What is a risk assessment?

Risk assessment is an essential part of modern business practice and is a commonly used phrase in meetings and documents. It sounds self-explanatory and uncontroversial: the idea of assessing the risks involved in any given endeavour, in order to control and minimise them, is a sensible one.

The practicalities of exactly how and when a business risk assessment should be carried out are often less well understood and appreciated, however. Risk assessment is just one part of an overall risk management strategy, and creating and implementing such a plan can seem daunting for businesses of any size.

Some even see risk management as merely generating unnecessary paperwork and actually hindering the smooth running of the business. However, when risk management and risk assessment are properly carried out, then nothing could be further from the truth.

What is risk management?

A widely accepted risk management definition is:

the identification, measurement, control and financing of risks that threaten the existence, assets, earnings or personnel of an organisation or the service it provides.

Risk management can be applied to a wide variety of business objectives, but we will focus here on its most common application in the area of workplace health and safety.

What is risk assessment?

Risk assessment is the initial stage of your overall risk management strategy. It involves determining what the risks are and how they are best tackled within a defined situation. The situation is the context of the workplace, the type of work being done, the employees concerned and so on. Establishing the basic situation is the first step, followed by identifying, analysing and prioritising the risks.

How are risks prioritised?

The risks with the most severe potential impact and with the greatest likelihood of happening should be prioritised first. Almost certainly, the most potentially serious risks will be those least likely to happen, while the least serious will be more likely to happen. Nevertheless, both qualities will need to be taken into account when prioritising.

Isn’t this just unnecessary red tape?

Risk assessment may seem like a burden, but it is an important step in reducing the likelihood and impact of business disruption, legal costs, physical injury to employees and members of the public, and damage to your company’s reputation.

Understanding what the risks are is the first step to preventing them. Accurate risk assessment can improve safety, reduce accidents and can also lower your insurance premiums. And even if you are fully insured against an event, surely it is better to take every possible measure to prevent it from happening in the first place.

Is risk assessment a legal requirement?

In the UK, Regulation 3 of the Management of Health & Safety at Work Regulations states that any employer or self-employed person is required to complete an adequate risk assessment. If you employ fewer than five people, you don’t have to keep documentation. However, you must be able to prove that a health and safety procedure is in place, so it may be helpful to create a document regardless. The Health & Safety Executive (HSE) can provide information and resources.

It is especially important to take appropriate fire safety measures, and some other risks also have specific control measures required by the law. These include working with particular machinery or chemicals, with electricity or at height. In some cases, a permit to work or a licence for risky activities may also be needed.

Read more: Guide to DSE risk assessments

Who can carry out a risk assessment?

Anyone with a basic level of competence and knowledge can carry out a risk assessment. Responsibility will always rest with the employer, so while risk assessment tasks can be delegated, it is worth bearing this in mind. You may want to bring in a consultant or other specialists to help you. Alan Boswell Group has a dedicated risk management team with years of experience in assessing and controlling workplace hazards.

How should I begin?

Start your risk assessment by walking around the workplace, making notes on the possible risks that you observe. Ask your employees what the main risks they notice or encounter are while doing their jobs. It’s important to consider individual workers, as different people will find different risks in the same situation, depending on their age, gender, disabilities and conditions, such as allergies or intolerances and whether they are pregnant or not. You must also take into account the risks faced — and posed by — members of the public, maintenance workers, contractors and other temporary visitors.

It’s important to consider individual workers, as different people will find different risks in the same situation

Remember, if employees provide input into the process, they are more likely to abide by the assessment.

How can I assess every possible risk?

It isn’t possible to assess and control every risk in the workplace. Some are known as acceptable risks, where the cost of protecting against them would be more than the cost of them happening. There are also what are known as one-in-a-million risks, where the consequences may be serious but the likelihood of them happening is minuscule.

Once again, concentrate on those risks that are both probable and major and work your way down the list until you reach those that are relatively trivial, or serious. Bear in mind that accurate risk assessment can be subjective, and opposing opinions should be listened to when making a decision as to whether a risk needs to be acted upon.

How often do I need to undertake a risk assessment?

Businesses and workplaces are ever-changing as the business grows and employees come and go. For this reason, risk assessments should be carried out on a regular basis, and especially whenever a change occurs, such as moving to new premises, taking on new equipment or staff and so on.

There are no fixed rules on how to carry out a risk assessment. Different industries will have different recommended procedures, while different measures apply to specific disciplines, for instance, health and safety, IT security, environmental risk assessment, project management and so on.

Generally, however, the process should involve identifying, evaluating, controlling, recording and reviewing regularly. All significant findings should be noted down, and reasonable measures taken to deal with any risks that you could reasonably be expected to know about or anticipate. You should aim to reduce your risks to a level that is as low as reasonably practicable (ALARP).

For more information and assistance in conducting a risk assessment, our Risk Management team can provide specialist guidance.