How do I write a workplace risk assessment?
Updated · UK law and HSE guidance
Short answer
To write a workplace risk assessment, identify hazards, decide who could be harmed and how, evaluate existing controls, record significant findings and assign further actions, then review the controls. Employers with five or more employees must record significant findings, but every employer must make a suitable and sufficient assessment.
| Core duty | Suitable and sufficient assessment |
|---|---|
| Written record | Significant findings where 5+ people are employed |
| People covered | Employees and non-employees affected by the undertaking |
| Control test | So far as is reasonably practicable |
| Review | When no longer valid or after significant change |
Start with the work as it really happens
Walk the workplace, observe normal and non-routine work, speak to workers and examine accident or ill-health records. Include maintenance, cleaning, start-up and shutdown. Identify who may be affected, including contractors, visitors, the public and workers who may be more vulnerable. Describe credible harm rather than writing only a list of hazard names.
- Consider equipment, substances, movement, environment and work organisation
- Include foreseeable abnormal events and emergencies
- Consult the workers who understand practical difficulties
Choose and record effective controls
For each hazard, note what is already in place and decide whether more is needed. Prefer removing the hazard or controlling it at source before relying on procedures or personal protective equipment. Record the significant findings, people at risk and measures required. Give every further action an owner and realistic completion date, then track it to closure.
- Avoid the risk where possible
- Substitute safer materials, equipment or processes
- Use engineering and collective controls before individual protection
- Provide information, instruction, training and supervision
Keep the assessment alive
Check whether controls are actually used and effective. Review when equipment, substances, staffing, processes or premises change; after an accident or near miss; when workers identify a problem; or when there is reason to think the assessment is no longer valid. Routine review dates are useful management reminders but are not a substitute for event-triggered review. Check progress on outstanding actions during every review. SitePaper can generate a structured draft for competent approval.
- Update the formal record with changes made
- Communicate revisions to all affected people
- Retain enough evidence to show decisions and actions clearly
Step by step
- Identify hazards. Observe routine and non-routine work, consult workers and check incident records.
- Identify who may be harmed. Include employees, contractors, visitors, the public and people with particular needs.
- Evaluate and control risk. Consider likelihood and severity, then apply the hierarchy of control.
- Record and act. Record significant findings and assign each further action to an owner and date.
- Review. Confirm controls work and revise after relevant changes, incidents or new information.
Sources
- HSE: Steps needed to manage risk
- Management Regulations 1999, regulation 3
- Management Regulations 1999, Schedule 1
This guide summarises UK law and HSE guidance for small businesses. It is not legal advice; check the sources and your own circumstances.