How to Create a Risk Assessment

A risk assessment isn't paperwork you produce to satisfy a client — it's the record that proves you thought about what could go wrong on this job, on this site, before anyone picked up a tool. Done well, it takes an hour and prevents rejections, near-misses and enforcement notices. Done badly (or copy-pasted from someone else's), it fails at the first review and can be used against you when something goes wrong.

This guide walks through creating a risk assessment from scratch in the UK: what the law requires, the five steps HSE recognises, how to score risk, how to write control measures that hold up, and how to document the whole thing so it's usable on site. It's written for contractors, sole traders and small firms who need the document to be right, not long.

What is a risk assessment?

A risk assessment is a structured examination of what could cause harm during a work activity, who could be harmed and how, and what you're doing to prevent it. It has to be suitable and sufficient — meaning proportionate to the risk and specific to the job — under Regulation 3 of the Management of Health and Safety at Work Regulations 1999. Every UK employer, and every self-employed person whose work could affect others, has to produce one. Firms with five or more staff must record it in writing.

Risk assessments underpin nearly every other safety document you'll be asked for. A method statement describes how the work will be done; a RAMS combines the risk assessment and method statement into a single package for site access. Neither works without a real risk assessment behind it — see RAMS vs risk assessment for the distinction principal contractors care about.

The five steps of a risk assessment

HSE's INDG163 — the reference most reviewers grade against — sets out five steps. Every risk assessment you produce should be built around them.

Step 1 — Identify the hazards

Walk the job through in your head, task by task, and list anything that could realistically cause harm. Split hazards into categories so you don't miss anything obvious:

• Physical — working at height, moving vehicles, sharp edges, hot surfaces, unstable loads
• Mechanical — power tools, lifting equipment, entrapment, ejected material
• Electrical — your own installations, existing live services, temporary supplies
• Chemical — solvents, adhesives, silica dust, isocyanates, fuel — covered in more depth by COSHH assessments
• Biological — Weil's disease, tetanus, mould, sewage, needlestick
• Ergonomic — manual handling, awkward postures, repetitive strain, vibration (HAVS)
• Environmental — noise, heat/cold, poor lighting, weather exposure, dust
• Psychosocial — lone working, fatigue, aggression from the public

Two rules matter here. First, be site-specific: "working at height" is not a hazard entry — "installing fascia to 3.2 m eaves from an aluminium tower scaffold on a pedestrian pavement" is. Second, cover the whole task lifecycle — set-up, work, breaks, clean-up, handover — because that's where the incidents actually happen.

Step 2 — Decide who might be harmed and how

Name the groups exposed to each hazard, not just "workers". A good list usually includes: your operatives, other trades on site, delivery drivers, cleaners, security, members of the public, and any vulnerable persons (young workers under 18, expectant mothers, lone workers, contractors with limited English). For each group, describe the mechanism: "a passing pedestrian could be struck by a dropped tool", not "could get hurt". Reviewers grade this line for realism — vague harm descriptions are the most-flagged weakness in rejected UK risk assessments.

Step 3 — Evaluate the risk and decide on controls

For each hazard, score the risk using the standard 5×5 matrix. Score it twice: inherent risk (no controls in place) and residual risk (with your controls applied). Showing both is what proves your controls actually work.

• Likelihood (1–5) — 1 rare, 2 unlikely, 3 possible, 4 likely, 5 almost certain
• Severity (1–5) — 1 first-aid only, 2 minor injury, 3 lost-time injury, 4 major injury/RIDDOR, 5 fatality or permanent disability
• Risk score — likelihood × severity. 1–4 low, 5–9 medium, 10–15 high, 16–25 unacceptable

Then design the controls to bring residual risk into the low band. Follow the hierarchy of control in order — don't jump straight to PPE:

1. Eliminate the hazard — remove the task, redesign the job, prefabricate at ground level
2. Substitute — swap solvent-based products for water-based, use a MEWP instead of a ladder
3. Engineering controls — guardrails, on-tool extraction, RCDs, mechanical lifting aids
4. Administrative controls — permits to work, exclusion zones, task rotation, toolbox talks, training records
5. PPE — the last line of defence, specified precisely: "FFP3 respirator to EN 149", not "appropriate mask"

If your residual risk is still amber or red after all reasonable controls, you either need more controls or the task itself has to be redesigned — you don't just accept the number.

Step 4 — Record your findings

Anything with five or more staff is a legal requirement. Even sole traders should record it for the audit trail. A record needs, at minimum: task description, location, date, assessor name and competence, hazards, persons affected, inherent risk score, controls, residual risk score, and a review date. Keep the language plain — this document has to be understood by the person doing the work, not just the reviewer.

Step 5 — Review and update

A risk assessment isn't a one-time document. Review it whenever the job changes, when new plant or substances are introduced, after an incident or near-miss, and at least annually as a baseline. See how often to review risk assessments for the review triggers principal contractors expect to see documented.

A worked example — first-fix electrics, occupied flat

To show what "site-specific" means in practice, here's one row from a real risk assessment for first-fix electrical containment work in an occupied residential block:

• Task: Installing surface-mounted trunking to communal hallway walls, Block C, ground and first floor
• Hazard: Contact with existing buried cables when fixing trunking to plastered blockwork above the skirting line
• Who is harmed: Electrician (arc-flash, burns, electrocution); residents in adjacent flats (loss of supply, fire)
• Inherent risk: L4 × S5 = 20 (unacceptable)
• Controls: Cable-avoidance tool sweep before every fixing (calibrated within 12 months, record in site log); reference to as-built drawings; permit to break plaster signed by site manager; RCD-protected supply; safe-isolation procedure documented and posted at the DB; toolbox talk delivered and signed by all operatives before work starts
• Residual risk: L1 × S5 = 5 (medium)
• Further action: None — residual risk is as low as reasonably practicable given the controls

Every row of a good risk assessment reads like that: specific hazard, named group, honest inherent score, controls a competent person could actually verify, honest residual score.

Common reasons UK risk assessments get rejected

Tier-1 principal contractors and CHAS/SMAS assessors reject risk assessments for a small, repeatable list of reasons. Check yours against every one before you submit:

• Hazards listed generically ("working at height") with no site-specific detail
• No inherent-vs-residual scoring — just a single number, so controls can't be validated
• Controls that reference PPE first and eliminate/substitute nowhere
• No named assessor, or assessor competence not stated
• No review date, or a review date that's already passed
• Copy-pasted content from another site (different addresses, wrong trade)
• No cross-reference to the method statement or the COSHH assessments it depends on
• Missing vulnerable-person considerations (young workers, lone workers, expectant mothers)

If you're getting knocked back repeatedly, our page on rejected RAMS covers the specific rewrites principal contractors actually want to see.

Legal framework in one place

The risk assessment sits at the centre of a stack of UK regulations. The core duty is Regulation 3 of MHSWR 1999 (suitable and sufficient assessment). Site-specific duties layer on top: CDM 2015 Regulation 8/12 for construction, WAHR 2005 Regulation 6 for work at height, LOLER 1998 Regulation 8 for lifting plans, COSHH 2002 Regulation 6 for hazardous substances, PUWER 1998 Regulation 4 for equipment, and Control of Noise at Work Regulations 2005 for exposure > 80 dB(A). The umbrella duty of care under Section 2 and Section 3 of the Health and Safety at Work etc. Act 1974 covers everything else. For a fuller breakdown, see legal requirements for risk assessments.

Documentation and sign-off

A risk assessment is only worth what it evidences. That means:

• A unique document reference and version number
• Named competent assessor with a dated signature
• Approver sign-off (usually the site manager or health & safety lead)
• Distribution list showing everyone who's been briefed
• Briefing / toolbox-talk record with operative signatures
• A stored audit trail of edits, versions and reviews

If you're producing risk assessments on paper or in Word, this is where things tend to fall over: version drift, missing signatures, no audit trail. A structured builder like the Riskora risk assessment generator handles the documentation step — presets for your trade, HSE-referenced hazard libraries, inherent/residual scoring, sign-off workflow, briefing links, version control and an audit log — so the paperwork side of the job stops being the weak link.

Riskora is a professional documentation tool, not a replacement for competent judgement. The assessor still owns the decisions on this specific job; the tool makes sure the record of those decisions is complete, defensible and quick to produce.

Risk assessment checklist

Before you submit any risk assessment, check every item on this list:

• Task description is site-specific, not generic
• Every foreseeable hazard for the actual work is listed
• Persons affected are named by group, with a specific harm mechanism
• Inherent risk scored using a documented likelihood × severity matrix
• Controls follow the hierarchy — elimination first, PPE last
• Residual risk is scored and demonstrably lower than inherent
• Any residual amber/red risk is justified or has a further action recorded
• Named assessor with competence stated, signed and dated
• Approver sign-off in place
• Review date set and not yet passed
• Cross-references to related method statement, COSHH and permits
• Vulnerable-person considerations recorded
• Briefing / toolbox-talk record attached or referenced

Summary

Creating a risk assessment properly comes down to five things: identify hazards specific to this job, name who's exposed and how, score risk honestly before and after controls, apply the hierarchy of control in order, and record it so it can be briefed, reviewed and defended. Skip any of those and the document either fails at review or fails you at the point it matters. Get them right and you have a piece of paperwork that actually earns its place on site.

Sources: HSWA 1974; MHSWR 1999 Reg 3; CDM 2015 Reg 8, 12; WAHR 2005 Reg 6; LOLER 1998 Reg 8; PUWER 1998 Reg 4; COSHH 2002 Reg 6; Control of Noise at Work Regulations 2005; HSE INDG163 (Five Steps to Risk Assessment); HSE HSG65.