The 5 steps to risk assessment

The worked example on this page is the office risk assessment. This example covers a small company office of fourteen staff on the first floor of a shared building.

Step 1: identify the hazards

A hazard is anything that could cause harm: a wet floor, a ladder, a chemical, a heavy box, a trailing cable, a workload that cannot be done in the hours. Look for the things that could cause real harm, not every trivial risk. HSE suggests looking at:

• how people work, and how plant and equipment are used;
• what chemicals and substances are used;
• what safe or unsafe work practices exist;
• the general state of the premises.

Walk around and watch the work as it is actually done. Ask the people who do it: they know where the problems are. Check accident and ill health records, manufacturers' instructions and safety data sheets. Think about work that is not done every day, such as maintenance, cleaning and deliveries, and about harm that builds up slowly, such as back pain, dermatitis, noise and stress.

Step 2: decide who might be harmed and how

For each hazard, write down the groups of people at risk, not their names, and how they could be hurt. Staff who do the work come first, but think about everyone else too: people working nearby, cleaners, contractors, visitors, delivery drivers and members of the public.

Some people need particular thought: new and young workers, new and expectant mothers, lone workers, people with a disability, and anyone who does not share a first language with the rest of the team. Where one of them is at greater risk, say so in the assessment and say what is done about it.

Step 3: evaluate the risks and decide on precautions

For each hazard, decide how likely harm is and how serious it could be, look at what you already do, and decide whether more is needed. HSE's current guidance splits this into two parts, assessing the risk and controlling it, but the work is the same.

You are not expected to remove every risk. You are expected to do everything reasonably practicable, which means weighing the level of risk against the cost, time and effort of controlling it. Work down the order HSE gives:

1. remove the hazard altogether if you can;
2. redesign the job, or replace the material, machine or process with a safer one;
3. organise the work to reduce how much people are exposed;
4. put practical measures in place so the work is done safely;
5. provide personal protective equipment, and make sure it is worn.

Rating the risk: the 5x5 risk matrix

A 5x5 risk matrix scores likelihood from 1 to 5 and severity from 1 to 5, and multiplies them. The score is out of 25. Rate each hazard twice: before the controls, to show how serious it is, and after them, to show what is left. HSE does not require a matrix, but it makes ratings consistent from one assessor to the next and shows on paper that the controls made a difference.

Step 4: record your findings and implement them

If you employ five or more people, the law requires you to record the significant findings: the hazards, who might be harmed and how, and what you are doing to control the risks. With fewer than five you do not have to write it down, but most businesses do, because the record is the evidence when an inspector, an insurer or a client asks.

The record does not need to be long. It needs to show that a proper check was made, that you asked who might be affected, that the significant hazards were dealt with, that the precautions are reasonable and the remaining risk is low, and that your staff were involved. Then do what it says. Anything not yet in place goes on an action list with an owner and a date, and the list is where most assessments succeed or fail. HSE's warning is plain: the paperwork matters less than controlling the risks in practice.

Step 5: review the assessment and update it

Check that the controls are actually working, and review the assessment whenever there is reason to think it no longer fits:

• new equipment, substances, processes or premises;
• new staff, especially young workers or someone with particular needs;
• a problem raised by the people doing the work;
• an accident, a case of ill health or a near miss.

HSE does not set a fixed interval, but most businesses put a review date a year ahead so it does not drift. Keep the old version when you update it, so you can show what changed and when. The office example was assessed on 15 September 2026 with its next review set for 15 September 2027.

Two versions of the five steps

HSE's old leaflet, INDG163 “Five steps to risk assessment”, has been withdrawn and replaced by web guidance that words the steps differently. Both describe the same process, and inspectors recognise either.

What the law requires

Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to their employees and to anyone else affected by their work, to record the significant findings where there are five or more employees, and to review the assessment when it may no longer be valid. The five steps are the accepted way of doing that. Some hazards have their own assessment under their own regulations: hazardous substances under COSHH, and fire under the Fire Safety Order, which needs a separate fire risk assessment.

Sources

• HSE, Risk assessment: steps needed to manage risk
• HSE, Managing risks and risk assessment at work (replaces INDG163)
• Management of Health and Safety at Work Regulations 1999, regulation 3