Every safety duty in this industry eventually funnels into one document: the risk assessment. Forklift rules, COSHH, PPE, manual handling, first aid - each regime assumes a risk assessment underneath it. The Management of Health and Safety at Work Regulations 1999 set the legal minimum, and it fits on three lines. The craft is in making those three lines true for a real operation.
Under the 1999 Regulations, an employer must - at minimum:
That is the whole statutory skeleton. Everything else - templates, matrices, scoring systems - is method, not law. The duty also reaches beyond your own payroll: you are required to protect your employees AND others from harm, which in a depot means agency staff, visiting drivers, contractors and the public at the gate.
The identification step fails when it copies a generic list. A fleet’s real inventory includes: vehicle movements in the yard (still the big one), forklifts and pedestrians sharing space, manual handling at the dock and at delivery points, falls from vehicle beds and cabs, hazardous substances in the workshop, lone working on the road and on nights, work at height on curtainsiders, and the risks the operation exports - the delivery at someone else’s premises, on their stairs, in their car park. Each gets the same treatment: how likely, how bad, then eliminate or control.
The third duty has an order built into it: eliminate first, control only what cannot be eliminated. The pedestrian route that removes people from the shunting area beats the hi-vis policy that tolerates the mix. The tail lift that removes the manual lift beats the lifting-technique poster. Assessments that end in “staff to take care” have usually skipped the eliminate half of the duty.
HSE’s own guidance is that for most small, low-risk businesses the steps are straightforward - the framework scales. A two-van operator’s assessment can be a few honest pages; a multi-site fleet’s needs the same logic with more rows. What neither needs is theatre: forty-page matrices nobody reads, or a bought-in template listing hazards the site does not have while missing the ones it does.
The assessment that satisfied an insurer three years ago describes a business that no longer exists. New vehicles, new contracts, new premises, new shift patterns and every incident are all triggers to revisit it. And the self-employed are not automatically outside the regime - if your work could harm others, check whether health and safety law applies to you.
Someone has to own the assessment, and “someone” is the employer - the duty sits with the business, not with a consultant hired to hold it. Outside help can draft, but the operation that cannot explain its own assessment to an inspector does not have one; it has a purchase receipt. Write it for the people who will use it: supervisors making tonight’s decisions, drivers reading a delivery-point plan, agency staff on their first shift. The audience test is brutal and useful - if the night-shift lead cannot find the bit that matters to tonight’s problem in thirty seconds, the document is a compliance ornament rather than a control.
And involve the workforce in building it. The driver who does the route daily knows which customer’s yard floods and which dock plate sticks; an assessment written without that knowledge misses the hazards and loses the audience in the same move.
Notice how often this post’s three duties surface inside the other regimes: COSHH assessments, manual handling assessments, first-aid needs assessments, PPE suitability assessments - each is the same identify-judge-control logic wearing a topic hat. A business that gets the underlying habit right finds the topic-specific versions write themselves; one that treats each as a separate chore ends up with a folder of inconsistent paperwork. The 1999 Regulations are the trunk; everything else is branches.