A risk assessment is not a form. It is the process an employer goes through to work out what in their work could hurt somebody, decide whether what they already do is enough, and write down what they found. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to employees and to anyone else affected by the work, and it is the duty almost every other health and safety obligation hangs off.
What the law actually asks for
Regulation 3(1) requires a suitable and sufficient assessment of the risks to employees at work and to people not employed by you who are affected by what you do. Suitable and sufficient is doing a lot of work in that phrase. It means proportionate to the risk: a small office does not need what a demolition contractor needs, and an assessment that lists hazards nobody in the business recognises is neither suitable nor sufficient, whatever it cost.
How to write a risk assessment: the five steps, in order
HSE's method is identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record the significant findings, then review. The evaluation step is the one businesses skip. Listing hazards is easy and listing controls is easy; deciding whether the controls you already have actually reduce that risk to an acceptable level is the judgement that makes the document worth anything.
Who should perform a risk assessment, and who can
The duty is the employer's and it cannot be given away. The person who carries it out has to be competent, which in regulation 7 terms means having sufficient training, knowledge, experience and other qualities. That can be the owner of a small business who knows the work, and often should be, because the person who understands the job usually sees more than a visitor with a template.
Writing it down, and reviewing it
An employer with five or more employees must record the significant findings. Below that the assessment is still required and only the record is optional, which surprises people. Review is triggered by reason to suspect it is no longer valid or by a significant change: new equipment, a new process, a new building, an accident, or a near miss that showed the assessment was wrong.
Health and safety risk assessment cost: having one written
A consultant's fee for a general workplace risk assessment moves on how many premises are involved, how many separate activities need their own assessment, and whether a site visit is required. What you are paying for is the evaluation and the defensibility, not the typing. A generic document bought for a fixed price and never matched to the work is the cheapest way to have nothing.
A basic risk assessment, and what makes it enough
Enough is not long. A useful assessment names the task, lists what could realistically cause harm, says who is exposed and how, and records the controls actually in place with anything further that is needed, who owns it and by when. Two pages of that beat twenty pages of generic hazard lists, because the test is whether the people doing the work recognise their own job in it. What makes a short assessment inadequate is not its length but an omission: a hazard everybody on site knows about that the document does not mention, which is what an inspector looks for first.
A risk assessment for working at height, and what it has to decide
The regulations do not ask whether the work is safe; they ask whether it could be avoided, and then whether the equipment chosen is the right one for that task. So the assessment starts with a question most forms skip: can this be done from the ground, with a pole, a drone, a camera, a jig, or by bringing the thing down. If it cannot, it chooses between a tower, a platform, a scaffold and a ladder, and records why, with a ladder only defensible for short duration light work where the alternatives are not reasonably practicable. Then it deals with the edge, the fall distance, what is below, the weather and the rescue.
Risk assessment layout, and the two fields people leave blank
The columns that work are activity, hazard, who is at risk, existing controls, a rating, further action, owner and date, in that order, because it reads left to right as the argument it is. Keep one row per hazard rather than bundling, and keep the further action column honest: an empty one means you judged the existing controls sufficient, which is a decision and should be written as one. The two fields left blank most often are the owner of the further action and the review date, and those are the first two an inspector reads, because together they show whether anybody is accountable.
Other questions people ask
Is a risk assessment a legal requirement?
Yes. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer and every self-employed person to make one. What is optional below five employees is the written record, not the assessment.
How many steps in a risk assessment are there?
HSE describes five: identify hazards, decide who might be harmed, evaluate and decide precautions, record the significant findings, and review. The same five apply to a hazardous substance assessment under COSHH, with the substance data added at the evaluation step.
Who is responsible for making sure risk assessments are done?
The employer. Carrying one out can be delegated to a competent person inside or outside the business, but the responsibility for it being done, and being right, stays with the employer.
How often should a risk assessment be reviewed?
There is no fixed interval in the regulations. The trigger is a reason to suspect it is no longer valid or a significant change in what it covers. Many businesses review annually as a discipline, which is sensible but is not the legal test.
How many steps to a hazardous substance risk assessment, and is it a different process?
It follows the same shape as any assessment and adds two substance specific steps, so the sequence people are taught is eight rather than five: identify the substances and gather the safety data, identify who could be exposed and by which route, evaluate the risk including how much and for how long, decide the controls in the hierarchy order, record the assessment, put the controls in place and instruct people, monitor exposure and provide health surveillance where it is required, and review. The two that are easy to skip are the monitoring and the health surveillance, and they are the two that turn up as failures on enforcement.
Is writing a risk assessment something I can do myself?
For most small businesses yes, and the law expects the employer to be able to. You know the work and the premises, which is the hard part; the method is a walk round, a list of hazards in the order they are met, and an honest column for what is already being done. Bring somebody in where the hazard needs measurement or specialist knowledge to judge: asbestos, fire engineering in a complex building, local exhaust ventilation performance, noise and vibration exposure, or an explosive atmosphere. Buying a consultant for a two page assessment usually buys a longer document rather than a safer one.