Key takeaways:

  • You have final responsibility: Even if you delegate day-to-day risk assessments, the ultimate legal responsibility for Health & Safety remains with you as the business owner.
  • Establishing a competent person: A competent person needs the right mix of skills, practical knowledge, training, and real-world experience relevant to your specific industry.
  • Look inward first: The Health & Safety Executive (HSE) prefers you to appoint an existing, competent employee before looking for external help. If you have to find an external source of competence, HS Direct is here to take the weight off your shoulders.

As a business owner, you should know that choosing the right person to take on your risk assessment management is vital to staying compliant and keeping your team safe.

If you’re wondering how to delegate this all-important task, we’re here to help. We’ll walk you through everything you need to know about choosing the perfect person for the job, from the qualifications to look out for to whether you should hire an external risk manager or train up an existing employee.

Contents:

Who is responsible for risk assessments?

When it comes to risk assessments, whether you’re an employer or self-employed, you have final responsibility. Steps need to be taken to complete the “effective planning, organisation, control, monitoring and review of preventive and protective measures”.

You’re legally required to carry out risk assessments within your workplace, but you don’t necessarily have to be the one to do it.

You can choose an appropriate person with the necessary skills and experience to handle day-to-day risk assessment management. As outlined in the Management of Health and Safety at Work Regulations 1999, this individual must be a ‘competent person’.

But even if you choose to delegate the responsibility, it’s ultimately still on you to make sure all due diligence is carried out properly.

If you need a refresher on the basics, check out our ultimate guide to risk assessments.

What is a ‘competent person’?

A ‘competent person’ is someone who has the necessary skills, knowledge, training, and experience to identify any and all hazards in your workplace and put control measures in place to avoid them entirely or reduce the impact.

Under Health & Safety law, the Health and Safety Executive (HSE) requires all employers to appoint at least one ‘competent person’ to help manage their duties. Here are the key requirements to keep in mind:

  • Training and knowledge — They need practical and theoretical knowledge that’s relevant to the work your business carries out.
  • Experience — They should be familiar with the specific hazards and risks that can be found in your industry or working environment.
  • Hierarchy of appointment — Where possible, the HSE prefers employers to appoint an existing, competent employee before seeking external help.
  • Limitations — While a competent person can offer expert advice and practical assistance, the overall legal responsibility for Health & Safety always remains with the business owner.

Who is a competent person in a workplace?

Your chosen risk assessment manager will play an important role in keeping your work environment safe and compliant, and their job will be to identify and evaluate potential risks, implement control measures, and maintain records of all previous assessments.

When it comes to choosing who acts as your risk assessment manager, here are the three main competent person examples:

  • Yourself — As the employer, you can take on the role of the risk assessment manager if you have the necessary qualifications and training.
  • Somebody else in the business — You can choose an existing employee or multiple employees within your organisation to manage risk assessments, provided they meet the competency criteria.
  • Somebody external — Another option is to hire an external consultant or professional service specialising in risk assessment to oversee the process. This is a great choice for smaller businesses that might not have the in-house expertise needed.

If you decide to handle things internally, it’s a good idea to familiarise yourself with the legal requirements for risk assessments and method statements.

Should a risk assessment manager have qualifications and training?

You wouldn’t assign someone to carry out a manual task without the right training and experience, and the same applies to risk assessments. Picking the best person for the role is crucial, and you’ll need to take their training and qualifications into consideration when you’re delegating the task.

Qualifications

Your risk assessment manager should have the necessary qualifications to carry out their duties. These qualifications typically include:

  • Occupational Health & Safety — Credentials like NEBOSH (National Examination Board in Occupational Safety and Health) or IOSH certificates are preferred by UK employers and show a strong foundation in safety principles.
  • Enterprise risk — Certifications from the Institute of Risk Management (IRM) or degrees in Business, Finance, or Engineering can be relevant depending on the complexity of your business.
  • Auditing — Qualifications in specific compliance and management standards, like ISO 14001 or ISO 45001, show they know how to monitor and review safety systems.

Training

As well as qualifications, your chosen risk assessment manager should have gone through proper training in risk assessment best practices. They should know the specific requirements of your industry and have a solid understanding of how to identify, evaluate, and mitigate risks effectively.

Look out for core training in:

  • Hazard identification — Knowing how to systematically spot hazards and gauge the severity of potential harm.
  • Control implementation — Designing actionable controls to reduce risks to an acceptable level.
  • Specialist assessments — Training for specific site dangers, such as COSHH (Control of Substances Hazardous to Health), DSE (Display Screen Equipment), or Fire Risk Assessments.
  • Accident investigation — Knowing how to determine root causes and report incidents (e.g. RIDDOR requirements).

What is a risk manager?

If you decide not to use an internal employee to handle your risk assessments, you might look at hiring a risk manager instead. But what exactly are they?

Essentially, a risk manager is a dedicated professional who is responsible for identifying, assessing, and managing potential threats to an organisation’s profitability, security, and overall success.

These are usually external consultants who come into a business to help navigate uncertainty by creating contingency plans and developing controls to minimise losses from financial, operational, and regulatory risks.

What does a risk manager do?

So, what does a risk manager do on a day-to-day basis?

A risk manager reviews a company’s risk profile to uncover any potential financial, safety, or security risks. First, the leadership team sets out the overall risk tolerance for the business (how much risk they’re comfortable with, and any hard-stop areas that need to be addressed immediately if found).

Then, the risk manager lays out the procedures and processes to help the business put any necessary avoidance strategies or mitigation plans (like taking out specific insurance policies) in place to reduce the impact of those risks.

Because many organisations have gaps in their training and development, a risk manager will usually also create training programs to help reduce a company’s exposure to risk.

Does your business need a dedicated risk manager?

Deciding whether to bring in a dedicated external risk manager or train up an existing staff member is a big call.

Here’s a quick breakdown of the pros and cons of each option:

OptionProsCons
Option 1: Hiring a dedicated Risk Manager (Bringing in an outside expert)
  • Instant expertise — They already have deep, regulatory knowledge and specialised certifications from day one.
  • Unbiased perspective — An external hire looks at your operations with fresh eyes, catching blind spots that internal staff might miss.
  • Dedicated focus — Their sole responsibility is risk, making sure safety and compliance tasks never get pushed to the back burner.
  • Higher costs — A dedicated salary, benefits, and onboarding packages call for a significant financial commitment.
  • Learning curve — They will need time to understand your specific company culture, workflows, and unique operational quirks.
Option 2: Training an existing staff member (Upskilling a trusted employee)
  • Deep company knowledge — The employee already clearly understands your workflows, team dynamics, and business culture.
  • Cost-effective — Training courses and certifications are significantly cheaper than recruiting and paying a new full-time executive’s salary.
  • High trust — You already know their work ethic, reliability, and loyalty to the company brand.
  • Divided attention — Risk assessment becomes a side gig tacked onto their existing daily workload, which can lead to burnout or overlooked hazards.
  • Limited scope — A newly trained employee will lack the deep, nuanced experience needed to handle complex legal or high-stakes regulatory crises.
  • Internal blind spots — Familiarity breeds comfort; existing staff may overlook systemic risks simply because “that’s how we’ve always done it.”

Get risk assessment support at HS Direct

Choosing the right person for your risk assessment management is a big decision, but getting your actual assessments sorted doesn’t have to be a headache.

If you’re managing things in-house, having the right templates on hand makes life a lot easier for your competent person. At HS Direct, we offer a huge library of Health & Safety risk assessments, ranging from a blank risk assessment template you can customise to specific documents like an electrical fitting risk assessment or a dedicated fire risk assessment template.

Ready to take the stress out of compliance? Get in touch today and find out how we can support your business.

FAQs

Can I legally act as the “competent person” for my own business?
Yes, if you feel you have the necessary skills, hands-on experience, and practical knowledge of the hazards in your workplace, you can take on the role yourself. Many small business owners choose this route to keep costs down, helped by professional templates and guides.

What happens if my competent person leaves the company?
Having a competent person appointed is a strict legal requirement, so you’ll need to fill the gap quickly. If your designated safety lead hands in their notice, you should immediately look to appoint a temporary external advisor, upskill another staff member, or step into the role yourself to ensure your business remains compliant.

Does the competent person carry personal legal liability if an accident happens?
Generally, no. While the competent person is responsible for identifying hazards and advising on controls, the ultimate legal duty of care and overall liability under UK law always remains with the employer or business owner. As long as the competent person has acted in good faith and to the best of their professional ability, they are not personally prosecuted for workplace accidents.