The 5 Steps to Risk Assessment

Risk assessment is the cornerstone of effective health and safety management. It's not just a legal requirement under the Management of Health and Safety at Work Regulations 1999—it's the systematic process that identifies what could cause harm in your workplace and determines whether you're doing enough to prevent it.

The Health and Safety Executive (HSE) provides a straightforward 5-step approach to risk assessment that works for businesses of all sizes and sectors. Understanding and implementing these steps properly is fundamental to fulfilling your duties under the Health and Safety at Work etc. Act 1974.

Why risk assessment matters

Risk assessment isn't bureaucratic box-ticking. It's the systematic process of:

• Identifying what might cause harm to people in your workplace
• Deciding whether you're taking reasonable steps to prevent that harm
• Implementing additional controls where needed
• Demonstrating you understand your risks and are managing them properly

Legal requirement

The Management of Health and Safety at Work Regulations 1999, Regulation 3, requires every employer to make a "suitable and sufficient assessment" of:

• Risks to the health and safety of employees arising out of or in connection with work
• Risks to the health and safety of persons not in their employment arising out of their work

This assessment must identify the measures needed to comply with health and safety legislation.

If you employ 5 or more people, you must record:

• The significant findings of the assessment
• Any group of employees identified as being especially at risk

Foundation for safety management

Risk assessment informs everything else you do for health and safety:

• What training employees need
• What protective equipment is required
• How work should be organized
• What inspections and maintenance are necessary
• How to respond to incidents

Without proper risk assessment, you're operating blind. You cannot fulfil your duties under Section 2 of the Health and Safety at Work etc. Act 1974 to ensure, so far as is reasonably practicable, the health, safety, and welfare of your employees.

The HSE's 5 steps to risk assessment

The Health and Safety Executive provides a clear, structured approach to risk assessment:

1. Identify the hazards
2. Decide who might be harmed and how
3. Evaluate the risks and decide on precautions
4. Record your significant findings and implement them
5. Review your assessment and update if necessary

Let's explore each step in detail with practical guidance for workplace application.

Step 1: Identify the hazards

The first step is systematically identifying things in your workplace that could cause harm.

What is a hazard?

A hazard is anything that has the potential to cause harm. This could be:

• Physical hazards (machinery, electricity, working at height, vehicles)
• Biological hazards (bacteria, viruses, infectious diseases)
• Chemical hazards (cleaning substances, fumes, dusts)
• Ergonomic hazards (manual handling, repetitive tasks, poor workstation design)
• Psychosocial hazards (work-related stress, violence, harassment)
• Environmental hazards (noise, vibration, temperature extremes)

How to identify hazards

Walk around your workplace systematically:

• Inspect all areas where your employees work
• Look at equipment, substances, work activities, and the environment
• Consider both routine operations and occasional tasks
• Don't forget areas like storage rooms, access routes, and welfare facilities
• Think about maintenance, cleaning, and emergency situations

Consult with employees:

• Ask people who do the work what concerns them
• Employees often spot hazards that management misses
• Review accident records, near misses, and complaints
• Involve safety representatives where they exist

Check manufacturer instructions and safety data sheets:

• Equipment manuals often identify hazards and required precautions
• Safety data sheets (SDS) detail hazards of chemicals and substances
• Industry guidance highlights common hazards for your sector

Review accident and ill-health records:

• Past incidents reveal hazards that have caused harm
• Near misses identify hazards before they cause injury
• Trends point to systemic problems requiring attention

Consider specific groups:

• New or young workers who lack experience
• Pregnant workers or nursing mothers
• Workers with disabilities
• Lone workers
• Contractors and visitors

Common workplace hazards to consider

Physical hazards:

• Slips, trips, and falls (wet floors, uneven surfaces, poor lighting)
• Working at height (ladders, scaffolds, roofs)
• Moving vehicles (forklifts, delivery lorries)
• Machinery and equipment (moving parts, sharp edges, entanglement points)
• Electricity (damaged cables, overloaded sockets, wet conditions)
• Fire (ignition sources, flammable materials, escape routes)
• Manual handling (lifting, carrying, pushing, pulling heavy loads)

Health hazards:

• Hazardous substances (chemicals, dusts, fumes)
• Noise (prolonged exposure to loud environments)
• Vibration (power tools, machinery)
• Temperature extremes (heat stress, cold environments)
• Biological agents (legionella, blood-borne viruses, contaminated materials)

Organizational hazards:

• Work-related stress (workload, lack of support, bullying)
• Violence and aggression (dealing with public, lone working)
• Fatigue (long hours, shift work, inadequate rest)
• Inadequate training or supervision

Step 2: Decide who might be harmed and how

Once you've identified hazards, determine who could be harmed and what type of harm could occur.

Who to consider

Your employees:

• All staff, including part-time, temporary, and agency workers
• Consider different groups who may have specific needs or vulnerabilities
• Think about employees who work in different locations or at different times

Vulnerable groups requiring special consideration:

• New or young workers - Lack experience and may not recognize risks
• Pregnant workers and nursing mothers - Some hazards present particular risks
• Disabled workers - May be affected differently or need adjustments
• Lone workers - Cannot get immediate help if something goes wrong
• Shift workers or those working unusual hours - Fatigue and reduced alertness

Non-employees:

• Contractors and subcontractors working on your site
• Visitors to your premises
• Members of the public near your work activities
• Service users, patients, residents, or customers
• Neighbouring businesses
• Delivery drivers and maintenance personnel

Types of harm to consider

For each hazard, think about:

• What injuries could occur? (e.g., fractures, cuts, burns, electric shock)
• What health conditions could develop? (e.g., dermatitis, asthma, hearing loss)
• How serious could the harm be? (minor injury, serious injury, fatality)
• How could it happen? (what sequence of events or failures?)

Recording who might be harmed

You don't need to list people by name. Identify groups such as:

• "Office workers using display screen equipment"
• "Warehouse staff operating forklifts"
• "Cleaning staff working with chemicals"
• "Visitors to reception area"
• "Contractors working on building maintenance"

Step 3: Evaluate the risks and decide on precautions

This is where you evaluate the level of risk and determine what you're doing to control it, and what more you need to do.

What is risk?

Risk is the likelihood that a hazard will actually cause harm, combined with the severity of that harm.

A hazard might have the potential to cause serious harm, but if proper controls are in place and it's unlikely to occur, the risk may be low. Conversely, even a moderate hazard might present high risk if controls are inadequate.

Evaluating risk level

Consider:

• How likely is it that harm will occur? (Unlikely, Possible, Likely, Highly likely)
• How severe would the harm be if it occurred? (Minor, Moderate, Serious, Fatal)
• How many people could be affected? (One person, Few, Many)
• How often are people exposed to the hazard? (Rarely, Occasionally, Frequently, Continuously)

The hierarchy of control measures

When deciding on precautions, follow the hierarchy of controls. Always try to eliminate hazards or use the highest level of control possible:

1. Elimination Remove the hazard entirely. This is the most effective control.

• Example: Stop using a hazardous chemical by switching to a non-hazardous alternative

2. Substitution Replace with something less hazardous.

• Example: Use water-based paints instead of solvent-based ones

3. Engineering controls Isolate people from the hazard through physical means.

• Example: Install guard rails at height, fit machine guards, provide local exhaust ventilation

4. Administrative controls Change how people work to reduce exposure.

• Example: Rotate workers to limit exposure time, implement safe systems of work, provide training

5. Personal Protective Equipment (PPE) Last resort after other controls. PPE only protects the individual wearing it and only if used correctly.

• Example: Safety glasses, gloves, hearing protection, high-visibility clothing

Deciding on additional precautions

For each hazard, ask:

• What controls are already in place?
• Are they adequate? (Do they reduce risk to an acceptable level?)
• Are they actually being used/followed?
• What additional controls are needed?
• Can the risk be reduced further?

Remember "so far as is reasonably practicable" - you must weigh the risk against the cost, time, and difficulty of measures to control it. If a risk is significant and controls are standard practice, you must implement them even if they're expensive.

Common control measures by hazard type

Slips, trips, falls:

• Keep floors clean, dry, and well-maintained
• Ensure adequate lighting throughout premises
• Mark changes in level clearly
• Keep walkways clear of obstructions
• Use appropriate floor coverings and footwear

Working at height:

• Avoid work at height where possible (use long-handled tools)
• Use proper access equipment (scaffolds, not ladders for prolonged work)
• Install edge protection and guardrails
• Provide fall arrest equipment where other controls aren't feasible
• Train workers on safe use of equipment

Manual handling:

• Eliminate or reduce manual handling (mechanical aids, redesign tasks)
• Make loads lighter or smaller
• Improve workplace layout to reduce carrying distances
• Train workers on safe lifting techniques
• Conduct individual assessments for high-risk tasks

Hazardous substances:

• Eliminate or substitute hazardous substances where possible
• Use in smallest quantities necessary
• Provide local exhaust ventilation to control exposure
• Provide appropriate PPE as last resort
• Train workers on safe use, storage, and disposal

Machinery:

• Install proper guards on moving parts
• Fit emergency stop controls
• Provide adequate training on safe operation
• Implement permit-to-work systems for maintenance
• Conduct regular inspection and maintenance

Psychosocial hazards:

• Conduct stress risk assessments
• Provide adequate resources and support
• Ensure reasonable workloads and deadlines
• Implement policies on bullying and harassment
• Provide employee assistance programmes

Step 4: Record your significant findings and implement them

Once you've assessed risks and decided on controls, document your findings and put the controls in place.

Recording requirements

If you employ 5 or more people, you must record:

• The significant findings of your risk assessment
• Any groups of employees identified as especially at risk
• The arrangements for implementing the preventive and protective measures

Even if you employ fewer than 5 people, recording your findings is strongly recommended. Written assessments:

• Demonstrate you've identified hazards and evaluated risks
• Provide evidence of due diligence if something goes wrong
• Help communicate risks and controls to employees
• Make it easier to review and update assessments

What to record

An effective risk assessment record should include:

1. What hazards have you identified? Be specific: "Unguarded rotating shaft on packaging machine" not "machine hazards"

2. Who might be harmed? Identify groups: "Machine operators and maintenance staff"

3. What is the risk level? Before and after controls: "High risk - reduced to low risk with guarding and training"

4. What controls are in place? List existing control measures: "Machine guard fitted, lockout/tagout procedure, trained operators"

5. What further action is needed? Be specific about additional controls required: "Install interlocked guard by 31 Jan, refresh training for all operators by 15 Feb"

6. Who is responsible and when? Assign responsibility and deadlines: "Maintenance Manager - install guard by 31/01/25; H&S Officer - arrange training by 15/02/25"

7. Review date: When will the assessment be reviewed? "Annual review or after any incident"

Implementing your findings

Recording the assessment is not the end. You must:

Communicate findings to those affected:

• Share relevant parts of risk assessments with employees
• Explain what hazards have been identified and what controls are in place
• Ensure everyone understands what they must do to work safely

Put control measures in place:

• Implement the precautions you've identified as necessary
• Purchase equipment, install guards, change procedures
• Ensure controls are in place before work proceeds
• Don't allow exposure to uncontrolled risks while "planning" controls

Provide information, instruction, and training:

• Train employees on identified risks and how to control them
• Provide written safe systems of work where appropriate
• Ensure supervisors understand their role in maintaining controls
• Keep records of training provided

Monitor implementation:

• Check that controls are actually being used
• Supervise work to ensure procedures are followed
• Inspect physical controls regularly to ensure they remain effective
• Address deviations from safe systems immediately

Step 5: Review your assessment and update if necessary

Risk assessments are not "do once and forget." They must be living documents that evolve as your workplace changes.

When to review risk assessments

Regularly:

• At least annually for general workplace assessments
• More frequently for high-risk activities or rapidly changing workplaces
• Set specific review dates in each assessment

After significant changes:

• New equipment or machinery introduced
• Changes to work processes or procedures
• New or different substances used
• Structural changes to premises
• Changes to workforce (significant increase, new vulnerable groups)
• Organizational changes affecting responsibilities

After incidents or near misses:

• Any accident, dangerous occurrence, or near miss
• Even if controls were in place, review why they failed
• Update assessments based on lessons learned

When control measures aren't working:

• If inspections reveal controls aren't being followed
• If monitoring shows procedures are ineffective
• If employees report difficulties following safe systems

When new information becomes available:

• New HSE guidance or industry standards
• Safety alerts about equipment or substances
• Incidents reported elsewhere in your industry
• New technology offering better control methods

How to conduct reviews

Check the assessment remains valid:

• Are the hazards identified still the main risks?
• Are there new hazards that weren't identified before?
• Are the people groups still accurate?

Evaluate control measures:

• Are existing controls still in place and working?
• Are they being used correctly and consistently?
• Have they been properly maintained?
• Are they adequate based on current knowledge?

Identify necessary updates:

• What needs to change in the assessment?
• What new control measures are needed?
• What training needs updating?
• Who needs to be informed of changes?

Document the review:

• Record when the review was conducted and by whom
• Note any changes made to the assessment
• Update action plans with new control measures
• Set the next review date

Common reasons risk assessments become outdated

Physical changes:

• Equipment replaced or modified
• Layout of workplace altered
• New buildings or areas brought into use
• Deterioration of controls over time

Operational changes:

• New products or services offered
• Different work methods adopted
• Changes to working hours or shift patterns
• Increased production volumes or pace of work

People changes:

• New employees with different experience levels
• Higher proportion of young or inexperienced workers
• Contractors or agency workers now used
• Employees with disabilities or health conditions

Knowledge changes:

• New HSE guidance published
• Industry standards updated
• Better control methods become available
• Incidents elsewhere reveal previously unrecognized risks

Common risk assessment mistakes to avoid

1. Generic assessments not specific to your workplace

The mistake: Using template assessments downloaded from the internet without adapting them to your specific circumstances.

Why it's a problem: Generic assessments don't reflect your actual hazards, controls, or workplace conditions. They won't identify risks specific to your premises, equipment, or way of working.

The fix: Use templates as a starting point but customize them based on your actual workplace walk-around and consultation with employees who do the work.

2. Failing to identify all hazards

The mistake: Only assessing obvious major hazards while overlooking routine activities, maintenance tasks, or less dramatic risks.

Why it's a problem: Harm can arise from hazards you didn't think to assess. Many serious accidents occur during "unusual" activities that weren't considered.

The fix: Systematically cover all work activities, including cleaning, maintenance, emergencies, and infrequent tasks. Consult employees about what they actually do.

3. Not implementing recommended controls

The mistake: Conducting the assessment and identifying necessary controls, but not actually putting them in place.

Why it's a problem: You've identified risks but done nothing to control them. This demonstrates negligence and provides no protection.

The fix: Treat identified controls as mandatory action items with assigned responsibilities and deadlines. Monitor implementation.

4. Assessments filed and forgotten

The mistake: Completing risk assessments, filing them, and never referring to them again or communicating findings to employees.

Why it's a problem: Controls can't be followed if people don't know about them. Employees can't work safely if they don't understand the risks.

The fix: Share relevant assessment findings with affected employees. Use them for training. Reference them in toolbox talks. Make them living documents.

5. Never reviewing or updating

The mistake: Conducting assessments once and never reviewing them, even as the workplace changes significantly.

Why it's a problem: Assessments become outdated and don't reflect current risks or controls. New hazards go unidentified and uncontrolled.

The fix: Schedule regular reviews. Review immediately after changes, incidents, or when controls aren't working. Document reviews.

6. Focusing only on likelihood, ignoring severity

The mistake: Assessing low-likelihood events as low risk, even if the potential severity is catastrophic.

Why it's a problem: Low-probability but high-consequence events still require robust controls. "It probably won't happen" is not adequate risk management.

The fix: Consider both likelihood and severity. Even unlikely events require strong controls if the potential harm is serious.

7. Relying too heavily on PPE

The mistake: Accepting hazards as inevitable and just issuing PPE rather than trying to eliminate or control them at source.

Why it's a problem: PPE is the least effective control method. It only protects the wearer, only if used correctly, and only when worn.

The fix: Work through the hierarchy of controls. Try to eliminate hazards or use engineering controls before resorting to PPE.

8. No consultation with employees

The mistake: Management conducts assessments in isolation without involving the people who actually do the work.

Why it's a problem: You miss practical insights from those with firsthand knowledge. Controls may be impractical or ignored.

The fix: Consult employees during assessment. They often identify hazards management misses and can suggest practical controls.

Frequently asked questions

Practical tools and templates

To help you conduct effective risk assessments:

Risk assessment template

A basic template should include sections for:

• Activity/area being assessed
• Date of assessment and assessor name
• Hazards identified (what could cause harm)
• Who might be harmed (and how)
• Existing control measures (what's already in place)
• Risk rating (likelihood × severity)
• Further actions needed (additional controls required)
• Responsible person and target date
• Review date

Risk rating matrix

A simple matrix helps evaluate risk level:

Use this to prioritize which risks need urgent action versus ongoing monitoring.

Industry-specific guidance

HSE provides sector-specific risk assessment guidance for:

• Offices and retail
• Construction
• Manufacturing
• Agriculture
• Healthcare and social care
• Education
• Hospitality and catering

These resources help identify hazards common to your industry and standard control measures.

Next steps: Implementing the 5 steps

To implement effective risk assessment in your workplace:

Step 1: Understand your legal duty

• Review the Management of Health and Safety at Work Regulations 1999
• Understand what "suitable and sufficient" assessment means
• Ensure someone competent is assigned to lead the process

Step 2: Plan your approach

• Decide who will conduct assessments (in-house or external support)
• Determine how you'll record findings (templates, software, forms)
• Plan consultation with employees
• Set a schedule for completing initial assessments

Step 3: Conduct assessments systematically

• Follow the 5 steps for each activity or area
• Walk around your workplace to identify hazards
• Consult with employees doing the work
• Evaluate existing controls and identify gaps
• Document findings clearly

Step 4: Implement control measures

• Assign responsibilities for implementing identified controls
• Set realistic deadlines
• Follow the hierarchy of controls
• Don't allow work to proceed with uncontrolled high risks
• Monitor implementation

Step 5: Communicate findings

• Share relevant risk assessment findings with affected employees
• Provide training on identified risks and required controls
• Make assessments accessible to those who need them
• Include key points in induction training

Step 6: Establish review process

• Set review dates for each assessment
• Schedule annual comprehensive reviews
• Review immediately after changes or incidents
• Document reviews and updates
• Communicate changes to affected employees

Summary: The 5 steps in brief

Step 1: Identify the hazards

• Walk around your workplace systematically
• Consult with employees who do the work
• Check manufacturer instructions and safety data sheets
• Review accident and ill-health records

Step 2: Decide who might be harmed and how

• Consider all employees, including vulnerable groups
• Don't forget contractors, visitors, and the public
• Think about the types and severity of harm

Step 3: Evaluate the risks and decide on precautions

• Consider likelihood and severity of harm
• Evaluate existing controls—are they adequate?
• Follow the hierarchy of controls for additional measures
• Ensure controls are reasonably practicable

Step 4: Record significant findings and implement them

• Write down significant findings if 5+ employees (recommended for all)
• Communicate findings to those affected
• Implement identified control measures
• Provide training and supervision

Step 5: Review and update assessments

• Review at least annually
• Review after changes, incidents, or when controls fail
• Document reviews and updates
• Communicate changes to affected persons

Related articles:

• Employer Health and Safety Duties: A Complete Guide
• Common Workplace Hazards and How to Control Them
• Health & Safety Record Keeping Requirements: A Complete Guide

Useful tools:

• Responsibility Checker
• Compliance Checker