What is a health and safety risk assessment?

A health and safety risk assessment is a systematic look at what you do, where you do it and who does it, carried out to identify what could cause harm and decide what needs to be in place to prevent that harm. It is not a form-filling exercise and it is not something only high-hazard industries need to think about — it is a general duty that applies to essentially every UK workplace, from a small office to a construction site, under the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999.

Why it matters

A risk assessment is the mechanism by which an employer's general duty to protect people becomes something specific and workable: not "make the workplace safe" as an abstract aspiration, but a documented judgement about this hazard, in this location, affecting these people, controlled in this way. Without it, safety decisions tend to happen informally and inconsistently — one manager wears the right gloves out of habit, another doesn't, and nobody has actually decided what the right control is or why.

Done properly, a risk assessment also protects the organisation as well as the people in it. It's the evidence that reasonably practicable steps were considered and taken, which matters if something does go wrong and matters just as much, day to day, in demonstrating to staff, contractors, insurers and regulators that hazards have genuinely been thought through rather than assumed away.

Who's responsible

The duty sits with the employer, and in practice is usually delegated to a director, a health and safety manager, a facilities manager or — for smaller organisations — the business owner directly. Where premises are shared, such as a multi-let office building or a managed estate, responsibility can sit with more than one party at once: the employer for what happens within their own operation, and the landlord or managing agent for the shared parts and building-wide arrangements. Getting that overlap right, so that nothing falls into a gap between the two, is one of the more common things a risk assessment review turns up.

The person carrying out the assessment doesn't need a particular qualification by law, but they do need to be what the Regulations call a competent person — someone with enough training, knowledge and experience to identify the hazards that are actually present and judge whether the controls in place are adequate. For routine, low-complexity workplaces that's often achievable in-house. For higher-hazard activities, or where the organisation genuinely lacks that competence internally, the duty to have a suitable and sufficient assessment doesn't go away — it just means bringing in someone who has it.

Hazards and risks aren't the same thing

The two terms get used interchangeably in conversation, but the distinction is the whole basis of the assessment process. A hazard is anything with the potential to cause harm — a wet floor, a piece of moving machinery, a chemical, a poorly designed workstation, a lone working arrangement. A risk is the likelihood that a hazard will actually cause harm, combined with how severe that harm would be, given the circumstances it exists in.

The same hazard can carry very different risk depending on context. A trailing cable in a rarely used storeroom is a hazard with low risk; the same cable across a busy corridor used by the public is the same hazard carrying materially higher risk. A risk assessment that stops at listing hazards without weighing likelihood and severity hasn't actually assessed anything — it's produced a hazard list, which is a useful input but not the output the law requires.

The risk assessment process

Health and Safety Executive guidance sets out five broadly recognised steps, and most competent methodologies follow the same shape even where the terminology differs slightly.

Identify the hazards. Walk the workplace, talk to the people who actually do the work, and look at accident and near-miss records, manufacturer's information and previous assessments. The people doing the job day to day routinely spot things a desk-based review misses.

Decide who might be harmed, and how. This step is easy to narrow too far. It isn't only the employees directly carrying out a task — it includes contractors, visitors, members of the public, and anyone with a particular vulnerability, such as a new or young worker, someone who is pregnant, or someone with a disability that changes how a hazard affects them.

Evaluate the risk and decide on precautions. For each hazard, judge how likely harm is and how severe it would be, and decide whether existing controls are adequate or whether more is needed. The Regulations expect this to follow a recognised hierarchy: eliminate the hazard where possible, substitute it for something less hazardous, use engineering controls, then administrative controls, and treat personal protective equipment as the last line of defence rather than the first.

Record the findings and implement them. Beyond a handful of employees, findings have to be written down — what the significant hazards are, who's affected, and what's being done about them. Recording them and doing nothing with them is not compliance; the point is that the actions actually happen.

Review and update. A risk assessment is a working document, not a certificate. It needs revisiting when something changes, and periodically even when nothing obviously has.

Evaluating existing controls

Before deciding what more is needed, the assessment has to establish what's already there and whether it's actually working — not just whether a control exists on paper, but whether it's being followed in practice. A guard that's routinely removed to speed up a task, a procedure nobody was ever trained on, or a control that was correct for the task as originally designed but hasn't kept pace with how the work is actually now done, are all examples of a control that looks adequate in a policy document and isn't adequate on the shop floor.

This is where the hierarchy of control matters again: an existing control lower down the hierarchy — personal protective equipment, say, relied on where an engineering control would remove the hazard at source — isn't necessarily wrong, but it's worth asking explicitly whether something higher up the hierarchy has genuinely been ruled out, rather than never considered.

Additional controls

Where existing controls fall short, the assessment needs to set out what else is required, in enough detail that someone else could actually implement it: not "improve signage" but which signage, where, to what standard, and by when. Additional controls should follow the same hierarchy as existing ones, and each one needs an owner and a realistic timescale — an action plan with no name against it tends to be the item still open at the next review.

It's also worth being honest about controls that can't be implemented immediately. A phased plan with interim measures, clearly documented, is a legitimate and often necessary response to a genuine constraint — cost, lead time, the need for specialist works. What isn't legitimate is silence: an assessment that identifies a gap and then says nothing about how or when it will be closed has not actually addressed the risk.

Recording your findings

For any organisation with five or more employees, the law requires the significant findings to be recorded in writing — the hazards identified, who's affected, and what controls are in place or planned. Below that threshold there's no strict legal requirement to record findings, but doing so anyway is good practice: it's the only way to demonstrate later what was actually considered, and it's usually far easier to update a document than to reconstruct one from memory after the fact.

There's no single template mandated by law, and organisations use a range of formats — a simple table, dedicated risk assessment software, or a narrative report for more complex activities. What matters is that the record is genuinely usable: specific enough to act on, clear about who is responsible for what, and something a new manager could pick up and understand without having sat through the original assessment.

Reviewing and updating

A risk assessment isn't a one-off exercise. It needs to be reviewed whenever something changes that could affect the hazards present or the adequacy of existing controls — new equipment, a different way of working, a change of premises, a near miss or incident, new starters, or new legislation and guidance. Even where nothing obvious has changed, periodic review is good practice, because gradual drift — a control quietly stops being followed, a process changes in small increments over time — is exactly the kind of gap a scheduled review is designed to catch.

There's no single statutory review interval that applies to every workplace or every hazard. Higher-risk activities generally warrant more frequent review than stable, low-risk ones, and the right interval is a judgement the assessment itself should record rather than leave implicit.

How this looks across different workplaces

The process is the same wherever it's applied; what changes is which hazards actually turn up.

In an office or commercial workplace, the significant hazards are often the least dramatic-looking: display screen equipment and workstation set-up, trailing cables and general trip hazards, fire evacuation arrangements, and the wellbeing and stress-related risks that come with sustained workload or poor management practice. It's easy to under-assess an office on the assumption that "nothing really happens here" — which is usually true right up until someone is injured by exactly the kind of low-drama hazard that got assumed away.

In education settings, the assessment has to account for a wide range of ages and vulnerabilities in the same building at once, activity-specific risks in science, design and technology, PE and off-site visits, and safeguarding-adjacent considerations around who has access to the site and when.

In healthcare and care settings, manual handling of people rather than objects, exposure to infection control risks, sharps and clinical waste, and lone working during home visits or out-of-hours care are typically the dominant themes, alongside the more conventional hazards found in any workplace.

In retail and hospitality, the mix usually includes manual handling of stock, slips from spillages, security and lone working risks — particularly around opening, closing and cash handling — and the fire and means-of-escape considerations that come with premises open to the public in numbers.

In warehousing and industrial premises, mechanical handling equipment, racking and storage, noise, dust and fumes, and the interaction between pedestrians and vehicle movements tend to be the significant hazards, often requiring more detailed, activity-specific assessments alongside the general workplace one.

For property managers and managing agents, the picture is different again: the assessment has to cover shared parts, plant rooms and communal areas that no single occupier is directly managing, and clearly establish where the managing agent's responsibility ends and each occupier's begins.

On construction sites, hazards are typically more numerous, more severe and change more often than in most other settings, which is why construction is subject to its own additional regime under the Construction (Design and Management) Regulations, on top of the general risk assessment duty. A construction-specific assessment tends to sit alongside, rather than replace, the wider organisational one.

How this relates to other specialist assessments

A general health and safety risk assessment is the umbrella exercise, but several hazards are significant or specific enough to warrant their own dedicated assessment, carried out to a particular methodology and often required by their own regulations.

A fire risk assessment is a distinct legal requirement under the Regulatory Reform (Fire Safety) Order 2005, separate from the general duty under the 1974 Act, and it needs its own competent assessment rather than being folded into the general one. Our guide to fire risk assessments covers what that process involves and how it differs from this one.

Beyond fire, a number of other hazard-specific assessments sit under the same general risk assessment principle but apply their own regulations and detail: COSHH assessments, covering hazardous substances under the Control of Substances Hazardous to Health Regulations 2002; manual handling assessments, where lifting, carrying or moving loads presents a risk of injury; display screen equipment (DSE) assessments, for people who habitually use screens as a significant part of their work; lone working assessments, for anyone working without direct supervision or colleague support nearby; and DSEAR assessments, where dangerous substances or explosive atmospheres are present. Alongside these, routine workplace inspections, thorough accident investigation following an incident or near miss, clearly defined safe systems of work, and task-specific method statements for higher-risk or non-routine activities all sit within the same overall approach to managing risk — each a distinct discipline in its own right, and each one we'll be covering in more detail as separate guides.

Frequently asked questions

Is a health and safety risk assessment a legal requirement?

Yes. Every employer has a general duty under the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999 to assess the risks to employees and anyone else affected by their work, and to record the significant findings where they employ five or more people.

How often does a risk assessment need to be reviewed?

There's no single statutory interval. It needs reviewing whenever something changes that could affect the hazards present or the adequacy of controls, and periodically even where nothing obviously has — the right interval is a judgement the assessment should record rather than a fixed rule that applies everywhere.

Do I need a different risk assessment for each hazard?

Not necessarily as separate documents, but certain hazards — fire, hazardous substances, manual handling, display screen equipment, lone working, and dangerous substances or explosive atmospheres — are significant or regulated enough to warrant their own dedicated assessment alongside the general one.

Who can carry out a risk assessment?

Anyone with enough training, knowledge and experience to identify the hazards actually present and judge whether existing controls are adequate — what the Regulations call a competent person. That can be done in-house for routine, lower-complexity workplaces; more complex or higher-hazard activities generally need specialist input.

What happens if I don't have a risk assessment in place?

Beyond the immediate risk of harm to people, an employer without a suitable and sufficient risk assessment is failing a basic legal duty, which can lead to enforcement action, and leaves the organisation without evidence that reasonably practicable steps were even considered if something does go wrong.

Is a checklist the same as a risk assessment?

No. A checklist or inspection checks whether controls that were already decided on are actually being followed in practice. A risk assessment is the exercise that identifies the hazards and decides what those controls should be in the first place — our workplace health and safety inspection checklist sets out that distinction in more detail.

When to seek professional advice

Many general workplace risks can be assessed competently in-house, particularly where the hazards are familiar and the workplace is relatively low-complexity. Specialist input is worth bringing in where the hazards are unfamiliar, where internal competence genuinely doesn't cover the activity in question, where an incident or near miss has raised doubts about existing arrangements, or where a landlord, insurer, client or regulator is asking for assurance you can't currently provide.

Our Health & Safety Consultancy covers general workplace risk assessment across offices, education, healthcare, retail, hospitality, warehousing and managed property, and our Construction Health & Safety service covers the additional regime that applies on site. Get in touch if you'd like to discuss what a risk assessment should cover for your workplace, or arrange for one to be carried out.