Where the duty sits
The law places occupational health and safety duties on the employer: having the risk assessment carried out, taking the measures, providing training, arranging health surveillance. That is why administrative fines are addressed to the employer.
The employer's representative
A person acting on the employer's behalf and taking part in managing the work and the workplace counts as the employer for these duties. Responsibility does not sit only at the very top of the org chart; whoever actually manages is within scope.
Buying a service does not transfer it
Engaging an external safety specialist, occupational physician or joint health and safety unit is a way of discharging the duty, not of transferring it. The provider has their own professional responsibility; neither cancels the other.
Contractor relationships
Where several employers work at one site, each is responsible for their own workers, and duties of coordination and mutual information arise on top. Saying “that is the contractor's work” does not remove the principal employer's duty to coordinate.
What makes a penalty large
Amounts are revalued each year, and some items apply per worker or for every month the breach continues. Those two multipliers make a single item far larger than it looks in the table.