CDM 2015 Risk Assessment Generator
By the Riskora Editorial Team · Written to our editorial standards
CDM 2015 doesn't just demand a risk assessment — it demands one that flows through the duty-holder chain, links to the construction phase plan, and survives the whole project lifecycle. This builder produces that. Free first PDF, no card.
UK (RAMS) example document — Two-Storey Rear Extension — 14 Birchwood Lane, Reading. Client: Mr & Mrs A. Whitfield (Private Client). Site: 14 Birchwood Lane, Reading, RG1 5JT. Scope: Construction of a two-storey rear extension (6.4m × 4.2m) to an existing semi-detached dwelling. Works comprise breaking out of existing rear elevation, trench-fill foundations to 1.0m, traditional cavity blockwork to first floor, pre-stressed concrete lintels, timber roof structure with natural slate finish, plus alterations to existing rear wall to form structural opening with rolled steel joist (RSJ 203×102 UB23). Works programmed over 9 weeks with a peak site team of 6 operatives. Hazards assessed: Manual handling — blocks, lintels, plasterboard, Working at height — independent scaffold & roof structure, Buried services strike during excavation, Collapse of excavation / trench wall, Hand-arm vibration (HAVS) — breaking out, drilling, Silica dust — cutting blocks, brick, concrete, Vehicle/pedestrian segregation — narrow domestic street.
Full version
What is a CDM 2015 risk assessment?
A CDM risk assessment evaluates health and safety risks across the full project lifecycle — design, construction, maintenance and demolition — under the Construction (Design and Management) Regulations 2015. Unlike a task-level assessment, it considers design-led risks passed via the Pre-Construction Information, interactions between trades, and the duties of clients, designers, principal contractors and contractors. It must connect to the construction phase plan (CDM 2015 reg 15).
Most 'CDM risk assessments' are task documents in a CDM-shaped envelope
The most common audit failure isn't bad hazard identification — it's a task-level risk assessment with "CDM 2015" stamped on the front sheet but no duty-holder block, no PCI cross-reference, no link to the construction phase plan, and no acknowledgement of design-led risks. HSE inspectors and CDM advisors flag this constantly. For the legal frame see UK risk assessment legal requirements.
How Riskora Helps
Riskora's CDM template is structured around the four duty holders. You confirm the project's CDM status (notifiable or not), name the PD and PC, list the PCI items the assessment addresses, then the wizard builds the hazard register and links it back to the CPP. Compare against the wider UK risk assessment software and the CDM-compliant RAMS generator.
Who it's for
- Principal contractors integrating subcontractor RAs into the CPP
- Principal designers issuing PCI with design-led risk information
- CDM advisors supporting domestic and commercial clients
- Contractors aligning task-level RAs to the principal contractor's CPP
- Clients evidencing the 'suitable arrangements' duty under reg 4
Understand the Fundamentals
Before you generate your document, these guides cover the knowledge that underpins every good RAMS, risk assessment, and method statement.
CDM-Compliant RAMS Generator
Combined risk assessment + method statement aligned to the CDM duty cycle.
UK Health & Safety Regulations for RAMS
How CDM 2015 sits relative to MHSWR 1999 and the rest of the UK framework.
Construction Risk Assessment (UK)
Task-level construction risk assessment that feeds the CDM duty chain.
Risk Assessment Examples (UK)
Worked examples showing the depth UK reviewers expect across construction trades.
UK Risk Assessment Legal Requirements
The full statutory framework — MHSWR 1999, CDM 2015 and sector-specific regs.
Best UK Risk Assessment Software
How Riskora compares to HandsHQ, HASpod, SafetyCulture and EcoOnline.
How does a CDM risk assessment differ from a standard one?
A standard risk assessment under MHSWR 1999 looks at a single task in isolation. A CDM assessment sits inside a duty-holder framework: the client appoints competent duty holders, the principal designer manages design risks pre-construction, the principal contractor plans and monitors construction-phase risks, and each contractor assesses the risks of their own work. The CDM version must reference where it sits in that chain.
Who carries out a CDM 2015 risk assessment?
Every duty holder contributes. Clients ensure suitable arrangements are in place (reg 4). Principal designers identify and reduce design-led risks (reg 11). Principal contractors plan, manage and monitor construction-phase risks via the CPP (reg 13). Contractors carry out task-level assessments and integrate them upward (reg 13). One person rarely does all of it on any project larger than a sole-trader job.
Is a CDM risk assessment required on small jobs?
CDM 2015 applies to all construction work in Great Britain — there is no minimum project value or duration. Notifiability changes (over 500 person-days or 30 working days with more than 20 workers simultaneously triggers F10), but the duty to plan, manage and assess risks applies even to a one-day domestic job.
Key Risks and Considerations
- •PCI design-led risks ignored at contractor level
- •Construction phase plan version mismatch with task RAs
- •Subcontractor RAs not integrated into the CPP
- •F10 notification missing on a notifiable project
- •Maintenance/demolition risks left to the next CDM cycle
What UK Law Actually Says
Direct quotes from the named regulations, with plain-English explanations of what each one means in practice.
Regulation 13, Construction (Design and Management) Regulations 2015
“Every contractor must plan, manage and monitor construction work carried out either by the contractor or by workers under the control of the contractor, in a way which ensures that, so far as is reasonably practicable, it is carried out without risks to health and safety.”
Reg 13 is the contractor duty that sits underneath the principal contractor's reg 13 duty. A task risk assessment that doesn't connect to the principal contractor's CPP fails the integration test reg 13 implies.
Read the source on legislation.gov.uk →Regulation 15, Construction (Design and Management) Regulations 2015
“The principal contractor must prepare a written plan (the 'construction phase plan'), and ensure that it identifies the health and safety risks involved in the work and the precautions necessary to address them.”
Reg 15 is the source of the CPP. CDM risk assessments are inputs into it — they must reference the CPP version they were written against and be revised when the CPP changes.
Read the source on legislation.gov.uk →The Numbers Behind the Risk
Why this matters — the most recent published figures from the Health and Safety Executive and ONS.
51 construction worker deaths
Construction remained the highest-fatality sector in 2023/24, with falls from height accounting for around half. CDM 2015 was introduced specifically to push planning and competence assessment upstream — to the client and designer — so these failures are designed out before site work begins.
Source: HSE — Construction sector statistics 2023/24 →HSE construction inspection campaigns annually
HSE runs dedicated CDM-focused inspection drives every year. The most common failures cited are duty-holder competence gaps, missing or stale construction phase plans, and PCI design-led risks that never made it into contractor RAMS.
Source: HSE — CDM 2015 guidance →Side-by-side: a task RA vs a CDM-aligned RA
Weak example. Title: "CDM Risk Assessment — Roofing Works". Activity: "Roof tiling". Hazard: "Work at height". Control: "Use scaffold". The CDM label is cosmetic — there's no duty-holder block, no PCI reference, no CPP link.
Passing example. Front sheet names client, PD, PC and contractor. PCI #5 (flat-roof maintenance access strategy) is cross-referenced. CPP v1.3 (28 March 2026) is linked. Hazard register opens with "Strip and re-cover 95m² pitched tile roof on plot 3 of the 4-unit block, scaffold tagged 12 Apr 2026, 4-day programme" — site-specific because the CPP demands it. Each hazard is mapped to the duty holder responsible for the control. The H&S File picks up the future maintenance access piece for handover.
Why the second one passes. It actually works the CDM lifecycle — design → construction → handover — not just the task. That is what CDM 2015 calls for in writing.
Common Mistakes (and How to Avoid Them)
1. Task RA branded as a 'CDM RA' with no duty-holder block
Why it fails: CDM is a duty-holder framework. Without naming the client, PD, PC and contractor the document cannot evidence the chain of responsibility CDM is built on.
Fix: Use the duty-holder block on the front sheet. The wizard makes it mandatory before download.
2. PCI design-led risks not cross-referenced
Why it fails: The whole point of the PCI is to push design-led risk information down to the contractors. If a contractor RA doesn't reference the PCI items it addresses, the PD's reg 11 duty has been broken in the chain.
Fix: List PCI item numbers on the RA front sheet; mirror each one in the hazard register.
3. Construction phase plan version not recorded
Why it fails: Reviewers need to see which CPP version the RA was written against. A stale RA against a newer CPP is one of the most common audit findings.
Fix: Record CPP version and date on the front sheet; re-issue the RA when the CPP changes.
4. F10 missing on a notifiable project
Why it fails: Notification under reg 6 is a strict duty — over 500 person-days or 30 working days with more than 20 workers simultaneously. Failure is an absolute offence.
Fix: The wizard asks for F10 reference when the project profile triggers notification thresholds.
Worked example: notifiable 4-unit residential block
Project. 4-unit two-storey residential block, 12-month programme, peak labour 18, total worker-days ~3,800. Notifiable under CDM 2015 (over 500 person-days, more than 20 workers simultaneously planned). F10 filed 14 February 2026.
Duty holders. Client — [Developer Ltd]; Principal Designer — [Practice]; Principal Contractor — [Main Contractor]; Contractors — groundworks, frame, roofing, M&E, finishes (5 firms). CDM advisor appointed by client to support competence checks under reg 4.
PCI cross-reference. Six design-led risks issued by PD in the PCI: (1) party-wall sequencing constraint with no.14 adjacent; (2) buried concrete obstruction shown on site plan; (3) high-voltage cable easement at south boundary; (4) confined-space access to existing manholes during connection; (5) flat-roof maintenance access strategy for future occupants; (6) modular kitchen pods requiring 5T crane lift in week 28. Each is addressed in the corresponding contractor RA and the principal contractor's CPP.
Construction phase plan. Version 1.3, dated 28 March 2026, owner — PC's project manager. Includes site layout, welfare strategy, traffic management, the six PCI items above, and the schedule of permits (hot works, permit-to-dig, confined space).
Hazard register highlights. Excavation strike of the HV easement (initial 3×5, residual 1×5 — exclusion zone + permit-to-dig + utility plans + DNO contact pre-dig); modular pod lift (initial 4×5, residual 1×5 — Appointed Person lift plan, 60T crane, exclusion radius 1.3× boom length, banksman, slinger/signaller). All hazards mapped to the duty holder responsible for the control.
Maintenance / future. Flat-roof access strategy (PCI #5) carried forward into the Health & Safety File handed to the client at handover — the CDM lifecycle continues beyond construction.
Why it supports a competent review. The assessment names the duty holders, references the PCI, links to a specific CPP version, and carries selected hazards into the H&S File. That's what CDM 2015 actually requires — not a task list with a CDM front cover.
Duty-holder cheat sheet (what each role assesses)
- Client (reg 4). Suitable arrangements — competent duty holders appointed, sufficient time and resources, welfare in place. Evidence: project execution plan, competence assessments.
- Principal Designer (reg 11). Eliminate / reduce design-led risks. Communicate residual risks via the PCI. Evidence: PCI, design risk register.
- Principal Contractor (reg 13). Plan, manage and monitor construction-phase risks. Produce and update the CPP. Coordinate contractors. Evidence: CPP, daily inductions, monitoring records.
- Contractor (reg 8/13). Assess and control task-level risks for own work; integrate with the CPP. Evidence: task RAMS, training records.
From the example to your own document
The free wizard above takes a one-line project description, asks the CDM status questions (notifiable, duty holders, PCI items, CPP version), and produces the structure shown in the worked example. First PDF is free with no card.
For the matching combined document see the CDM-compliant RAMS generator, and for the wider statutory framework see UK health & safety regulations for RAMS.
Key Features
- CDM 2015 duty-holder block (client / PD / PC / contractor)
- F10 notifiable status flag
- PCI cross-reference fields
- Construction phase plan link
- Project lifecycle: design → construction → maintenance
- Free first document — no card
Example Structure (UK Standard)
- Front sheet: project, address, F10 ref (if notifiable), CDM duty holders
- PCI cross-reference: list of design-led risks the RA addresses
- Construction phase plan: version, date, owner
- Hazard register: trade/task hazards mapped to duty holder
- Initial + residual risk on every line, with legend
- Sign-off: competent reviewer for each duty holder section
Common Questions Before Getting Started
Will this take long?
Under 5 minutes. Select your trade, pick hazards, download.
Is it complicated?
No training needed. The guided builder walks you through every step.
Do I need experience?
If you know what work you're doing, you can use Riskora.
Is it free to try?
Yes. The Free plan needs no card — generate, review and download one free PDF. Upgrade any time for branding, sign-off and higher limits.
Create your RAMS in under 5 minutes
No onboarding or setup needed — start generating documents instantly
Try Riskora FreeNo card required · 1 lifetime safety document · Upgrade when you need more
All documents generated by Riskora should be reviewed by a competent person before use on site. Riskora provides structured templates — professional judgement is always required.
What your RAMS actually contains
Riskora builds a structured, client-facing document — not a generic AI paragraph. Every section is shaped around your job, your site and your team.
Hazards
Task-specific hazards for the job, captured row by row — not a generic list pulled from an old RAMS.
Controls
Control measures mapped to each hazard with residual risk scoring after controls are applied.
PPE
PPE requirements tied to the activity and site, ready to brief to the team.
Method steps
Step-by-step method statement structured around how the work is actually sequenced on site.
Emergency arrangements
First aid, rescue plan, emergency contacts and site-specific escalation routes.
COSHH prompts
Substance prompts when the work involves chemicals, dusts, fumes or sealants — flagged early, not missed at review.
Sign-off
Operative sign-off captured against the document — names, dates and acknowledgement of the brief.
Version history
Every change tracked so you can show what was issued, when, and which version the team signed.
Approval status
Clear approval state on every document — draft, in review, approved, issued — visible across the team.
Audit trail
Who created it, who reviewed it, who signed it. A complete trail you can hand to a principal contractor or auditor.
From copied-and-pasted to site-specific
The reason RAMS get rejected is rarely the format — it's that the document is obviously generic. Riskora rebuilds it around this job, this site and this task.
Generic template copied from an old job.
- • Hazards and controls that don't match this site or task.
- • Method steps written for a different sequence of work.
- • No emergency arrangements specific to the location.
- • Client flags it as generic and asks for a rewrite.
Site-specific document structured around this job, site and task.
- • Hazards captured from the actual scope you pasted in.
- • Method steps sequenced for how the work runs on site.
- • Emergency arrangements and rescue plan tied to the location.
- • Approved internally, briefed to the team, signed off and stored.
From job details to signed-off document
A four-step workflow used by contractors, consultants and safety teams to turn informal job details into client-ready safety paperwork.
- 1Paste job details
Drop in a client email, a WhatsApp from the site manager, a scope of works or a tender note. Anything that describes the job.
- 2Riskora structures the document
Riskora turns your brief into hazards, controls, method steps, PPE, emergency arrangements and COSHH prompts.
- 3Review, edit and download
You stay in control of every section. Tweak anything, then download a clean PDF or share a link.
- 4Brief the team and record sign-off
Brief operatives, capture their sign-off and keep a full audit trail of who signed which version.
Built by people who've written this paperwork on real sites
Riskora is built by a founder with hands-on site and document experience — designed for contractors, consultants and safety teams who need to issue, brief and prove safety paperwork without losing a day to admin.
- Built for contractors, consultants and teams
Solo trades, principal contractors and in-house safety teams all run on the same workflow. - Supports multiple countries
UK, Ireland, Australia, New Zealand, US and Canada — wording and document types match the local standard. - Not just documents
Sign-off, approvals, version history and an audit trail — the management workflow around the paperwork.
Frequently Asked Questions
Describe your job — your draft is one paragraph away.
No training. No complex setup. Just select your trade and go.
References & Further Reading
Primary UK sources covering the legal and practical framework behind RAMS, risk assessments and method statements.
Create your cdm risk assessment free — preview before sign-up
Generate a preview first. Sign up only when you want to save, edit or export.
Final RAMS must be reviewed and approved by a competent person before use.
Riskora is an assistive document preparation tool. All documents generated must be reviewed, verified, and approved by a competent person before use on site. Riskora does not replace professional safety judgment, and no output should be treated as a legal compliance guarantee.