Competent Person Requirements Under Regulation 7 of the MHSWR 1999: A Practical Guide for Employers

Competent person requirements – Regulation 7 of the Management of Health and Safety at Work Regulations 1999 sits quietly in the background of most UK workplaces, but it carries real weight. It places a direct duty on every employer to appoint one or more people to help them comply with their health and safety obligations. That sounds simple. In practice, it is one of the most misunderstood duties in UK workplace compliance, and one of the first things the Health and Safety Executive looks at when things go wrong.

The core question is not whether you have appointed someone. It is whether the person you have appointed is genuinely competent for the risks and activities in your business. Competence here has a legal meaning, not a job-title meaning. A safety coordinator, an office manager with a NEBOSH General Certificate, or a director who has “always handled that side of things” may or may not meet the test. This guide explains what a competent person health and safety appointment actually requires under Regulation 7, how competence is judged, and when outsourcing to a consultant is a defensible and often sensible way to meet the duty.

The content below is written for employers, directors, HR leads, facilities managers and managing agents who either need to appoint a competent person for the first time, review an existing appointment, or justify the arrangement to an insurer, client or enforcing authority.

What Regulation 7 of the MHSWR 1999 Actually Requires

Regulation 7 of the Management of Health and Safety at Work Regulations 1999 requires every employer to appoint one or more competent persons to assist them in undertaking the measures needed to comply with the requirements and prohibitions imposed on them by health and safety law. The wording is deliberately broad because it has to apply equally to a five-person office, a multi-site logistics operation and a specialist manufacturer handling hazardous substances.

The duty is not discretionary. It applies to every employer regardless of size or sector. There is no small-business exemption and no carve-out for low-risk environments. A solicitors’ practice, a veterinary surgery and an engineering workshop all have to make an appointment. What differs is the depth of expertise required, not whether the duty applies.

Regulation 7 also sets out several supporting obligations that employers frequently overlook:

• the appointed person must be given adequate time and means to carry out their functions
• they must be given the information they need about the risks in the business, including any specific hazards, young workers, or shared workplaces
• where more than one competent person is appointed, arrangements must be in place to ensure they cooperate
• preference should be given to appointing someone from within the employer’s own staff, provided they are competent, over engaging an external service

That last point is often misread. The preference for an in-house appointment is not a prohibition on outsourcing. It is a preference that only applies where a suitably competent internal person actually exists. If no one internally has the knowledge, experience or capacity to advise on the risks involved, the employer is expected to look externally rather than pretend the duty is being met.

The practical effect is that Regulation 7 forces the employer to make a conscious, documented choice about who is advising them on health and safety, what that person is qualified to advise on, and whether the arrangement genuinely covers the risks present in the business.

Defining a Competent Person in Health and Safety Law

Under the Management of Health and Safety at Work Regulations 1999, a person is regarded as competent where they have sufficient training and experience or knowledge and other qualities to properly assist the employer in meeting their statutory duties. The regulation deliberately avoids naming specific qualifications. Competence is contextual. It is judged against the actual risks, activities and environment of the employer making the appointment.

Further guidance can be found in the Health and Safety at Work Act 1974.

This matters because it rules out two common misconceptions. The first is that holding a particular certificate automatically makes someone competent. It does not. A NEBOSH or IOSH qualification is evidence of baseline knowledge, but on its own it does not demonstrate that the holder understands the specific risks in your workplace. The second misconception is that long experience is enough. Twenty years of doing something a certain way is not the same as twenty years of keeping up with changing legislation, guidance and good practice.

A defensible definition of competence in this context draws together four strands:

• relevant knowledge of the legal framework, including the Health and Safety at Work etc Act 1974 and the specific regulations that apply to the employer’s activities
• sufficient training and experience in the type of workplace, industry or hazard being advised on
• the ability to recognise the limits of their own competence and know when to seek further specialist input
• enough time, authority and access to information to carry out the role properly

The final point is regularly the weakest. Someone can be technically capable yet functionally incompetent because they are given no time, no budget and no authority to act on what they find. The law treats that as a failure of appointment, not just a failure of resourcing.

It is also worth noting that “other qualities” in the regulation does meaningful work. It allows for competence built through apprenticeship routes, specialist operational experience and sector-specific knowledge that may not be captured by formal qualifications alone. A competent person on a working farm, in a nuclear licensed site, or in a care home is not measured by the same yardstick. The test is whether the person can properly assist this employer with these risks.

How the Courts and HSE Interpret Competence

The written regulation is only part of the picture. How it is applied in practice comes from HSE enforcement decisions, prosecutions and inspector guidance, and from the courts when incidents are examined after the fact. The consistent theme is that competence is tested against outcomes and adequacy, not against job titles.

When an HSE inspector examines a Regulation 7 appointment, the questions asked tend to follow a predictable pattern. Who is appointed? What are their qualifications and experience? What risks in the business are they expected to advise on? Do those risks actually match their competence? Have they had enough time and access to carry out the role? Is there documentary evidence of the advice they have given and the actions taken in response?

Where these questions produce weak answers, the appointment is treated as insufficient even if someone is nominally in post. In prosecutions following serious injury or fatality, it is common for the competence of advisers to be scrutinised closely. Tribunals and courts have shown little patience with arrangements where the appointed person clearly lacked the expertise for the hazard involved, whether that was fire safety in a complex building, machinery guarding in a production line, or control of substances hazardous to health.

The HSE’s own guidance, including its long-standing position on managing for health and safety, reinforces that competence is built through a mix of training, knowledge, experience, personal qualities and ongoing development. Inspectors will also look at what happens when the appointed person is absent, when the business changes, or when a new activity is introduced. If competence disappears the moment one person is on leave or a new process starts, the arrangement was never adequate in the first place.

Two practical inferences follow. First, competence is not a one-off box-tick at the point of appointment. It has to be maintained, reviewed and demonstrable. Second, where the risks of the business genuinely exceed the knowledge of any available internal person, relying on that person anyway is not a neutral choice. It is a compliance gap that tends to become visible only after an incident, by which point the employer is answering the question rather than controlling it.

Who Can Be Appointed: Internal Staff, External Consultants, or Both

Regulation 7 allows an employer to appoint an internal employee, an external adviser, or a combination of both. The decision is not purely about cost or preference. It is about matching the competence available to the risk profile of the business.

In-House Appointments

An internal appointment is usually sensible where the business has someone with genuine health and safety knowledge, sufficient seniority or authority to influence decisions, and enough time allocated to the role. Larger employers often have a dedicated health and safety manager or team, supported by general management commitment. Smaller employers sometimes appoint an operations manager, HR lead or director, which can work well where the risks are straightforward and the person has received appropriate training.

The strengths of an in-house appointment are obvious: day-to-day presence on site, detailed knowledge of the operation, immediate availability, and an understanding of the workforce and culture. The weaknesses are equally predictable: divided attention, gaps in specialist knowledge, limited exposure to other workplaces and practices, and the risk of drift where the same person signs off their own arrangements year after year.

External Consultants

An external health and safety consultant is appropriate where the risks in the business require specialist knowledge that is not available internally, where the employer does not have the scale to justify a full-time internal role, or where a level of independent challenge is genuinely useful. Consultants bring breadth of experience across sectors, up-to-date knowledge of changing regulation and guidance, and a professional distance that can be helpful when awkward issues need raising.

The practical value of an outsourced competent person is that it gives a small or medium employer access to the same quality of advice that a larger business would expect from an in-house team, without carrying the fixed cost. It also provides evidence of independent competence, which insurers, clients and prospective tenants increasingly expect to see.

Combined Arrangements

Many employers end up with a combined model, and this is often the strongest approach. An internal person, typically a manager or director, takes day-to-day responsibility for implementing arrangements, communicating with staff and maintaining records. An external consultant provides specialist input, reviews risk assessments, supports audits, advises on new activities, and acts as the technical reference point for complex issues such as fire risk assessment, COSHH assessments, or manual handling controls.

Where this model is used, the lines of responsibility must be clear. Regulation 7 expects cooperation between appointed persons where more than one is in place. In practice that means a written scope of services, defined communication arrangements, and clarity about who signs off what. Without that, the combined model can quietly become a gap where each party assumes the other is handling something.

When Outsourcing to a Health and Safety Consultant Satisfies the Duty

Outsourcing to a health and safety consultant can fully satisfy the Regulation 7 duty, provided the appointment is structured properly. The test is not whether the competent person is employed by the business. It is whether they are genuinely competent for the risks, adequately informed, given sufficient time, and properly integrated into the employer’s management arrangements.

An outsourced competent person arrangement typically satisfies the duty where the following conditions are met.

• the consultant has demonstrable qualifications, experience and sector knowledge relevant to the employer’s activities
• the scope of the engagement is defined in writing and covers the risks present in the business, not just a generic template
• the consultant has access to the workplace, relevant records, incident data and management decisions
• the employer retains clear internal responsibility for implementing the advice and maintaining day-to-day arrangements
• there is a documented route for the consultant to raise concerns, including to board or director level where necessary
• the arrangement is reviewed periodically and updated when the business changes

Where any of these are missing, the arrangement becomes harder to defend. The most common failure is a consultant engaged purely to produce paperwork, with no ongoing relationship, no site visits and no real line of sight into how the business actually operates. That is not a Regulation 7 appointment. It is a document service, and it will not withstand scrutiny after an incident.

The preference in Regulation 7 for an in-house appointment is often cited as a reason to avoid outsourcing. In reality, the preference only bites where there is actually a suitably competent internal person available. For many small and medium employers, particularly in sectors with specific regulatory exposure such as property management, healthcare, hospitality and light industrial activities, the honest answer is that no one internally has the depth of expertise required. In those cases, appointing an external health and safety consultant is not a workaround. It is the correct way to meet the duty.

There is also a practical point about defensibility. If an incident occurs and the HSE or an insurer asks how the employer satisfied itself that its arrangements were adequate, being able to point to a named, qualified external adviser with a defined scope, regular reviews and documented advice is a much stronger position than pointing to an internal nominee whose only credential is willingness to take the role on.

For employers considering this route, it is worth reading around the wider framework of health and safety legislation that shapes the consultant’s scope, because the competent person’s remit has to align with the specific duties the business carries.

Common Failures, Gaps, and Misconceptions Around Competent Person Appointments

Regulation 7 failures rarely involve an employer openly refusing to appoint anyone. They almost always involve appointments that look adequate on paper but fall apart under examination. The patterns are consistent across sectors.

Appointing by Job Title Rather Than Competence

A common failure is automatic appointment of the office manager, HR lead or operations director without any assessment of whether they have the training, knowledge and experience for the risks involved. The appointment is made because someone has to do it, not because that person is the right choice. When the business activity is low-risk and the person has sensible training, this can work. When the business involves higher-risk activities such as working at height, hazardous substances, complex fire safety arrangements or significant manual handling, it usually does not.

Over-Reliance on a Single Qualification

Holding a NEBOSH General Certificate is a good foundation, but it does not automatically make someone competent to advise on fire risk assessments in a multi-occupancy building, on COSHH assessments for a specialist manufacturing process, or on construction design and management duties. Employers sometimes treat any health and safety qualification as a universal credential. The regulation does not. Competence is measured against the specific risks.

Paper Arrangements With No Substance

Another frequent gap is the consultant engaged once a year to update a generic health and safety policy and a folder of template risk assessments. No site visits, no incident review, no involvement when changes happen. If the consultant has no visibility of how the business actually operates, they cannot properly assist the employer, and the employer cannot reasonably claim to have made a competent person appointment. This is a particular risk where services are bought primarily on price.

Unclear Scope in Combined Arrangements

Where an internal person and an external consultant are both involved, the scope between them is sometimes left vague. Each assumes the other is handling fire safety, or DSE assessments, or driver risk, or contractor management. Gaps emerge and no one notices until something goes wrong. Regulation 7 requires cooperation between appointed persons, and that cooperation has to be engineered rather than assumed.

Lack of Review When the Business Changes

An appointment that was adequate three years ago may no longer be adequate today. New premises, new equipment, new processes, new staff groups or new regulatory requirements can all shift the risk profile. If the competent person arrangement is not reviewed when these changes happen, the appointment quietly becomes inadequate. HSE inspectors routinely ask when the arrangement was last reviewed and what triggered the review.

Confusing Competent Person With Responsible Person

Particularly in fire safety, employers sometimes confuse the Regulation 7 competent person with the Responsible Person under the Regulatory Reform (Fire Safety) Order 2005, or with the competent person required to assist with fire risk assessments. These are related but distinct duties. A single appointment does not necessarily cover both unless the scope, competence and arrangements genuinely extend that far.

Treating Competence as Static

Competence has to be maintained. Legislation changes, guidance is updated, new hazards are recognised, and good practice moves on. A competent person who has not undertaken any continuing professional development for several years may no longer be current. The appointment should include some expectation of ongoing development, whether that is formal training, membership of a professional body, or regular engagement with updated guidance.

Practical Steps for Employers Making or Reviewing an Appointment

A defensible Regulation 7 appointment is the result of a deliberate process, not a single decision. The steps below are the sequence most employers benefit from following, whether they are appointing for the first time or reviewing an existing arrangement.

Understand the risk profile first. Before deciding who to appoint, get clear on the significant risks in the business. This means looking at activities, premises, equipment, substances, vulnerable groups, lone working, contractors and any sector-specific regulatory exposure. The competent person appointment has to match this profile, not a generic expectation.

Assess internal competence honestly. List the people who might reasonably take on the role. For each, consider their qualifications, their actual experience with the risks involved, their available time, their authority within the business, and their willingness to raise difficult issues. A short, honest assessment usually shows quickly whether a suitable internal person exists.

Decide on the model. Based on the risk profile and the internal assessment, choose between an in-house appointment, an external consultant, or a combined arrangement. Record the reasoning. If the choice is challenged later, being able to show how it was reached is far stronger than trying to reconstruct the thinking after the fact.

Define the scope in writing. Whether the appointment is internal or external, the scope should be documented. It should cover the risks the competent person is expected to advise on, the frequency of reviews and site visits, the records they will maintain, the reporting lines, and the arrangements for cooperation with anyone else involved in the role. For external appointments, this sits naturally within the consultancy agreement.

Provide the information and access required. Regulation 7 explicitly requires the employer to give the competent person the information they need. That includes details of the risks in the business, the measures in place, information about employees at particular risk, and details of shared workplaces. Without this, the appointment cannot function properly.

Allocate time, authority and budget. Competence without capacity is not competence in any meaningful sense. For an internal appointment, this means protected time in the role. For an external appointment, it means enough contracted hours to cover the scope properly. For both, it means the authority to act on what they find and a budget to implement reasonable control measures.

Document the advice and the response. Keep a clear record of the advice given by the competent person and the decisions taken in response. This is partly about evidence of a functioning arrangement and partly about continuity when people change. The absence of any such record is one of the first things an inspector will notice.

Review the arrangement at sensible intervals. An annual review is a reasonable minimum for most businesses. A more frequent review is warranted where the business is changing, where new risks have emerged, or where an incident has raised questions about the adequacy of arrangements. The review should cover competence, scope, time, access and output quality.

Check alignment with related duties. The competent person appointment interacts with several other duties, including risk assessments under Regulation 3 of the MHSWR, fire safety arrangements under the Regulatory Reform (Fire Safety) Order 2005, and specific duties under COSHH, manual handling and PPE regulations. The appointment should be checked against these to ensure nothing is falling through the gaps.

For employers who want to benchmark their approach against real-world examples, looking at case studies of how other organisations have structured their competent person arrangements and wider compliance framework can be a useful sense-check, particularly where the business has grown or changed significantly since the current arrangement was put in place.

Frequently Asked Questions About the Competent Person Duty

Can a Director Also Be the Appointed Competent Person?

Yes, provided they genuinely meet the competence test for the risks in the business. A director who holds appropriate qualifications, has relevant experience and is given time to carry out the role can be appointed. The concern arises where the role is given to a director purely because of seniority, without the underlying competence. Being responsible for health and safety at board level is not the same as being competent to advise on it.

Does a Small Business With Low Risk Still Need a Formal Appointment?

Yes. Regulation 7 applies to every employer regardless of size. What changes is the depth of expertise required. A small, low-risk office may only need someone with sensible training and access to reliable guidance. A small business handling hazardous substances, working at height or running specialist equipment will need something more substantial. The duty to appoint does not disappear because the risks are modest.

How Often Should a Competent Person Appointment Be Reviewed?

An annual review is a sensible default for most businesses, but the appointment should also be reviewed whenever the business changes in ways that affect the risk profile. New premises, new activities, significant staff changes, new regulatory requirements or a serious incident should all trigger a review. The objective is to confirm that the person appointed is still competent for the risks that now exist, not the risks that existed when the appointment was first made.

What Happens if the HSE Decides the Appointment Is Inadequate?

Where an HSE inspector concludes that an employer has not made a suitable Regulation 7 appointment, the likely outcomes range from advice and improvement notices through to prosecution, depending on the seriousness of the failing and whether an incident has occurred. In practice, an inadequate appointment is often identified as part of a wider investigation into another matter, such as an accident or a complaint. The competent person issue then becomes one of several breaches under consideration.

Is an Outsourced Arrangement Seen as Weaker Than an In-House One?

No. Regulation 7 expresses a preference for internal appointments only where a suitably competent internal person is available. Where the expertise needed does not exist in the business, an external consultant is the correct route. A well-structured outsourced arrangement, with a defined scope, regular site contact and clear reporting, is often more defensible than a nominal internal appointment that lacks substance.

If you are appointing a competent person for the first time, reviewing an arrangement that has drifted, or looking for a defensible outsourced solution that genuinely meets the Regulation 7 duty, contact us to discuss how Acorn Safety Services can act as your appointed competent person across fire, health and safety and wider workplace compliance.