Five steps to risk assessment
A useful workplace risk assessment doesn't need to be unnecessarily complicated. HSE's current guidance breaks risk management into a straightforward process: identify hazards → assess risks → control risks → record findings → review controls. The important thing is not the wording of the headings. It is what you actually do.
Step 1 — Identify the hazards
A hazard is something capable of causing harm. Look at how people actually work; machinery and equipment; vehicles; substances; workplace conditions; routine and non-routine activities; maintenance and cleaning; previous accidents and ill health; and unsafe practices. HSE specifically recommends looking at accident and ill-health records because they can expose hazards that are less obvious during a walk-around. Talk to the people doing the job too — they may see risks that are invisible from an office.
Step 2 — Decide who might be harmed and how
Identifying "working at height" isn't enough. Ask: who could fall? Who could be struck by something falling? Could contractors be affected? Could members of the public enter the area? Then describe how the harm could occur. Consider employees and other people affected by the work, including contractors, visitors and members of the public. HSE also highlights workers who may have particular requirements.
Step 3 — Evaluate and control the risk
Consider how likely the harm is and how serious it could be. Then look at the controls already in place — are they enough? If not, determine what else needs to happen. HSE recommends first considering whether the hazard can be removed altogether; if it cannot, the risk should be controlled so that harm is unlikely. Potential approaches include eliminating the hazard, substituting something safer, redesigning the work, reducing exposure, introducing practical protective measures, and providing suitable PPE where necessary. The precise controls depend on the hazard.
Step 4 — Record the significant findings
If you employ five or more people, the significant findings need to be recorded. HSE says that should include the hazards, who might be harmed and how, and what is being done to control the risks. It is also good management to record additional actions, responsibility and target dates. A useful assessment makes it clear what happens next.
Step 5 — Review the controls
Workplaces change. People change. Equipment changes. Processes change. Substances change. Controls can deteriorate. HSE therefore says employers should review controls to ensure they remain effective and reconsider them when workplace changes could introduce new risks. Accidents, near misses and concerns can also be triggers. See review frequency.
Don't confuse the five steps with five boxes
A poor assessment can technically contain all five headings. For example — hazard: machinery; risk: injury; control: training — tells the reader very little. A stronger assessment explains the particular hazard, who is exposed, how injury could occur, what controls exist and what additional action is needed. Specificity matters.
Risk matrices and scoring
Some businesses use numerical matrices combining likelihood and severity. These can be useful for prioritisation. But the law does not become satisfied merely because the spreadsheet produces a green number. A score should support judgement — not replace it. Controls still need to be appropriate to the actual hazard and work.
What does "reasonably practicable" mean?
HSE describes this as weighing the level of risk against the measures needed to control the real risk in terms of money, time or trouble. The greater the risk, the stronger the justification needed for not taking a control measure.
Risk assessment is a cycle
The process doesn't really end at step five. A useful model is: identify → assess → control → record → review → identify again. Changes and experience feed back into the next assessment. That is how risk management becomes part of running the business rather than an annual paperwork exercise. See what a risk assessment is.
Build consistent workplace risk-assessment records
Complys gives you a structured way to build, store and manage risk assessments — with owners, recorded significant findings, review dates and read-and-acknowledge — so the five steps lead to action, not just a form.
Risk assessment software →FAQs
What are the five steps to risk assessment?
A common HSE structure is: identify hazards; decide who might be harmed and how; evaluate/control risks; record significant findings; and review the assessment.
Do I need a risk matrix?
Not universally. A matrix can support risk evaluation and prioritisation, but appropriate judgement and controls remain necessary.
Should workers be involved?
Yes. HSE recommends involving employees because people doing the work can identify hazards and practical controls that may otherwise be missed.
When do significant findings need recording?
HSE states that employers with five or more people must record significant findings.
Is reviewing the assessment part of the process?
Yes. Controls need to remain effective and the assessment needs to reflect changes in the workplace.
Related: what is a risk assessment, hazard vs risk, review frequency, and risk assessment software. General information, not legal advice.