Guidance · Reviewed August 2026
What the law requires, the five steps HSE sets out, when you must write it down, and the mistakes that turn a risk assessment into paperwork nobody uses.
The short answer
A risk assessment is a careful look at what could cause harm in your work, so you can judge whether your precautions are enough. Every employer must do one. If you employ five or more people you must record the significant findings in writing. The duty comes from regulation 3 of the Management of Health and Safety at Work Regulations 1999, made under the Health and Safety at Work Act 1974 (HASAWA).
Hazard and Risk Are Not the Same Thing
This is the distinction most assessments get muddled, and it matters because the two lead to different actions.
| What it means | Example | |
|---|---|---|
| Hazard | Anything with the potential to cause harm. It exists whether or not anyone is exposed to it. | A spill on a corridor floor. |
| Risk | How likely it is that someone is harmed by that hazard, and how serious the harm would be. | High if it’s a busy route in a warehouse; low if it’s in a locked plant room. |
The same hazard carries a different risk in different workplaces. That’s why a downloaded assessment for “an office” tells you very little about yours.
Who Has to Do One, and When It Must Be Written Down
Regulation 3 requires every employer to make a suitable and sufficient assessment of the risks to employees at work, and to people not in their employment who are affected by the business. The same duty applies to self-employed people whose work could put others at risk.
“Suitable and sufficient” is a legal test rather than a phrase. HSE’s Approved Code of Practice takes it to mean the level of detail should be proportionate to the risk: a proper check was made, it covers who might be affected, it addresses the obvious significant risks, the precautions are reasonable, the remaining risk is low, and workers or their representatives were involved.
| Employees | What the law requires |
|---|---|
| Any number | You must assess the risks to employees and to anyone else affected by your work, and act on what you find. |
| Five or more | You must also record the significant findings in writing. |
Note it is five or more, not more than five, and it’s a headcount rather than full-time equivalents. Below five the assessment still has to happen — only the recording requirement changes. Most clients and insurers will ask to see something written regardless, and it sits alongside your health and safety policy, which has the same threshold.
The Five Steps
HSE sets out risk management as a five-step process. You can do it yourself or appoint a competent person to help.
STEP 1
Identify hazards
Walk the workplace and think about what could cause harm: how people work, how plant and equipment are used, what chemicals and substances are present, what safe or unsafe practices exist, and the general state of the premises.
Two things people miss. Look back at your accident and ill health records — they surface hazards you’d otherwise walk past. And take account of non-routine work: maintenance, cleaning, shutdowns, changes in production.
Include hazards to health, not just safety — manual handling, hazardous substances and causes of work-related stress. Talk to your employees while you’re doing it; they usually know where the problems are.
STEP 2
Assess the risks
For each hazard, decide how likely it is that someone could be harmed and how serious that harm could be. Then work out:
- who might be harmed, and how
- what you are already doing to control the risk
- what further action is needed
- who will carry that action out
- when it needs to be done by
The last three turn an assessment into something that actually changes the workplace. Without a named person and a date, you have a list of observations.
STEP 3
Control the risks
Start with the strongest control and work down. Can you get rid of the hazard altogether? If not, in order of preference:
- redesign the job
- replace the materials, machinery or process
- organise the work to reduce exposure
- put practical measures in place to work safely
- provide personal protective equipment and make sure it’s worn
PPE is last for a reason. It protects one person, only while worn correctly, and it fails silently. Where a residual risk needs managing procedurally, that’s a safe system of work.
STEP 4
Record your findings
At five or more employees, you must record the significant findings. HSE is specific about what that means:
- the hazards
- who might be harmed, and how
- what you are doing to control the risks
HSE publishes a free template and worked examples. Its own warning is worth repeating: don’t rely purely on paperwork — the priority is controlling the risks in practice.
STEP 5
Review the controls
Check that what you put in place is actually working. Review again if the controls may no longer be effective, or if something changes — staff, a process, or the substances or equipment used. Also review if workers have raised problems, or there has been an accident or near miss.
Update the record with any changes you make, and date it.
What “reasonably practicable” actually means
You are not expected to eliminate all risk. You must do everything reasonably practicable to protect people — balancing the level of risk against the money, time or trouble needed to control it. Where the risk is serious, very little counts as disproportionate.
Worth knowing: under section 40 of HASAWA, if you are prosecuted it is for you to prove it was not reasonably practicable to do more. That reversal is the strongest practical argument for keeping a dated, specific written assessment even when you employ fewer than five people.
Don’t Forget Vulnerable Workers
Some people face higher risk from the same hazard, and an assessment that treats the workforce as uniform will miss it. Consider separately:
New and expectant mothers →
Migrant workers →
Lone workers →
All vulnerable workers →
Where Risk Assessments Go Wrong
| The problem | Why it matters |
|---|---|
| Generic and downloaded | An assessment for “a warehouse” isn’t an assessment of your warehouse. The hazards may match; the risks won’t. |
| No named actions or dates | Identifying a control and never assigning it is worse than not identifying it. It shows you knew. |
| Controls listed but not implemented | A written control you never put in place is evidence against you if something happens. |
| Safety only, no health | HSE recorded 1.9 million workers suffering work-related ill health in 2024/25 against 680,000 sustaining an injury. Stress, dust, noise and manual handling are all assessable. |
| Routine work only | Maintenance, cleaning and breakdowns are where a lot of serious incidents happen, precisely because they’re outside the normal routine. |
| Written once, never reviewed | An undated assessment, or one from several years and one process change ago, carries very little weight with an inspector. |
| Confused with the policy | They’re separate documents. The policy sets the framework; assessments record specific hazards and controls. |
Not sure where to start?
A health and safety risk review will identify what your workplace needs before you write anything. Or map your training requirements by sector, hazard and job role — free, no account needed. The tools sit on envicourse.com, our course marketplace, and open in a new tab.
Training That Teaches Risk Assessment
You can carry out an assessment yourself, but you must be competent to do it — meaning sufficient training, knowledge and experience for the risks involved. These are the usual routes.
| If you need to… | Usual route |
|---|---|
| Assess risks for a team you manage | IOSH Managing Safely — three days, with risk assessment at its core. |
| Learn the method quickly | NEBOSH HSE Award in Managing Risks and Risk Assessment at Work, or the Risk Assessment and Method Statement course. |
| Hold a formal H&S role | NEBOSH General Certificate, or the NEBOSH IIRSM Certificate in Risk Management. |
| Work on construction sites | SSSTS for supervisors, SMSTS for site managers, or the NEBOSH Construction Certificate. |
| Investigate when it goes wrong | NEBOSH HSE Introduction to Incident Investigation. See also incidents and reporting. |
| Assess fire risk specifically | NEBOSH Certificate in Fire Safety. Fire risk assessment sits under separate legislation — see fire safety guidance. |
| Browse everything | All risk assessment training courses. |
Frequently Asked Questions
What are the five steps of a risk assessment?
Identify hazards, assess the risks, control the risks, record your findings, and review the controls. Older guidance used slightly different wording — “decide who might be harmed” as a separate step — but the process is the same and HSE’s current five steps are the ones above.
Is a risk assessment a legal requirement?
Yes. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to employees and to others affected by their work. It is how you demonstrate you have met your general duties under HASAWA.
Do I have to write it down?
If you employ five or more people, yes — you must record the significant findings: the hazards, who might be harmed and how, and what you are doing to control the risks. Below five you must still carry out the assessment, but recording it isn’t required. Most clients and insurers ask for it anyway.
What’s the difference between a hazard and a risk?
A hazard is anything with the potential to cause harm — a chemical, a ladder, a wet floor. The risk is how likely it is that someone is actually harmed by it, and how serious that harm would be. The hazard stays the same wherever it is; the risk changes with the circumstances.
How often should a risk assessment be reviewed?
There is no fixed interval in law. Review when the controls may no longer be effective, when staff, processes, substances or equipment change, when workers raise a problem, and after any accident or near miss. Annually is the usual working standard in the absence of any of those. Date every revision.
Who is competent to carry one out?
You can do it yourself if you have sufficient training, knowledge and experience for the risks involved. For straightforward workplaces that’s often the owner or a manager with an IOSH-level qualification. For higher-hazard or specialist work — asbestos, confined spaces, process safety — you’ll usually need a competent person with specific expertise.
What is a RAMS?
A risk assessment and method statement combined into one document, common on construction sites and frequently requested by principal contractors before you’re allowed on site. The risk assessment identifies the hazards and controls; the method statement sets out how the task will actually be carried out. See RAMS training explained.
Related Guidance
Health and safety policy →
HASAWA 1974 explained →
RAMS explained →
Managing health and safety →
All guidance topics →
General guidance only, reviewed against HSE guidance and the Management of Health and Safety at Work Regulations 1999 in August 2026. Envico is an independent training intermediary and is not affiliated with the HSE.