How to Write a Risk Assessment: A Step-by-Step UK Guide

A risk assessment is a careful examination of what could cause harm in your workplace, so you can decide whether you have done enough to prevent it. Under the Management of Health and Safety at Work Regulations 1999, every UK employer must carry out a suitable and sufficient risk assessment, and those with five or more employees must record the significant findings. This step by step guide explains how to write one properly.

What a risk assessment is, and is not

A risk assessment is not about creating paperwork for its own sake or eliminating every conceivable risk. It is a practical process of identifying real hazards, deciding who might be harmed and how, and putting sensible, proportionate controls in place. The law asks you to do what is reasonably practicable, which means balancing the level of risk against the time, cost and effort needed to control it.

Done well, a risk assessment protects your people, reduces accidents and absence, and gives you a clear record that you have met your legal duty. Done badly, or copied from a generic template without thought, it offers little protection and can expose the weakness of your arrangements if something goes wrong.

The five steps to a risk assessment

The HSE sets out a widely used five step approach. Working through these in order gives you a thorough, defensible assessment:

• Identify the hazards: walk through the workplace and consider what could cause harm, from machinery and chemicals to slips, manual handling, electricity and stress.

• Decide who might be harmed and how: think about employees, contractors, visitors and members of the public, and any groups at greater risk such as new or young workers, pregnant workers or lone workers.

• Evaluate the risks and decide on controls: for each hazard, assess how likely harm is and how serious it could be, then apply the hierarchy of control to reduce the risk.

• Record your significant findings: write down the main hazards, who is affected, and the controls in place. This is a legal requirement if you employ five or more people.

• Review and update: revisit the assessment regularly and whenever something changes, such as new equipment, new processes or an incident.

Step 1: identifying hazards

A hazard is anything with the potential to cause harm. The best way to find hazards is to walk around the workplace and look, rather than relying on memory or assumptions. Talk to your staff, because they often know about problems that are not obvious to a manager. Check manufacturers' instructions and safety data sheets for equipment and chemicals, and look back at your accident and near miss records to see what has already caused or nearly caused harm.

Think beyond the obvious physical hazards to include things like work related stress, display screen equipment, and the risks faced by people working alone or away from the main site.

Step 2: who might be harmed and how

For each hazard, identify the groups of people who could be harmed and the way in which harm could occur. You do not need to list every person by name, but you should identify groups, for example warehouse staff, cleaners, visitors or maintenance contractors. Pay particular attention to those who may be at greater risk, including new and young workers, pregnant and new mothers, disabled workers, and lone workers, as they may need additional controls.

Step 3: evaluate the risk and apply the hierarchy of control

Once you have identified a hazard and who it could harm, decide what to do about it. The hierarchy of control sets out the order of preference for controls, from most to least effective:

• Eliminate: remove the hazard entirely where you can, for example by doing the job a different way.

• Substitute: replace it with something less dangerous, such as a safer chemical.

• Engineering controls: isolate people from the hazard, for example with guarding or ventilation.

• Administrative controls: change the way people work, through safe systems of work, training and signage.

• Personal protective equipment: provide PPE as a last resort, where risk remains after the measures above.

The aim is to reduce the risk so far as is reasonably practicable, not necessarily to zero, but to a level where the remaining risk is acceptable and well controlled.

Step 4: recording your findings

If you employ five or more people, you must record the significant findings of your risk assessment. Even if you employ fewer, recording it is good practice and provides evidence that you have met your duty. A good record clearly states the hazard, who is at risk, the controls already in place, any further action needed, who is responsible, and the date. Keep it simple and practical, so that it is actually used rather than filed and forgotten.

Step 5: reviewing and updating

A risk assessment is a living document, not a one off task. Review it regularly and whenever there is a significant change, such as new equipment, a new process, a change in staff, or after an accident or near miss that reveals a gap. A useful discipline is to set a review date and treat the assessment as part of your ongoing management of health and safety rather than an annual chore.

Common mistakes to avoid

The most common failing is using a generic template without tailoring it to your actual workplace, which produces a document that looks compliant but offers little real protection. Other frequent mistakes include focusing only on obvious physical hazards while ignoring issues like stress or lone working, failing to involve the staff who do the work, listing controls that are not actually in place, and never reviewing the assessment after the day it was written.

Frequently asked questions

• Is a risk assessment a legal requirement in the UK: Yes. The Management of Health and Safety at Work Regulations 1999 require every employer to carry out a suitable and sufficient risk assessment.

• Do I have to write my risk assessment down: If you employ five or more people you must record the significant findings. Recording it is good practice for any business.

• What are the five steps of risk assessment: Identify hazards, decide who might be harmed, evaluate risks and decide on controls, record your findings, and review and update.

• How often should a risk assessment be reviewed: Regularly, and whenever something changes such as new equipment, new processes, or after an incident.

• What is the hierarchy of control: The order of preference for controls: eliminate, substitute, engineering controls, administrative controls, and personal protective equipment as a last resort.

Featherstone Safety Hub includes a guided risk assessment builder with risk scoring, review reminders and printable output, so you can produce professional assessments without starting from a blank page. Start your free 14 day trial of Featherstone Safety Hub.