Does MHHHRA apply to lower tier COMAH sites?

If you operate a lower tier COMAH site, you’ve probably read about MHHHRA and quietly concluded it’s an upper-tier problem. Almost everything written about it so far is aimed at upper-tier sites preparing safety reports, so that’s an easy conclusion to reach.

In most cases it’s also the wrong one, and the reasoning behind it is worth pulling apart, because it rests on a false premise that catches a lot of good operators out.

If you want the full plain-English explainer of what MHHHRA actually is, start with What is MHHHRA? This page is specifically about whether, and how, it lands on a lower-tier site.

The assumption that catches lower tier sites out

The usual reasoning goes like this: MHHHRA is about COMAH safety reports, I’m lower tier, so I don’t produce a safety report, therefore it doesn’t apply to me.

That looks watertight. It isn’t, because the first link in the chain is wrong.

The duty to carry out a suitable and sufficient assessment of your major accident risks does not come from the safety report. It comes from general health and safety law, which applies to every workplace and draws no line between upper and lower tier. The safety report is an additional obligation that upper-tier sites carry on top. It was never the thing that created the assessment duty in the first place.

So removing the safety report doesn’t remove the duty. It just removes the document. The underlying requirement to understand and control your major accident risks to people is exactly the same, and MHHHRA is the current benchmark for how that’s done. That makes it relevant to you whether or not you ever write a safety report.

In short: lower tier does not mean lower duty.

Why lower tier sites are often more exposed, not less

There’s an uncomfortable second half to this. Upper-tier sites have something forcing the work along: a safety report that gets submitted and scrutinised by the regulator. Whatever else you think of it, that external pressure keeps the assessment honest and up to date.

A lower-tier site has no such forcing function. Nobody is routinely asking to see the work. So the discipline has to be entirely self-imposed, and when it isn’t, the gaps go unnoticed for years, because nothing surfaces them.

That’s exactly what I see in practice. The most common pattern on lower-tier sites is a HAZID or a HAZOP that the site treats as its COMAH risk assessment, and stops there. The studies get done, the actions get closed out, and everyone believes the job is finished. But a HAZID or HAZOP is an input to the assessment, not the assessment itself. The steps that turn those studies into a defensible major-accident risk assessment, pulling them together, understanding the cumulative risk to the people actually exposed, and demonstrating the risks are as low as reasonably practicable, often simply never happen, because nobody realised they were still to come.

So what does a lower tier site actually need to do?

More than a HAZID, but proportionate to your hazards. MHHHRA is built around proportionality: the depth of work expected scales with the severity of what could happen. A lower-tier site with modest hazards isn’t expected to do the same volume of quantitative analysis as a large upper-tier establishment. But proportionate is not the same as nothing, and it’s certainly not “we did a HAZOP”.

What good looks like for a lower-tier site is knowing where you genuinely stand: whether your hazards have been properly identified and screened, whether you’ve understood the risk to people rather than just listed the hazards, and whether you can show you’ve done what a competent operator reasonably would. Most sites haven’t checked that in a structured way, which is what the free readiness self-assessment below is for.

How worried should I be?

Not panicked, but not complacent either. The point of this page isn’t to alarm you. It’s to dismantle the one assumption, “we’re only lower tier, so this isn’t ours”, that stops sites from looking in the first place. Once you look, you usually find the position is fixable, and fixable far more cheaply now than under pressure later.

Find out where your lower tier site actually stands. My free MHHHRA readiness self-assessment walks you through each stage of the guidance with the common lower-tier pitfalls flagged, so you can see your gaps clearly. Enter your email and I’ll send it over.

Or request a free 30-minute briefing. I’ll talk you and your team through what MHHHRA means for a lower-tier site specifically, with 15 minutes for your questions. No charge, no obligation.

Common questions

Do lower tier COMAH sites need a safety report?

No: the safety report is an upper-tier requirement. But the duty to carry out a suitable and sufficient assessment of major accident risks applies to lower-tier sites too, because it comes from general health and safety law, not from the safety report.

Is a HAZOP enough to meet MHHHRA for a lower tier site?

On its own, usually not. A HAZID or HAZOP is an input to the risk assessment, not the finished assessment. MHHHRA expects you to take those studies further: understanding the cumulative risk to people and demonstrating it’s as low as reasonably practicable, proportionate to your hazards.

Does MHHHRA expect lower tier sites to do full quantitative risk assessment?

Not necessarily. MHHHRA is built around proportionality, so the rigour expected scales with the severity of the hazard. A lower-tier site with modest hazards isn’t held to the same depth as a large upper-tier establishment, but it’s still expected to assess risk to people properly rather than stop at a hazard study.

How do I know if my lower tier site is ready?

Work through a structured readiness check against the guidance. My free self-assessment does exactly that: request it above.