What is a risk assessment? A guide to the five key steps

Latest figures from the Health and Safety Executive (HSE) show the annual cost of workplace injuries in the UK exceeds £6 billion. While you can’t prevent accidents altogether, identifying and mitigating injury risk can help protect your employees’ safety and wellbeing.

In this article, we look at how to put together a risk assessment which protects your staff and meets your compliance obligations.

Updated: 12.10.26

By Gavin Dearsley

What is a risk assessment in the workplace?

Workplace risk assessments identify hazards and the risk they pose of causing injury or illness. They also involve looking at ways to remove those hazards or reduce the impact of the risks on staff.

In most cases, a risk assessment is essential to keep your business insurance remains valid. If you make a claim and it can be demonstrated that risks weren’t properly assessed or safeguards weren’t put in place, your insurer may reject it.

Is a risk assessment a legal requirement in the UK?

Yes, under the Management of Health and Safety at Work Regulations (1999), employers must protect employees and others from harm. By law, the minimum you must do is:

Identify risks that could cause injury or illness.

Consider the likelihood of injury and how serious it could be.

Take steps to remove the hazard completely or mitigate the risk and its impact.

Legally, a risk assessment must be recorded in writing if you have five or more employees. However, it’s best practice to keep a written record of the assessment even if you have fewer staff. This helps ensure everyone understands their responsibilities for keeping the workplace safe. It also shows that, as an employer, you take your duty of care seriously.

If you employ staff, you must also have employers’ liability insurance, which compensates employees if they’re injured or become ill through work. Although these policies typically cover workplace negligence, employers can be held responsible if a risk assessment is judged inadequate, leading to fines or prosecution.

When will I know if my business needs a risk assessment?

Employers are legally bound to protect employees from harm. Assessing risk is the minimum you must do by law, even if you only have one employee. Risk assessments apply to both onsite and remote working.

Who can carry out a risk assessment?

Risk assessments should be carried out by a ‘competent person’. No formal qualifications are needed, and you can do it yourself if you have the relevant knowledge and experience.

For many micro or small business owners, an assessment and the steps you need to take to minimise risk are relatively simple. The HSE has a helpful checklist of how to choose a competent person.

For larger businesses or complex operations, a competent person may have specific knowledge of health and safety legislation, such as a facilities or building manager. Alternatively, you can outsource the task to a risk management services provider who can help ensure your business is compliant.

The five steps to risk assessment

There are five key steps to a risk assessment:

Step 1: Identify the hazards 

Walk around your workplace and speak to staff to identify hazards. Checking accident logs can also highlight recurring risks and unsafe work practices which should be addressed.

Consider materials used and whether any pose a risk, such as chemicals, flammable materials, or equipment. Buildings and facilities should be in good working order, so it’s also important to consider the overall state of the premises, the tasks staff are required to carry out, and how they are carried out.

Bear in mind that some employees or visitors may be more vulnerable than others. For example, hazards may be different for people with mobility issues, while language barriers could make it harder to understand safety instructions.

Step 2: Assess the risks

When you’ve identified the risks, you’ll need to consider the likelihood of someone being hurt and how serious the injury or illness might be. As part of this, think about who might be hurt (employees, visitors, members of the public) and how.

If you already have precautions in place, consider what else you can do to further control the risks. You should also be clear about who’s responsible for particular actions and when they will be completed.

Always remember how risks might affect anyone you’ve identified as vulnerable and consider how they can be mitigated.

Step 3: Control the risks

You should first try to remove the risks altogether. If that’s not possible, consider how those risks can be minimised using the ‘hierarchy of controls’:

Hierarchy of controls

Control	Definition
Eliminate	Can you remove the hazard altogether? Example: removing a flammable substance.
Substitute	Can you replace the hazard with a safer option? Example: using non-flammable materials instead.
Engineering Controls	What physical protections can you put in place? Example: safety barriers, ventilation system, machine guard.
Administrative controls	Can you change hazardous work practices? Example: additional staff training, altering schedules, reducing shift lengths.
Use of personal protective equipment (PPE)	Ensuring employees have protective equipment for hazards that cannot be avoided. Example: safety glasses, gloves, overalls, hard hats.

Step 4: Record your findings and implement them 

You should record all your findings (remember that if you have five or more employees, this must be done in writing). The HSE provides templates you can use, but you can use your own as long as you cover:

What the hazards are and how likely they are to cause harm.

Who could be hurt and how.

What you’re doing to minimise risks and any action you need to take to reduce risks further (and by when).

Step 5: Review and update 

You should regularly review and update your risk assessment to check it’s still fit for purpose. 

How often should risk assessments be reviewed?

There’s no official rule about how often you should review your risk assessment, but it should be at least annually.

It’s also important to review your risk assessment if:

An accident or near miss occurs.

You increase your workforce.

Move to new premises.

Buy new equipment or machinery.

Change working practices.

Or make any other changes that could impact hazards or risk.

What are the different types of risk assessment?

Risk can be assessed in different ways:

Type of assessment	Assessment description
Qualitative assessment	Based on judgement. Typically, the person identifying and analysing hazards will be experienced and have expertise within their industry.    Risks are labelled and sorted according to the probability of an incident occurring and its impact (for example, high, medium, low).
Quantitative assessment	Risks are prioritised according to data rather than based on experience and judgement.   For example, when a hazard is identified and analysed, it will be given a number based on the likelihood of it happening, and its severity if it were to occur.   Quantitative assessments are generally used in industries where risk must be carefully reviewed, such as manufacturing, engineering, or where chemicals are involved.
Generic assessment	These assessments look at everyday workplace activities. For example, display screen equipment (DSE) risk assessments, accessibility, fire exits, or electrical equipment.
Site-specific assessment	If your business operates at various locations, each assessment should consider any circumstances unique to that site. This could depend on location, the immediate environment, or the equipment used. For example, if you’re overseeing two or three building sites, each one might start with a generic assessment as there will be similar risks across them all. However, one site might be close to a busy road and need a specific assessment to manage the site and regulate traffic.
Dynamic assessment	Dynamic assessments happen on-site and often in real-time. This typically applies to emergency situations or where hazards are unpredictable.

Common examples of specific workplace risk assessments

Some industries and job roles may need additional assessments to fulfil regulatory obligations, including:

Fire risk assessments – this is a legal requirement for all commercial buildings. These assessments must also be recorded in writing.

COSHH (Control of Substances Hazardous to Health) – if your business operations include working with dangerous substances, you must carry out a COSHH risk assessment before work begins. The HSE provides guidance about what’s considered a substance hazardous to health (such as chemicals, dust, fumes).

DSE (Display Screen Equipment) – this covers any worker who uses a screen for work. This includes computers and laptops, as well as CCTV screens and other devices. You can find out more in our guide to DSE risk assessments.

Manual Handling – you must protect employees from the risk of injury if any part of their work involves handling physical loads. This includes lifting, moving, pulling, or pushing. The HSE also has guides and information about manual handling training.

Supporting your business and managing risk

Risk assessments are an intrinsic part of any risk management strategy and help ensure you meet your legal responsibilities as an employer.

From a productivity standpoint, identifying and mitigating hazards can help your business save money by reducing absences for work-related injuries, illness, and stress. Managing risk and prioritising staff welfare also builds trust and can boost morale.

If your organisation is large or your operations are complex, you could benefit by using a risk management service provider. A third-party expert brings a fresh pair of eyes and may spot gaps in safety procedures. Their experience across industries can also mean they can suggest alternatives and improvements to current work practices.

Make an enquiry today

To find out how our risk management service could help your business meet its legal obligations, speak to a member of the team.

Speak to us: 01603 967900