HSE describes risk management as a step-by-step process: identify hazards, assess risks, control risks, record findings and review controls. The five-step approach below explains these tasks for workplaces in Great Britain; specialist risks may require additional methods and legal requirements.
HSE’s current online guidance is the reference for the process. Older publications used slightly different headings, but the practical purpose remains to identify significant risks and implement effective precautions. The headings on this page are a way to organise the work, not a legally prescribed form.
This page walks through each step, explains where most assessments fall short, and uses an office worked example to tie it together. For the broader picture of what a risk assessment is and why the law requires one, see our introduction to risk assessment.
Step 1: Identify the hazards
The first step is to work out what in your workplace could cause harm. A hazard is anything with the potential to harm someone — physical, chemical, biological, ergonomic or psychosocial.
Start with the work as it is actually done. A generic list can prompt questions, but it cannot establish which hazards matter at your workplace or whether your controls work.
Three methods work well in combination. A walkthrough — physically walking the workplace and noting what you see. Cables across walkways, missing guards on equipment, blocked fire exits, unsafe storage. Take photographs. Worker consultation — the people doing the work usually know where the near-misses happen. Ask them. They have information the walkthrough won’t reveal. Records review — accident books, near-miss reports, sickness absence patterns, RIDDOR submissions if you’ve made any, occupational health referrals. Past incidents indicate hazards that have already caused harm.
Include non-routine work such as maintenance and cleaning, where normal arrangements may change. Also consider health risks from noise, vibration, dust, repetitive work and stress, which may develop over time.
Step 2: Decide who might be harmed and how
For each hazard, think about who could actually be hurt by it. The “who” matters because different groups need different protection — and missing a group is one of the most common failures.
The obvious group is your own employees. Within that, certain workers need particular attention: new and inexperienced staff who don’t yet know the workplace, pregnant workers, young workers whose physical and risk-perception development isn’t complete, lone workers who don’t have the safety net of colleagues nearby, and workers with disabilities or health conditions that affect their exposure.
Beyond your employees, consider contractors, agency workers, visitors, customers, members of the public near the premises, delivery drivers, and anyone else who might be present. The duty in the Health and Safety at Work etc. Act 1974 extends to “people who are not your employees but who may be affected by your work” — which is broader than most people realise.
The “how” is equally important. Specify the actual harm mechanism, not just “could get hurt”. Slipping on a wet floor and falling onto the concrete steps is useful. Slips, trips and falls is generic and doesn’t help anyone decide on controls.
Step 3: Evaluate the risks and decide on precautions
Evaluate whether your precautions meet specific legal requirements and reduce risks so far as reasonably practicable. Cost alone does not justify leaving a risk uncontrolled: the sacrifice would need to be grossly disproportionate to the risk reduction.
A risk assessment matrix can help compare likelihood and severity. It is optional for general workplace assessments, and a low numerical score never overrides a legal requirement or necessary precaution.
The bigger decision at this step is which controls to apply. The hierarchy of control sets the order. It’s not a suggestion; it’s an expectation built into the regulations.
Eliminate the hazard if you can. Don’t use the chemical. Don’t work at height. Don’t have the trailing lead. Elimination is the most effective control because it removes the risk entirely.
Substitute a less hazardous material or process where suitable, while checking any new risks. For example, a less hazardous coating may reduce solvent exposure; handling aids may reduce carrying but still require assessment of pushing and pulling.
Engineering controls physically separate people from the hazard. Machine guards, local exhaust ventilation, edge protection, soundproofing, automation.
Administrative controls change how people work — training, procedures, permit-to-work systems, signage, supervision, job rotation to reduce exposure time.
PPE comes last. Personal protective equipment depends on the user wearing it correctly, on it being maintained, and on it actually being suitable for the hazard. It only protects the wearer. And it’s the least reliable control because all the previous options have addressed the hazard itself; PPE only manages the consequences.
PPE isn’t bad — sometimes it’s necessary. But assessments that jump straight to “wear safety glasses” without considering whether the eye hazard could be engineered out are working at the wrong end of the hierarchy.
Step 4: Record your findings and implement them
Employers with five or more employees must record significant findings under the general Management Regulations. This threshold does not remove separate recording requirements, such as fire risk assessments for all responsible persons in England and Wales. In every case, the controls must be implemented.
The HSE publishes a free assessment template covering the common columns: hazard, who might be harmed and how, what you’re already doing, what further action you need to take, who’s going to do it, and by when. You don’t have to use that exact form — any structure that captures the same information works — but it’s a sensible starting point. We cover what completed assessments look like in our page on risk assessment examples.
Implementation is where assessments most often die. The document gets filed, the actions get assigned, and nothing happens. The discipline that distinguishes good safety management from box-ticking is the routine follow-through on the action column — checking that the new guard was fitted, that the training was delivered, that the SOP was updated, by the date promised.
Step 5: Review your assessment and update if necessary
The assessment isn’t a one-off document. Regulation 3 of the 1999 regulations requires it to be reviewed when there’s reason to believe it’s no longer valid, or when significant change has taken place. We cover this in detail on our page on how often a risk assessment should be reviewed, but the triggers are: new equipment, new processes, new staff, layout changes, accidents or near-misses, regulatory changes, and the passage of time.
There is no universal annual interval under regulation 3. Set checks and review dates appropriate to the risks, and review promptly when controls may be ineffective or circumstances change. A scheduled annual date is not a reason to postpone a necessary review.
A review is not always a full rewrite. Often it’s a quick check that confirms nothing material has changed and updates the review date. That’s a valid review and worth recording.
The hierarchy of control, expanded
The hierarchy of control deserves more than a single paragraph because it’s the most frequently misapplied principle in workplace safety.
Well-designed engineering controls can reduce reliance on individual actions. They still need correct selection, use, maintenance and checking: a removed or defective guard provides no reliable protection. Procedures, training and supervision remain important alongside physical controls.
The reason PPE is last is sharper still. PPE depends on three things being right simultaneously: the equipment being correct for the hazard, the user wearing it properly, and the user wearing it every time. Any of those failing means the worker is exposed.
For silica-generating work, first avoid or reduce dust generation and use suitable water suppression or extraction. Respiratory protection may also be required. Tight-fitting RPE needs a suitable face-fit test when selected, with a user seal check each time it is put on; fit testing is not simply a start-of-shift check. Do not assume job rotation or an FFP 3 mask alone adequately controls every task.
Work through the appropriate control hierarchy and explain the precautions selected. PPE may be needed alongside engineering measures; its suitability, fit, maintenance and use must be assessed.
Worked example: a small open-plan office
Consider a small accountancy practice with eight staff in an open-plan office. The general risk assessment runs through the five steps.
Hazards identified: trailing cables under desks; an emergency exit partially blocked by stored archive boxes; a kettle without a fixed base on a worktop near the printer; one workstation positioned directly under a ceiling air-con vent; manual handling of archive boxes onto a high shelf during year-end; work-related stress around the January/February tax-return season; a glass-fronted reception door that doesn’t have manifestation.
Who might be harmed and how: staff, visitors, cleaners and contractors may face trips, scalds, handling injuries, stress or collisions with unmarked glass. Draughts and poor workstation conditions can cause discomfort and should be considered without assuming they necessarily cause a particular injury.
Illustrative precautions: route cables safely; remove stored boxes from the emergency exit and keep it clear; provide a stable kettle location; improve workstation conditions; relocate archive boxes and assess suitable handling aids, load sizes and storage heights. Plan workload cover before busy periods and make large glass areas visible. A chosen box weight is not a universal safe lifting limit.
Recording: the seven hazards are entered on the HSE template with current controls and further actions, with owners and deadlines. The completed document is two pages.
Review: scheduled annually, with an explicit trigger to reassess before the January tax-return season each year, after any office move, and after any accident or near-miss.
The time required depends on the workplace and assessor. The example illustrates decisions to consider; it is not a completed assessment, a fixed duration or a guarantee that the listed controls will be sufficient in another office.
A note on training and competence
The assessor needs sufficient skills, knowledge and experience for the work. A trained manager may handle straightforward risks, while complex hazards can need specialist assistance. Neither a job title nor a particular certificate automatically establishes competence.
Our Risk Assessment Training courses cover the full five-step methodology, the hierarchy of control, and the documentation practice. The qualification provides a defensible baseline of competence for staff who carry out general workplace assessments.
Frequently asked questions
Is the five-step risk assessment still the current HSE method?
HSE’s current guidance follows five linked tasks: identify hazards, assess risks, control risks, record findings and review controls. The method is proportionate to the work; a particular template or matrix is not compulsory.
What if I have fewer than five employees?
You must still assess and control risks. The general written-record threshold is five employees, but separate rules can require records for smaller employers too, including fire risk assessments in England and Wales.
What does “suitable and sufficient” mean?
It’s the legal standard for the assessment, set out in regulation 3 of the 1999 regulations. The assessment must identify the significant risks arising from the work, be appropriate to the nature of the work, and account for any specific groups of workers who are particularly at risk. The HSE has explicitly said that a suitable and sufficient assessment doesn’t have to be perfect, but it does have to be proportionate to the level of risk.
How long does a typical risk assessment take?
There is no standard duration. It depends on the work, hazards, available information and assessor’s competence. Allow enough time to consult workers, examine controls and implement necessary action; completing a form quickly is not the objective.
Related guides
- How often should a risk assessment be reviewed?
- Who can carry out a risk assessment? The competence question explained
- Risk assessment examples: three worked examples for UK workplaces
Sources & references
- HSE — Current risk-management steps
- Management Regulations 1999, regulation 3
- HSE — Reasonable practicability
- HSE — Respiratory protective equipment fit testing
- HSE — Construction dust controls
- Home Office — Fire risk assessment recording duties
Make sure your team is competent to carry out clear, defensible workplace risk assessments.
View course →
Mark writes about workplace health & safety, risk assessment and accredited online training for Risk Assessment Training, part of Online CPD Academy.