Short answer. HSE's guidance sets out five steps: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record your significant findings, and review the assessment and update it when things change. Employers with five or more employees are legally required to write their significant findings down.
Why a risk assessment matters
A risk assessment is simply a careful look at what, in your workplace, could cause harm, so you can weigh up whether you have done enough to prevent it. Under the Management of Health and Safety at Work Regulations 1999 (MHSWR), regulation 3, every employer must make a "suitable and sufficient" assessment of the risks to employees and anyone else affected by their work. The Health and Safety at Work etc. Act 1974 sets the general duty; MHSWR sets out how you go about meeting it.
"Suitable and sufficient" does not mean elaborate. HSE's own position, set out in INDG163, Risk assessment: A brief guide to controlling risks in the workplace, is that the assessment should be proportionate to the risk: a small office needs a lighter touch than a warehouse running forklift trucks.
HSE's five steps to risk assessment
HSE's five steps give a straightforward structure that most UK risk assessments follow, whether they are done on a simple form or as part of a wider management system.
1. Identify the hazards
Walk the workplace and look at what could cause harm: machinery, chemicals, electrical equipment, work at height, manual handling, lone working, poor lighting, or slip and trip hazards. Talk to staff, since they often know where the near misses happen. Check accident records, manufacturers' instructions and safety data sheets as well.
2. Decide who might be harmed and how
For each hazard, identify the groups of people it could affect and how. This includes employees carrying out the task, but also cleaners, contractors, visitors, young workers, new or expectant mothers, and members of the public who might come into contact with the work.
3. Evaluate the risks and decide on precautions
Having spotted the hazards, decide how likely it is that someone will be harmed and how serious that harm could be. Then decide what you need to do to remove the hazard or, if that is not reasonably practicable, control the risk so that harm is unlikely. "Reasonably practicable" is the legal test: it weighs the risk against the time, cost and effort of dealing with it, and it is what decides how far down the hierarchy of controls you need to go.
4. Record your significant findings
If you employ five or more people, MHSWR regulation 3(6) requires you to record the significant findings of your assessment in writing: the hazards identified, who is at risk, and what you are doing to control the risk. Even where the legal duty does not apply, writing the assessment down is good practice. It gives you something to review, something to show an inspector or insurer, and something to train new staff against.
5. Review your assessment and update if necessary
A risk assessment is not a one-off exercise. Review it when something changes: new equipment, a different process, an incident or near miss, new legislation, or simply because time has passed and circumstances have moved on. Many employers set a routine review date, commonly annually, as a minimum check, then review sooner if anything material changes.
Common workplace hazards
The hazards worth checking for vary by industry, but most workplaces share a similar core list.
- Physical hazards: slips, trips and falls, moving machinery, and exposure to noise or vibration.
- Chemical hazards: exposure to substances such as solvents, acids or dusts, which fall under the Control of Substances Hazardous to Health Regulations 2002 (COSHH).
- Biological hazards: bacteria, viruses and other pathogens, relevant in healthcare, laboratory and food settings.
- Ergonomic hazards: poor workstation setup, repetitive tasks and manual handling, which can lead to musculoskeletal problems.
Regular workplace inspections, staff feedback and a look through your accident book will surface most of these before they cause an injury.
Evaluating likelihood and severity
Once hazards are identified, the next task is weighing up how likely each one is to cause harm and how serious that harm would be. A common tool is the risk matrix, which scores likelihood against severity to give each risk a rating, so the most pressing issues get attention first. This works best when it involves people who actually do the job, not just the person filling in the form.
The hierarchy of control
Once a risk has been evaluated, precautions should follow a recognised order, working down the list only as far as reasonably practicable at each stage:
- Elimination or substitution: remove the hazard entirely, or replace it with something less dangerous.
- Engineering controls: physical changes such as machine guarding, local exhaust ventilation, or redesigning a workstation.
- Administrative controls: safe systems of work, training, signage and job rotation to reduce exposure.
- Personal protective equipment (PPE): the last line of defence, used where the risk cannot be adequately controlled by other means, and properly maintained once provided.
Businesses that need help structuring this process, or embedding it into a wider system rather than a one-off document, can look at York Green's health and safety consultancy service.
Keeping the assessment alive
A risk assessment that sits in a drawer after it is written does nothing. Build the review into your calendar, update it whenever the workplace changes, and use it to brief staff so the precautions on paper match what actually happens on the shop floor. For further reading, see how to run a full workplace safety audit.