How to do a risk assessment: the five steps
Last reviewed 15 September 2026
HSE describes risk assessment as five steps. They are not a legal form of words, but they are what inspectors, insurers and clients recognise, and the template follows them.
- Identify the hazards. Walk around the workplace and look at what could cause harm. Ask the people who do the job, check accident and near miss records, read manufacturers' instructions and data sheets. Think about long term harm as well as accidents: noise, vibration, dust, stress, repetitive work.
- Decide who might be harmed and how. Groups, not names: staff who do the task, others nearby, cleaners, contractors, visitors, the public. Say how each group could be harmed. Some people need particular thought: new and young workers, expectant mothers, lone workers, people with disabilities, and anyone who does not share a language with the rest of the team.
- Evaluate the risks and decide on precautions. For each hazard, look at what you already do and whether it is enough. The law asks for everything reasonably practicable, which means the cost and effort must be weighed against the risk. Try to remove the hazard first, then reduce it, then protect people from it, then equip them. A rating of likelihood times severity helps you compare hazards and show that controls reduce the risk.
- Record your findings and implement them. If you have five or more employees you must write down the significant findings. A good record shows a proper check was made, who could be affected, that the obvious hazards were dealt with, that the precautions are reasonable and the remaining risk is low, and that staff were involved. Then do what the record says: the further action list with an owner and a date is where most assessments succeed or fail.
- Review and update. Workplaces change: new equipment, new staff, new products, a different way of working. Review the assessment at least once a year, and whenever something changes or after an accident or near miss. Keep the old revision so you can show what changed and when.
What the law requires
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer and self employed person to make a suitable and sufficient assessment of the risks to their employees and to anyone else affected by their work. Where there are five or more employees the significant findings must be recorded, and the assessment must be reviewed if there is reason to think it is no longer valid or there has been a significant change.
The duty sits on top of section 2 of the Health and Safety at Work etc. Act 1974, which requires employers to ensure the health, safety and welfare of employees so far as is reasonably practicable. The assessment is how you work out what reasonably practicable means for your business. Some hazards have their own regulations with their own assessment duties: hazardous substances (COSHH), fire, manual handling, display screen equipment, noise, vibration and asbestos among them. A general risk assessment records that those specific assessments exist and points to them.
Suitable and sufficient
The assessment does not have to be perfect, and it does not have to cover every trivial risk. It has to show that a proper check was made, that you asked who might be affected, that you dealt with the significant hazards taking account of how many people could be affected, that the precautions are reasonable and the remaining risk is low, and that you involved your staff. A short assessment that does those things is better than a long one that does not.
Risk assessment or method statement?
A risk assessment says what the hazards are and how they are controlled. A method statement says how the job will be done, step by step, with the controls built into the sequence. Construction clients usually ask for both together, as RAMS. Start with the risk assessment; the method statement is written from it.