COMAH Safety Report: What It Must Contain

TL;DR

• Only upper-tier operators must produce one: Establishments above the higher Schedule 1 thresholds prepare a full safety report; lower-tier sites stop at a MAPP.
• Write the report around five demonstrations: MAPP and SMS in place, major accident hazards prevented, adequate safety by design, emergency plans drawn up, land-use information supplied.
• Populate every paragraph of Schedule 3: Management system, environment, installation and substances, accident scenarios, and protection and intervention measures.
• Expect assessment against the SRAM’s five elements: Descriptive, MAPP and SMS, Predictive, Technical, and Emergency Response — each with its own criteria.
• Review at least every 5 years: Plus any time the SMS changes significantly, a modification is planned, new hazard knowledge emerges, or an incident reshapes the risk picture.

Regulation 8 of the Control of Major Accident Hazards Regulations 2015 does not offer a polite suggestion. It states that the operator of an upper-tier establishment must prepare a safety report and must not construct, operate, or significantly modify that establishment until the Competent Authority has communicated its conclusions on it. Two winters ago I sat in a project review where a Pre-Construction Safety Report for a new hydrogen purification unit was paused for 38 days because two of the five demonstrations had not been evidenced to the assessor’s satisfaction. Construction contracts were mobilised, steelwork was in a yard three counties away, and nothing moved until the revisions were accepted. That is what a regulation with teeth looks like.

The safety report is the document standing between your tank farm, your reactor block, or your bulk ammonia vessel and a prohibition notice. It is written proof that you understand the major accident hazards on the establishment, that you have taken all measures necessary to prevent and mitigate them, and that your management system can keep delivering those measures year after year. This guide walks through what a COMAH safety report must contain — the five demonstrations required by Regulation 8, the minimum information set out in Schedule 3, the SRAM criteria the Competent Authority applies, and the common deficiencies that send reports back for a second round.

What Is a COMAH Safety Report and Who Must Produce One?

A COMAH safety report is a written technical demonstration submitted to the Competent Authority by the operator of an upper-tier establishment. It is not a declaration, not a certificate, and not a form with tick-boxes. It is a reasoned document that sets out the major accident hazards present on site, the controls in place to prevent and mitigate them, and the management system designed to keep those controls functioning through the life of the establishment. The legal home for the obligation is Regulation 8 of COMAH 2015, with the content specification in Regulation 9 and Schedule 3.

Only operators of upper-tier establishments — those holding dangerous substances above the higher Schedule 1 thresholds — are required to produce a safety report. Lower-tier operators prepare a Major Accident Prevention Policy (MAPP) and keep evidence of implementation available for inspection, but submit no full report. Getting this boundary right matters: an operator I worked with last year slipped into upper-tier status when a chlorine intermediate inventory rose above threshold during a planned capacity expansion, and the PCSR had to be written from scratch against a 90-day deadline.

The Competent Authority in Great Britain is not a single body. It comprises the Health and Safety Executive, the Environment Agency in England, the Scottish Environment Protection Agency, Natural Resources Wales, and the Office for Nuclear Regulation for nuclear premises. Inspectors from these bodies assess the report jointly, which is why the document must satisfy both process-safety and environmental-protection assessors in one read.

A COMAH safety report comes in four practical varieties, and readers often confuse them:

• Pre-Construction Safety Report (PCSR): Submitted before physical construction begins on a new upper-tier establishment. It focuses on design intent, basis of safety, inherent safety choices, and the envelope of hazards the finished installation will carry.
• Pre-Operations Safety Report (POSR): Submitted before operations commence. It covers the as-built plant, commissioning outcomes, and the final operating procedures and emergency arrangements.
• Full safety report for an existing establishment: Produced by operators who are already running when they cross into upper-tier status, or who already hold upper-tier inventories.
• Modification safety report: Produced before any change to an installation, process, or substance inventory that could have significant repercussions for major accident hazards.

One clarification worth making early. In UK COMAH terminology, the legal document is always called the “safety report.” “Safety case” is the term used for an offshore installation’s document under the Offshore Installations (Offshore Safety Directive) (Safety Case etc.) Regulations 2015, not COMAH. The two documents share philosophical DNA, but the legal frameworks are separate.

The Five Demonstrations: What the Safety Report Must Prove

Under Regulation 8, the safety report exists to demonstrate five things. Every paragraph of Schedule 3 is written to make one or more of these demonstrations possible. Assessors working from the Safety Report Assessment Manual read your document looking for these outcomes; if you cannot find them in your own report, they will not be found either.

1. A MAPP and Safety Management System are in place and implemented. The report must describe the Major Accident Prevention Policy and the SMS designed to implement it across all seven Schedule 2 elements — organisation and personnel, identification and evaluation of major hazards, operational control, management of change, emergency planning, monitoring of performance, and audit and review.
2. Major accident hazards and possible scenarios have been identified, and all measures necessary have been taken to prevent them and to limit their consequences for people and the environment. This is the demonstration with the sharpest teeth. “All measures necessary” is the COMAH phrasing of the ALARP principle — a duty that is qualitatively higher than a simple reasonableness test.
3. Adequate safety and reliability have been incorporated into the design, construction, operation, and maintenance of any installation, storage facility, equipment, and infrastructure connected with major accident risks. This pushes the report into engineering territory — basis of safety, safety-critical elements, performance standards, and inspection regimes.
4. Internal emergency plans have been drawn up and information supplied to enable the external emergency plan to be produced by the local authority. The report does not duplicate the emergency plans themselves, but it must show that the operator has provided what is needed for Regulation 12 (internal plans) and what the local authority needs for Regulation 13 (external plans).
5. Sufficient information has been supplied to the Competent Authority to enable decisions to be made on the siting of new activities or developments around existing establishments. This is the land-use planning demonstration, the mechanism by which HSE advises local planning authorities on development near hazardous installations.

The “all measures necessary” principle sits above all five demonstrations and governs how they are judged. Measures are necessary unless the cost of implementing them is grossly disproportionate to the risk-reduction benefit they deliver — a deliberately strict test that shifts the burden of proof onto the operator to justify any gap between current practice and relevant good practice.

Schedule 3 Contents: The Minimum Information Every Safety Report Must Contain

Schedule 3 is where the legal abstraction becomes a table of contents. Paragraphs 2 through 6 define the minimum information set, and in practice each paragraph becomes a major section (or volume) of the report. What follows is a paragraph-by-paragraph walkthrough written from the perspective of someone assembling the document, not someone reading the statutory instrument.

Schedule 3 Paragraph 2: Information on the Management System and Organisation

This paragraph demands that the MAPP be included as a separately identifiable document within the safety report, together with a description of the Safety Management System put in place to deliver it. The 2015 regulations also introduced a requirement to provide information supporting the identification of domino effect establishments under Regulation 16 — a detail that often gets pushed too late in the drafting process.

A compliant paragraph 2 section includes:

• The MAPP itself: Kept brief, written by the operator, approved at board level, and signed. Generic policies imported from a corporate template without site-specific content are routinely flagged as deficient.
• SMS description covering all seven Schedule 2 elements: Including how human factors are integrated into each, which is an explicit SRAM criterion most legacy reports handle lightly.
• Organisational arrangements: Roles, responsibilities, reporting lines, competence requirements, and resource commitments for major accident hazard management.
• Domino effect information: Data to be shared with the CA and neighbouring operators where the establishment could amplify or be amplified by a neighbour’s major accident.
• Environmental management elements of the SMS: Often drawn from an ISO 14001 system, but required under COMAH regardless of certification status.

Schedule 3 Paragraph 3: Description of the Environment of the Establishment

Paragraph 3 builds the descriptive foundation the rest of the report stands on. It covers geographical location, meteorological, geological, and hydrographic conditions, together with the history of the establishment where that history is relevant to present-day risk. The depth must be sufficient for the Competent Authority to judge off-site consequences — which means population density around the site, land use inside likely consequence footprints, and the sensitive receptors the environmental regulator will scrutinise.

The section I find most often underwritten is the coverage of external major accident initiators — Natech events, where a natural hazard triggers a technological disaster. Flooding, seismic activity, lightning, extreme wind, and heatwave-driven process excursions all sit here. The Chemical and Downstream Oil Industries Forum (CDOIF) updated its Adapting to Climate Change: Good and Best Practice guidance in January 2026, and the revision makes it explicit that Schedule 3 paragraph 3 is the right home for climate-change adaptation evidence. Reports submitted after that date without a visible Natech treatment are already attracting assessor comment.

Paragraph 3 should also characterise SSSIs, watercourses, aquifers, coastal zones, and any other receptors that will be scoped for a MATTE (Major Accident to the Environment) assessment later in paragraph 5.

Schedule 3 Paragraph 4: Description of the Installation

Paragraph 4 describes the establishment itself — the main activities, the products, the processes, and above all the dangerous substances present. Since the 2015 revision, operating methods must take account of “available information on best practices,” and the inventory must be aligned with CLP Regulation classifications.

The working contents for paragraph 4:

• Description of each installation with major accident potential: Reactor trains, storage vessels, distillation columns, loading bays, pipelines — not a site map, but a written walkthrough of what each installation does and how it fits into the process envelope.
• Operating methods: Grounded in current best practice references (CCPS, EEMUA, IChemE guidance), with any deviations explained.
• Substance inventory with CLP classification: Maximum quantities present or likely to be present, against Schedule 1 thresholds.
• Physical, chemical, toxicological, and ecotoxicological characteristics: Including behaviour under abnormal conditions — hot fire, cold failure, polymerisation, contamination, spillage.
• Loss-of-containment behaviour: How the substance behaves once outside primary containment — liquid pool spread, flashing, aerosol formation, vapour cloud dispersion, gravity spreading for dense gases.

A common error is describing the substance inventory as a static list. A report that does not explain why each substance is present, where its maximum inventory is held, and when that maximum occurs during the operating cycle is incomplete.

Schedule 3 Paragraph 5: Identification and Accidental Risk Analysis and Prevention Methods

This is the predictive heart of the report. Paragraph 5 demands a detailed description of possible major accident scenarios, their probabilities or triggering conditions, and the consequences they would produce. The scenarios must form a representative set — not every conceivable event, but a chosen set that collectively covers the full envelope of major accident hazards on the establishment. A representative set for a bulk ammonia terminal might include catastrophic vessel rupture, gasket failure during loading, and a road tanker collision inside the operational envelope; a representative set for a specialty chemicals complex with multiple reactor trains will be an order of magnitude larger.

Paragraph 5 expects hazard identification to be traceable to a recognised technique — HAZID for early-stage installations, HAZOP for procedure-rich plants, LOPA for specific scenario barrier counts, and bow-tie diagrams to show the architecture of threats, top events, consequences, preventative barriers, and mitigating barriers. Quantitative risk analysis (QRA) supports siting and land-use decisions and is rarely avoidable for upper-tier sites holding toxic inventories.

The 2015 regulations added an explicit requirement for a review of past accidents and incidents involving the same substances and processes. This is deceptively easy to dismiss as a paragraph of history; assessors read it as a direct test of operator learning. A report that cites the Buncefield investigation but does not reflect its lessons in tank overfill barrier design is an easy deficiency to call out.

Environmental scenarios belong here too. MATTE assessments — following CDOIF’s methodology — scope the scenarios that could cause major environmental harm, characterise receptors, and quantify consequence severity in the A/B/C bandings the environmental regulators use.

Schedule 3 Paragraph 6: Measures of Protection and Intervention to Limit the Consequences

Paragraph 6 describes the engineered and organisational measures that stand between the scenarios in paragraph 5 and a realised major accident. It is the evidence base for demonstrations 2, 3, and 4. The 2015 revision added an explicit expectation that both technical and non-technical measures for impact reduction are described — broadening the scope beyond hardware into competence, procedures, and organisational resilience.

The contents:

• Engineered protection: Bunds and secondary containment, deluge and fixed foam systems, fire and gas detection, emergency shutdown logic, pressure relief and blowdown, blast walls, dike drains, containment basins for firewater run-off.
• Organisational measures: Permit-to-work systems, operator training and competence, shift handover, management of change, inspection and maintenance regimes, control-room staffing, and fatigue management.
• Internal emergency plan description: Organisation, command structure, internal resources, declared decision-makers, mustering, casualty handling, first-responder interface — the detail is in the plan itself but the report must show the plan is fit for the scenarios in paragraph 5.
• Information for the external emergency plan: What the local authority needs to prepare its off-site plan under Regulation 13 — warning systems, evacuation zones, shelter-in-place advice, protective action distances.
• Performance standards for safety-critical elements: Each SCE (detection, shutdown, relief, containment) tied to a documented performance standard with survivability, functionality, availability, reliability, and interaction criteria.
• Relevant good practice references: Each barrier benchmarked against the applicable RGP — API, EEMUA, IEC 61511, EI, OISD, CCPS — with any deviations justified.

A summary mapping of Schedule 3 paragraphs to the demonstrations they support sits at the end of this section for reference when drafting:

Schedule 3 Paragraph	Subject	Primary Demonstrations Supported	SRAM Element
Paragraph 2	Management system, MAPP, SMS	1, 4	MAPP and SMS
Paragraph 3	Environment of the establishment	2, 5	Descriptive
Paragraph 4	Installation, processes, substances	2, 3	Descriptive, Technical
Paragraph 5	Risk analysis and prevention	2, 5	Predictive
Paragraph 6	Protection and intervention	2, 3, 4	Technical, Emergency Response

How the Competent Authority Assesses a Safety Report

Operators who write safety reports without reading the Safety Report Assessment Manual are writing blind. The SRAM is the public document the CA inspectors use to judge completeness and adequacy, and it organises the assessment into five elements that mirror the flow of a well-structured report. You can read the HSE’s explanation of how the CA examines reports on the HSE assessment criteria page, and the full L111 guidance on the HSE L111 publication page.

The SRAM’s five assessment elements are:

• Descriptive Element: Covers paragraph 3 (environment) and the descriptive parts of paragraph 4 (installation). Assessors check completeness, internal consistency, and whether the level of detail is proportionate to the risk.
• MAPP and SMS Element: Tests paragraph 2 — is the MAPP present, is the SMS described against all seven Schedule 2 elements, is there prima facie evidence of implementation rather than paper claims?
• Predictive Element: Targets paragraph 5 — scenario identification completeness, adequacy of consequence modelling, sufficiency of the representative set, treatment of external initiators, quality of the past-incident review.
• Technical Element: Examines paragraph 6 — engineered measures, performance standards, safety-critical elements, maintenance regimes, and deviations from relevant good practice.
• Emergency Response Element: Closes paragraph 6 — internal emergency plan fitness, adequacy of information for the external plan, command arrangements, resources, and drills evidence.

The demonstration standard within the SRAM is specific. To pass, each significant topic must show four things together: a summary description, links to the standards being complied with, links to the SMS arrangements delivering the control, and prima facie evidence the control is working. A report that asserts compliance without evidencing all four is marked as incomplete on that topic.

Two outcomes are possible. Either the CA issues a communication under Regulation 22 indicating that the major accident hazards are being properly managed, or it notifies the operator in writing that the report contains significant omissions or serious deficiencies and is therefore rejected. The CA’s target is to complete a full assessment within 12 months of submission, with the active assessment phase completed within 6 months of commencement. Rejection is serious — there is no iteration mechanism; the operator must submit a new safety report.

The ALARP Demonstration: The Report’s Toughest Requirement

In the quarterly lessons-learned forum I attend, the single topic that dominates discussion is ALARP evidencing. Not whether ALARP applies — it always applies — but how the report shows it has been achieved for each scenario in the representative set. Weak ALARP treatment is the most frequent cause of a report being sent back for revision, and in my experience it is the section where seasoned process safety engineers and newly qualified drafters differ most visibly.

COMAH encodes ALARP in the phrase “all measures necessary.” Legally, a measure is necessary unless its cost is grossly disproportionate to the risk-reduction benefit it delivers. “Grossly” is not a synonym for “slightly.” UK case law and HSE guidance place the multiplier high — particularly for hazards carrying potential for multiple fatalities — and the burden of proof sits entirely on the operator. A safety report that claims ALARP without showing the cost-benefit reasoning is not making an ALARP demonstration at all; it is making an assertion.

A defensible ALARP demonstration in a COMAH safety report includes:

• Individual risk and societal risk presented together: Individual risk to the most exposed person, societal risk as an F-N curve where appropriate, both benchmarked against the CA’s risk criteria.
• Bow-tie diagrams with performance-standard-tagged barriers: Each preventative and mitigating barrier shown explicitly, with its performance standard and any identified degradation factor.
• Cost-benefit analysis at the scenario level: Not a site-wide CBA, but scenario-specific reasoning using a valuation of prevented fatalities that aligns with current HSE guidance.
• Relevant good practice benchmarking: Each barrier tested against RGP, with explicit justification where the site’s practice falls short or diverges.
• Carry-forward improvement plan: ALARP is never completed; open recommendations from HAZOPs, LOPAs, and incident investigations carry between safety report revisions with target dates and owners.

A worked example I often point drafters to is a bund overflow scenario at a bulk flammable liquids terminal. Paragraph 5 identifies catastrophic tank failure as a scenario; paragraph 6 shows the bund, the bund wall impermeability, the deluge coverage, and the dike drain. An ALARP demonstration for this scenario explores whether a higher bund wall or a secondary containment basin is reasonably practicable, costs both options, compares the cost to the prevented-fatality benefit using the representative scenario’s societal risk contribution, and concludes either that the upgrade is required or that the current design is ALARP with reasoning. That scenario-level rigour, repeated across the representative set, is what an ALARP demonstration looks like.

When to Submit, Review, and Revise the Safety Report

Timing is where many operators slip. Regulation 9 sets the submission deadlines and Regulation 10 governs review and revision. The rules group into four submission triggers and a distinct review cycle.

1. New upper-tier establishment: The PCSR must be submitted a reasonable period before construction of the establishment starts, and the POSR before operation begins. “Reasonable” is not defined in days, but 6–12 months is the working planning figure for a complex installation.
2. Existing establishment newly above threshold: The safety report must be submitted within a reasonable period before the upper-tier threshold is crossed — driven by inventory changes, expansion, or the arrival of a new dangerous substance.
3. Five-year mandatory review: Every safety report must be reviewed at least every 5 years, even where no material changes have occurred. The operator must notify the CA whether the review led to a revision or not.
4. Pre-modification: A revised safety report must be produced before any modification of an installation, establishment, storage facility, process, or nature or physical form or quantity of dangerous substances that could have significant repercussions for major accident hazards.

Out-of-cycle review and revision is triggered by any of the following: significant changes to the SMS with implications for major accident prevention, new knowledge about the substances or processes (for example a revised ecotoxicity classification), an accident or significant near-miss that reveals a previously unrecognised scenario, or a change in the regulatory or standards landscape material to the demonstrations. In practical terms, treating the safety report as a living document reviewed annually against a change log is far safer than waiting for the 5-year anniversary and discovering the document no longer matches the plant.

Common Deficiencies That Lead to Rejected Safety Reports

The Competent Authority’s rejection letters read in patterns. Significant omissions and serious deficiencies — the two SRAM categories — cluster around a small number of recurring failures. I keep a working list of these pulled from published assessment decisions and peer-review experience:

1. Incomplete representative set of major accident scenarios. The set fails to cover the envelope of MAHs, usually missing low-frequency / high-consequence external initiators or combinations.
2. Weak or missing review of past accidents. The section lists incidents but shows no evidence of learning integrated into barrier design or SMS arrangements.
3. Unjustified deviation from relevant good practice. Barriers that sit below RGP with no documented cost-benefit reasoning explaining why.
4. Generic ALARP assertions. Site-level ALARP claims without scenario-specific cost-benefit reasoning, commonly tied to template-imported language.
5. MAPP disconnected from the SMS. A board-signed MAPP that no one below the executive layer recognises, while the SMS described in paragraph 2 does not map back to MAPP objectives.
6. Insufficient environmental receptor characterisation. MATTE scoping is present in name only; sensitive receptors in the likely consequence zone are not identified or their exposure pathways are not traced.
7. Human factors barely addressed. Human error is mentioned but not integrated into the SMS description, performance standards, or scenario analyses.
8. Domino effects not documented. Regulation 16 information missing or reduced to a site map with nearby operators labelled but no exchanged information evidenced.
9. Report inconsistent with what the inspection finds on site. The most damaging category — discovered when an inspector walks the plant and finds controls described in the report are not in place, or are present in a different form.

A peer-review pass before submission — ideally by a drafter who did not write the report — catches most of these.

Safety Report Contents Checklist (Quick Reference)

The table below is the bookmark-and-return-to reference I use on every report. Each content element is tagged with its Schedule 3 paragraph and the demonstration it supports. An “Evidence location” column is left blank for drafters to populate with their document’s section reference.

Content Element	Sch 3 Paragraph	Demonstration	Evidence Location
MAPP (separately identifiable document)	Para 2	1
SMS description, all seven Schedule 2 elements	Para 2	1
Human factors integration in SMS	Para 2	1
Domino effect information	Para 2	1, 2
Geographical, meteorological, geological, hydrographic conditions	Para 3	2, 5
Site history relevant to present risk	Para 3	2
Population and receptor characterisation	Para 3	2, 5
External initiators (including Natech and climate adaptation)	Para 3	2
Description of each MAH installation	Para 4	2, 3
Operating methods referencing best practices	Para 4	3
Dangerous substance inventory with CLP classification	Para 4	2
Physical, chemical, tox and ecotox characteristics	Para 4	2
Loss-of-containment behaviour	Para 4	2
Representative set of major accident scenarios	Para 5	2, 5
Review of past accidents and incidents	Para 5	2
Consequence modelling outputs	Para 5	2, 5
MATTE assessment	Para 5	2, 5
Engineered protection measures	Para 6	2, 3
Safety-critical elements and performance standards	Para 6	3
Organisational measures	Para 6	2, 3
Internal emergency plan description	Para 6	4
Information for external emergency plan	Para 6	4
RGP references and deviation justifications	Para 6	2, 3
ALARP demonstration per representative scenario	Para 5 and 6	2
Non-technical summary (Regulation 17)	Separate	5

Readers who want to work directly from the statutory instrument can consult the full text of COMAH 2015 on legislation.gov.uk alongside the HSE COMAH 2015 guidance portal.

Frequently Asked Questions

Conclusion

The contents of a COMAH safety report are converging, not stabilising. CDOIF’s January 2026 climate-change adaptation guidance has already shifted what assessors expect to see in Schedule 3 paragraph 3 — Natech scenario treatment is now a visibility test, not a nice-to-have. The Scottish Government’s hydrogen planning and consenting guidance published in February 2026 maps Schedule 3 paragraphs 2 to 6 directly onto hydrogen facilities entering the upper-tier regime for the first time, which signals that the next wave of safety report work will come from energy-transition projects bringing unfamiliar substance behaviours into a regime built around hydrocarbon and toxic chemistry experience.

The direction of travel is toward reports that are more dynamic, more environmentally integrated, and more explicitly tied to the SMS arrangements that keep controls functional between review cycles. Operators who treat the COMAH safety report as a static compliance artefact will find the 5-year revision cycle grows longer and more painful each time. Operators who treat it as the living technical spine of their major-accident-hazard management — maintained against a change log, stress-tested by peer review before submission, and written to the five demonstrations rather than the paragraphs — find their reports pass assessment faster and survive inspection scrutiny better.

The upper-tier duty holder preparing a first report, or a 5-year revision, can take one durable principle from everything above: write the document the assessor will read, evidenced against the demonstrations the assessor will test, referenced to the standards the assessor applies. Everything else — the template, the software, the corporate style guide — is secondary to that single discipline.