An employer must-
(a) conduct and document the risk assessment to determine if any person could be exposed to an HBA; and
(b) ensure that the HBA risk assessment contemplated in paragraph is conducted by a competent person.