HS Easy practical guide
How to Carry Out a Risk Assessment: A Simple 5-Step Guide
A practical five-step guide to carrying out a workplace risk assessment, identifying hazards, selecting controls and keeping the assessment under review.
The short answer
Carry out a risk assessment by identifying hazards, deciding who could be harmed, evaluating the risk, recording proportionate controls, and reviewing the assessment when work, people, equipment or conditions change.
A risk assessment is a structured way to look at what could cause harm during work and decide how to control it. It should reflect the real task, workplace and people involved. Use this five-step process for routine work, changing activities and higher-risk tasks. The person carrying out the assessment should have enough knowledge and experience to assess the work properly. Specialist advice may be needed for complex or higher-risk activities.
1. Identify the hazards
Walk the job and speak to the people who do it. Consider equipment, substances, vehicles, work at height, energy sources, the work area and changing conditions. Review previous incidents, near misses, inspections and manufacturer information.
- Observe routine work, cleaning, maintenance and unusual tasks.
- For mobile plant, consider overturning, falling objects, blind spots, moving parts and overhead power lines.
- For manual handling, consider the task, load, individual and environment, including size, shape, weight and stability.
2. Decide who might be harmed and how
Identify everyone who could be affected, not only the person doing the task. Include employees, contractors, visitors, delivery drivers and people working nearby. State the likely harm clearly, such as a fall, crush injury, respiratory illness or hearing damage.
- Consider people with less experience, new starters and temporary workers.
- Consider nearby workers who could be exposed to dust or moving vehicles.
- Record how each group could be harmed by each hazard.
3. Evaluate the risk and choose controls
Consider how likely harm is and how serious it could be, using your organisation's risk-scoring method where one exists. Start by removing the hazard or using a safer option. Do not rely on PPE where a stronger control is reasonably practicable.
- Use elimination or substitution before engineering controls, procedures and PPE.
- Choose controls that suit the task and check they work in practice.
4. Record findings and put controls in place
Record significant hazards, who may be harmed, existing controls, further actions, owners and due dates. Brief workers and check controls are in place.
- Make actions specific, for example: install local exhaust ventilation.
- Record checks required, such as pre-start equipment checks.
- If you employ five or more people, you must record the significant findings.
5. Review and update the assessment
Review after incidents, near misses, changes to work, equipment, substances or conditions, or when controls are ineffective.
- Check controls in practice, not only on paper.
- Use incident findings to improve the assessment.
- Set a review date, but review sooner if things change.
Key takeaways
A good risk assessment is a working control document, not a one-off form. Base it on the actual job, involve the people affected and select controls that reduce risk at source where possible. Record clear actions, complete them, and revisit the assessment whenever work or conditions change.
Frequently asked questions
What are the five steps of a risk assessment?
Identify hazards; decide who might be harmed and how; evaluate the risk and choose controls; record findings and implement controls; review and update the assessment.
Who should be involved in a risk assessment?
The person leading it should involve workers who know the task, supervisors and others affected by the work. Specialist or competent-person input may be needed for complex or higher-risk activities.
When should a risk assessment be reviewed?
Review it after incidents, near misses, changes to tasks, equipment, substances, people or workplace conditions, or where controls are ineffective. A planned review date can help, but should not delay an earlier review.
Is PPE enough to control a risk?
PPE should not be the only control where the hazard can be removed, substituted, isolated or controlled by equipment or safer methods. PPE may still be needed as part of a wider set of controls.
Do I need to write down a risk assessment?
If you employ five or more people, you must record the significant findings of your risk assessment. Smaller businesses may still find it useful to keep a written record.
Related HS Easy resources
Continue with HS Easy
Build, review, version and export Risk Assessments and RAMS in the HS Easy digital module.
Download the printable PDF guide
General information only. Review current HSE guidance, your own procedures and the conditions at your workplace.