Overview
Risk assessment is part of the process employers use to identify workplace hazards, decide who could be harmed and determine what controls are needed. For managers, the test is whether the assessment reflects actual work, leads to action and is reviewed when circumstances change, rather than whether a completed form exists.
In Great Britain, the main general requirement comes from the Management of Health and Safety at Work Regulations 1999. Northern Ireland has separate Management of Health and Safety at Work Regulations (Northern Ireland) 2000.
Where to Start
Risk assessment should begin by looking at how people actually work. HSE advises employers to consider how work is carried out, how plant and equipment are used, substances present, workplace conditions and both safe and unsafe working practices. Accident and ill-health records can identify hazards that are less obvious. Non-routine activities such as maintenance and cleaning should also be considered.
Managers should make sure the assessment includes everyone who may be affected. This can include employees, contractors, visitors and members of the public. Some workers may need particular consideration, including young or inexperienced workers, pregnant workers and new mothers, migrant workers and people with disabilities.
Workers should be involved in the process. They may know where procedures are difficult to follow, where tasks have changed or where controls do not work as intended. HSE specifically advises employers to involve employees when identifying hazards and assessing risks.
Are the Controls Sufficient?
Once hazards have been identified, the assessment should consider how likely harm is and how serious the consequences could be. Managers then need to examine the precautions already in place and decide whether further action is required.
The first option should be removing the hazard where possible. If it cannot be eliminated, HSE advises considering measures such as redesigning the job, replacing materials or equipment, changing how work is organised and introducing practical safety measures. Personal protective equipment may form part of the controls where needed.
The law does not require every conceivable risk to be eliminated. Employers are expected to take reasonably practicable measures, balancing the level of risk against the time, cost and effort involved in controlling it.
Turn Findings into Actions
A useful assessment should show what needs to happen next. HSE recommends identifying any further controls, who will carry out the action and when it needs to be completed. This gives managers something that can be checked rather than leaving recommendations without ownership.
Employers with five or more employees must record the significant findings. HSE describes this as recording the hazards, who may be harmed and how, and the controls in place. The priority remains controlling risk in practice rather than producing unnecessary paperwork.
Review What Happens After the Assessment
Controls must be reviewed to check that they continue to work. A review may be needed when staff, processes, substances or equipment change, when existing measures may no longer be effective, or after workers report problems, accidents or near misses. Any changes should be reflected in the assessment record.
This means that a fixed annual review date should not become the only trigger. Significant operational change or evidence that a control is failing should prompt earlier action.
Competence and Responsibility
Employers must appoint one or more competent people to help them meet their health and safety duties. HSE describes a competent person as someone with sufficient skills, knowledge and experience to recognise hazards and help put suitable controls in place. Formal qualifications are not always necessary.
Lower-risk organisations may be able to manage assessments internally. Large, complex or higher-risk organisations may need specialist assistance. Using an external adviser does not transfer the employer's legal responsibility for health and safety management.
Common Compliance Gaps
Warning signs include generic assessments copied between different activities, actions without owners or deadlines, assessments that have not changed despite alterations to the work, and controls that appear on paper but are not followed.
Another concern is limited worker involvement. If employees cannot explain the precautions relevant to their job, managers should question whether the assessment has been translated into working arrangements.
Manager Checklist
- Do assessments describe how work is actually carried out?
- Are non-routine tasks such as cleaning and maintenance included?
- Have employees and others who could be affected been considered?
- Are additional needs of particular workers addressed where relevant?
- Do assessments identify further actions, owners and timescales?
- Can managers verify that stated controls are actually being used?
- Are changes, incidents and concerns triggering reviews?
- Is competent assistance proportionate to the risks involved?
FQA
Does every workplace need a risk assessment?
Employers must assess risks to employees and others who could be affected by their work. The amount of detail should be proportionate to the risks involved.
Does every assessment have to be written down?
Employers with five or more employees must record their significant findings. Smaller employers still have to assess and control risk even where a written record is not required.
Does a risk assessment need a fixed annual review?
HSE does not prescribe one universal annual review interval. Controls should be reviewed to make sure they remain effective and when workplace changes, incidents, near misses or worker concerns indicate that reassessment may be needed.
Can an external consultant take responsibility for the assessment?
A consultant can provide competent assistance, but the employer retains the legal duty to manage health and safety.