How to Write a Risk Assessment (UK)

A risk assessment is a written check of what on a job could hurt someone and what you are doing to stop it. If you employ anyone the law says you have to carry one out, and if you have five or more staff you have to write it down. This guide walks through the five steps the HSE sets out, with a real example, so you can produce one that stands up to a client or an inspector.

What the law actually requires

The duty comes from the Management of Health and Safety at Work Regulations 1999, which sit under the Health and Safety at Work etc. Act 1974. Regulation 3 says every employer must make a suitable and sufficient assessment of the risks to workers and to anyone else affected by the work. There is no set format. What matters is that you have thought it through properly and can show it. Firms with five or more employees must keep a written record; smaller firms should still write it down because clients and principal contractors almost always ask for it.

The five steps

1. Identify the hazards. Walk the job and note anything with the potential to cause harm: working at height, power tools, dust, chemicals, moving vehicles, manual lifting. Ask the people doing the work, because they see the near misses.
2. Decide who might be harmed and how. For each hazard, name who is at risk and the way they could be hurt. Include your own workers, other trades on site, and members of the public.
3. Evaluate the risk and decide on control measures. Judge how likely harm is and how serious it would be, then set out what you will do to reduce it. Work down the order of control: remove the hazard if you can, then reduce it, then guard against it, and use personal protective equipment last.
4. Record your findings. Write down the hazards, who is at risk, and the controls. This is the document clients want to see and the one an inspector will ask for.
5. Review and update. Look at it again when the job changes, when something goes wrong, or at least once a year. A risk assessment written for one site does not automatically fit the next one.

A worked example

Take a small firm replacing guttering on a two storey house. The main hazards are falling from the ladder or scaffold, dropping tools or materials onto people below, and manual handling of the guttering. Those at risk are the two operatives and anyone passing beneath. The controls: use a tower scaffold rather than a ladder for the run, foot and tie any ladder used for access, keep a clear exclusion zone below with cones, use a tool lanyard, and split heavy lengths between two people. Recorded on one page, dated and signed, that is a suitable and sufficient assessment for the job.

Common mistakes to avoid

The usual failures are copying a generic assessment that does not match the actual job, listing hazards with no real controls against them, and writing it once and never reviewing it. An assessment that names the site, the task and the specific controls beats a long generic one every time.

If a client has asked you for both a risk assessment and a method statement together, that pair is called RAMS. Our guide to method statements and RAMS explains what to add.

Save yourself the blank page

You do not need to build the format from scratch. Our risk assessment template gives you the five steps laid out, with a five by five scoring matrix and worked example rows, ready to fill in for your job in a form clients and inspectors recognise.