Every employer in Great Britain must assess the risks to the health and safety of their employees and anyone else affected by their work. That is regulation 3 of the Management of Health and Safety at Work Regulations 1999. A good risk assessment is short, specific to your work and actually used. A bad one is a generic template nobody has read since it was downloaded.
Who has to do one, and who has to write it down
Every employer and self-employed person whose work could affect others must assess risks. If you employ five or more people, you must record the significant findings: the hazards, who could be harmed, and the controls you have in place or plan to add.
Some groups need specific consideration: new and expectant mothers, young workers under 18, lone workers and people with a disability. Specific regulations add their own assessments, such as COSHH, manual handling, display screen equipment, noise, vibration and fire.
The five steps
- Identify the hazards: walk the workplace, talk to the people who do the job, read manufacturers' instructions and safety data sheets, and look at your accident and near-miss records. Think about long-term health hazards (noise, dust, stress, manual handling), not just obvious safety hazards.
- Decide who might be harmed and how: employees, contractors, visitors, members of the public, cleaners and maintenance staff who are not there all the time.
- Evaluate the risks and decide on controls: compare what you do now with good practice, and add controls until the risk is as low as reasonably practicable.
- Record your significant findings: what the hazards are, who is at risk, what controls are in place, and what further action is needed, by whom and by when.
- Review and update: when anything significant changes, after an incident or near miss, and at a set interval so it does not go stale.
Scoring risk: likelihood times severity
Many businesses use a simple 5 by 5 matrix: rate how likely harm is (1 rare to 5 almost certain) and how bad it would be (1 minor injury to 5 fatality), then multiply. A score of 15 to 25 is high and needs action before work continues; 8 to 12 is medium and needs improvement; 1 to 6 is low and needs monitoring.
Score the risk twice: before controls (the inherent risk) and after them (the residual risk). The gap shows the value of your controls, and an auditor will expect residual risk to be lower.
Choosing controls: the hierarchy
- Eliminate the hazard altogether, for example by designing out work at height.
- Substitute something less hazardous, such as a water-based product instead of a solvent.
- Engineering controls: guards, local exhaust ventilation, barriers, interlocks.
- Administrative controls: safe systems of work, permits, signage, training, supervision, job rotation.
- Personal protective equipment, as the last line of defence, not the first.
A worked example
Hazard: slips on a wet warehouse floor near the loading door when it rains. Who: warehouse staff, drivers and visitors. Before controls: likelihood 4, severity 3, score 12 (medium). Controls: entrance matting, a canopy over the door, a spill kit and cleaning rota, anti-slip footwear for warehouse staff, and "wet floor" signs. After controls: likelihood 2, severity 3, score 6 (low). Action: fit the canopy by the end of next month, owner the site manager.
Mistakes to avoid
- Copying a generic template without changing it to fit how the work is really done.
- Listing controls that do not exist on the shop floor.
- Never sharing the assessment with the people doing the job.
- Actions with no owner or date.
- Never reviewing it, even after an accident.
Frequently asked questions
How often should a risk assessment be reviewed?
The law says whenever there is reason to think it is no longer valid or there has been a significant change. Most businesses also review at least once a year, and always after an accident or near miss involving the task.
Do I need a risk assessment if I have fewer than five employees?
Yes. You must still assess the risks. You just do not have to write the findings down, though it is good practice and the easiest way to show you did it.
Who can carry out a risk assessment?
A competent person: someone with the knowledge and experience of the work to spot the hazards and judge the controls. In a small business that is usually the manager or supervisor, involving the people who do the work.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.