Do I Need a Written Risk Assessment?

Whether you need to write down your risk assessments depends primarily on how many people you employ. However, certain types of assessments must always be recorded in writing, regardless of business size.

The 5-employee threshold

The Management of Health and Safety at Work Regulations 1999 (Regulation 3) creates a clear dividing line:

If you employ 5 or more people, you must record:

• The significant findings of your risk assessment
• Any group of employees identified as being especially at risk
• The arrangements for protecting health and safety

If you employ fewer than 5 people:

• There's no legal requirement to record risk assessments in writing
• However, certain specific assessments must still be written (see below)

How to count employees

Count all people employed at any one time, including:

• Full-time permanent staff
• Part-time workers (counted as whole people, not FTE)
• Temporary and agency workers you directly employ
• Fixed-term contract employees
• Seasonal workers when they're employed
• Apprentices and trainees
• Directors who are also employees

Don't count:

• Self-employed contractors
• Agency workers supplied by another company (unless you employ them directly)
• Volunteers (though you must still assess risks to them)
• Yourself if you're a sole director with no employment contract

What must be recorded

The regulations don't prescribe a specific format, but your written risk assessment must include:

1. Significant findings

Record the hazards you've identified and your conclusions about the level of risk they present. Focus on significant risks — those that could realistically result in harm if not properly controlled.

What to include:

• The hazards identified (what could cause harm)
• Who might be harmed and how
• The level of risk (consider likelihood and severity)
• What you're doing to control the risk
• What further action is needed

What you can generally exclude:

• Trivial risks that any reasonable person would consider insignificant
• Risks already controlled to an acceptable level by well-established measures
• Everyday risks that apply to everyone (e.g., risk of tripping on stairs in a standard office)

2. Employees especially at risk

Identify any groups of employees who face particular risks due to:

• Personal characteristics: Young workers, older workers, pregnant workers, new and expectant mothers
• Health conditions: Disabilities, chronic conditions, sensory impairments
• Work patterns: Lone workers, night workers, those working in isolation
• Experience level: New starters, trainees, those unfamiliar with hazards
• Language barriers: Workers who may not fully understand safety instructions

Document what additional precautions you're taking to protect these groups.

3. Arrangements for protecting health and safety

Record the control measures you've implemented and how you maintain them:

• Physical controls (guards, barriers, ventilation systems)
• Safe systems of work and procedures
• Training provided and to whom
• Supervision arrangements
• PPE issued and maintenance schedules
• Monitoring and inspection routines
• Emergency procedures

Format options: How to record your findings

The law doesn't specify a particular format. Your written risk assessment can be:

Paper-based records

• Traditional printed documents filed in folders
• Handwritten forms (if legible)
• Advantage: No technology dependency, easy to take on workplace walks
• Disadvantage: Harder to update, search, and distribute

Digital documents

• Word documents, PDFs, or spreadsheets
• Stored on computer systems or cloud storage
• Advantage: Easy to update, search, and back up
• Disadvantage: Requires access to computers or devices

Specialist software

• Dedicated health and safety management systems
• Cloud-based risk assessment platforms
• Advantage: Structured workflows, automatic reminders, reporting tools
• Disadvantage: Cost, learning curve, vendor dependency

HSE templates

The Health and Safety Executive provides free risk assessment templates for various industries and activities. These can be downloaded, completed, and kept as written records.

Which format should you use?

Choose a format that:

• You'll actually maintain and keep up to date
• Relevant people can access when needed
• Can be easily updated when circumstances change
• Provides clear information for employees and inspectors
• Suits the complexity of your workplace

For most small businesses, a simple Word document or spreadsheet is entirely adequate. Don't over-engineer the solution.

Assessments that must always be written

Certain risk assessments must be recorded in writing regardless of how many employees you have:

1. Fire Risk Assessment

Under the Regulatory Reform (Fire Safety) Order 2005, all businesses and landlords must:

• Conduct a fire risk assessment
• Record the significant findings if you employ 5 or more people, or if the premises are licensed or have an alterations notice
• Record the significant findings if required by an enforcing authority

Even if you have fewer than 5 employees, you must record fire risk assessment findings if:

• You have a licensed premises (alcohol, entertainment, late night refreshment)
• The fire authority has served an alterations notice
• An inspector requires it

What to record:

• Fire hazards identified (ignition sources, fuel, oxygen)
• People at risk, especially those with mobility issues or disabilities
• Evaluation of risk and existing fire precautions
• Actions needed to reduce or manage fire risk
• Emergency plan and evacuation procedures

2. COSHH Assessment

The Control of Substances Hazardous to Health Regulations 2002 (COSHH) require written assessments for work involving hazardous substances, regardless of employee numbers.

You must record:

• The hazardous substances used or created
• The health risks they present
• Who might be exposed and how
• Precautions needed to control exposure
• Monitoring and health surveillance arrangements (if required)
• Emergency procedures

When COSHH applies:

• Cleaning chemicals and solvents
• Paints, adhesives, and resins
• Dusts (wood, silica, metal)
• Fumes and vapours
• Biological agents
• Any substance with a hazard label

Even a sole trader using hazardous substances must document COSHH assessments.

3. Manual Handling Assessment

The Manual Handling Operations Regulations 1992 don't explicitly require written records, but HSE guidance strongly recommends documenting assessments for anything other than simple, low-risk manual handling.

Should be written when:

• The task involves significant risk of injury
• The load is particularly heavy, awkward, or unstable
• The task is repetitive or sustained
• The working environment presents additional challenges
• Multiple workers are involved

Consider recording:

• The task, load, and working environment (TILE assessment)
• Individual capabilities and training
• Risk of injury and likelihood
• Control measures to reduce risk
• Review date

4. Display Screen Equipment (DSE) Assessment

The Health and Safety (Display Screen Equipment) Regulations 1992 require employers to assess workstations used by employees who regularly use DSE as a significant part of their work.

While the regulations don't explicitly require written records for businesses with fewer than 5 employees, documenting DSE assessments is strongly recommended.

Should record:

• Results of individual workstation assessments
• Equipment provided (chairs, monitors, keyboards, accessories)
• Any issues identified and actions taken
• Training provided on DSE use
• Eye test arrangements

5. Specific High-Risk Activities

Certain activities require written assessments regardless of employee numbers:

Work at height (Work at Height Regulations 2005):

• Planning for work at height must be documented
• Method statements and risk assessments for significant work at height

Confined spaces (Confined Spaces Regulations 1997):

• Written safe system of work required before entry
• Risk assessment of atmosphere, access, emergency arrangements

Young persons (Management Regulations 1999, Regulation 19):

• Risk assessment must be conducted before young person (under 18) starts work
• Should be recorded to demonstrate compliance

New and expectant mothers (Management Regulations 1999, Regulation 16):

• Once you're notified an employee is pregnant, post-natal, or breastfeeding
• Must conduct specific risk assessment and record any actions needed

Fewer than 5 employees: Should you record anyway?

Even though there's no legal requirement, recording risk assessments when you have fewer than 5 employees is highly advisable.

Why you should write it down anyway:

1. Demonstrates due diligence If there's an accident, you'll need to show you've taken health and safety seriously. A written assessment provides clear evidence you've considered the risks.

2. Provides evidence of compliance HSE inspectors can still visit businesses with fewer than 5 employees. Written records demonstrate you've met your duty to assess risks.

3. Protects in legal proceedings If facing prosecution or a civil claim, written assessments show you followed a systematic process to identify and control risks.

4. Insurance requirements Some insurers require written risk assessments as a condition of cover, regardless of business size.

5. Client requirements Many clients, particularly larger organizations, require evidence of risk assessments before awarding contracts.

6. Aids memory and communication Writing things down helps you remember what you decided and communicate clearly with employees, contractors, and others.

7. Provides baseline for reviews A written assessment gives you something to review and update when circumstances change.

8. Supports business continuity If you or the person who did the assessment leaves, written records ensure knowledge isn't lost.

Who should carry out the assessment

The regulations require risk assessments to be conducted by a "competent person" — someone with sufficient training, experience, and knowledge to identify risks and recommend appropriate controls.

For written assessments specifically:

Who can write them:

• The employer or business owner (if competent)
• A manager or supervisor with relevant knowledge
• An employee designated as responsible for health and safety
• An external health and safety consultant
• A combination (consultant advises, employer documents)

Competence requirements: For straightforward workplace risks, basic competence includes:

• Understanding of the work activities and environment
• Knowledge of relevant hazards and control measures
• Ability to identify who might be harmed
• Understanding of the hierarchy of controls
• Familiarity with relevant legal requirements

For specialist hazards, you need appropriate expertise:

• Fire risk assessments may require fire safety training or professional assessment
• COSHH assessments need understanding of chemical hazards
• Structural issues may need structural engineer input
• Asbestos surveys require licensed asbestos surveyors

Approval and sign-off

Written risk assessments should be:

• Signed by the assessor — the person who conducted the assessment
• Approved by a responsible person — someone with authority to ensure actions are implemented
• Dated — so you know when it was completed and when review is due

For small businesses, the same person might conduct, write, and approve the assessment. That's fine as long as they're competent and have authority to implement controls.

Storage and accessibility

Written risk assessments must be accessible to those who need them, but there's no specific legal requirement about where they're kept.

Good practice for storage:

Keep assessments:

• In a location known to relevant staff
• Easily retrievable when needed
• Protected from loss or damage
• Backed up if digital
• Version-controlled if you update them

Who needs access:

• Managers and supervisors
• Employees working with the assessed hazards
• Health and safety representatives
• Inspectors from HSE, fire authority, or other regulators
• Insurance assessors (if claim is made)
• Contractors working in the assessed area

Retention period

There's no specified retention period for risk assessments, but you should keep them:

• While they remain current and in use
• For a reasonable period after being superseded (at least 3 years recommended)
• Indefinitely if they relate to exposures that could cause long-term health effects

For assessments relating to specific incidents or exposures, keep them in line with your accident records (typically 3-7 years, longer for young persons or exposures causing latent harm).

Review triggers: When to update written assessments

Written risk assessments must be reviewed and updated when circumstances change or there's reason to believe they're no longer valid.

Common review triggers:

Changes to work activities:

• New processes, equipment, or substances introduced
• Changes to how work is carried out
• Different products or materials used
• Automation or mechanisation changes

Changes to the workplace:

• Alterations to buildings or facilities
• Changes to layout or workflow
• New premises or work locations
• Environmental changes (lighting, ventilation, noise)

Changes to workforce:

• Employment of young persons
• Notification of pregnancy, post-natal period, or breastfeeding
• Employees with new health conditions or disabilities
• Significant changes in staff numbers or shift patterns

Incidents and near misses:

• Accidents causing injury or property damage
• Near-miss events that could have caused harm
• Occupational ill-health reports
• Dangerous occurrences

New information:

• Updated guidance from HSE or industry bodies
• Changes to relevant legislation
• New research on health hazards
• Manufacturer safety bulletins about equipment

Routine review:

• Annually as a minimum (good practice)
• More frequently for high-risk activities
• As part of safety audits or inspections

UK regulatory context

The requirement to record risk assessments stems from the Management of Health and Safety at Work Regulations 1999, specifically:

Regulation 3 — Risk Assessment

Regulation 3(6):

"Where the employer employs five or more employees, he shall record— (a) the significant findings of the assessment; and (b) any group of his employees identified by it as being especially at risk."

This implements the EU Framework Directive 89/391/EEC, though the UK maintains these requirements post-Brexit under retained EU law.

Why the 5-employee threshold?

The threshold recognizes that:

• Micro-businesses need flexibility and reduced administrative burden
• Written records become more important as organizations grow
• Larger workforces create greater communication challenges
• Evidence of systematic assessment is more critical with more employees

However, the threshold is somewhat arbitrary — the risks in a 4-person workshop may be identical to a 6-person one. Hence the strong recommendation to record findings regardless of size.

Enforcement approach

HSE and local authority inspectors recognize that small businesses have resource constraints. They're generally looking for:

• Evidence you've thought about risks systematically
• Actions that reflect a genuine effort to protect people
• Documentation proportionate to the risks

They're not looking for:

• Perfect formatting or professional presentation
• Exhaustive documentation covering every possible scenario
• Consultant-quality reports (unless the risks warrant them)

Common questions about recording requirements

Self-employed obligations

If you're self-employed with no employees, the rules are more flexible:

When self-employed people must record assessments:

Always record if:

• Your work activities could affect other people (customers, public, other businesses)
• You use hazardous substances (COSHH assessment required)
• You conduct high-risk activities (work at height, confined spaces)
• You work on construction sites (typically need RAMS)
• You work in others' premises (they may require written assessments)
• You have employers' liability or public liability insurance that requires it

Not usually required if:

• You work alone from home with no hazardous substances
• Your work presents no risk to others
• You conduct only low-risk activities

Practical advice for sole traders:

If you need written risk assessments, keep them simple:

• Use free HSE templates as a starting point
• Focus on the actual risks in your work
• Document the precautions you take
• Include emergency procedures
• Keep them updated as your work changes
• Make them available to clients who request them

Even a single-page document covering key hazards, controls, and emergency procedures is usually sufficient for straightforward self-employed work.

Summary: Recording requirements at a glance

Related articles:

• What is a risk assessment?
• Who needs a risk assessment?
• Risk assessment templates and examples

Useful tools:

• Risk Assessment Builder
• Hazard Identification Checker