Guide

What is a risk assessment?

Risk assessment is the single document every accreditation scheme, main contractor and HSE inspector expects to see. Here is what it is and how it is built.

The short answer

A risk assessment is the structured process of identifying the hazards in a task, deciding who could be harmed and how, and putting proportionate controls in place to reduce the risk. In UK law the duty to carry out a suitable and sufficient risk assessment sits in Regulation 3 of the Management of Health and Safety at Work Regulations 1999, made under the Health and Safety at Work etc. Act 1974. The Health and Safety Executive sets out a five-step method for doing it.

The HSE five steps

1. Identify the hazards. Look at the work and note anything with the potential to cause harm, from working at height to hazardous substances.
2. Decide who might be harmed and how. Consider employees, subcontractors, visitors and the public, and any groups at greater risk.
3. Evaluate the risks and decide on precautions. Judge how likely and how serious the harm is, then decide the control measures using the hierarchy of control.
4. Record your findings and implement them. Write down the significant findings and actually put the controls in place, not just list them.
5. Review and update. Revisit the assessment when the work changes, after an incident, and periodically.

This is the method described in the HSE guidance leaflet INDG163, and it is the reference framework used across every UK workplace.

Do you have to write it down?

If you employ five or more people you must record the significant findings in writing. If you employ fewer than five, recording is recommended rather than required, but a written assessment is the evidence a buyer or assessor will ask for, so in practice most contractors write one anyway. If you are self-employed and your work could put yourself or others at risk, the same duty to assess applies.

What makes a risk assessment suitable and sufficient

The phrase suitable and sufficient is the legal test. It means the assessment matches the real work, identifies the significant hazards rather than every trivial one, and leads to controls that are actually put in place. The common failing is the opposite: a generic template downloaded and never adapted, written by someone who does not do the job, listing actions that are never implemented. An assessment that describes work you do not do, or misses work you do, is the version that gets a CHAS application referred.

Related guides

Read what a method statement is, how a risk assessment differs from a method statement, and the electrician risk assessment guide.

Common questions

What is a risk assessment in simple terms?

It is a structured check of a task that identifies the hazards, decides who could be harmed and how, and sets out the control measures needed to reduce the risk. UK law requires it under Regulation 3 of the Management of Health and Safety at Work Regulations 1999.

What are the five steps of a risk assessment?

Identify the hazards; decide who might be harmed and how; evaluate the risks and decide on precautions; record your findings and implement them; then review and update. This is the HSE method set out in guidance leaflet INDG163.

Do I legally have to write a risk assessment down?

If you employ five or more people you must record the significant findings in writing. With fewer than five it is recommended rather than required, but a written assessment is what buyers and accreditation assessors ask to see.

What does suitable and sufficient mean?

It is the legal standard for a risk assessment: it must match the actual work, identify the significant hazards, and lead to controls that are genuinely put in place. A generic, unadapted template usually fails this test.