A Practical Guide To Workplace Health And Safety Risk Assessment

Every UK employer has a duty to keep people safe at work. A health and safety risk assessment is the structured, legal process that makes this possible – helping you identify hazards, assess risks, and put proportionate control measures in place before someone gets hurt.

What Is a Health and Safety Risk Assessment?

A risk assessment is a careful, structured look at what in your workplace could cause harm (hazards), how likely it is that someone might be harmed (risk), and what you will do to control those risks. A risk assessment identifies workplace hazards and risks so you can take action before an accident happens.

In the UK, the purpose is to protect employees, contractors, visitors, and the public as far as is reasonably practicable – not to eliminate every conceivable risk. Key components of a risk assessment include hazard identification and risk evaluation.

Some essential terms to understand:

• Hazard – anything with the potential to cause harm (machinery, substances, working at height, fatigue).
• Risk – the chance that someone could be harmed by a hazard, and how serious that harm could be. Risk evaluations consider the likelihood and severity of potential harm.
• Risk level – a rating (typically low, medium, or high) used to prioritise action.
• Control measures – the steps taken to eliminate or reduce risks, following a hierarchy from elimination down to PPE.
• Reasonably practicable – a legal test meaning employers must weigh the risk against the cost, time, and effort of reducing it.

A risk assessment is central to safety management, underpinning policies, safe systems of work, permits, and training plans. At Evolve Training, we approach risk assessments as practical tools that support frontline supervisors – not just compliance documents for audits.

Why Are Risk Assessments Important for UK Employers?

Risk assessments are legally required under the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999. Health and safety risk assessments help prevent accidents and ill health, and implementing preventive measures reduces the likelihood of workplace incidents.

Why risk assessments are important:

• Preventing harm – they help you spot potential risks before someone is injured or develops ill health.
• Legal compliance – employers must conduct risk assessments by law. Failure to do so can result in enforcement action, fines, or prosecution.
• Reducing downtime – fewer accidents mean less disruption, lower insurance costs, and fewer lost working days.
• Protecting reputation – serious incidents damage trust with clients, regulators, and the workforce.
• Spotting patterns – many organisations use risk assessments to identify recurring issues (e.g. repeated manual handling strains) and justify investment in better equipment or training.

Consider a lifting operation at an Aberdeen oil and gas supply base. A thorough risk assessment – covering load weights, rigging plans, exclusion zones, and weather conditions – can prevent a dropped load that might otherwise cause a fatal injury. In 2025/26, 126 workers were fatally injured in Great Britain, with falls from height and being struck by moving objects among the leading causes.

Regulators such as the Health and Safety Executive and local authorities expect to see suitable and sufficient risk assessments when investigating accidents or complaints. Effective risk assessments can lead to improved workplace procedures and training across the business.

Who Needs to Do Risk Assessments and Who Is Responsible?

Every UK employer, and many self-employed people whose work could affect others, must assess risks from their work activities. Employers have a legal duty to conduct risk assessments, and this applies regardless of sector or size.

The employer or dutyholder is ultimately accountable. However, they can – and should – appoint a competent person to carry out or oversee risk assessments. A competent person is someone with the knowledge, training, and experience of the work and its health and safety risks. Employers must have access to competent health and safety assistance. The HSE’s guidance on competence provides further detail on what competence means in practice.

How responsibility typically works:

• Small office – the employer often carries out the assessment themselves.
• Construction site – responsibility is layered between dutyholders, principal contractors, and site supervisors.
• Offshore or marine operation – safety managers, supervisors, and permit authorities all have defined roles, with coordination across multiple employers.

Trained supervisors and health and safety representatives play a vital role. Risk assessment training through courses like NEBOSH, IOSH Managing Safely, or task-specific programmes helps them assess risks more confidently and fulfil their health and safety duties.

When Should You Carry Out or Review a Risk Assessment?

Risk assessments must be done before work starts and kept up to date through regular review. Risk assessments must be reviewed regularly to remain effective, and best practice recommends reviewing risk assessments at least annually for stable environments.

Key triggers for carrying out or reviewing an assessment:

• Before a new project, process, or site begins
• When introducing new machinery, equipment, or hazardous substances
• After accidents, near misses, or reports of occupational ill health
• When changing work patterns, shift arrangements, or staffing
• When inspection findings suggest existing control measures are not working
• After any significant change in who might be harmed

Regular reviews and updates of risk assessments are necessary when processes change. Employers must ensure risk assessments are updated when new hazards arise.

For example, if a scaffold contractor is changed or new equipment is introduced on a construction project, the working at height risk assessment must be updated before work proceeds. Similarly, if new or expectant mothers join the workforce, or there is increased public access to a site, this should trigger a review. The frequency should always be based on risk level – check current HSE sector guidance rather than relying on a fixed calendar alone.

How to Do a Health and Safety Risk Assessment: The Five-Step Process

The HSE promotes a simple five-step model for risk assessment. The process is broadly similar across sectors, but the level of detail increases with the complexity and potential hazards of the work. Specific regulations – such as COSHH, Work at Height, LOLER, and Confined Spaces – require additional or more detailed assessments that build on this general process.

Step 1 – Identify Hazards

Identifying hazards is the first step in the risk assessment process. A hazard is anything in the workplace with the potential to cause harm – machinery, vehicles, confined spaces, hazardous substances, electricity, work at height, or pressure systems.

Ways to identify hazards:

• Walk around the worksite and observe actual working conditions
• Talk to workers and supervisors about what concerns them
• Review accident, near-miss, and ill health records
• Check manufacturer instructions and safety data sheets
• Consult HSE and industry guidance

Don’t overlook less visible workplace hazards such as fatigue, noise, lone working, and occupational stress. Failing to identify all hazards can result in serious accidents. Involving workers in hazard identification fosters a culture of safety and often reveals potential hazards that management has not spotted.

Step 2 – Decide Who Might Be Harmed and How

For each hazard, identify who might be harmed: employees, contractors, agency workers, visitors, members of the public, or others on shared sites. Consider specific groups – young or inexperienced workers, older workers, disabled staff, expectant mothers, lone workers, night-shift staff, and apprentices. Employers must assess risks to new or expectant mothers as a specific legal requirement.

Describe how each group might be harmed – for example, struck by loads during a lifting operation, falls from height on scaffolding, exposure to welding fume, musculoskeletal injury from manual handling, or long-term hearing loss from noise. In multi-employer workplaces such as construction sites or ports, dutyholders should coordinate risk assessments and share relevant findings. Not sharing risk assessments can put workers at serious risk.

Step 3 – Assess Risks and Decide on Control Measures

Assess how likely it is that someone might be harmed by each hazard and how severe the harm could be. Assign a risk level – low, medium, or higher risk – to help prioritise taking action. Risk levels must be reduced to as low as reasonably practicable.

Control measures should be proportionate to the level of risk identified. Follow the hierarchy of control:

1. Eliminate the hazard entirely
2. Substitute with something less hazardous
3. Engineering controls (guards, ventilation, barriers)
4. Administrative controls (permits, procedures, training)
5. PPE as a last resort

The process of risk assessment includes evaluating existing precautions – check whether current protective measures are effective before adding new ones. Any residual risk should be tolerable and well-managed.

Example 1: In a warehouse where manual handling of heavy or irregular loads causes repeated strains, the first step is to explore mechanical handling aids before resorting to manual handling training alone.

Example 2: For working at height on a telecoms mast, design in guard rails and fall-arrest systems before relying on harnesses and administrative controls.

Step 4 – Record Significant Findings and Implement Controls

If an employer has five or more employees, they must record the significant findings of their risk assessments. Risk assessments must be documented for workplaces with five or more employees. Smaller businesses are strongly encouraged to keep records as best practice.

A clear record should show:

• The hazards identified
• Who might be harmed and how
• Existing control measures
• Additional measures needed
• Who is responsible for implementation and by when

The real priority is implementing the agreed control measures on site – guarding equipment, issuing permits, updating safe systems of work, and providing training and supervision. Training workers on safety controls is important during a risk assessment. Records can be digital or paper, so long as they are accessible to managers, supervisors, employees, and inspectors. Any template must be adapted to the organisation’s own tasks and potential hazards – a generic document is unlikely to meet the “suitable and sufficient” standard.

Step 5 – Review and Update the Risk Assessment

Review is essential because workplaces, equipment, and people change, and risk assessments can quickly become out of date. Review risk assessments after significant changes in the workplace, after incidents or near misses, after changes to process, equipment, substances, staff, or site layout, and when monitoring suggests controls are not working as intended.

Reviews should be proportionate: a small office may need only light updates, while a high-hazard environment may require formal review meetings and sign-off. Involving workers in reviews often reveals practical issues – controls that are difficult to follow or conflicting procedures between contractors. Records of reviews help demonstrate continuous improvement during audits or regulatory inspections.

Types of Risk Assessments in UK Workplaces

While the core principles are similar, different work regulations require specific types of assessment:

• Type: General workplace; When Required: All routine operations; Example: Office, workshop, yard
• Type: Task-based; When Required: Specific high-risk tasks; Example: Working at height, confined space entry, forklift operations (NPORS)
• Type: COSHH; When Required: Hazardous substances use; Example: Cleaning chemicals, welding fume, paint
• Type: DSE; When Required: Screen-based work; Example: Office workstations
• Type: Young persons’; When Required: Workers under 18; Example: Apprentices, work experience
• Type: RAMS; When Required: Construction and engineering; Example: Linking assessment to method statement
• Type: In sectors Evolve Training commonly serves, task-based assessments cover PASMA tower scaffold erection, lifting operations subject to LOLER, and manual handling tasks in logistics or oil and gas support work. All of these still follow the basic “identify hazards – assess risks – control risks – record – review” cycle.

Common Mistakes and How to Improve Risk Assessments

Even in busy, well-intentioned UK workplaces, risk assessments often fall short. Here are the most common pitfalls:

• Generic cut-and-paste documents that do not reflect the actual site or tasks – these rarely meet the “suitable and sufficient” test
• Ignoring long-term health risks like noise, vibration, stress, and chemical exposure while focusing only on obvious accidents
• Underestimating who might be harmed – overlooking contractors, visitors, or vulnerable groups
• Over-reliance on PPE instead of elimination or engineering controls
• Using vague language that can lead to misinterpretation of risks
• Never reviewing assessments after changes or incidents
• Failing to share findings with supervisors and staff, or poor awareness of what was identified

To raise awareness and improve quality:

• Keep language clear and specific to the task
• Link assessments directly to safe systems of work and permits
• Prioritise higher risk tasks for immediate action
• Ensure management visibly supports implementation
• Invest in targeted health and safety training (IOSH Managing Safely, NEBOSH, or task-specific courses) to build competence across the organisation

How Training Supports Better Risk Assessments (Evolve Training Perspective)

Training is one of the most practical ways to build competence for those expected to carry out or review risk assessments. Accredited courses such as NEBOSH and IOSH help managers and supervisors understand their legal duties, how to identify hazards, evaluate and assess risks, and select proportionate control measures. Effective risk assessments can lead to improved workplace procedures and training right across the plan for your business.

Evolve Training in Dyce, Aberdeen, has provided health and safety and technical skills training since 1993. Its one-day Risk Assessment course is designed to help delegates identify hazards, estimate risk, apply the hierarchy of control and produce a safe working procedure. The wider course programme includes working at height, confined space, manual handling, fire safety, first aid, lifting operations, PASMA and forklift training.

If you want to strengthen your team’s ability to carry out and improve risk assessments, explore our full range of health and safety courses or get in touch to discuss your needs.

FAQs About Health and Safety Risk Assessment