TL;DR: A UK risk assessment must identify hazards, decide who is harmed and how, evaluate risks, record the significant findings (if you employ five or more people), and be reviewed regularly. Use the HSE five-step approach. This guide walks you through each step with a worked example for a small business.
Why this matters
Under the Management of Health and Safety at Work Regulations 1999 (MHSWR), every UK employer and self-employed person must carry out a "suitable and sufficient" risk assessment of the workplace risks faced by their employees and anyone else affected by their work. The Health and Safety Executive (HSE) is the regulator that enforces this duty in Great Britain.
Failing to carry out a proper risk assessment is one of the most common reasons businesses receive enforcement notices, refuse-to-work orders, or get marked down on tenders and pre-qualification questionnaires. The good news: writing one is genuinely straightforward once you understand the structure.
The five-step HSE approach
Step 1 — Identify the hazards
A hazard is anything with the potential to cause harm: chemicals, electricity, working at height, manual handling, slips and trips, lone working, noise, dust, machinery, hot surfaces, traffic on site, fatigue, violence and aggression. Walk the workplace, talk to the people doing the work, look at past incidents and near misses, and check manufacturer data sheets and guidance.
If you'd rather not start from a blank page, our free UK risk assessment template gives you a structured starting point with the right column headings.
Step 2 — Decide who might be harmed and how
For each hazard, list who could be affected and the way they could be harmed. Don't just write "everyone". Be specific: employees, contractors, agency workers, members of the public, visitors, drivers, young workers, new and expectant mothers, lone workers, and people with disabilities all face different risks.
Step 3 — Evaluate the risk and decide on controls
Risk is a combination of likelihood and severity. The simplest scoring system is a 5×5 matrix: rate likelihood 1–5, rate severity 1–5, multiply for a risk score 1–25. Anything 12+ usually needs strong controls before work proceeds.
Apply the hierarchy of controls in order:
- Eliminate the hazard altogether (the best control).
- Substitute with something less hazardous.
- Engineering controls — guards, barriers, ventilation, isolation.
- Administrative controls — training, supervision, safe systems of work, signage.
- PPE — gloves, helmets, harnesses, goggles. Always the last line of defence.
Step 4 — Record the significant findings
If you have five or more employees, you must record the significant findings in writing. The record should include the hazard, who is affected, existing controls, the residual risk score, any further actions needed, who is responsible, and the deadline.
The easiest way to do this in 2026 is digitally — paper templates get lost, become outdated, and look unprofessional. Our UK risk assessment software generates a fully formatted PDF that's ready to share with clients, contractors, or the HSE.
Step 5 — Review and update
Review your risk assessment at least annually, after any incident or near miss, when work practices change, after new equipment is introduced, or when new staff start. A risk assessment that hasn't been touched in three years is one of the first red flags an inspector or auditor will spot.
A worked example: a small office
Let's take a small UK office with eight employees. Hazards likely to appear:
- Slips and trips — wet floors near the kitchen, trailing cables. Controls: cleaning rota, "wet floor" signs, cable management. Residual risk: low.
- Display Screen Equipment (DSE) — back, neck and eye strain. Controls: DSE assessment for each user, adjustable chairs, screen breaks every hour. Statutory under the Health and Safety (Display Screen Equipment) Regulations 1992.
- Fire — required under the Regulatory Reform (Fire Safety) Order 2005. Separate fire risk assessment, fire wardens trained, extinguishers serviced annually.
- Electrical — controls under the Electricity at Work Regulations 1989: PAT testing, fixed-wiring inspections every five years.
- Lone working for the receptionist after hours. Controls: check-in calls, panic alarm, locked door policy.
That single example covers about half of what most small office risk assessments need to record.
Common mistakes UK businesses make
- Copy-and-paste from a template with no thinking. The HSE explicitly says a risk assessment must be specific to your workplace.
- Listing only PPE as a control. PPE is the last line of defence, not the first.
- Vague controls like "be careful". A control must be something you can audit.
- No review date. Without a review date, the document quietly becomes useless.
- Not involving the people doing the work. They know the real risks better than anyone.
Records you should keep alongside the assessment
- Training records for everyone exposed to the hazards.
- Maintenance and inspection records for control measures (guards, fire equipment, PAT, ladders).
- Accident book and any RIDDOR-reportable incidents.
- Method statements for higher-risk tasks (often required as part of a RAMS pack).
- Toolbox talk attendance records.
If you're working as a contractor, the principal contractor or client will often ask for these alongside the risk assessment itself before letting you on site.
How specific does it need to be?
"Suitable and sufficient" is the legal test. In practice, that means the assessment is proportionate to the risks involved, takes account of all relevant hazards, and considers everyone who might be affected. A small office cleaning service might have a single 3-page assessment. A construction site under CDM 2015 needs activity-specific assessments and method statements for every significant task.
A useful sanity check: read your assessment as if you were an HSE inspector visiting tomorrow. Does it describe your workplace, or could it have been written for any business in the country? If it's the second, it isn't suitable and sufficient.
Special groups to think about explicitly
- Young workers (under 18) — must have an assessment that takes their inexperience and physical development into account.
- New and expectant mothers — a separate assessment is required, and you must adjust working conditions or hours where risks are identified.
- Lone workers — assess communication, supervision, emergency response and personal safety.
- Workers with disabilities — assess access, evacuation, and any reasonable adjustments needed.
- Visitors and members of the public — particularly important in retail, hospitality and any visited workplace.
Writing your first one through a guided workflow
If you want to skip the blank page entirely, our free UK risk assessment generator asks you a few questions about your trade and produces a fully structured draft you can edit and download. It uses HSE-referenced hazards and controls so you start from a sensible baseline rather than guessing.
Reviewing in practice
Set a calendar reminder for the annual review and treat it as a 30-minute task: open the assessment, walk the floor, talk to two or three of the people doing the work, and update anything that has changed. Trigger an out-of-cycle review whenever you change a process, bring in new equipment, hire new people, or have a near miss. The point isn't to rewrite the document — it's to keep it honest.
Final word
A risk assessment isn't paperwork for paperwork's sake. Done well, it makes your people safer, lowers your insurance costs, wins you tenders, and gives you a defence if something does go wrong. Done badly — or not at all — it leaves you exposed both legally and operationally.
Ready to write yours?
Register interest in Assessment First and we’ll confirm current availability for the appropriate risk-assessment workflow.