A risk assessment identifies what could cause harm at work, who could be affected and what controls are needed. In Great Britain, the Management of Health and Safety at Work Regulations 1999 require employers to make a suitable and sufficient assessment. Northern Ireland has separate legislation with corresponding duties.
That phrase does most of the work. It tells you what’s expected without prescribing exactly how to get there: identify the hazards a reasonable person could anticipate, decide who could be harmed, evaluate whether your controls are adequate, write down what you find, and check the assessment when something changes. The detail of how you do that varies by industry and complexity, but the underlying duty is the same whether you run an office in Leeds or a roofing business in Cornwall.
This page is the starting point. It covers what an assessment is, why the law exists, who must carry one out, and how the work breaks down. The methodology pages and the vertical guides — fire, legionella, COSHH, manual handling and the rest — each sit downstream of the core concepts here.
Why the law requires risk assessments
The current framework comes from the early 1970s. Before the Health and Safety at Work etc. Act 1974, occupational safety in the UK was a patchwork of older Acts and Factories Inspectorate rules. The Robens Report in 1972 recommended bringing the whole system under a single framework with one regulator and one general duty: employers must protect the health, safety and welfare of their workers “so far as is reasonably practicable”. That phrase is still the legal test today.
The 1974 Act is the parent legislation; it sets the duty but doesn’t say how to meet it. The Management of Health and Safety at Work Regulations 1999 fill in the method. Regulation 3 is the one that matters for our purposes: every employer must make a suitable and sufficient assessment of the risks to workers and to anyone else affected by the work. Where the employer has five or more employees, the significant findings must be recorded.
The regulations remain in force in Great Britain. HSE estimated 1.9 million workers with work-related ill health in 2024/25 and provisionally recorded 126 worker fatalities in 2025/26. These describe different kinds of harm and reporting periods; neither measures how many employers comply with the assessment duty.
Hazard, risk, and control measures
Three terms appear on every risk assessment and trip up most beginners.
A hazard is anything with the potential to cause harm. A trailing extension lead, a hot pan, a kerb. The hazard exists regardless of whether anyone is exposed to it.
A risk is the chance that someone will actually be harmed by the hazard, combined with how serious the harm could be. A trailing lead in a locked cupboard is a hazard with negligible risk. The same lead across a busy corridor is a hazard with substantial risk.
A control measure is anything you put in place to reduce the risk. Tucking the lead behind the desk, fitting cable management, training staff to spot trip hazards, or — better still — eliminating the lead by adding a permanent socket.
The duty is to meet any specific legal requirements and reduce risks so far as reasonably practicable. This is not a simple cost-benefit balance: a precaution should only be rejected on cost grounds where the money, time or trouble would be grossly disproportionate to the risk reduction.
The five steps, at a glance
The HSE’s recommended method has five stages. We cover the detail of each on our guide to the five steps of a risk assessment, but the outline is short enough to set out here.
Step one is to identify the hazards. Walk the workplace, talk to the people doing the work, look at accident records, think about non-routine tasks like cleaning and maintenance, and consider long-term health risks alongside acute injury risks.
Step two is to decide who might be harmed and how. Different people face different risks in the same workplace. Pregnant workers, young workers, lone workers, contractors, visitors and members of the public all need separate consideration.
Step three is to evaluate the risks and decide on precautions. Compare what you’re already doing with what good practice looks like for the activity, and decide whether the gap requires action. This is where a risk assessment matrix often comes in — as a structured way of comparing severity and likelihood, not as a substitute for judgement.
Step four is to record the significant findings and implement the controls. Under the general Management Regulations, the written-record duty applies where the employer has five or more employees. Separate rules may require records regardless of headcount, including fire assessments in England and Wales.
Step five is to review and update. Assessments aren’t one-off documents. They have to be revisited when something significant changes or when there’s reason to believe they’re no longer valid.
Who must carry out a risk assessment
The employer remains responsible even when another person helps with the assessment. Self-employed people are covered where they employ others, their work poses a risk to other people, or their work falls within specified high-risk activities. Not every self-employed person is subject to the same general duties.
The person who actually carries out the assessment has to be “competent”, which the regulations define as someone with the skills, knowledge, experience and training appropriate to the task. Competence is not the same as a particular qualification. An experienced site supervisor may be competent to assess routine construction hazards without holding a NEBOSH certificate; a NEBOSH-qualified consultant new to a specific industry may not be competent to assess its niche risks. We go into this in more detail on our page covering who can carry out a risk assessment.
Seek suitable specialist help when the assessment exceeds the skills and knowledge available internally. Complex fire, water-system or industrial risks may need specialist competence; an assessor’s certificate alone does not establish suitability for the premises or task.
Types of risk assessment
The general risk assessment under the 1999 regulations is the umbrella requirement. Several specific risks have their own regulations on top — each requiring its own assessment, each building on the same underlying method.
Fire risk assessment duties depend on the nation and premises. The Regulatory Reform (Fire Safety) Order 2005 covers England and Wales; Scotland and Northern Ireland have separate fire safety legislation.
Legionella risk assessment sits under the Control of Substances Hazardous to Health Regulations 2002, supported by HSE Approved Code of Practice L8.
COSHH risk assessment covers hazardous substances generally — chemicals, dusts, fumes, biological agents — excluding asbestos, lead and ionising radiation which each have their own regulations.
Manual handling risk assessment is required under the Manual Handling Operations Regulations 1992, with the well-known TILE framework (Task, Individual, Load, Environment).
DSE assessment covers employees who habitually use display screen equipment as a significant part of normal work. HSE describes users as those working with DSE daily for continuous periods of an hour or more.
Work-related stress must be assessed and controlled. HSE’s six Management Standards provide one recognised approach to examining work design and identifying action.
Others include lone working, working at height, working from home, pregnancy, and young persons. Each is its own page; each plugs into the same five-step method.
A separate category — dynamic risk assessment — covers the on-the-spot judgement needed when conditions change faster than a written assessment can keep up with. It supplements the general assessment rather than replacing it, and it originated in the UK fire service.
How risks are scored
A risk matrix can help compare likelihood and severity. A 5 × 5 example produces scores from 1 to 25, but no matrix size, colour scheme or numerical scoring method is prescribed for general workplace assessments.
The matrix is a structured way of comparing risks against each other. It is not a precise calculation of harm. Two assessors looking at the same hazard will often score it differently, and a score of 12 isn’t twice as serious as a score of 6 in any meaningful sense. The value of the matrix is consistency within an organisation — everyone using the same scoring conventions — not mathematical accuracy.
A 3 × 3 matrix may be sufficient for some tasks; complex hazards may require specialist methods. Choose a proportionate method that supports sound decisions. Our risk assessment matrix guide explains the limitations of scoring.
Recording, reviewing and revising
Under the general Management Regulations, employers with five or more employees must record significant findings and groups especially at risk. The record should explain the hazards, people affected and controls, including actions still needed. Additional regulations may impose wider recording duties.
There is no fixed legal review period. The duty under regulation 3 is to review the assessment when there is reason to suspect it is no longer valid, or when significant change has taken place. Significant change includes new equipment, a new process, a new workplace layout, a new member of staff in a different role, an accident or near-miss, a change to the regulations, or simply the passage of enough time that conditions have drifted.
Set a review schedule that reflects the hazards, changes and reliability of controls. An annual review may be a useful organisational arrangement, but it is not a universal legal interval and must not delay action when a review trigger occurs.
Common mistakes
The following examples describe weaknesses that can make an assessment ineffective.
Treating the assessment as paperwork
The legal duty is to control the risk in practice. A perfectly drafted document with controls that nobody actually applies is worse than useless — it documents the employer’s knowledge of the hazard.
Generic templates without site-specific detail
A downloaded “office risk assessment” template is a starting point, not a complete assessment. The 1999 regulations require the assessment to be suitable and sufficient for your workplace, not for offices in general.
Confusing hazard and risk
Listing every possible hazard without thinking about who is actually exposed produces bloated, unreadable documents. The assessment should focus on the hazards that pose a real risk to real people doing real work.
Not consulting the workforce
The people doing the work usually know where the risks sit. An assessment carried out without them tends to miss the practical issues that drive accidents.
Failing to review
An assessment from three years ago describing the old layout, the old equipment and people who no longer work there isn’t a current assessment. Reviewing routinely is cheaper than defending a stale one after an incident.
Where this leads
A risk assessment isn’t a one-off exercise; it’s a way of working. The methodology is the same across every industry and every type of risk — what changes is the technical detail of the hazards and the controls. The vertical pages on this site cover that detail. The methodology pages cover the underlying technique. The two FAQ pages cover the most-asked questions about competence and review frequency.
If you or your team need to build the competence to carry out assessments yourselves, our Risk Assessment Training courses cover the full HSE method and lead to a recognised certificate.
Frequently asked questions
What is the legal definition of a risk assessment in the UK?
There isn’t a single statutory definition. The Management of Health and Safety at Work Regulations 1999 require employers to make a “suitable and sufficient” assessment of the risks to workers and others affected by the work. The HSE’s plain-English version is that an assessment is a careful examination of what could cause harm so the employer can decide whether enough has been done to prevent it.
Who is legally required to carry out a risk assessment?
Every employer must assess relevant risks. Self-employed people have duties where their work can harm others, they employ people or they carry out specified high-risk activities. Appointing a consultant does not transfer the employer’s responsibility.
Do I have to write the assessment down?
The general Management Regulations require a record when an employer has five or more employees. Smaller employers still need to assess and control risks, and separate rules may require written records regardless of size. For example, responsible persons in England and Wales must record their fire risk assessment.
What is the difference between a hazard and a risk?
A hazard is anything with the potential to cause harm. A risk is the chance that someone will actually be harmed by the hazard, combined with how serious that harm could be. Removing the hazard removes the risk; reducing exposure or adding controls reduces the risk without removing the hazard.
What does “reasonably practicable” mean?
Where a duty is qualified by reasonable practicability, compare the risk with the sacrifice needed to reduce it. A precaution should only be rejected where its cost in money, time or trouble is grossly disproportionate to the risk reduction. Specific absolute duties must still be met.
Related guides
- How often should a risk assessment be reviewed?
- Who can carry out a risk assessment? The competence question explained
- Risk assessment examples: three worked examples for UK workplaces
Sources & references
- HSE — Steps needed to manage risk
- Management Regulations 1999, regulation 3
- HSE — Getting competent help
- HSE — When health and safety law applies to self-employed people
- HSE — Enforcement policy and reasonable practicability
- Home Office — Fire safety responsibilities
- HSE — Latest health and safety statistics
Build the competence to carry out suitable and sufficient risk assessments yourself.
Explore the Risk Assessment Training course →
Mark writes about workplace health & safety, risk assessment and accredited online training for Risk Assessment Training, part of Online CPD Academy.