In this section
Objective: That all employers carry out a COVID-19 risk assessment.
COVID-19 is a public health emergency. Everyone needs to assess and manage the risks of COVID-19, but businesses in particular should consider the risks to their workers and customers. As an employer, you also have a legal responsibility to protect workers and others from risk to their health and safety. This means you need to think about the risks they face and do everything reasonably practicable to minimise them, recognising you cannot completely eliminate the risk of COVID-19.
You must make sure that the risk assessment for your business addresses the risks of COVID-19, using this guidance to inform your decisions and control measures. A risk assessment is not about creating huge amounts of paperwork, but rather about identifying sensible measures to control the risks in your workplace. If you have fewer than five workers, or are self-employed, you don’t have to write anything down as part of your risk assessment, but it can be useful to do so. Your risk assessment will help you decide whether you have done everything you need to. There are interactive tools available to support you from the HSE.
Employers have a duty to consult their people on health and safety. You can do this by listening and talking to them about the work and how you will manage risks from COVID-19. The people who do the work are often the best people to understand the risks in the workplace and will have a view on how to work safely. Involving them in making decisions shows that you take their health and safety seriously. You must consult with the health and safety representative selected by a recognised trade union or, if there isn’t one, a representative chosen by workers. As an employer, you cannot decide who the representative will be.
At its most effective, full involvement of your workers creates a culture where relationships between employers and workers are based on collaboration, trust and joint problem solving. As is normal practice, workers should be involved in assessing workplace risks and the development and review of workplace health and safety policies in partnership with the employer.
Employers and workers should always come together to resolve issues. If concerns still cannot be resolved, see below for further steps you can take.
How to raise a concern:
- contact your employee representative
- contact your trade union if you have one
- contact HSE at:
The standard risk assessment requirements should be carried out in all circumstances and any additional COVID-19 related guidance followed too.
In accordance with risk assessment procedures, it is important that the operator records what they have done; the steps they have taken to protect staff visiting and contractors; and provides clear advice to those people through briefings, signage or other means. The handling arrangements in emergency and disaster plans and salvage procedures for sites are likely to need reviewing as soon as practical.
Heritage sites and visitor attractions open to the public
The key to successful site opening and managing is to ensure that there are sufficient staff and volunteers on site, working in appropriate conditions, to ensure the visitors and workers have a positive and safe experience. This may mean different staffing levels than normal, and will certainly mean different working practices for everyone on site. It could also be worth amending your usual booking procedures, for example by introducing a pre-booking system.
Operators are responsible for carrying out the standard risk assessment for their sites, but they should expect the general public to heed general government advice about social distancing, travel etc. The risk assessment should look at every point of contact between visitors and staff, and also at every stage of the visitor experience, from pre-visit marketing to visitor arrival, their experience on site and visitor departure. Visitors who endanger others by not observing safety measures should be refused services or entry.
There are many types of heritage sites, and the manager should carefully consider the particular circumstances of their site and consider all guidance in relation to their historic place. Generally, sites that are primarily in the open (e.g. historic parks and gardens, earthwork monuments, battlefields, archaeological sites) are likely to be easily and quickly adapted to allow access. Many of these will be unstaffed sites that are open to the public without charge or open countryside where existing government guidelines on accessing green spaces safely should be followed.
In these cases the heritage designation does not add further issues that need to be considered. With careful thought and a flexible approach to visitor management, almost all other heritage sites will also be able to open and function safely and effectively by following these guidelines alongside other relevant government and sector advice.
Many heritage sites make extensive use of volunteers. They may need additional time to get up to speed with new ways of working as well as changed health and safety requirements and may not have access to on-line guidance or training material. It is important that all volunteers are given sufficient information so that they clearly understand the risks involved in public-facing activities. Volunteers should not be allowed to continue offering support if they do not comply with safety measures.
Businesses operating in historic premises
A wide range of businesses operate in historic premises, including retail, care homes, catering, private tours, accommodation, weddings, concerts, and film and TV production. They will all need to find solutions specific to their business that will achieve a safe and functional environment for staff and visitors/guests or customers. Additional guidance available for each type of business should be consulted and appropriate actions implemented.
Wedding receptions and civil partnership celebrations, including in the form of a sit down meal, can take place up to a maximum of 15 people in tiers 1 and 2 areas, but only where they can be done in a COVID-secure environment/venue. In tier 3 areas, weddings can take place with up to a maximum of 15 people, but receptions are not permitted. In tier 4, weddings and civil partnership ceremonies should not take place except in exceptional circumstances. See further guidance on wedding and civil partnerships receptions and celebrations.
In tier 4 non essential retail must close. In tiers where non essential retain can re-open, the same kind of challenges regarding constrained spaces are likely to apply. Existing guidance for retail businesses should also be followed. Older buildings may have a more complex layout, and managing the flow of visitors and/or customers may be a little more complicated or require a non-standard approach (such as temporarily abandoning managing visitors through guided groups, implementing one-way systems or keeping closed sections of the building which make visiting unsafe). The business will need to think about restricting numbers, and their contingency for avoiding overcrowding within, at and near to the property. In offices in listed buildings, particular attention is likely to be necessary to apply the most effective ways of regularly cleaning any sensitive historic surfaces without causing lasting damage to them (see advice below).
Heritage and conservation specialists and their employers/clients
In relation to heritage and conservation specialists, the guidance in relation to construction sites may apply including, in the case of archaeology, advice available from Prospect and the Chartered Institute for Archaeologists. Particular consideration should be given to working on or visiting sites where health and safety is managed by clients or their agents. The heritage specialist should ensure that the third-party risk assessment and safe system of work are adequate and consistent with their own before entering the site or building. On heritage sites, working areas may well be more constrained, e.g. in excavation trenches or in roof spaces.
Equipment to aid restoration, repair and alteration activity may not always be practical in such sites, so more people may need to be in the same space to carry out specific actions, such as replacing heavy structural beams. Each activity needs to be carefully considered, including thinking about how it might best be delivered. Sites should start from the premise of required social distancing. Work practices may need to be modified, while remaining within existing HSE requirements. Many activities are likely to be possible with appropriate consideration and professional judgement about safe delivery. Where this is not possible work should cease temporarily until it is safe to resume.
Careful documentation as part of the risk assessment process of the risks and training of staff will be important to avoid high risk situations. Where site inspections or other heritage work are temporarily carried out by only one person instead of a team, HSE’s lone-working guidance should be followed.
Collecting data for NHS Test and Trace
Continued opening up of the economy is reliant on NHS Test and Trace being used to minimise transmission of the virus. In order to ensure that businesses are able to remain open, we are now mandating that businesses must ask one member of every party who accesses their services to provide their contact details through NHS Test and Trace. You must have a system to ensure that you can collect contact information for your customers in place.
Many businesses have bookings systems that can be used to effectively collect contact details for their customers, and if you do not already do so, you should do so in order to ensure that you are compliant with the new regulations on NHS Test and Trace.
Designated venues are required to:
Ask at least one member of every party of customers or visitors (up to 6 people) to provide their name and contact details
Keep a record of all staff working on their premises and shift times on a given day and their contact details.
Keep these records of customers, visitors and staff for 21 days and provide data to NHS Test and Trace if requested
Display an official NHS QR code poster, so that customers and visitors can ‘check in’ using this option as an alternative to providing their contact details
Adhere to General Data Protection Regulations
The regulations cover a number of settings in the hospitality, leisure and tourism sectors including heritage locations open to the public (castles, stately homes and other historic houses). Check Maintaining records of staff, customers and visitors to support NHS Test and Trace for details.
These requirements are not applicable to unstaffed, unticketed heritage sites that are open to the public (for example, ruins or prehistoric sites) or archaeological and historic sites which are not open to the public.
Any business that is found not to be compliant with these regulations will be subject to financial penalties. It is vital that you comply with these regulations to help keep people safe, and to keep businesses open.
We have worked with industry and relevant bodies to design a system in line with data protection legislation, details of which can be found here.
Whilst the risk to health from COVID-19 is at the forefront of everyone’s minds, the threat of terrorism nonetheless remains substantial. It is essential that businesses and other organisations remain cognisant of these threats as they look to adjust their operations, ensuring that security measures are proactively adapted to support and complement other changes. For further information, consult the National Counter Terrorism Security Office (NaCTSO) and Centre for Protection National Infrastructure (CPNI) for specific security advice related to COVID-19.
1.1 Managing risk
Objective: To reduce risk to the lowest reasonably practicable level by taking preventative measures, in order of priority.
To help contain the virus, office workers who can work effectively from home should do so over the winter. Where an employer, in consultation with their employee, judges an employee can carry out their normal duties from home they should do so. Public sector employees working in essential services should continue to go into work where necessary. Anyone else who cannot work from home should go to their place of work. The risk of transmission can be substantially reduced if COVID-19 secure guidelines are followed closely. Extra consideration should be given to those people at higher risk.
Employers have a duty to reduce workplace risk to the lowest reasonably practicable level by taking preventative measures. Employers must work with any other employers or contractors sharing the workplace so that everybody’s health and safety is protected. In the context of COVID-19, this means protecting the health and safety of your workers and customers by working through these steps in order:
In every workplace, increasing the frequency of handwashing and surface cleaning.
Businesses and workplaces should make every reasonable effort to ensure their employees can work safely. When in the workplace, everyone should make every reasonable effort to comply with the social distancing guidelines set out by the government (2m, or 1m with risk mitigation where 2m is not viable).
Where the social distancing guidelines cannot be followed in full, in relation to a particular activity, businesses should consider whether that activity needs to continue for the business to operate, and if so, take all the mitigating actions possible to reduce the risk of transmission between their staff.
Further mitigating actions include:
– increasing the frequency of hand washing and surface cleaning
– keeping the activity time involved as short as possible
– using screens or barriers to separate people from each other
– using back-to-back or side-to-side working (rather than face-to-face) whenever possible
– reducing the number of people each person has contact with by using ‘fixed teams or partnering’ (so each person works with only a few others)
Finally, if people must work face-to-face for a sustained period with more than a small group of fixed partners, then you will need to assess whether the activity can safely go ahead. No one is obliged to work in an unsafe work environment.
All venues should ensure that steps are taken to avoid people needing to unduly raise their voices to each other. This includes - but is not limited to - refraining from playing music or broadcasts that may encourage shouting, including if played at a volume that makes normal conversation difficult. This is because of the potential for increased risk of transmission - particularly from aerosol transmission. We will develop further guidance, based on scientific evidence, to enable these activities as soon as possible. You should take similar steps to prevent other close contact activities - such as communal dancing.
In your assessment you should have particular regard to whether the people doing the work are especially vulnerable to COVID-19.
You should also consider the security implications of any changes you intend to make to your operations and practices in response to COVID-19, as any revisions may present new or altered security risks and collection care risks which may need mitigations.
The recommendations in the rest of this document are ones you should consider as you go through this process. You could also consider any advice that has been produced specifically for your sector, for example by trade associations or trades unions.
If you have not already done so, you should carry out an assessment of the risks posed by COVID-19 in your workplace as soon as possible. If you are currently operating, you are likely to have gone through a lot of this thinking already. We recommend that you use this document to identify any further improvements you should make.
Guidance on working safely during the COVID-19 outbreak is available from HSE.
Where the enforcing authority, such as the HSE or your local authority, identifies employers who are not taking action to comply with the relevant public health legislation and guidance to control public health risks, they are empowered to take a range of actions to improve control of workplace risks. For example, this would cover employers not taking appropriate action to ensure social distancing, where possible.
Failure to complete a risk assessment which takes account of COVID-19, or completing a risk assessment but failing to put in place sufficient measures to manage the risk of COVID-19, could constitute a breach of health and safety law. The actions the enforcing authority can take include the provision of specific advice to employers to support them to achieve the required standard, through to issuing enforcement notices to help secure improvements. Serious breaches and failure to comply with enforcement notices can constitute a criminal offence, with serious fines and even imprisonment for up to two years. There is also a wider system of enforcement, which includes specific obligations and conditions for licensed premises.
Employers are expected to respond to any advice or notices issued by enforcing authorities rapidly and are required to do so within any timescales imposed by the enforcing authorities. The vast majority of employers are responsible and will join with the UK’s fight against COVID-19 by working with the Government and their sector bodies to protect their workers and the public. However, inspectors are carrying out compliance checks nationwide to ensure that employers are taking the necessary steps.
1.2 Sharing the results of your risk assessment
You must share the results of your risk assessment with your workforce. If possible, you should consider publishing the results on your website (and we would expect all businesses with over 50 workers to do so).
We would expect all businesses to demonstrate to their workers and customers that they have properly assessed their risk and taken appropriate measures to mitigate this. You should do this by displaying a notification in a prominent place in your business and on your website, if you have one.
Below you will find a notice you should display in your workplace to show you have followed this guidance.
There may also be other industry standards or marks that you can use to demonstrate to any visitors, guests and customers that you have thought carefully about risk.
If there are more than 5 cases of COVID-19 within 14 days associated with your workplace, you should contact your local PHE health protection team to report the suspected outbreak. Find your local PHE health protection team.