What is a risk assessment?

A risk assessment is a careful examination of what in your work could cause harm to people, so you can decide whether your precautions are adequate. In the UK it is a legal duty under regulation 3 of the Management of Health and Safety at Work Regulations 1999, and employers with five or more employees must record the significant findings in writing.

Who must carry out a risk assessment?

Every employer and every self-employed person whose work could affect others. The duty in regulation 3 of the Management of Health and Safety at Work Regulations 1999 is to make a suitable and sufficient assessment of the risks to the health and safety of employees at work, and of anyone else who could be affected by the work being carried out.

The written record threshold is five employees, but the assessment duty itself has no threshold. A sole trader whose work could injure a member of the public still has to assess that risk, they simply do not have to write it down. Certain hazards also carry their own separate assessment duties on top of the general one, including substances hazardous to health under COSHH, manual handling, display screen equipment, noise, vibration and work at height.

The steps the HSE sets out

The HSE frames the process in five steps. They are deliberately plain, and the plainness is the point.

1. Identify the hazards. A hazard is anything with the potential to cause harm. Walk the workplace, look at what people actually do rather than what the procedure says, check accident and near miss records, and ask the people doing the job.
2. Decide who might be harmed and how. Employees, contractors, visitors, members of the public, and anyone whose circumstances change the risk, including new and expectant mothers, young workers, lone workers and people with disabilities.
3. Evaluate the risks and decide on precautions. For each hazard, consider how likely harm is and how severe it would be, then work through the hierarchy of control.
4. Record your significant findings. What the hazards are, what you are already doing, and what more you will do, with who is responsible and by when.
5. Review and update. Whenever something changes, and periodically in any case.

The hierarchy of control

Deciding on precautions is not a free choice. The law expects you to work down a hierarchy, and to be able to say why you stopped where you did.

1. Eliminate. Remove the hazard entirely. Do not work at height if the job can be done at ground level.
2. Substitute. Replace it with something less dangerous, such as a water based solvent instead of a flammable one.
3. Engineering controls. Isolate people from the hazard with guards, ventilation, barriers or interlocks.
4. Administrative controls. Change how people work, through procedures, permits, training, signage and rotation.
5. Personal protective equipment. Last, because it protects only the wearer, only when worn, and only when it fits and is maintained.

The order is not advisory. An assessment that jumps straight to PPE and gloves for a hazard that could have been engineered out is not suitable and sufficient, and it will not survive contact with an inspector or a claim.

What “suitable and sufficient” actually means

The phrase is the legal test, and it is less mysterious than it sounds. An assessment is suitable and sufficient if it identifies the significant risks, ignores the trivial ones, is proportionate to the hazard, considers everyone who could be affected, and remains valid for a reasonable period.

Three failures come up repeatedly:

• The generic template. A downloaded assessment for “office work” that was never edited describes somebody else’s office. It fails because it did not examine your work.
• The assessment of the procedure rather than the job. If the assessment describes how the task is supposed to be done and the task is routinely done another way, it is assessing a fiction.
• The one that was never revisited. An assessment dated four years ago, for equipment that has since been replaced, is evidence of a system that is not running.

When to review an assessment

There is no fixed legal interval, which is why so many organisations default to “annually” and treat it as a diary task. The regulations require review when there is reason to suspect it is no longer valid, or when there has been a significant change. In practice that means:

• New equipment, substances, processes or premises.
• A change in the people doing the work, including new starters, young workers or someone returning with a health condition.
• An incident or near miss connected to the activity, which is direct evidence the assessment underestimated something.
• New guidance, new legislation or an enforcement notice.

That third trigger is the one most often missed, and it is the most informative. A near miss is the cheapest possible signal that an assessment is wrong. Linking incident records back to the assessment that covers the activity is what closes the loop, and it is why near miss reporting is worth more than its reputation suggests.

Logincident