In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999 sets no universal calendar interval. It requires review where the assessment may no longer be valid or significant change has occurred. Planned checks should also establish that controls continue to work; specialist rules may add requirements.
Online guidance on this topic is full of confident assertions that risk assessments should be reviewed annually, every two years, or at some other fixed interval. These are conventions adopted by individual employers or industry bodies — not legal requirements. The actual legal position is more flexible than that, and understanding it properly is the difference between a routine compliance exercise and a useful safety management practice.
Why there’s no annual requirement
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 sets out the review duty. Subsection (3) requires the employer to review the assessment if there is reason to suspect that it’s no longer valid, or there’s been a significant change in the matters to which it relates. The regulation doesn’t specify a time interval, and the absence isn’t an oversight — workplaces vary so much in their rate of change that a single statutory interval wouldn’t make sense.
A small office that hasn’t changed its layout, staff, equipment or work pattern in two years probably doesn’t need a fundamentally new assessment. A construction site changes substantially every few weeks and needs continuous review. A hospital ward sits in between. Tying the duty to a calendar would be either over-prescriptive for the static workplace or under-prescriptive for the dynamic one.
The HSE has been consistent on this. Its published guidance — including the managing risks pages on its website — refers to “regular” review without specifying a fixed interval, and lists the substantive triggers that should drive review.
The five review triggers
In practice, five triggers should prompt review of any risk assessment.
Significant change in the work, the workplace or the workforce
New equipment, new processes, new materials, new layouts, new shift patterns, the introduction of a substantial new product line, a major refurbishment, a change in management arrangements. Any change that materially affects what people do, how they do it, or where they do it triggers review of the relevant assessment.
Reason to suspect the assessment is no longer valid
This is broader than significant change. It covers situations where the assessment hasn’t been formally invalidated but evidence suggests it may not be working — controls that look good on paper but aren’t being followed in practice, hazards identified but not visibly addressed, worker concerns that aren’t reflected in the document.
Incident or near-miss
An accident, near miss or report of work-related ill health should prompt consideration of whether the assessment and controls remain adequate. Investigate the circumstances rather than assume that every incident proves the same underlying failure.
Monitoring results indicating the controls aren’t working
Some assessments include ongoing monitoring — air quality measurements for COSHH, temperature monitoring for legionella, absence patterns for stress, inspection records for working at height equipment. Where monitoring shows that controls aren’t achieving the expected outcomes, the underlying assessment needs revisiting.
Time elapsed since the last review, considered as good practice
Choose a review schedule that reflects the risks and how quickly conditions can change. Regular checks can identify gradual changes before they become serious. An annual diary reminder may help in some workplaces, but it is neither a universal interval nor a substitute for prompt review after a trigger.
Vertical-specific timelines
The following are review considerations for different hazards. They should be used to set a suitable local schedule, rather than as fixed intervals for every workplace.
Fire risk assessments in England and Wales must be reviewed regularly to remain up to date, particularly when they may no longer be valid or significant change occurs. Consider the premises, people, fire precautions and findings of checks. Do not assume that waiting twelve months is appropriate; Scotland and Northern Ireland have separate legislation.
Review legionella risks regularly and when circumstances change, including water-system alterations, changes in use, new risk information or ineffective controls. HSE does not prescribe a universal two-year assessment interval. Routine temperature checks and cleaning have their own control-scheme frequencies.
Review COSHH assessments when substances or processes change, exposure information changes, monitoring suggests inadequate control or there is another reason to doubt validity. Set review arrangements appropriate to the hazardous work.
Review DSE assessments when a user, workstation or way of working changes, or pain or discomfort is reported. HSE does not set a universal two-year refresh interval for office workstations.
Manual handling is reviewed when tasks change, new equipment is introduced, or there’s evidence of musculoskeletal disorder among the workforce.
For work-related stress, monitor action plans with workers and review whether changes are effective. Set follow-up times appropriate to the situation; organisational surveys and individual support discussions serve different purposes.
Review work-at-height arrangements as the task, equipment, site or conditions change. Equipment inspections and pre-use checks are separate from the risk assessment review and must follow the applicable requirements.
Documenting a review
A review can confirm that an assessment remains appropriate, but it must examine relevant changes and the effectiveness of controls. Updating a date without checking the actual work is not a meaningful review.
A useful pattern for documenting a “no significant change” review is something like:
“Reviewed [date] by [name and role]. No significant changes to work, workplace, workforce or controls since last review. No reported incidents. Assessment remains valid. Next review by [date].”
Such a note can record a review only if it accurately describes the checks made and conclusions reached. A signature or standard wording does not itself establish legal compliance.
A review that identifies needed changes generates an updated version of the assessment. The change log — what changed, why, when, by whom — is part of the documentation. The previous version isn’t deleted; it’s archived with the date of supersession.
Where the assessment is in a digital system, the system typically captures these elements automatically. Where it’s a paper or document-based assessment, the review record needs to be deliberate.
Setting a practical review schedule
A planned review date helps keep assessments under attention. The interval should reflect the work, the reliability of controls and information from workers and monitoring.
A contract, insurer or certification scheme may impose its own review expectations. Check the actual terms; there is no general rule that every insurer requires a document dated within twelve months.
Coordinate assessment reviews with relevant inspections and maintenance where useful, but do not confuse the duties. Fire alarms, lifting equipment and other systems have their own checking requirements, which are not universally annual.
Staff, equipment, materials and layouts can change gradually. Checks should look for this drift as well as obvious major changes, and should confirm that existing precautions are still effective.
Use a proportionate planned schedule together with prompt review whenever the assessment may no longer be valid or significant change occurs. Record actions, responsibilities and deadlines, then check completion.
Where this connects in the cluster
The review duty connects every vertical. Different categories of risk attract different practical cadences, but the underlying legal framework is the same regulation 3 duty — covered in our introduction to risk assessment and applied across the cluster.
The competence to recognise when an assessment needs review is itself part of the competent person’s role. The same competence framework covered on our who can carry out a risk assessment page applies — the assessor doesn’t just write the assessment, they maintain it.
For organisations building in-house competence in maintaining assessments routinely — rather than commissioning fresh external work each year — formal Risk Assessment Training covers both the initial assessment method and the ongoing maintenance discipline.
Frequently asked questions
Is there a legal requirement to review a risk assessment every 12 months?
No universal twelve-month interval is set by the general Management Regulations in Great Britain. Review when the assessment may no longer be valid or significant change occurs, and check that controls remain effective. Other specific duties or contractual requirements may also apply.
What counts as a significant change requiring review?
New equipment, new processes, new materials, new layouts, new shift patterns, new staff in different roles, a change of premises, regulatory change affecting the activity, an incident or near-miss, or any other change that materially affects what people do or how they do it. The test is whether the change is likely to alter the hazards, the people at risk, or the adequacy of the controls.
Do I need to redo the whole assessment or can I just review it?
A full rewrite is not always needed. Check the relevant work, changes and controls, then record any revised findings and actions. A short review is only sufficient where the checks genuinely support that conclusion.
What’s the maximum gap between reviews under UK law?
The general Management Regulations specify review triggers rather than a maximum number of months. That does not justify neglecting checks: the employer must ensure the assessment and controls remain suitable, and specialist requirements may apply.
How often should a fire risk assessment be reviewed?
Under the Fire Safety Order in England and Wales, review regularly so the assessment stays up to date, particularly when it may no longer be valid or there is significant change. The appropriate schedule depends on the premises and risks; annual review is not a universal statutory rule.
Is there a two-year review requirement for legionella?
No. Some commercial sources and online guides cite “every two years” as a legal requirement for legionella risk assessment review. This is convention, not law. ACOP L8 requires review when there’s reason to suspect the assessment is no longer valid or when the system has changed.
Related guides
- Who can carry out a risk assessment? The competence question explained
- Risk assessment examples: three worked examples for UK workplaces
- Working from home risk assessment: the duty for home and hybrid workers
Sources & references
- Management Regulations 1999, assessment review duty
- HSE — Reviewing controls
- Fire Safety Order, article 9
- HSE — Managing legionella risks
- HSE — DSE workstation assessments
- HSE — COSHH assessment
Build in-house competence to write and maintain your own risk assessments.
Explore the Risk Assessment Training course →
Mark writes about workplace health & safety, risk assessment and accredited online training for Risk Assessment Training, part of Online CPD Academy.