to the benefits of the risk reduction.
That gross disproportion is required before a measure can be ruled
out on the grounds of sacrifice can be interpreted as applying a bias
on the side of safety. From the statement of Tucker LJ, that -
"The greater the risk, no doubt, the less will be the weight
to be given to the factor of cost",
we believe that the greater the risk, the more that should be spent
in reducing it, and the greater the bias on the side of safety. This
can be represented by a 'proportion factor', indicating the maximum
level of sacrifice that can be borne without it being judged 'grossly
|benefits of risk reduction
Although there is no authoritative case law which considers the
question, we believe it is right that the greater the risk: the higher
the proportion may be before being considered 'gross'. But
the disproportion must always be gross.
HSE has not formulated an algorithm which can be used to determine
the proportion factor for a given level of risk. The extent of the bias
must be argued in the light of all the circumstances. It may be possible
to come to a view in particular circumstances by examining what factor
has been applied in comparable circumstances elsewhere to that kind
of hazard or in that particular industry.
Taking greater account of the benefits as the risk increases also
compensates to some extent for imprecision in the comparison of costs
and the benefits. It again errs on the side of safety, since the consequences
of the imprecision have greater impact, in terms of the degree of unanticipated
death and injury, as the level of risk rises.11
In measuring the risk to be reduced, and the sacrifice involved
in measures to achieve that reduction, the starting point should be
the present situation. If there are several options, therefore, they
should each be considered as against the present situation. (See paragraph
47 for further discussion on choosing between options.)
In some situations, it will not be possible to assess options in
this way. For example, where an installation is being built, it will
not be possible to separate the costs of risk reduction measures from
the costs of building. In such situations, the starting point should
be an option which is known to be reasonably practicable (such as one
which represents existing good practice). Any other options should be
considered as against that starting point, to determine whether further
risk reduction measures are reasonably practicable.
[back to top]
Societal concerns can arise when the realisation of a risk impacts
on society as a whole. The impact may produce an adverse socio-political
response (which has its origins in the public aversion to certain characteristics
of the hazards concerned). The harm which results is a loss of confidence
by society in the provisions and arrangements in place for protecting
people and, consequently, a loss of trust in the regulator and duty-holders
with respect to control of the particular hazard and hazards more generally.
This might arise where large numbers of people are killed at one
time (which we call "societal risk"), where potential victims
are particularly vulnerable (such as children), or where the nature
of the risks inspire dread (such as long-term or irreversible effects).
There is no guidance from the courts as to whether societal concerns
should be taken into account by duty holders in deciding what is grossly
disproportionate. In deciding whether to propose regulations, or in
setting enforcement priorities, HSC considers that risk and sacrifice
must be assessed in its social context. As well as taking account of
individual risk, HSC considers societal concerns.
We believe it is right that, in all cases, the judgment as to whether
measures are grossly disproportionate should reflect societal risk,
that is to say, large numbers of people (employees or the public) being
killed at one go. This is because society has a greater aversion to
an accident killing 10 people than to 10 accidents killing one person
Where HSC considers that duty-holders should take other societal
concerns into account, Regulations, ACOPs or other HSE guidance will
state how duty-holders should take such concerns into account
and what those concerns are.
[back to top]
Transfer of risks
Introduction of a health and safety measure to control a hazard
may transfer risk to other employees or members of the public.
If the transferred risk arises from the same hazard, then
it should be offset against the benefit from the measure under consideration.
For example, the introduction of mechanical exhaust ventilation may
transfer the risk from the same hazard (fumes) from the employee to
the general public as the fumes are pumped outside the workplace. The
added risk to the public should be offset against the benefits the measure
otherwise brings to employees.
If the transferred risk arises from a different hazard,
it should be treated as a separate matter for which control measures
must be introduced to reduce its risk ALARP. For example, providing
scaffold fans to protect members of the public from being struck by
objects dropped from the scaffold will transfer some of the risk from
the public to the scaffolders involved in erecting the fans. Since a
different hazard is involved (ie. scaffolders falling from a height),
the fans should be provided to reduce the risks to the public ALARP,
but at the same time, the duty holder must ensure that the risks of
the scaffolders' working methods are reduced ALARP. However, if
the risks from the health and safety measure to be introduced (in this
example, scaffolding fans) when properly controlled are still greater
than the risks which it is sought to prevent (injury to members of the
public) when properly controlled, the measure should not be introduced.
[back to top]
Duty-holders may wish to alter the conditions in which equipment
is operated or to relax or otherwise alter some or all control measures
in response to changed circumstances. This is permissible provided that
the altered control measures continue to ensure that risks are reduced
[back to top]
The determination of control measures forms part of the statutory
risk assessment duty-holders are required to undertake. Such assessments
involve duty-holders identifying the hazards in their workplace, determining
who might be harmed and how; evaluating the risk from the hazards and
deciding whether the existing control measures are sufficient or whether
more should be done.
In reality, there is often only a limited number of options for
dealing with a particular health and safety issue and the optimum option
is in many cases likely to have been already established as relevant
good practice accepted by HSE as reducing risks ALARP. Often HSE staff
will be able to rely on authoritative documented sources of good practice,
such as HSC ACOPs12 and HSE Guidance, on legal
standards which require risks to be reduced ALARP.
HSE staff should ensure that duty-holders are using good practice
which is appropriate to their activities, relevant to the risks from
their undertaking, and covering all the risks from that undertaking.
Such documents may only deal with some of the risks which the duty-holder
must consider. Good practice which covers all the risks which a duty-holder
must address in order to reduce risks ALARP may not be available, and
this is particularly likely to be so for major investments in safety
measures or where hazards are regulated through safety case regimes.
A universal practice in the industry may not necessarily be good
practice or reduce risks ALARP. Duty holders should not assume that
it is. HSE must keep its acceptance of good practice under review since
it may cease to be relevant with the passage of time; new legislation
may make it no longer acceptable; new technology may make a higher standard
REASONABLY PRACTICABLE. Similarly HSE expects duty-holders to keep relevant
good practice under review.
Probably the majority of judgements made by HSE involves it in
comparing duty-holders' actual or proposed practice against RELEVANT
GOOD PRACTICE. Relevant good practice provides duty-holders with generic
advice for controlling the risk from a hazard. In so far as they can
adopt relevant good practice, this relieves duty-holders of the need
(but not the legal duty) to take explicit account of individual risk,
costs, technical feasibility and the acceptability of residual risk,
since these will also have been considered when the good practice was
In practice therefore, explicit evaluations of risk rarely need
to be made in relation to day-to-day hazards. However, duty-holders
have to make them where there is no relevant good practice establishing
clearly what control measures are required.
[back to top]
Choosing between options
A selection amongst options may be needed at any stage of a particular
project: at the design stage, involving choice between different design
concepts for the whole project, and, as the project is developed, between
more detailed options. In making these options, duty-holders must consider
the risks involved in the whole life-cycle of a project.
At the design stage, where safety cases or plans are required to
be submitted to HSE, HSE will assess the option which duty-holders put
before it, but where that option does not reduce risks ALARP, HSE may
reject a safety case, ask duty holders to consider a different option,
or use its enforcement powers to prevent further work (depending on
the situation in question). HSE will make its judgement as to whether
the design presented to it reduces risks ALARP based on its knowledge
as a regulator, including its knowledge of good practice in that area,
and its knowledge of other possible design options. Where the option
put forward does not reduce risks ALARP, HSE may intervene according
to the situation in question - for example, to prevent further work
or to inform the duty-holder of its opinion.
The reason for the design chosen will be a relevant factor
in considering what it is reasonably practicable to do. Depending on
the particular legal context and the circumstances in question, where
the very essence or ethos of the business could not be achieved without
following the design suggested, then HSE could not reject the option
so as to prevent the undertaking proceeding. The question would be how
to reduce the risks of that option ALARP. But such situations will be
rare. In most cases, there will be several options for achieving the
essence of the business in question.
At a more detailed level, HSE would consider judgements as to whether
risks are or will be controlled ALARP as central to deciding between
options, though again the reason for the option chosen may still be
a relevant factor. For example, HSE may have to accept a process using
intrinsically more dangerous components since only these components
will provide the products essential to the duty-holder's undertaking.
In practice, duty-holders may have a number of options where an
assessment would show that costs are not grossly disproportionate. The
option, or combination of options which achieves the lowest level of
residual risk should be implemented, provided grossly disproportionate
costs are not incurred. The legal requirement to reduce risks as low as is reasonably practicable rules out HSE accepting a less protected
but significantly cheaper option.
[back to top]
New versus existing plant
It should be borne in mind that reducing the risks from an existing
plant ALARP may still result in a level of residual risk which is higher
than that which would be achieved by reducing the risks ALARP in a similar,
new plant. Factors which could lead to this difference include the practicability
of retrofitting a measure on an existing plant, the extra cost of retrofitting
measures compared to designing them in on the new plant, the risks involved
in installation of the retrofitted measure (which must be weighed against
the benefits it provides after installation) and the projected lifetime
of the existing plant.
All this may mean, for example, that it is not reasonably practicable
to apply retrospectively to existing plant, what may be demanded by
reducing risks ALARP for a new plant (and what may have become good
practice for every new plant).
[back to top]
-  1 KB 704;  1 All ER 743.
- Tucker LJ.
- Asquith LJ.
- The Court of Appeal, in R v. Board of Trustees of the Science Museum  3 All ER 853, held that the term "risk" in s.3, HSWA, means the possibility of danger rather than actual danger.
- SI 1999/.
- SI 1999/743. Reg. 4 requires "all necessary measures" to be taken to prevent major accidents and limit their consequences to persons and the environment. HSE regards this as equivalent to a requirement to reduce the risk of a major accident ALARP.
- The relationship between health and safety and environmental legislation may depend on the terms of the particular legislation in question.
- Whether a reasonably foreseeable, but unlikely, event - such as an earthquake - should be considered depends on the consequences for health and safety of such an event.
- See Annex 1 to Reducing Risks, Protecting People for a fuller discussion.
- It should be noted, however, that the greatest uncertainties generally occur for the less likely but higher consequence events.
- Approved Codes of Practice have a special status under s.17, HSWA, and therefore a special status as good practice. If it is proved that a duty-holder did not follow the relevant provisions of an ACOP, he will need to show that he complied with the law in some other way or he will be found in breach of the law on which the ACOP gives guidance.
Added to HSE website 13 December 2001