Employers have a legal duty to assess, control and monitor the risks in the workplace so that employees and others are protected from harm. Where PPE is part of the answer, the risk assessment is where that decision is made, recorded and justified.

This module takes you through each step of a risk assessment and explains what makes an assessment suitable and sufficient, with particular attention to the selection, use, maintenance and storage of PPE. It also explains the wider duties that the Safety, Health and Welfare at Work Act 2005 and the General Application Regulations 2007 place on employers and other duty holders, which the PPE provisions build on.

Finally, the module gives practical guidance to employers and the self-employed on selecting and providing PPE: making sure it is suitable, that it fits, that it is compatible with other PPE, and that employees are involved and understand why it matters.

Even if you will never write a risk assessment yourself, understanding how one is done lets you give your employer the information they need, spot when a control is missing, and understand why the PPE rules in your workplace are what they are.

The topics covered in this module are:

• What a risk assessment is, and who should carry it out
• Hazard and risk: what the words mean
• The five steps of risk assessment
• Step 1: identifying the hazards, and the PPE-specific questions
• Step 2: deciding who might be harmed, including people nearby
• Step 3: evaluating the risks and deciding on controls
• Step 4: recording the findings and putting them into practice
• Step 5: reviewing and updating
• Providing PPE: employers, agencies and the self-employed
• Selecting suitable PPE: fit, comfort, compatibility and replacement
• The duties of manufacturers and suppliers, and PPE markings

The Health and Safety Authority describes a risk assessment as a careful examination of what, in your work, could cause harm to people, so that you can weigh up whether you have taken enough precautions or should do more to prevent harm.

As Module 1 explained, risk assessment is required by the Safety, Health and Welfare at Work Act 2005 and the General Application Regulations 2007, and other regulations, including those on PPE, chemical agents, noise and asbestos, require it too. In Ireland every employer must record the assessment in writing, whatever the size of the business, and base the Safety Statement on it.

A risk assessment has five steps:

• Identify the hazards.
• Decide who might be harmed, and how.
• Evaluate the risks and decide on the control measures.
• Record the findings and put them into practice.
• Review and update the assessment regularly.

The assessment must be carried out by a competent person: someone with the authority, knowledge, skills and experience of the work to do it properly. Usually that is an experienced manager or supervisor, who calls on specialists, an occupational hygienist for dust or noise, for example, where needed.

Module 1 covered 'reasonably practicable' and the hierarchy of control. Two more words matter for risk assessment: hazard and risk.

A hazard is anything with the potential to cause harm: injury, ill health, death, or physical or psychological damage to a person. Hazards come from substances, activities, processes and ways of working. Working at height, operating machinery, handling chemicals and working near electricity are all hazards.

Risk is the likelihood that someone will actually be harmed by the hazard, combined with how serious that harm could be. Examples of significant risks include:

• Exposure to harmful bacteria or viruses that can cause serious illness or death.
• Working near live electrical parts, with the risk of electrocution or serious burns.
• Working at height without proper platforms, guardrails and toe-boards, with the risk of fatal or life-changing injury.
• Working near the dangerous parts of machinery, with the risk of amputation, crushing or cuts.
• Poor manual handling techniques, with the risk of immediate injuries such as fractures, or long-term damage to the back.

In the workplace, a hazard is the potential to cause harm; the risk depends on how the work is done.

Take working at height as the hazard. If the work is done from a stable, properly guarded platform, the risk of a fall is small and no further precaution may be needed. If the same work is done without adequate fall prevention, the risk of a fall rises sharply, and the employer must find a safer way of doing it.

So risk assessment is simply a way of identifying the possible sources of harm, the hazards, and judging how likely and how serious the harm could be, the risks, for the people who could be affected.

A good risk assessment leads to the selection and implementation of controls that are suitable and sufficient for the risks of the work. For PPE, it answers three questions: is PPE needed at all once the higher controls are in place; if so, what type and standard; and who must wear it, when, and how it will be checked and maintained.

The person carrying out the assessment must understand the work activities and processes well enough to spot the hazards. Practical ways of identifying them include:

• Walking through the workplace and looking at what could cause harm, task by task, including infrequent jobs such as maintenance and cleaning.
• Applying the hierarchy of control from the start: PPE is a last resort for the risk that remains after the more effective measures have been put in place. The competent person decides where PPE is needed and who will wear it, including part-time, temporary and agency workers.
• Checking whether the layout of the work area protects other people: is welding done in a screened bay, is grinding isolated from the people who walk past?
• Considering the people who will use the PPE: are they instructed and, where necessary, trained; are there arrangements for storage, maintenance and repair; is the storage clean, dry, well lit and easy to reach; are the people who maintain the PPE competent?
• Reading the manufacturers' instructions and safety data sheets, which state the hazards and the protection required.
• Reviewing accident, near-miss and first-aid records, which often show injuries caused by missing or misused PPE and what was done about them.

When identifying hazards that may call for PPE, several specific questions need to be answered:

• Which type and class of PPE suits the hazard? A disposable FFP2 mask may be adequate for occasional work in low levels of general dust, but regular exposure to higher dust levels needs a reusable respirator with P3 filters, and a solvent vapour needs a different filter altogether.
• Will the PPE fit the individual user, after adjustment, and can they wear it for the whole time the risk is present?
• Does the PPE actually control the residual risk, remembering that it is the last resort in the hierarchy?
• Are the different items of PPE compatible with each other? If head protection and hearing protection are both needed, a helmet with integrated earmuffs avoids the problem of separate earmuffs that cannot seal properly under a helmet.
• Does the PPE itself create a new risk? A welding shield restricts vision; several items worn together in a confined space can restrict movement and make escape harder; gloves near rotating machinery can be caught and drag the hand in.
• For how long will each item last, and how will it be replaced?

The answers go into the assessment, so that the PPE chosen is a considered decision rather than whatever happens to be in the store.

The second step has two parts: identifying the people who could be harmed by each risk, and understanding how they could be harmed. Harm may be direct, an injury to the person doing the work, or indirect, to someone helping with the task who is not protected by the PPE.

Two groups are most affected when PPE is used:

• The people wearing the PPE.
• The people nearby or passing through: other employees, contractors, visitors and members of the public.

Temporary staff, part-time workers, agency workers and subcontractors must be included in the assessment. They are often less familiar with the task, the working conditions and the hazards of the workplace, and they may not have been given the same PPE or training as the permanent staff.

Young workers, new workers, pregnant workers and people with a disability or a health condition may also be at greater risk, and may need different or additional PPE; a respirator that fits one face will not fit another, and a standard harness may not fit every body.

Visitors and passers-by must be protected as well as the people doing the work. PPE is often used with work equipment that also puts people nearby at risk, so wherever possible the work should be done in an area with enough space for safe operation, so that no one passing is exposed to flying debris, sparks or fumes from welding, grinding or cutting.

When work is done above areas where people normally work or walk, those areas must be cordoned off while the work goes on. Failing to do so exposes everyone below to serious risk from falling objects.

Visitors must be considered in the risk assessment too. They should never be exposed directly to the risks of the work, and where they need to be near an activity for which PPE is required, suitable PPE must be provided to them, with instruction in how to use it, unless they already have their own PPE of an equivalent standard, as other contractors normally will.

The simplest protection for others is distance and separation: screens, barriers, exclusion zones and clear signs that keep people out of the area where PPE is required.

Having identified who could be harmed and how, the assessor decides how likely the harm is and what needs to be done about it.

Module 1 introduced 'reasonably practicable'. If a risk has already been reduced to an insignificant level, nothing more is needed. But if PPE is even being considered, that in itself shows that a significant risk remains and must be controlled.

At this point the HSA advises the assessor to consider two things:

• What is already being done to control the risk?
• Is anything more needed to make the existing controls effective?

Most workplaces already have controls in place. For PPE, these are often specific to particular processes: safety goggles and hearing protection for grinding, a face-fit-tested respirator for spray painting, a harness for a specific task at height. The assessor checks whether each of these is the right item, of the right standard, used in the right way.

For each hazard linked to the use of PPE, the assessor must look critically at how the risk is currently managed:

• Can the risk be avoided altogether? This is always the first question. Cleaning windows from the ground with an extension pole removes the need for ladders or platforms, and with them the need for a harness.
• Can the controls be improved so that PPE is no longer needed? A vacuum cleaner with a high-efficiency filter removes dust that dry sweeping would throw into the air and into the workers' lungs.
• Is anything missing from the current precautions? Check the PPE manufacturers' instructions and confirm that the equipment is used and maintained as they specify.
• Is there more information about the hazard? Manufacturers and suppliers of PPE, and of the substances and equipment being used, are legally required to provide information about the risks and the controls.

Where the assessor concludes that PPE is essential for controlling the residual risk, the assessment must set out how the PPE will be selected, used, monitored, maintained and stored, and who is responsible for each of those things.

The fourth step is to write down the significant findings of the first three steps and make sure they are put into practice: the main hazards, who could be harmed and how, and the controls that have been agreed, including the PPE.

Not every hazard needs to be written down. Where general precautions already control a risk adequately, for example normal lighting that is suitable and sufficient, it need not appear in the assessment; the assessment records the significant risks and the specific controls for them.

Recording the controls is only half of the step. The assessment must also say how the controls will be implemented in practice: who supervises, who monitors, who checks that the PPE is being worn and is in good condition. Experience shows again and again that PPE stops being used when nobody is checking.

In Ireland every employer must record the risk assessment in writing and base the Safety Statement on it, whatever the size of the business. The written assessment must be brought to the attention of the employees affected, in a form and language they understand.

The final step is for the competent person to review the assessment regularly, and to update it whenever there is a significant change in the workplace that could affect it. Questions to ask at each review include:

• New processes: have new processes, work equipment or changes to the layout been introduced, and do they change the risks or the controls?
• Outstanding improvements: are there actions from the last assessment that have still not been completed?
• Employee feedback: have the people doing the work been asked about the risks and about how well the PPE works in practice, whether it fits, whether it is comfortable, whether it gets in the way?
• New equipment or machinery: does it need its own assessment, and are the existing PPE controls still suitable?
• New employees: do new, temporary or agency workers have the training and PPE they need?
• Accidents and near misses: has anything happened that suggests the controls are not working?

Any changes must be recorded in the assessment, and the employees affected must be told about them, usually through a toolbox talk or a short training session, so that everyone knows the updated risks and controls.

The duty to carry out the risk assessment lies with the employer, and failing to do one, or doing one that is not adequate, is an offence under the Safety, Health and Welfare at Work Act 2005.

• The regulations require employers to provide PPE free of charge to their employees. The same protection applies to casual, part-time and intermittent workers, who must be supplied, trained and supervised in the same way as full-time staff.
• Agency workers: the agency, as the employer, is responsible for making sure the worker has the PPE the regulations require, and the business using the worker must supervise and monitor them like any other employee. In practice the two must agree who supplies what, and the hirer must never let a worker start without the PPE the task needs.
• The genuinely self-employed, people who provide their services as a business and control how they do the work, have the same duties for themselves. A self-employed builder must assess the risks and provide their own PPE.
• A self-employed person working on a site controlled by another company must follow that company's site rules on PPE, which will be based on the site risk assessment, and must provide PPE for anyone working under their control, such as a casual labourer.

Choosing the right PPE is part of the risk assessment, not an afterthought. PPE must:

• Be suitable for the task: the type and class of PPE is decided during the risk assessment, and managers, supervisors and users must all be told which PPE is required for which task.
• Meet recognised standards: PPE must carry the CE mark and the reference to the standard it meets, for example EN 166 for eye protection or EN 149 for disposable respirators. Suppliers can advise on the right markings for the intended use, and manufacturers must provide information on the performance of their PPE, but the legal responsibility for providing the right PPE stays with the employer. For specialist items such as harnesses and respiratory equipment, expert advice from a specialist supplier is often needed.
• Be replaced regularly: how often depends on the type of PPE and how it is used, and both must be considered when it is bought. Under-ordering leads to worn-out, unsafe PPE being used for too long; over-ordering leads to stock that goes out of date. Managers and supervisors must check regularly that every worker has adequate, working, in-date PPE.
• Be right for the conditions: a disposable mask that soaks through in a hot, humid environment, or gloves that make a fine task impossible, will not be worn, and PPE that is not worn protects no one.

PPE only protects when it fits, when it is comfortable enough to be worn for the whole exposure, and when it works with the other PPE the person is wearing. Employers must ensure that PPE:

• Fits the intended user: employers may need to stock a range of sizes, and some PPE, above all tight-fitting masks and respirators, must be fitted to the individual. Face-fit testing is covered in Module 3.
• Is of a suitable weight: heavy welding helmets, breathing apparatus and protective suits are tiring to wear, and the health and physical capability of the user must be taken into account when the PPE is assigned.
• Is compatible when items are used together: the arms of safety spectacles can lift earmuffs away from the head and break the seal; earmuffs on a separate headband cannot sit correctly under a safety helmet; a helmet with integrated hearing protection solves both problems. A respirator must seal with a visor or goggles in place, not only on its own.
• Does not hinder escape: several items of PPE worn together, especially in a confined space, can slow a person down in an emergency, and the selection must be reviewed with that in mind.

Involving the people who will wear the PPE in choosing it, trying several models before buying, is the single most effective way of making sure it is worn.

Manufacturers and suppliers must ensure that PPE is designed and made to meet the essential health and safety requirements that apply to it.

• Those requirements cover the materials used; the levels of protection offered, for example the different impact ratings for eye protection; the classes of protection, such as the categories of respiratory protective equipment; and the manufacturer's instructions and information that must accompany the product.
• PPE must carry the CE mark and the number of the standard it conforms to. Only very small items, such as earplugs, may carry the marking on the packaging and the accompanying information instead of on the item itself.
• The marking is the employer's proof that the item has been through conformity assessment, and the accompanying information tells the employer exactly what it protects against and to what level.

Employers should talk to the manufacturer or supplier about their needs and describe the hazards and risks involved, so that the supplier can propose PPE that gives the protection required. The employer must then check that the standards shown on the equipment and in its documentation are sufficient for the risks identified in the assessment. The supplier advises; the employer decides and remains responsible.

Employers must consult their employees on the health and safety measures that affect them, and PPE is one of the areas where consultation pays off most. The people who wear the equipment know whether it fits, whether it steams up, whether it can be worn for a full shift, and whether it gets in the way of the job.

• Let workers try two or three models before a purchase is made, and record their preference in the assessment.
• Ask the safety representative and the supervisors to report problems with PPE as they arise, not at the annual review.
• Explain why the PPE is needed, what it protects against and what happens to the body if it is not worn. People who understand the risk wear the protection.
• Make it easy: PPE that is close to hand, clean, dry and in the right size gets used; PPE that has to be fetched from a locked store does not.

Consultation is a legal duty, but it is also the cheapest way of making sure that the PPE you pay for is actually worn.