COSHH and risk assessment software for real venues
Every chemical on site with its data sheet, its PPE and its training record. Every venue risk assessment scored on a 5 × 5 matrix, signed off, and dated for review. Two registers an inspector may ask for, kept where the rest of your compliance already lives.
14-day free trial, full-featured, no card required.
Nobody knows which of these is still valid
The COSHH file in most venues is a lever arch folder of safety data sheets, some of which are for products the supplier stopped making two years ago, next to a set of risk assessments signed by a manager who has since left. Nothing in that folder tells you which sheet has lapsed, which assessment is past its review date, or which of your kitchen porters has actually been shown how to handle the oven cleaner. You find out when somebody asks, and by then the answer is fixed.
Zynthio holds both registers as structured records rather than as scans. A substance carries its own data sheet with an expiry date, and an expired sheet is treated as no sheet at all — so your count of substances without a valid SDS is honest rather than flattering. A risk assessment carries a scored hazard list, a named assessor, a signature and a review date that clears properly when you review it.
What you can see at a glance
- Which substances have no safety data sheet on file — counting the ones whose sheet has lapsed
- Which COSHH assessments are current, due soon within 30 days, or overdue
- Which risk assessments are past their review date, and the worst band across their hazards
- Which staff have acknowledged their COSHH training, and which course delivers it
- Every change audit-logged with the before, the after and the IP address
Straight answer on one thing: these states are calculated and shown, but nothing emails or pushes you about them. HACCP is the one compliance register with a scheduled reminder job. Opening the compliance dashboard has to be a routine.
Two registers, built the way the regulations are written
The substance register, with the data sheet attached
Every chemical on site gets a record: name, manufacturer, product code, its hazards, its risk level, the PPE required to use it, how it is stored, how it is disposed of, and the first aid, emergency and spillage procedures somebody would need at two in the morning. The safety data sheet is attached with an expiry date, and its status is on file, missing, or expired — with expired sitting alongside missing rather than alongside on file. That is the correct reading, and it is why the dashboard count of substances without a valid sheet is one you can trust.
COSHH assessments, PPE and staff training records
A COSHH assessment walks the HSE's five steps against a substance: what the hazards are, who might be harmed and how, the controls in place and the controls still needed, the exposure route, frequency and duration, the risk before and after those controls, the emergency and first aid procedures, whether training is required and which course delivers it, and whether health surveillance is needed. Risk here is recorded in words — low, medium or high — rather than on a matrix, because a chemical exposure is not usefully a number. Your head chefs, chefs and cleaners get the register by default so they can read an assessment and acknowledge their training; authoring records and uploading data sheets stays with org admins and above.
Approval that re-bases the review clock
The COSHH review cycle is six or twelve months, set on the substance, and an assessment reads as current, due soon within 30 days, or overdue. An assessment in force with no review date set at all reads as overdue — deliberately, because an undated review is not a review. Approving is org admin and above; it supersedes and archives whatever assessment was previously in force for that substance, and it re-bases the review dates from the approval date, so approving a draft that has been sitting in a queue does not land it instantly overdue.
Risk assessments on a 5 × 5 matrix, from templates
Zynthio ships risk assessment templates by category — fire, kitchen, manual handling and others — each carrying suggested hazards, who is at risk, suggested controls and the legal basis. Assessments are numbered in the form RA-2026-001 and record the header the regulations expect: the assessor's name, the location, the activity and who is at risk. Hazards are scored likelihood times severity across a 5 × 5 matrix, banded Low at 1 to 4, Medium at 5 to 12 and High at 13 to 25 — the same bands HACCP uses. Each hazard also carries a residual risk after controls, and a residual higher than the initial score is refused: controls that make a thing more dangerous is a data entry error, not a finding.
Sign-off that means something, and a PDF that prints the right name
Sign-off is org admin and above and puts the assessment in force. Signing an archived assessment is refused, and so is signing one with no hazards on it at all, because an empty assessment cannot be suitable and sufficient. A signature is invalidated by the things that change the substance of the document — the hazards, the assessment date, the location, the activity, who is at risk, the assessor's name — and survives a rename or a shifted review date. The assessor is stored as a name rather than as a Zynthio login, because the competent person is often a consultant who has never used your system, and the PDF always prints that recorded name rather than whoever pressed download.
A review that genuinely clears an overdue assessment
The risk assessment review cycle defaults to twelve calendar months, clamped at month end, and it counts from the review you actually recorded rather than from the date it was due — so reviewing something three weeks late clears it properly instead of leaving it permanently behind. Recording a review is open to anybody with the module, because the person who walks the kitchen is not always the person who signs. Everything is audit-logged with the before, the after and the IP address, and each assessment prints to PDF on its own.
The rest of the compliance file is in the same login
COSHH and risk assessments sit under Compliance & Safety alongside three modules they share data and scoring with.
HACCP
Uses the same 5 × 5 matrix and the same Low, Medium and High bands, so your hazard analysis and your risk assessments agree with each other.
Audits
Ships a dedicated COSHH & Chemical Safety audit template, so somebody actually walks the store cupboard rather than trusting the register.
Checklists & Monitoring
Puts the recurring safety walk on a schedule — the daily and weekly checks that keep the controls in your assessments actually happening.
Both are included in Core — £59 per site, per month
COSHH and Risk Assessments are two of the nine modules in the Core plan, alongside Checklists & Monitoring, Defect Management, Audits, HACCP, the Refusals register, Reporting and Recipes with allergen tagging. Unlimited users on every site, iOS and Android apps included. Annual billing gives you two months free, and ten or more sites takes 15% off automatically. See full pricing.
COSHH and risk assessments, answered plainly
What does a COSHH record in Zynthio actually hold?
Two records that work together. The substance holds the name, manufacturer, product code, its hazards, its risk level, the PPE required, storage, disposal, first aid, emergency and spillage procedures, and a safety data sheet with an expiry date. The assessment is the HSE's five steps against that substance: the hazards, who might be harmed and how, the controls in place and the controls still needed, the exposure route, frequency and duration, the risk before and after controls, emergency and first aid procedures, whether training is required and which course delivers it, and whether health surveillance is needed.
How is risk scored?
It depends which register you are in, and that is deliberate. Risk assessments use a 5 x 5 matrix of likelihood times severity, banded Low at 1 to 4, Medium at 5 to 12 and High at 13 to 25. HACCP hazard analysis uses the same bands, so the two modules can never disagree about what "high" means. COSHH is different: risk before and after controls is recorded in words - low, medium or high - rather than on a matrix.
Who can sign off a risk assessment?
Sign-off is org admin and above, and signing puts the assessment in force. Two things are refused outright: signing an archived assessment, and signing one with no hazards recorded at all, because an empty assessment cannot be suitable and sufficient. A signature is not voided by every edit - changing the hazards, the assessment date, the location, the activity, who is at risk or the assessor's name invalidates it, while renaming the record or shifting the review date does not. A system that demands re-signing for trivia teaches people to click through re-signing.
Will Zynthio remind me when a review or a safety data sheet is due?
No, and we would rather tell you that here than have you find out later. Overdue states are calculated for COSHH review dates, safety data sheet expiry, COSHH training expiry and risk assessment review dates, and they appear on a dashboard tile - but nothing emails or pushes anybody. HACCP is the one compliance register with a scheduled daily reminder job. If these dates matter to you, opening the compliance dashboard needs to be a routine on somebody's week.
Do I have to write every risk assessment from scratch?
No. Zynthio ships risk assessment templates by category - fire, kitchen, manual handling and so on - each carrying suggested hazards, who is at risk, suggested controls and the legal basis. You create an assessment from a template or from nothing. Each gets a reference number in the form RA-2026-001, records the assessor as a name rather than as a Zynthio user (because the competent person is often a consultant who has never logged in), and prints to a PDF that always shows the recorded assessor rather than whoever downloaded it.
Related guides
Practical guides from the Zynthio team on this part of running a venue.
Your first aid needs assessment is the legal starting point
GB law sets no ratio of first aiders to staff, so a first aid needs assessment is what decides the cover a hospitality venue must provide.
RIDDOR accident reporting: what UK hospitality must report
RIDDOR accident reporting runs on three deadlines: without delay, 10 days and 15 days. What a UK hospitality venue must report and record.
Keeping a fire risk assessment current in hospitality
A fire risk assessment is a live record, not a one-off form. What the law asks in each UK nation, and how to keep yours defensible.
Digital defect reporting: how it cuts maintenance costs
Digital defect reporting turns small faults into logged, tracked jobs, cutting emergency repairs and protecting your food safety records.
More operator guides on the Zynthio blog. How we write them: editorial policy.
One login, one bill, one set of sites
Every Zynthio module shares the same sites, the same people and the same reporting. Turn on what you need.
Martyn’s Law Readiness
Procedure templates, a per-site capacity and tier view, a quarterly drill record and a staff briefing.
Zero-Hours Readiness
Guaranteed hours, shift notice and cancellation payment policies, plus the rota record that evidences them.
Food Safety & HACCP
Digital daily checks, temperature logs, HACCP plans, allergen charts and EHO-ready PDF records.
Rotas, Clock-In & HR
Build rotas against a live labour budget, clock staff in with geofencing, approve timesheets.
Stock & Cashing Up
Stocktakes, purchase orders, delivery scanning, GP tracking and daily cashups with weekly rollups.
EPOS & Till
Connect your existing till for live sales into stock and rotas, plus the ZynthioEPOS till in build.
HACCP Plans
Build a full Codex HACCP plan online, link CCPs to daily checks and export EHO-ready PDFs.
Audits & Mock EHO
Ten UK templates, 400+ inspector-style questions, weighted scoring and a site league table.
Staff Training
Assign courses, track completion by person and site, and issue certificates into the HR file.
Review Management
Google, TripAdvisor and your FSA rating in one dashboard with a reputation score per site.
Table Bookings
Website booking widget, live service diary, deposits and a guest CRM - no per-cover fees, ever.
Refusals Register
A digital refusals book filled from the till, ready for the licensing officer.
Cash Management
Safes, floats, banking and an append-only ledger with daily cash-up reconciliation.
Accounting Export
The daily sales journal, supplier bills and payroll journal in Xero’s own import layouts.
KPIs & Reporting
Clock-in accuracy, labour budget, salary utilisation and reputation, per site and per group.
Recipe Costing
Cost dishes from live stock prices, track GP ex-VAT and tag all 14 UK allergens.