Health & safety guide

What is a risk assessment?

A risk assessment is the process of identifying what could cause harm at work, considering who could be harmed and how, and deciding what needs to be done to eliminate or control the risk. It is not simply a form that needs completing. The purpose is to prevent people being harmed.

Under the Management of Health and Safety at Work Regulations 1999, employers in Great Britain have duties to assess risks to employees and risks to people who are not employees but could be affected by the work. HSE describes risk assessment as one part of the wider process of controlling workplace risks.

Hazard and risk are not the same thing

A hazard is something with the potential to cause harm. A risk considers how likely that harm is and how serious it could be. For example — hazard: an unprotected edge at height; potential harm: a person could fall; risk: depends on matters such as who can access the edge, how frequently they are exposed and what controls are already in place. See hazard vs risk.

What is the purpose of a risk assessment?

A risk assessment should help you make decisions. It should establish what could cause harm, who could be affected, how they could be harmed, what controls already exist, whether those controls are sufficient, what additional action is needed, who needs to carry it out, and when it needs to be completed. The finished document is evidence of that process — but the document itself isn't the objective. Controlling the risk is the objective.

What are the five steps?

A useful structure is: (1) identify the hazards; (2) decide who might be harmed and how; (3) assess and control the risks; (4) record the significant findings where the recording requirement applies; and (5) review the controls and update the assessment when circumstances change. HSE currently describes its process in essentially these five stages. See the five steps to risk assessment.

What hazards should you consider?

The answer depends on the business and work. Examples can include falls from height, vehicles and workplace transport, machinery, electricity, hazardous substances, manual handling, slips and trips, noise, vibration, fire, display screen work, work-related stress and lone working. Some hazards have additional regulations or require more specific assessments; a general workplace risk assessment should help identify when those more specialised assessments are necessary.

Who might be harmed?

Don't automatically write "employees" and move on. Depending on the work, consider employees, contractors, agency workers, visitors, customers, members of the public and people sharing the workplace. HSE also tells employers to consider workers who may have particular requirements, including young workers, new or expectant mothers and people with disabilities. The question is not simply who is present? It is: who could actually be affected by this hazard, and how?

Does every risk need eliminating?

Not every workplace risk can be completely eliminated. The employer needs to do what is reasonably practicable to protect people. HSE explains this as balancing the level of risk against what is required to control the real risk in terms of money, time or trouble. That does not mean cost automatically overrides safety — higher risks justify greater effort to control them.

Does a risk assessment have to be written down?

Every employer needs to assess relevant workplace risks. Where an organisation employs five or more people, HSE states that the significant findings must be recorded. For smaller businesses, writing the assessment down can still be extremely useful because it creates a record of the hazards, controls and decisions that can later be reviewed.

Is a generic risk assessment enough?

Only if it genuinely reflects the work. A template can help structure the process, but the assessment needs to consider the actual workplace, activity, hazards, people exposed, existing controls and additional controls required. Changing the company name on somebody else's assessment doesn't make it suitable for your work.

When should a risk assessment be reviewed?

Risk assessments should be kept current. HSE says controls should be reviewed to make sure they continue to work, particularly where they may no longer be effective or workplace changes could introduce new risks. Accidents, near misses and concerns raised by workers can also indicate that a review is appropriate. See how often risk assessments should be reviewed.

Great Britain and Northern Ireland

For Great Britain, the core management regime is the Management of Health and Safety at Work Regulations 1999. Northern Ireland has separate Management of Health and Safety at Work Regulations (Northern Ireland) 2000, including regulation 3 on risk assessment. HSENI likewise uses a five-step risk-assessment approach.

Keep risk assessments organised and accessible

Complys gives you a structured way to build, store and manage risk assessments — hazards, who is at risk, controls with owners, recorded significant findings, review dates and read-and-acknowledge — with the judgement remaining yours or your competent person's.