Writing a risk assessment doesn't have to be complicated. Whether you're a small business owner, a facilities manager, or responsible for health and safety in your organisation, this guide will take you through the complete process of creating effective workplace risk assessments using the HSE's proven 5-step method.
Do you need to write a risk assessment?
Check if you're legally required to document risk assessments.
What is a Risk Assessment?
A risk assessment is a systematic examination of your workplace to identify what could cause harm to people, evaluate the level of risk, and determine what control measures you need to put in place to protect workers and others.
The process helps you:
- Identify potential hazards before accidents happen
- Prioritise which risks need urgent attention
- Demonstrate legal compliance
- Create a safer working environment
- Reduce insurance premiums and liability
- Show employees you take their safety seriously
The goal isn't to eliminate every possible risk (which is often impossible), but to ensure risks are controlled to an acceptable level through reasonable and practical measures.
The HSE 5-Step Method
The Health and Safety Executive recommends a straightforward five-step approach that works for businesses of all sizes. Let's explore each step in detail.
Step 1: Identify the Hazards
A hazard is anything that has the potential to cause harm. Start by walking through your workplace with fresh eyes, looking for things that could cause injury or ill health.
Common workplace hazards include:
- Physical hazards: Slips, trips, falls, working at height, machinery, vehicles, electricity, noise, vibration
- Chemical hazards: Cleaning products, paints, solvents, dust, fumes
- Biological hazards: Bacteria, viruses, mold, waste materials
- Ergonomic hazards: Manual handling, repetitive tasks, poor workstation setup
- Psychosocial hazards: Stress, violence, lone working, working hours
- Environmental hazards: Temperature extremes, poor lighting, ventilation
How to identify hazards effectively:
-
Walk the workplace systematically - Don't just sit at a desk. Physically inspect all areas, including storage rooms, outdoor spaces, and less-visited locations.
-
Talk to your employees - They work with the equipment and processes daily and often have valuable insights into risks you might miss.
-
Check accident and ill-health records - Past incidents indicate where problems exist.
-
Review manufacturer instructions - Equipment and chemical datasheets often highlight specific hazards.
-
Consult HSE guidance - Industry-specific guidance is available for most sectors.
-
Consider different scenarios - Think about routine work, maintenance, cleaning, and emergency situations.
Don't forget to consider hazards that affect visitors, contractors, cleaners, and members of the public who might be affected by your work activities.
Step 2: Decide Who Might Be Harmed and How
For each hazard you've identified, consider who could be harmed and how this might happen. Different groups may face different levels of risk.
Groups to consider:
- Office staff
- Warehouse or production workers
- Maintenance personnel
- Cleaning staff
- Contractors
- Visitors and customers
- Young or inexperienced workers
- New and expectant mothers
- People with disabilities
- Lone workers
- Those working outside normal hours
Some people face higher risks than others. Pregnant workers, young employees, people with disabilities, and those new to the job deserve special consideration in your assessment.
Example: In a retail store, wet floors pose a slip hazard to staff, customers, and delivery personnel. Elderly customers may be at higher risk of serious injury from a fall.
Step 3: Evaluate the Risks and Decide on Precautions
Now you need to evaluate the level of risk and decide whether existing control measures are adequate or if more needs to be done.
Understanding risk levels:
Risk is calculated by considering two factors:
- Likelihood - How likely is it that the hazard will cause harm?
- Severity - How serious would the harm be if it occurred?
Risk Scoring Matrix:
| Likelihood / Severity | Minor Injury (1) | Moderate Injury (2) | Major Injury (3) | Fatality (4) |
|---|---|---|---|---|
| Unlikely (1) | Low (1) | Low (2) | Medium (3) | Medium (4) |
| Possible (2) | Low (2) | Medium (4) | Medium (6) | High (8) |
| Likely (3) | Medium (3) | Medium (6) | High (9) | Very High (12) |
| Very Likely (4) | Medium (4) | High (8) | Very High (12) | Very High (16) |
Risk ratings:
- Low (1-3): Acceptable risk with current controls
- Medium (4-6): Review controls and consider improvements
- High (8-9): Immediate action required to reduce risk
- Very High (12-16): Stop work until risk is controlled
The Hierarchy of Controls
When deciding on control measures, follow this hierarchy from most effective to least effective:
- Elimination - Remove the hazard entirely
- Substitution - Replace with something less hazardous
- Engineering controls - Isolate people from the hazard
- Administrative controls - Change the way people work
- PPE - Personal protective equipment (last resort)
Applying controls:
First, check what you're already doing. Then ask:
- Can I get rid of the hazard altogether?
- If not, how can I control the risks so harm is unlikely?
- Are my current controls working effectively?
- Do my controls follow recognised standards or best practice?
Office Risk Assessment Example
A medium-sized accounting firm identified that many staff were experiencing back pain and eye strain from prolonged computer use.
After conducting a risk assessment, they implemented Display Screen Equipment (DSE) assessments for all desk workers, provided adjustable chairs and monitor arms, introduced mandatory breaks every hour, and offered eye tests. Sick days due to musculoskeletal problems dropped by 60% within six months.
Step 4: Record Your Findings and Implement Them
If you have five or more employees, you must record the significant findings of your risk assessment. However, even if you have fewer employees, writing it down helps you stay organised and demonstrates you've taken reasonable steps.
Your risk assessment record should include:
- Hazards identified - What could cause harm
- Who might be harmed - Which groups of people
- Existing controls - What you're already doing
- Risk rating - Using your scoring matrix
- Additional actions needed - What more you plan to do
- Action owner - Who is responsible
- Target date - When actions will be completed
- Review date - When you'll review this assessment
Recording format:
While there's no legal requirement for a specific format, a simple table works well:
| Hazard | Who's at Risk | Existing Controls | Risk Rating | Further Action | Action By | Target Date | Review Date |
|---|---|---|---|---|---|---|---|
| Wet floors in entrance | Staff, customers, visitors | Warning signs, anti-slip mats | Medium (4) | Install automatic mat system, improve drainage | Facilities Manager | 30/01/2025 | Annually |
A risk assessment is only useful if you actually implement the control measures you've identified. Assign clear responsibilities and deadlines for all actions.
Communication is crucial:
- Share relevant findings with affected employees
- Provide training on new control measures
- Display key safety information in work areas
- Include risk assessment briefings in induction for new starters
- Make assessments available for inspection
Step 5: Review Your Assessment and Update if Necessary
Risk assessments aren't "set and forget" documents. They need regular review to remain effective.
When to review:
- Annually as a minimum for most workplaces
- Before changes - New equipment, processes, or chemicals
- After incidents - Accidents or near misses indicate controls may be inadequate
- When work patterns change - New shift patterns, increased production
- Following workplace changes - Renovations, layout changes, new locations
- When new people join - Particularly vulnerable groups
- When regulations change - New legal requirements
Set calendar reminders for annual reviews. Many businesses review all risk assessments at the same time each year to ensure nothing is missed.
Review process:
- Are the control measures still in place and working?
- Have there been any changes to the work activity?
- Have any new hazards been identified?
- Are the risk ratings still appropriate?
- Have there been any accidents or near misses?
- Is there new guidance or industry best practice?
Update your assessment to reflect any changes and communicate updates to affected staff.
Practical Examples
Let's look at complete risk assessment examples for different workplace scenarios.
Warehouse vs Office: Different Approaches
Warehouse Environment
- •Focus on physical hazards (forklifts, manual handling, falls from height)
- •Need for extensive PPE requirements
- •Regular machinery inspections required
- •Clear segregation of pedestrians and vehicles
- •Higher risk ratings requiring immediate controls
Office Environment
- •Emphasis on ergonomic hazards (DSE, workstation setup)
- •Psychosocial factors (stress, lone working)
- •Fire safety and evacuation procedures
- •Slip and trip hazards
- •Generally lower risk ratings with simpler controls
Example 1: Retail Shop Floor
Hazard: Manual handling of stock deliveries
Who's at risk: Shop staff, delivery drivers
Existing controls:
- Staff trained in manual handling techniques
- Team lifting policy for items over 20kg
- Trolleys and hand trucks available
Risk rating: Medium (6) - Possible likelihood, Moderate injury severity
Further actions needed:
- Purchase additional trolleys for stockroom
- Introduce regular stretching sessions for staff
- Review delivery schedules to avoid single person working
Action by: Store Manager
Target date: 28/02/2025
Review date: Annually or after any manual handling injury
Example 2: Small Workshop
Hazard: Noise from machinery
Who's at risk: Workshop operatives, maintenance staff
Existing controls:
- Machines serviced regularly to minimise noise
- Ear defenders provided
- Exposure limited to 4-hour shifts
Risk rating: Medium (6) - Likely likelihood, Minor injury (hearing damage) severity
Further actions needed:
- Conduct formal noise assessment
- Implement hearing surveillance program
- Install acoustic panels in workshop
- Create quiet rest area
Action by: Workshop Supervisor
Target date: 31/03/2025
Review date: Every 2 years or when machinery changes
Example 3: Care Home
Hazard: Aggressive behaviour from residents with dementia
Who's at risk: Care staff, other residents, visitors
Existing controls:
- Staff trained in dementia care and de-escalation
- Behaviour management plans for specific residents
- Alarm systems for staff to call for assistance
- Incident reporting procedures
Risk rating: High (8) - Possible likelihood, Major injury severity
Further actions needed:
- Increase staffing levels during high-risk periods
- Implement advanced training in positive behaviour support
- Review environmental factors (noise, lighting) that may trigger aggression
- Provide regular supervision and debriefing for affected staff
Action by: Care Home Manager
Target date: Immediate review, ongoing improvements by 30/04/2025
Review date: Monthly review of specific incidents, full assessment every 6 months
Common Mistakes to Avoid
Even experienced professionals can make errors when conducting risk assessments. Here are the most common pitfalls:
1. Generic, copy-paste assessments
Using a template from the internet without adapting it to your specific workplace means you'll miss hazards unique to your situation.
2. Not involving employees
Your workers are the experts in their day-to-day tasks. Conducting assessments in isolation leads to gaps and reduces buy-in.
3. Focusing only on obvious hazards
Don't overlook less visible risks like stress, lone working, or long-term health effects from exposure to substances.
4. Weak or vague control measures
"Be careful" or "Take care" aren't control measures. Be specific: "Use the handrail when ascending stairs" or "Wear safety glasses when grinding."
5. Not implementing what you've written
A risk assessment gathering dust in a drawer protects no one. Actions must be completed and controls must be maintained.
6. Never reviewing
Risk assessments quickly become outdated as workplaces evolve. Annual reviews are the minimum.
7. Underestimating risk ratings
Being optimistic about risk levels provides false reassurance. Be realistic and err on the side of caution.
8. Forgetting about vulnerable groups
Young workers, pregnant employees, and those with disabilities may face different or heightened risks.
Legal Consequence
Failure to conduct suitable and sufficient risk assessments is one of the most common breaches identified during HSE investigations following serious incidents. Courts take a dim view of inadequate risk assessments, and they're often used as evidence of negligence.
Tips for Effective Risk Assessments
Keep it proportionate
A small office doesn't need a 50-page document. The level of detail should match the size of your organisation and the complexity of your activities.
Use clear language
Avoid jargon and technical terms where possible. Everyone who needs to read the assessment should be able to understand it.
Take photographs
Pictures can illustrate hazards and controls more clearly than written descriptions alone.
Cross-reference other documents
Link to your health and safety policy, training records, equipment manuals, and COSHH assessments where relevant.
Involve a diverse group
Different perspectives help identify hazards others might miss. Include representatives from different departments and levels.
Don't forget external factors
Consider weather conditions, public events, seasonal variations, and other external influences on your workplace.
Track completion of actions
Use a simple action tracker to monitor progress on implementing additional controls.
Construction Site Assessment
A construction company was preparing to refurbish a three-story building. Initial risk assessments identified standard construction hazards, but a site walkthrough with experienced trades revealed additional risks: asbestos in ceiling tiles, unstable floor joists, and a bat roost requiring ecological protection.
By involving frontline workers and specialists early, they identified hazards that would have caused serious delays and potential harm if discovered mid-project. Additional controls included asbestos removal by licensed contractors, structural engineering surveys, and timing work to avoid bat breeding season. Project completed safely and on schedule.
Special Considerations
Fire risk assessments
While general risk assessments cover many hazards, fire requires a separate, more detailed assessment under the Regulatory Reform (Fire Safety) Order 2005.
COSHH assessments
Working with hazardous substances requires specific Control of Substances Hazardous to Health (COSHH) assessments in addition to general risk assessments.
COVID-19 and infectious diseases
Consider biological hazards and transmission risks, particularly in healthcare, education, and public-facing roles.
Remote and lone workers
Don't forget employees working from home, traveling, or working alone. They face unique risks requiring specific controls.
Temporary workers and contractors
Ensure temporary staff and contractors receive appropriate briefings on site-specific hazards and controls.
Frequently Asked Questions
Frequently Asked Questions
There's no set length. A small office might have a 2-page assessment, while a manufacturing facility might need dozens of pages. Focus on being thorough and clear rather than hitting a word count. Quality matters more than quantity.
For straightforward low-risk environments like small offices or shops, you can conduct your own risk assessments with proper guidance. For complex, high-risk activities (construction, chemical handling, etc.), or if you're unsure, engaging a qualified health and safety consultant is advisable.
A hazard is something with the potential to cause harm (like a wet floor). A risk is the likelihood that harm will actually occur and how serious it would be. You assess hazards to determine the level of risk they present.
Not necessarily. You can group similar activities together. For example, one assessment might cover all office workstations rather than assessing each desk individually. However, significantly different activities need their own assessments.
Beyond the legal requirement, failing to conduct risk assessments leaves you exposed to preventable accidents, employee injury, regulatory enforcement action, prosecution, unlimited fines, and civil claims for damages. Most importantly, people could get hurt when simple precautions could have prevented it.
A suitable and sufficient risk assessment: identifies significant hazards, covers everyone who might be affected, addresses the real risks in your workplace (not generic ones), implements appropriate controls based on the hierarchy of control, is proportionate to the risk level, and is reviewed and updated when needed.
Documentation and Record Keeping
Proper documentation demonstrates compliance and helps you track improvements over time.
What to keep:
- Completed risk assessment forms
- Action plans and completion records
- Review dates and update notes
- Training records for those conducting assessments
- Evidence of employee consultation
- Incident reports that triggered reviews
How long to keep records:
While there's no specified retention period for risk assessments, best practice is to keep:
- Current assessments: Until superseded by updated version
- Superseded assessments: At least 3 years
- Assessments relating to hazardous substance exposure: 40 years
- Assessments connected to incidents or claims: Indefinitely
Storage:
- Keep digital and physical copies
- Ensure assessments are accessible to those who need them
- Protect confidential information appropriately
- Back up digital records regularly
Moving Forward
Writing effective risk assessments is a skill that improves with practice. Start with high-priority areas, involve your team, and build up a comprehensive picture of your workplace hazards and controls.
Remember, the purpose isn't to create perfect paperwork - it's to create a safer workplace. A simple, practical risk assessment that's actually implemented is worth infinitely more than an elaborate document that sits unused.
Next steps:
- Identify which areas of your workplace need risk assessments
- Prioritise based on likelihood and severity of potential harm
- Schedule time to conduct walkthroughs
- Consult with employees and review incident records
- Document your findings using a clear format
- Implement control measures
- Set review dates and calendar reminders
The best risk assessment is one that's complete, communicated, implemented, and regularly reviewed. Don't let perfect be the enemy of good - start today and improve as you go.
Get Your Template
Risk Assessment Template
Our professionally designed template includes the risk matrix, example hazards, and step-by-step guidance to complete your assessment quickly and correctly.
- ✓ HSE-compliant format
- ✓ Built-in risk scoring matrix
- ✓ Example entries included
- ✓ Review schedule tracker
Coming soon - join our mailing list to be notified when templates are available.
Further Resources
HSE Guidance:
- HSE's "Five Steps to Risk Assessment" (INDG163)
- Industry-specific guidance for your sector
- Example risk assessments for common scenarios
Training:
Consider IOSH Managing Safely or similar courses to develop your risk assessment skills further.
When to get professional help:
If your workplace involves high-risk activities, complex hazards, or specialised equipment, engaging a qualified health and safety consultant ensures thorough assessments and regulatory compliance.
Legal References:
- Management of Health and Safety at Work Regulations 1999 (Regulation 3)
- Health and Safety at Work etc. Act 1974 (Section 2)
Document Control:
- First published: 23 December 2024
- Last reviewed: 23 December 2024
- Next review: December 2025
- Version: 1.0