The 5 Steps to Risk Assessment, Explained

What Is a Risk Assessment?

A risk assessment is a careful look at what in your work could hurt people, and a decision about whether you’re doing enough to stop it. That’s all it is. It isn’t a form for the sake of a form, and it doesn’t need to be long. The HSE’s own guidance says that for most small, low-risk businesses the steps are straightforward, and you can do it yourself.

The point is to protect people. A good assessment tells your team what the risks are and what they should do about them, in words they understand. A bad one sits in a folder until the day an inspector or an insurer asks to see it. This guide walks through the HSE’s method step by step; our risk assessment training teaches the same method online for the people who write and sign off assessments.

Hazard vs Risk: What’s the Difference?

These two words get mixed up all the time, and the difference matters.

• A hazard is anything with the potential to cause harm: a wet floor, a ladder, a cleaning chemical, a reversing van, a box of paper, a heavy workload.
• A risk is the chance that someone is harmed by that hazard, together with how serious the harm could be.

A tin of bleach locked in a cupboard is still a hazard, but the risk is low. The same bleach decanted into an unlabelled water bottle is the same hazard with a much higher risk. Risk assessment is about the second part: you can’t always remove the hazard, but you can almost always lower the risk.

Is a Risk Assessment a Legal Requirement?

Yes. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a “suitable and sufficient” assessment of the risks to the health and safety of their employees, and of anyone else affected by the work, such as visitors, contractors and the public. Self-employed people have a matching duty if their work could put other people at risk, or if it falls in one of a few high-risk areas, such as construction, agriculture, gas or asbestos.

The regulations sit under the Health and Safety at Work etc. Act 1974, which sets the general duty to protect people so far as is reasonably practicable. Risk assessment is how you work out what that means for your business.

“Suitable and sufficient” doesn’t mean perfect. It means the assessment covers the significant risks in your work, is proportionate to them, and leads to sensible action. A ten-person office needs a few pages. A chemical plant needs a great deal more.

These rules apply in Great Britain. Northern Ireland has its own, near-identical Management of Health and Safety at Work Regulations (Northern Ireland) 2000, enforced by HSENI.

The 5 Steps to Risk Assessment

The HSE sets out risk assessment in five steps. You’ll see them described as the “5 stages of risk assessment” too; it’s the same method. The HSE’s current wording, from its guide Managing risks and risk assessment at work, is:

1. Identify hazards.
2. Assess the risks.
3. Control the risks.
4. Record your findings.
5. Review the controls.

You may come across older versions of the five steps with slightly different labels, from earlier HSE guidance. The method is the same. Here’s what each step means in practice.

Step 1: Identify the Hazards

Start by finding the things that could cause harm. The best way is to walk round the workplace with fresh eyes, and to ask the people who do the work. They know which floor is always wet and which shelf everyone climbs.

Useful places to look:

• manufacturers’ instructions and the safety data sheets for any chemicals;
• your accident book and any ill-health or absence records;
• jobs you don’t do every day, such as maintenance, cleaning, deliveries or changing a machine setting;
• long-term health hazards, not just injuries: noise, dust, substances, display screen work, manual handling and work-related stress.

Don’t list everything that could ever go wrong. Concentrate on the hazards that could realistically cause harm in your work.

Step 2: Assess the Risks

For each hazard, decide who might be harmed and how. Think in groups rather than names: warehouse staff, office staff, cleaners, delivery drivers, visitors. Then think about the people who may be more at risk:

• new and young workers, who lack experience;
• new and expectant mothers;
• migrant workers, who may not know UK practice or may not read English well;
• people with a disability or a health condition;
• lone workers, and people who work at night;
• contractors and maintenance workers who don’t know your site;
• members of the public.

Next, write down what you’re already doing to control the risk. Most workplaces have more precautions in place than they realise. Then judge whether those precautions are enough, by thinking about how likely harm is and how serious it would be. Some businesses use a simple risk rating or matrix for this. It can help you decide what to tackle first, but it isn’t required, and a score is no substitute for doing something about the risk.

Step 3: Control the Risks

If what you’re doing isn’t enough, decide what more you need to do. The law doesn’t expect you to remove every risk. It expects you to do what is reasonably practicable (more on that below), and to choose controls in a sensible order, starting with getting rid of the hazard altogether.

Compare what you do with recognised good practice for your industry. The HSE publishes guidance for most sectors and common hazards, and if a simple, cheap control is widely used, you’ll be expected to use it too.

Step 4: Record Your Findings

If you employ five or more people, regulation 3(6) says you must record the significant findings of the assessment, and any group of employees identified as especially at risk. With fewer than five, you don’t have to write it down, though it’s sensible to.

The record should say what the hazards are, who might be harmed and how, what you’re already doing, and what further action you’ll take, by whom and by when. Keep it short and plain, then share it with your team. Our free risk assessment template is laid out in exactly this format, with worked examples.

Step 5: Review the Controls

Workplaces change, so a risk assessment can’t be a one-off. Regulation 3(3) says you must review it if there’s reason to suspect it’s no longer valid, or if there’s been a significant change in the work it covers. Check that the controls you chose are actually being used and actually working. We cover when to review in more detail further down.

What Does “Reasonably Practicable” Mean?

“So far as is reasonably practicable” is the test that runs through the Health and Safety at Work Act and many of the regulations made under it. The HSE explains it in its guide to the steps needed to manage risk: you’re not expected to eliminate all risks, but you need to do everything reasonably practicable to protect people from harm. That means balancing the level of risk against the measures needed to control it, in terms of money, time or trouble.

A few things follow from it:

• The bigger the risk, the more time, money and trouble you’re expected to spend controlling it.
• Doing nothing is rarely reasonable where a cheap, well-known control exists. A non-slip mat or a cable cover costs very little.
• You don’t have to spend a fortune on a trivial risk. Nobody expects you to carpet the car park.

The Hierarchy of Control

When you decide what to do in step 3, work down the hierarchy of control. Start at the top and only move down when the option above isn’t reasonably practicable.

1. Eliminate the hazard. Stop doing the risky thing, or do it a different way. Deliver stock to the ground floor instead of carrying it upstairs.
2. Substitute. Replace it with something less dangerous: a water-based product instead of a solvent, smaller boxes instead of heavy ones.
3. Engineering controls. Isolate people from the hazard: guards on machines, extraction for dust and fumes, barriers between people and vehicles.
4. Administrative controls. Change the way people work: safe systems of work, signage, job rotation, training and supervision.
5. Personal protective equipment (PPE). Gloves, safety boots, hearing protection, eye protection. PPE is the last resort, because it only protects the person wearing it, and only when it fits and is worn properly.

This order reflects the “general principles of prevention” in Schedule 1 of the 1999 Regulations, which regulation 4 requires employers to apply. They include avoiding risks, tackling them at source, replacing the dangerous with the less dangerous, and putting measures that protect everyone ahead of measures that protect individuals. In practice you’ll often combine several controls for one hazard. That’s normal.

A Worked Example: A Small Warehouse

Here’s how the five steps might look for a small distribution warehouse with eight staff, a reach truck and a delivery bay. It’s an illustration, not a finished assessment for your site.

Step 1: Identify the hazards. The manager walks the site with two of the team and looks at the accident book. They list: the reach truck and delivery vans moving where people walk; lifting and carrying cartons; staff climbing racking to reach top-shelf stock; shrink-wrap and pallets left in aisles; and the battery charging point for the truck.

Step 2: Assess the risks. Pickers, drivers and visiting delivery drivers could be struck by a vehicle, which could be fatal. Pickers could hurt their backs lifting heavy cartons, especially on busy days. Anyone could trip over pallets or wrapping. Current controls include a trained, authorised truck driver and a speed limit, but there are no marked walkways and a step ladder is often missing.

Step 3: Control the risks. For vehicles, they separate people and traffic with marked pedestrian walkways and a barrier at the bay door, and ban pedestrians from the loading area during unloading. For lifting, they move the heaviest lines to waist-height shelves and buy a second pallet truck. For the racking, they fix a mobile step unit to each aisle and make “no climbing” a rule the supervisor checks.

Step 4: Record your findings. With eight employees, the business must record the significant findings. The record for the two main hazards looks like this:

Hazard	Who might be harmed and how	Already doing	Further action	By who	By when
Vehicles and pedestrians	Pickers and visiting drivers could be struck by the reach truck or a van, causing serious or fatal injury	Trained, authorised driver; site speed limit	Mark pedestrian walkways; barrier at bay door; no pedestrians in the bay during unloading	Warehouse manager	Within two weeks
Lifting cartons	Pickers could suffer back injuries lifting heavy cartons from high and low shelves	Lifting technique covered at induction	Move heaviest lines to waist height; buy a second pallet truck; carry out a manual handling assessment	Supervisor	End of the month

Step 5: Review the controls. The manager checks after a month that the walkways are being used, asks the team what’s working, and sets a review date. When the business adds a second shift or a new truck, they review again.

Notice the manual handling row: lifting is significant enough that it needs its own specific assessment under the Manual Handling Operations Regulations 1992. That’s common, and it’s covered below.

Who Should Carry Out a Risk Assessment?

The employer is responsible, but the assessment should be done by someone competent. The HSE describes a competent person as someone who has the necessary skills, experience and knowledge to manage health and safety. Regulation 7 of the 1999 Regulations requires every employer to appoint one or more competent people to help them meet their health and safety duties.

In a small, low-risk business, that can be you. If you understand the work and the hazards, you can do the assessment yourself. In a larger or higher-risk organisation, it’s usually a manager or supervisor who knows the work, backed up by a health and safety adviser for the harder risks. Regulation 7(8) says that if you have a competent person among your own employees, you should appoint them in preference to someone from outside.

Whoever does it, two things make the biggest difference:

• Involve the workers. You have a legal duty to consult your employees on health and safety, and they’ll spot hazards that a manager walking through never sees.
• Get the right training. No formal qualification is required, but people who write assessments should understand the method. A short course gives supervisors the basics; managers with wider safety responsibilities often take IOSH Managing Safely, which covers assessing and controlling risks in depth.

How Often Should You Review a Risk Assessment?

There’s no fixed legal interval. The 1999 Regulations say you must review an assessment when:

• there’s reason to suspect it’s no longer valid; or
• there’s been a significant change in the matters it relates to.

In practice, that means reviewing when you bring in new equipment, substances or processes, move or change premises, take on new people (especially young workers), or when someone tells you they’re pregnant. Review after any accident, near miss or case of work-related ill health, and whenever your team raises a concern.

Many businesses also set a regular review date, often once a year, so that slow changes don’t go unnoticed. That’s good practice rather than a legal rule. Record each review, even when nothing needs to change: it shows the assessment is a living document.

Common Risk Assessment Mistakes

Most risk assessments that fail, fail in predictable ways. Here are the ones to avoid.

• Downloading a generic assessment and signing it. An example is a useful starting point, but the assessment has to describe your workplace, your people and your controls.
• “Take care” as a control. Telling people to be careful isn’t a control measure. Say what they should actually do.
• Listing every trivial hazard. Paper cuts and staplers bury the risks that could seriously hurt someone. Focus on what’s significant.
• No names or dates on actions. “Improve lighting” with nobody responsible and no deadline rarely happens.
• Jumping straight to PPE. Gloves and hi-vis are the last line of defence, not the first.
• Not involving the people who do the job. They know the shortcuts, the workarounds and the near misses.
• Writing it and filing it. If your team hasn’t seen it and nobody checks it’s followed, it isn’t protecting anyone.
• One assessment for the whole business. Different areas and tasks usually need their own assessments, or at least their own sections.

When You Need a Specific Risk Assessment

The general risk assessment covers your work as a whole. Some hazards and some groups of people also need a specific assessment under their own regulations. They follow the same five steps, with extra detail on what to look at.

Situation	Law (Great Britain)	What it requires
Hazardous substances	Control of Substances Hazardous to Health Regulations 2002 (COSHH)	Assess the risks from substances such as chemicals, dusts and fumes, and how to prevent or control exposure. See our guide, What Is COSHH?
Manual handling	Manual Handling Operations Regulations 1992	Avoid hazardous manual handling so far as reasonably practicable; assess and reduce the risk of any that can’t be avoided. See our summary of the regulations
Fire	Regulatory Reform (Fire Safety) Order 2005 in England and Wales	The “responsible person” must carry out a fire risk assessment, review it regularly and, since 1 October 2023, record it in full whatever the number of employees. Scotland (Fire (Scotland) Act 2005) and Northern Ireland (Fire and Rescue Services (Northern Ireland) Order 2006) have their own fire safety laws
Display screen equipment	Health and Safety (Display Screen Equipment) Regulations 1992	Assess the workstations of people who use screens habitually as a significant part of their normal work (the HSE’s rule of thumb is daily, for continuous periods of an hour or more), including those who work from home long term or split their time between home and the workplace
Young persons (under 18)	Management of Health and Safety at Work Regulations 1999, regulations 3 and 19	Assess the risks to young people before they start, taking particular account of their inexperience, lack of awareness of risks and immaturity
New and expectant mothers	Management of Health and Safety at Work Regulations 1999, regulation 16	Where you employ women of childbearing age, include the risks to new and expectant mothers and their babies in your assessment. Once an employee tells you in writing that she is pregnant, has given birth in the last six months or is breastfeeding, carry out an individual risk assessment and act on it

Other regulations bring their own assessments too, including noise, vibration, work at height, asbestos and flammable substances (DSEAR). If a hazard has its own regulations, check what they require on top of the five steps. Our COSHH training and manual handling training cover the two most common specific assessments in detail.

What to Do Next

If you haven’t looked at your risk assessment for a while, here’s what to do this week:

1. Find your current assessment. If there isn’t one, or it’s a generic download, start again with the five steps.
2. Walk round with one or two of your team and list the hazards that could cause real harm.
3. Fill in the free risk assessment template below, with a name and a date against every action.
4. Share the findings with everyone affected, and put a review date in the diary.
5. Check whether you also need a specific assessment, such as COSHH, manual handling or fire.

If the people writing your assessments have never been shown how, a little training goes a long way. Our online risk assessment training teaches the HSE’s five steps, from spotting hazards to choosing controls and recording findings people will follow.