Do you have a current risk assessment for your work?
Quick check to point you in the right direction
Why risk assessment matters
Almost every other health and safety duty you have starts here. You cannot decide what training people need, what equipment to buy, or what precautions to take until you have worked out what could actually go wrong.
That is what a risk assessment is: a careful look at what could cause harm, so you can weigh up whether you have taken enough precautions. It is not a form to be completed and filed.
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to employees and to anyone else affected by the work. The same duty applies to the self-employed where their work creates a risk to others.
Who needs a risk assessment?
If you employ anyone, you need one. If you are self-employed and your work could harm someone else, you need one.
- Employers of any size — including those with one employee
- The self-employed — where the work creates a risk to others
- Landlords — for the parts of a property you control and for the work you arrange
- Trustees and committees — village halls, churches, community groups
- Anyone controlling premises used by people who are not their employees
The five-employee threshold is often misunderstood. It does not decide whether you must assess — that duty applies to everyone. It decides whether you must record the significant findings in writing.
The five steps
The HSE's approach has been consistent for years, and it is still the clearest way to work through it.
The five steps to risk assessment
0 of 5 completeThe five steps to risk assessment
0/5Step three is where the work actually happens, and it is the step most often skipped. Listing hazards without deciding what you are going to do about them is not an assessment.
Read the detail on each step in our guide to the five steps to risk assessment.
What "suitable and sufficient" means
This is the legal standard, and it is the one that decides whether your assessment holds up.
An assessment is suitable and sufficient if it:
- Identifies the significant risks, ignoring the trivial ones
- Reflects what actually happens in your workplace, not what the template assumed
- Identifies who is at risk, including people who are not your employees
- Is proportionate to the risk — a small low-risk office does not need what a construction site needs
- Enables you to identify and prioritise the measures you need to take
- Remains valid for a reasonable period
A generic template downloaded and filed without visiting the work is the single most common reason assessments fail this test. The document exists, but it does not describe your workplace, so it cannot identify your risks.
Our guide on what suitable and sufficient means in practice works through how this is judged.
The hierarchy of controls
Once you know the risk, the law does not leave the choice of control entirely to you. There is an order, and personal protective equipment sits at the bottom of it for a reason.
Working down the hierarchy
| Level | What it means | Example |
|---|---|---|
| 1. Eliminate | Remove the hazard completely | Stop using a hazardous chemical |
| 2. Substitute | Replace it with something safer | Swap a solvent for a water-based product |
| 3. Engineering controls | Isolate people from the hazard | Local exhaust ventilation, machine guarding |
| 4. Administrative controls | Change how people work | Job rotation, permits to work, training |
| 5. PPE | Protect the individual | Gloves, respirators, hearing protection |
PPE is the last resort, not the first answer. It protects only the person wearing it, only when it is worn, and only when it fits and is maintained. If your assessment reaches for PPE before considering the levels above it, expect that to be challenged.
See the hierarchy of controls explained for how to apply this to a real assessment.
When must it be written down?
If you have five or more employees, you must record the significant findings. Below that, you do not have to — but it is usually worth it.
Fewer than 5 employees
- •No legal duty to record it
- •You must still carry out the assessment
- •Nothing to show an inspector, a client, or an insurer
- •Nothing to hand a new starter
5 or more employees
- •Significant findings must be recorded
- •Applies to the whole business, not per site
- •Counts all employees, including part-time
- •Written record is the evidence of compliance
Note that the count is of employees, not of people on site. Agency workers, contractors and volunteers are treated differently — our guide on whether you need a written risk assessment sets out how the counting works.
How often should you review it?
There is no legal renewal date. The duty is to review when:
- The work, equipment, substances or premises change significantly
- There has been an accident or near miss that the assessment did not anticipate
- New information emerges about a hazard
- There is any other reason to suspect it is no longer valid
Many businesses review annually as a matter of routine. That is a sensible habit, but it is not the legal test — a change to the work triggers a review the day it happens, not at the next anniversary.
Related HSE guidance
The Approved Code of Practice for the Management Regulations carries special legal status: follow it and you are doing enough, depart from it and you must show you have done something equally effective.
- L21 — Management of Health and Safety at Work — the ACOP for the risk assessment duty itself
- L64 — Safety signs and signals
- L73 — Reporting injuries, diseases and dangerous occurrences
- L74 — First aid at work
Common mistakes
Copying a template without visiting the work. The most common failure by a distance. A template is a prompt, not an assessment.
Assessing the task, not the person. A lift that is safe for one worker may not be for another. New and expectant mothers, young workers and people with health conditions need specific consideration.
Stopping at the hazard list. Identifying that something could cause harm is step one of five.
Filing it and forgetting it. An assessment that describes work you no longer do is not evidence of compliance — it is evidence you have not looked.
Assuming fewer than five employees means nothing is needed. It only removes the duty to write it down.