Many businesses that find themselves facing enforcement action already have a risk assessment. These days that often isn’t the problem. The difficulty lies in the gap between the system on paper and what happens in practice.

A case in the news this month illustrates the point. Factory Services UK Limited was fined £160,000 at Warrington Magistrates’ Court on 8 September 2026 after an accident in which a maintenance engineer’s arm was pulled into an unguarded running conveyor through a hole that was cut in the casing years earlier so workers could clear blockages while the machine remained in operation. There was no emergency stop, and the engineer was working alone during the night shift. 

Despite routine inspections, management walkarounds and audits, the modification was never picked up. The company’s own safe systems of work required machinery to be guarded and isolated before any maintenance, but these were reportedly not followed or enforced. The company pleaded guilty to section 2(1) HSWA and paid £4,728 in costs. 

An earlier case this year shows a different version of the same gap. In January 2026, the agrochemicals manufacturer Syngenta Ltd pleaded guilty to two offences, including failing to make a “suitable and sufficient” risk assessment. The company was fined £400,000 and ordered to pay £8,288 in costs at Leeds Magistrates’ Court after a contractor narrowly escaped serious injury in a high-pressure steam release at its Huddersfield site. The company had a documented procedure for the maintenance work involved. However, the procedure relied on a single method of isolating pipework known to be corroded, while HSE’s guidance identifies double isolation as the safer approach. The paperwork therefore existed, but it didn’t reflect the risk of the job as it was being carried out.

The wording “suitable and sufficient” as required by Regulation 3(1) Management of Health and Safety at Work Regulations 1999 goes to the heart of the matter. A risk assessment is expected to be an ongoing process that keeps pace with the reality of the work activities being carried out: identifying shortcuts that creep in, equipment that has aged and the “routine” practices that may have drifted away from the original system that was assessed.

What this means for you: A safety management system offers little protection if it isn’t effective in practice. The value of an assessment lies not in its existence, but in whether it reflects how the work is genuinely carried out and whether the people doing that work would recognise and follow it. Organisations best placed to withstand scrutiny are those who can evidence the connection between the documented system and the day-to-day practice.

If you’d like to find out more, get in touch.

Shared for general information purposes only and does not constitute legal advice. It is recommended that specific professional advice is sought before acting on any of the information given. Please contact us for specific advice on your circumstances.

Cyber Essentials certification is a UK government backed security standard that demonstrates an organisation has implemented the key technical controls needed to protect against the most common cyber threats.

Get the Regulatory Brief

This field is for validation purposes and should be left unchanged.
Name(Required)
A PRACTICAL GUIDE FOR BUSINESSES AND INDIVIDUALS WHEN THE REGULATOR CALLS

This field is for validation purposes and should be left unchanged.
Name(Required)

This field is for validation purposes and should be left unchanged.
Name(Required)