• Home
• How to Write a Risk Assessment

How to Write a Risk Assessment

Writing a risk assessment is important to identify and record hazards in your workplace and put in place steps to manage them. There are many ways to write a risk assessment. You can make one from scratch tailored to your business, use a template, and adapt it to your needs, or hire a professional to create a risk assessment for you.

Find out everything you need to know about writing risk assessments, including what they are, why they’re important, who can make them, and how to write a risk assessment from the start. Alternatively, try our risk assessment software from Protecting and take advantage of risk assessment templates online.

Start your free 15-day trial of our health and safety software and create unlimited risk assessments, RAMS, and COSHH assessments online in minutes. Use simple step-by-step templates crated by experts – or learn what it takes to write a risk assessment yourself with the rest of this guide.

What is a risk assessment?

A risk assessment is a written document that identifies all the hazards that exist in a workplace and what steps will be taken to protect people’s safety in the environment. It’s simply the process of thinking about the work you’re going to do, the harm it could cause you or others, and how to keep everyone safe.

You might not realise it, but you already carry out risk assessments throughout the day – just in your head. For example, if it looks dangerous to cross the road where you are, you walk to the traffic lights and wait for them to change to cross safely. A risk assessment is simply a written record of your findings from that process.

Risk assessments go into greater detail and lay out every possible hazard and methods to implement control measures that eliminate or minimise their potential impact. Workplaces such as offices, construction sites, restaurants, and airports all require risk assessments to protect employees, customers, visitors, and the businesses themselves.

Why are risk assessments important?

A risk assessment is a legal requirement for UK workplaces under the Management of Health and Safety at Work Regulations 1999. The minimum you must do as an employer is to identify the hazards that could cause injuries or illness, assess the level of harm and risk, and the actions to control or eliminate the risk.

A company risk assessment isn’t just for employees through. You also need to understand how the public, visitors, customers, and anyone else could be harmed by your work, operations, and activities. Risk assessments help protect the health and safety of everyone on your premises.

Beyond the legal requirements, many companies create risk assessments for financial and moral reasons. Risk assessments are essential to making work safer. The impact of workplace-related injuries are far-reaching and increases every year.

In the UK, costs of workplace injuries and illness were £20.7bn in 2023 – £7.7bn for workplace injuries and £13.1bn for sickness.

How many employees does there need to be to provide written risk assessments?

Even if you’re a one-man-band, you still need to complete a risk assessment before you start a job to understand any harm you may face. Every employer must complete a risk assessment, but you only need to write it down and keep a record if you have five or more employees.

However, if you’re a sole-trader or have under five employees, you don’t have to write down your findings, but we and the HSE strongly suggest you do to stay safe. You may be subcontracting and have been asked to provide a risk assessment for your part of the job. Or you want to go the extra mile to ensure employees stay safe.

It isn’t a legal requirement for you to write a risk assessment if you have a small company. However, be ready to create one if you want to win more work, look more professional, or work on part of a larger project.

I don’t have a health and safety team. Who can complete a risk assessment?

It doesn’t matter – you don’t need to be an expert in health and safety to write a risk assessment. You need to be a ‘competent person’ according to the Health and Safety Executive (HSE – the government body responsible for health and safety). This is ‘someone who has enough training and experience or knowledge’ in the area.

If you can identify things that may cause harm and figure out a way to stop people getting hurt, you can write your own risk assessment. This free guide walks you through what a risk assessment should include and how to create a risk assessment. If you do need support, check out the Protecting online resource library.

Why isn’t training enough to manage workplace risks?

We often hear from companies that have invested a lot in health and safety training but find themselves at square one when it comes to risk assessments. The people who received training still lack the ability to write a risk assessment. And when they do write them, documents get rejected by clients.

Where risk assessments are concerned, training is just the beginning. It’s important to plan for after training has been completed. Embedding safety within the culture of your organisation will ensure the long-term success of any training investment.

Managers of your organisation must help promote safe working practices. And there is a need for there to be the appropriate resources (time, money, and people) allocated to make sure safety is effectively managed. There should be a constant dialogue about safety, and staff must be able to speak up about safety concerns without fear.

These concerns should be captured and included in health and safety documentation, such as in all risk assessments. Companies that have a good safety culture experience fewer accidents and injuries and win more repeat work. Put the effort into health and safety, and you’ll reap the rewards long after the course ends.

How to create a risk assessment

Writing a risk assessment may seem like a daunting task at first. Fear of the blank page is a common problem – you might have no idea where to start or what to write. Using a risk assessment template provides an idea of what to include and where to place all the key information.

If you want to write a risk assessment from scratch we’ve also got you covered. Below we break down the core components of a risk assessment and walk you through how to create a risk assessment for your workplace and business. Follow these steps to make an effective company risk assessment:

Step 1: Identify the hazards

The first step of a risk assessment is to identify hazards in your workplace. Simply walk around and look for them – anything that has the potential to harm someone. Remember PEME: people, equipment, machinery, and environment when tackling the first stage of a risk assessment. Keep a lookout for:

• Objects that can cause slips and trips, like cables across the floor
• Things that may cause falls from height, like ladders and raised working areas
• Machinery and electrical hazards, such as frayed wires
• Biological hazards, like blood, bacteria, and animals
• Working situations that cause strain, such as lifting heavy objects, vibration, and poor posture
• Chemicals (COSHH)

Ask to see past accident records. Check the manufacturer’s label for products you use. And don’t forget to think about any long-term health hazards, such as asbestos-related diseases.

Step 2: Consider who might be harmed

After you’ve identified the hazards, the second step of a risk assessment is to work out who could be harmed by the risks. It’s not just employees – think about other people that may encounter the hazards. Some people may be more vulnerable than others, like those working on scaffolding who are more at risk of falling from a height.

For each hazard you identify, make a note of who has the potential to be harmed. Is it the employee, a contractor, members of the public, or all of them? Are they at risk of falling from height, walking under scaffolding, running the risk of an object falling on them? Think about every possibility and include in your risk assessment.

Step 3: Evaluate the risks

Assess how likely the risks you’ve identified are to happen and how severe they would be if they occur. Evaluating them helps prioritise areas to focus on and action to take for a safe workplace. One of the most common ways to complete this assessment is using a risk matrix.

A risk matrix is a grid that maps the severity of the risk against the likelihood of it happening. It helps to identify the steps you can take to reduce the potential harm, and which risks require the most attention. This is included in our RAMS software that you can use to create unlimited risk assessments and RAMS reports.

In 2020/21 – 441,000 workers suffered non-fatal injuries – with slips, trips, and falls the biggest cause.

Step 4: Control measures

Now you know who is likely to be hurt, how, and by what, it’s time to consider what to do to avoid or reduce the risks. Control measures are the actions you take to reduce the severity and/or likelihood of a hazard causing harm to anyone.

Consider all the different ways that you could remove or reduce this risk. Is there particular clothing that would protect your workers? Would regular cleaning help? Do you need to improve lighting in the area? Anything from changes to the environment, working practices, and training may help.

Another handy acronym to have at your disposal is ERIC PD – eliminate, reduce, isolate, control, PPE, and discipline. It’s important to go through control measures in that order. Many rely on PPE as the sole control measure; however, this should only ever be considered as a last resort.

Control measures often work best in combination with each other. They don’t have to be expensive to be effective, and they should be ‘sensible.’ This means that they shouldn’t get in the way of employees getting the job done but should protect them while they do so.

A great starting point for control measures is simply to use Protecting. There’s a huge amount of content available particularly around high-risk work, such as working from height and operating vehicles on site, that details how to plan for safety in these particular areas.

Step 5: Write a risk assessment

It’s time to write the risk assessment itself. The risk assessment should be clear and concise and cover the information you have pieced together in the previous steps. Check out our free risk assessment template for an example to follow.

It’s important to take your time when writing a risk assessment. Consider all possibilities and take every risk into account.

Risk assessments are the first things HSE inspectors turn to after a near-miss/accident is reported. If they find fault, your business could face a substantial fine. Beware of the three most common faults that inspectors find in risk assessments:

• Incorrect hazards – failing to identify all hazards linked to an activity and not explaining the hazard enough. Including the wrong hazards in your risk assessment may lead to your document being rejected or worse.
• The wrong people – it’s a common mistake to forget about the public when considering people at risk of a hazard. Ensure you consider all the possible people who could be harmed, don’t just think about your employees.
• Not providing the full picture – take the time to really think about your risk assessment, and whether you’ve covered all possibilities. Have you included reactive work as well as planned? Have you included every reasonable control measure? Have you provided details on how the measures can reduce the risk?

Your risk assessment needs to make it clear how lives will be protected.

Step 6: Regularly review

Few workplaces stay the same. Sooner or later, you’ll bring in new equipment, substances, or procedures or hire new team members that could create fresh hazards. It makes sense to review what you do on an ongoing basis.

It’s standard practice to review a risk assessment annually as a minimum. However, you need to set a review process that works for your organisation. Remember – a risk assessment is only complete when the job is. As your job progresses, make sure to review your risk assessment on an ongoing basis and ask yourself:

• Have there been any significant changes?
• Are there improvements you still need/can make?
• Have your workers spotted a problem?
• Have you learnt anything from accidents or near misses?

You don’t have to get your risk assessment right the first time. Do the best you can, then continue to enhance it as the project progresses.

How do you make your risk assessment easy to understand?

It’s important to create a written risk assessment that’s simple to understand. Risk assessments are only effective if those involved know what they need to do to stay safe.

A risk assessment tends to cover an entire project, such as installing a new bathroom. This means that the work included may vary, involving different trades and activities. Deliver a quick understanding of the job at hand.

It’s helpful if the hazards are grouped by task. This makes it easy for the reader to gain a quick understanding of every single risk involved in a specific task.

Under each task there should then be a record of every hazard involved. Each hazard should have an assigned risk value. It’s common practice to use the traffic light system for this to make it really clear how dangerous a task can be.

The higher the risk, the more you should do about it. Using the traffic light system, if a risk is marked red the potential to cause serious harm is high. Readers then know to pay close attention to the control measures to ensure they complete the task safely.

The hazards with the highest level of risk should be listed first to ensure they get the most attention. Include a risk matrix at the start of the risk assessment so readers can understand how the values have been worked out.

Apply clear and concise controls

It must be easy to understand how to remove or reduce the risk involved in a task. Take your time writing control measures but keep them short and to the point. You want them to be quickly understood by everyone reading them on a busy site.

Control measures should be listed according to efficiency. The most effective should be presented first, followed by the remaining control measures, finishing with the least effective.

Then make it very clear who is at risk of harm. Common categories used are:

• All operatives on site
• The operative carrying out the work
• The general public
• Your client’s employees

These won’t work for every environment, so create categories relevant to your work.

Five parts of a successful risk assessment

Read about the 5 steps to a risk assessment and consider a final few things to remember before you get started on writing your risk assessment:

1. Write a new document for each job

The temptation to copy a risk assessment from a previous job can be strong, but no two jobs are the same. Each one has its own risks and controls that must be considered and included. Take the time to start each risk assessment with fresh eyes and consider the individual tasks carefully.

2. Know the site rules

Make sure your first stop when you’re getting to know your workplace hazards is the site/office manager. It’s crucial that any specific rules for the site are included in your risk assessment. Think about first aid guidelines, waste management, and site access rules.

3. Regularly review control measures

A control measure that seems so straightforward you could copy and paste it from job to job still needs reviewing every time. Each site is different, so controls that worked on one site may not necessarily work in the same way on another one. Use a risk matrix to quickly amend the risk value, reducing or increasing the likelihood or severity of each task.

4. Ensure someone is responsible for enforcing control measures

It’s great to come up with control measures that keep workers safe, but if there isn’t anyone making sure they’re followed, the exercise was pointless. There should be a named person responsible for every control measure. They’re responsible for ensuring control measures are followed, that the risk is reduced, and the control measure is updated after any changes.

5. Have a system in place to make it easy to update

A fundamental element of a successful risk assessment is that it can be updated easily. Say a task crops up unexpectedly, some extra contractors are added to the job, or you’ve had a near miss or accident. Situations like this mean you need to update your risk assessments and do it quickly to prove you’re on top of the new situation.

Use Protecting’s risk assessment software to create risk assessments in minutes and update them in seconds online. Having an open dialogue with workers will help you stay aware of changing conditions. The latest version of a risk assessment should be found easily, and you must be able to make and share updates with the team immediately after a change is made.

About Protecting

Protecting is a cloud-based software that makes the process of creating risk assessments, RAMS, and COSHH safety documents very easy. You can create unlimited numbers of risk assessments to keep your organisation safe. Give it a go today with a free 15-day trial.

We make risk assessments accessible for companies of all shapes and sizes.