A risk assessment is not a form. It is the process an employer goes through to work out what in their work could hurt somebody, decide whether what they already do is enough, and write down what they found. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to employees and to anyone else affected by the work, and it is the duty almost every other health and safety obligation hangs off.
What the law actually asks for
Regulation 3(1) requires a suitable and sufficient assessment of the risks to employees at work and to people not employed by you who are affected by what you do. Suitable and sufficient is doing a lot of work in that phrase. It means proportionate to the risk: a small office does not need what a demolition contractor needs, and an assessment that lists hazards nobody in the business recognises is neither suitable nor sufficient, whatever it cost.
The five steps, and why the order matters
HSE's method is identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record the significant findings, then review. The evaluation step is the one businesses skip. Listing hazards is easy and listing controls is easy; deciding whether the controls you already have actually reduce that risk to an acceptable level is the judgement that makes the document worth anything.
Who has to do it, and who can
The duty is the employer's and it cannot be given away. The person who carries it out has to be competent, which in regulation 7 terms means having sufficient training, knowledge, experience and other qualities. That can be the owner of a small business who knows the work, and often should be, because the person who understands the job usually sees more than a visitor with a template.
Writing it down, and reviewing it
An employer with five or more employees must record the significant findings. Below that the assessment is still required and only the record is optional, which surprises people. Review is triggered by reason to suspect it is no longer valid or by a significant change: new equipment, a new process, a new building, an accident, or a near miss that showed the assessment was wrong.
What it costs to have one written
A consultant's fee for a general workplace risk assessment moves on how many premises are involved, how many separate activities need their own assessment, and whether a site visit is required. What you are paying for is the evaluation and the defensibility, not the typing. A generic document bought for a fixed price and never matched to the work is the cheapest way to have nothing.
Questions people ask about what is a risk assessment
Is a risk assessment a legal requirement?
Yes. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer and every self-employed person to make one. What is optional below five employees is the written record, not the assessment.
How many steps are there in a risk assessment?
HSE describes five: identify hazards, decide who might be harmed, evaluate and decide precautions, record the significant findings, and review. The same five apply to a hazardous substance assessment under COSHH, with the substance data added at the evaluation step.
Who is responsible for making sure risk assessments are done?
The employer. Carrying one out can be delegated to a competent person inside or outside the business, but the responsibility for it being done, and being right, stays with the employer.
How often should a risk assessment be reviewed?
There is no fixed interval in the regulations. The trigger is a reason to suspect it is no longer valid or a significant change in what it covers. Many businesses review annually as a discipline, which is sensible but is not the legal test.