A risk assessment is not a form. It is a decision you make about how people could get hurt and what you are going to do about it — the form is only where you write down what you decided. That distinction explains almost every risk assessment failure the HSE writes up: a downloaded template, filled in once, describing a workplace that does not quite exist.
The legal test is not “comprehensive” or “detailed”. It is suitable and sufficient. A one-page assessment that genuinely reflects your workplace beats a twenty-page generic document every time — including in front of an inspector.
What the law actually requires
The duty sits in Regulation 3 of the Management of Health and Safety at Work Regulations 1999. Every employer must make a “suitable and sufficient” assessment of:
- The risks to the health and safety of employees while they are at work, and
- The risks to anyone else affected by the work — contractors, visitors, members of the public, and in some settings service users or pupils
This sits underneath the general duty in section 2 of the Health and Safety at Work etc. Act 1974, which requires employers to ensure health and safety so far as is reasonably practicable.
That phrase — so far as is reasonably practicable — is the whole balancing act. You are not required to eliminate all risk. You are required to weigh the risk against the time, cost and trouble of controlling it, and to act where the risk is significant relative to the effort. A control that is cheap and effective is almost never “not reasonably practicable”.
Do you have to write it down?
Only if you have five or more employees. Regulation 3(6) requires employers of five or more to record the significant findings.
Two things people get wrong about this:
- Under five employees still have to do the assessment — they just are not legally obliged to record it. In practice, recording it anyway is the only way to prove you did it.
- You record the significant findings, not everything. Trivial risks and the obvious precautions everyone already takes do not need documenting.
There is no prescribed format. A spreadsheet, a form, or a page of prose are all acceptable, provided the thinking is visible.
The five steps
HSE frames the process in five steps. They are not a legal formula, but they are the structure inspectors expect to see the shape of.
1. Identify the hazards
A hazard is anything with the potential to cause harm — a substance, a machine, a method of working, an environment. Ways to find them that actually work:
- Walk the workplace and look, ideally at a time when work is actually happening
- Ask the people doing the job. They know the workarounds, the awkward step and the thing that nearly went wrong last month
- Read your accident and near-miss records
- Check manufacturer instructions and safety data sheets
- Consider non-routine work — maintenance, cleaning, breakdowns, deliveries, out-of-hours
2. Decide who might be harmed and how
Not just “staff”. Be specific about the group and the mechanism of harm — “warehouse operatives could suffer crush injuries from reversing vehicles” tells you what to control; “staff — injury” does not.
Some groups need explicit consideration because the regulations require it or because their risk genuinely differs:
- Young workers under 18 — Regulation 19 requires specific consideration of their inexperience and immaturity
- New and expectant mothers — Regulation 16 requires assessment where the work could present a risk
- Lone workers, night workers, and anyone working away from supervision
- Agency and temporary staff, who may not know your site
- Disabled workers and anyone with a relevant health condition
- Visitors, contractors and the public
3. Evaluate the risks and decide on control measures
Risk is a function of how likely harm is and how severe it would be. Many organisations use a likelihood × severity matrix. That is fine as a way of ranking and prioritising — it is not a substitute for judgement, and the number it produces has no legal standing.
What matters far more is applying the hierarchy of control in order:
- Eliminate — remove the hazard entirely. The only control that cannot fail.
- Substitute — replace it with something less dangerous
- Engineering controls — guard it, enclose it, extract it, isolate people from it
- Administrative controls — safe systems of work, training, signage, permits, job rotation
- Personal protective equipment — last, always
PPE comes last because it protects one person, only if worn correctly, and fails silently. An assessment whose controls are mostly PPE and “staff to be careful” is the classic pattern of an assessment that has not really been done. See the hierarchy of control explained for a worked example.
4. Record your significant findings
A usable record shows, for each significant risk: the hazard, who could be harmed and how, the controls already in place, whether the remaining risk is acceptable, any further action needed, who owns that action, and by when.
The columns that get skipped are the last three — and they are the ones that turn an assessment into something that actually changes the workplace.
5. Review
There is no fixed legal review interval. Annual review is the common convention, but the real triggers are events:
- New equipment, substances, processes or premises
- A change in staffing — particularly new or young workers
- An accident, near miss or case of ill health
- New legislation or guidance
- Anything that makes you think “that’s not how we do it any more”
What “suitable and sufficient” actually means
HSE’s working test is that the assessment should:
- Identify the significant risks, ignoring the trivial
- Be proportionate to the risk — a small low-risk office does not need what a foundry needs
- Be appropriate to the nature of the work and remain valid for a reasonable period
- Identify the measures needed to comply with the law
Notice what is absent: length, complexity, and any particular template.
Seven ways risk assessments fail
- The generic template. Downloaded, lightly edited, describing hazards you do not have and missing the ones you do. Inspectors recognise these instantly.
- Written by someone who has never done the job. If nobody who actually does the task was consulted, the workarounds are invisible.
- Controls that are all PPE and “be careful”. The hierarchy was skipped.
- Actions with no owner and no date. The assessment identifies what should change, and nothing changes.
- Never reviewed after a change. New machine, same assessment.
- Never communicated. A correct assessment nobody has read protects nobody. The people doing the work must know what the controls are.
- Confusing the assessment with the safe system of work. The assessment decides what controls are needed; the safe system of work tells people how to do the job. You usually need both.
Risk assessments that have their own regulations
General risk assessment sits under MHSWR 1999, but several hazards carry their own specific assessment duty, with extra requirements:
- Hazardous substances — COSHH Regulations 2002. See how to do a COSHH assessment and what COSHH covers.
- Manual handling — MHOR 1992, using the TILE factors. See MHOR explained.
- Work at height — WAHR 2005. See the regulations explained.
- Display screen equipment — DSE Regulations 1992, for defined users.
- Fire — the Regulatory Reform (Fire Safety) Order 2005 requires a separate fire risk assessment. See fire safety training and the law.
- Noise, vibration, asbestos and confined spaces each have their own regimes.
A general risk assessment does not discharge these. Where a specific regime applies, it applies in addition.
Further reading
- HSE — Managing risks and risk assessment at work
- MHSWR 1999, Regulation 3 — risk assessment
- Health and Safety at Work etc. Act 1974, section 2
Risk assessment training
Our Risk Assessment Awareness course covers what the law requires, the five steps, the hierarchy of control, how to judge “suitable and sufficient”, and how to write findings that actually get acted on.
For care settings, where assessments cover service users as well as staff, see Risk Assessments in Care.
Related: COSHH Awareness · Manual Handling Awareness · Working at Height Awareness
£9 per course. CPD accredited, 100 % online, verifiable e-certificate on completion. Pay for 2, get 3 — any 3 courses for £18.
Please note: this is a CPD-accredited awareness course and general information, not legal advice. It is not an Ofqual-regulated qualification. Awareness training builds understanding of the risk assessment process; it does not by itself make someone a competent person for a specific high-hazard assessment, which may require additional training, qualifications and practical experience appropriate to the hazard.