How to write a risk assessment

Many people associate risk assessments with lengthy, complex-looking documents.

But a risk assessment is simply the process of thinking about the work you are going to do, the harm it could cause you or others, and how to keep everyone safe.

You might not realise it, but you already carry out risk assessments throughout the day; just in your head. For example, it looks dangerous to cross the road where you are, so to make it across safely you walk to the traffic lights and wait for them to change.

A risk assessment is simply a written record of your findings from that process.

A risk assessment is a legal requirement, according to the “The Management of Health and Safety at Work regulations 1999”.

The law states that every employer must assess the risks to their employees at work. But it doesn’t only cover employees; you also need to understand how non-employees (e.g. the general public) could be harmed by the work being done.

Beyond the legal requirements, many companies create risk assessments for financial and moral reasons. Risk assessments are essential to making work safer. The impact of workplace-related injuries are far-reaching and increases every year.

£9.47 billion – Annual costs of new cases of work-related ill health in 2016/2017

But what if I work for a small company?

Even if you’re a one-man-band, you still need to complete a risk assessment before you start a job to understand any harm you may face. However, if you are a sole-trader or have under five employees, you don’t have to write down your findings, but we and the HSE strongly suggest you do.

You may be subcontracting and have been asked to provide a risk assessment for your part of the job. Or you want to go the extra mile to ensure their employees stay safe.

So while it isn’t a legal requirement for you to write a risk assessment if you have a small company, be ready to create one if you want to win more work, look more professional, or work on part of a larger project.

That doesn’t matter; you don’t need to be an expert in health and safety to write a risk assessment. You need to be a ‘competent person’ according to the HSE (the government body responsible for health and safety). This is ‘someone who has enough training and experience or knowledge’ in the area.

So if you can identify things that can cause harm, and figure out a way to stop getting hurt, you can write your own risk assessment. This free guide is going to walk you through what actually goes into a risk assessment and how to write one up.

If you do need extra support, check out the protecting online resource library.

144 workers were killed at work in 2017/2017

Why training is not enough

We often hear from companies that have invested a lot in health & safety training, but find themselves at square one when it comes to risk assessments.

The people who received training still lack the ability to write a risk assessment; and when they do write them, documents get rejected by clients.

Where risk assessments are concerned, training is just the beginning. It’s important to make a plan for once training has been completed. Embedding safety within the culture of your organisation will ensure the long-term success of any training investment.

Managers of your organisation must help promote safe working practices. And there is a need for there to be the appropriate resources (time, money, people) allocated to make sure safety can be effectively managed.

There should be a constant dialogue about safety, and staff must be able to speak up about safety concerns without fear. These concerns should be captured and included in health & safety documentation, such as in the risk assessments.

Companies that have a good safety culture experience fewer accidents and injuries and win more repeat work. Put the effort into health & safety, and you’ll reap the rewards long after the course ends.

Writing your first risk assessment can seem like a daunting task. Fear of the blank page is a common problem; no idea where to start, or what to write. Don’t worry, we’ve got you covered. We’re going to break down the core components of a risk assessment and walk you through how to create one.

Step 1: Identify the hazards

The easiest way to get started with identifying hazards in your workplace…is to walk around and look for them! It’s simple, look for anything that has the potential to harm someone. Remember PEME: people, equipment, machinery and environment. Keep a lookout for:

• Objects that can cause slips and trips, like cables across the floor
• Things that can cause falls from height, like ladders and raised working areas
• Machinery and electrical hazards, such as frayed wires
• Biological hazards, like blood, bacteria and animals
• Working situations that cause strain, such as lifting heavy objects, vibration and poor posture
• Chemicals (COSHH)

Ask to see past accident records. Check the manufacturer’s label for products you’re using. And don’t forget to think about any long-term health hazards, such as asbestos-related disease.

Step 2: Consider who might be harmed

After you have identified the hazards, it’s time to work out who could be harmed by the job. Remember, it’s not only about employees; think about other people that may come into contact with the works.

Some people may be more vulnerable than others – for example, people that work on scaffolding are more at risk of falling from a height.

For each hazard you have spotted, make a note of who has the potential to be harmed. Is it the employee, a contractor, members of the public; or all of them?

Are they at risk of falling from height; or walking under scaffolding, running the risk of an object falling on them? Think about every possibility.

Step 3: Evaluating the risks

71,062 – Non-fatal injuries to employees reported by employers in 2017/8

You then need to decide how likely the risks are to happen and how severe they would be if they did. One of the most common ways to complete this assessment is using a risk matrix.

A risk matrix is a grid that maps the severity of the risk against the likelihood of it happening. It helps to identify the steps you can take to reduce the potential to harm, and which risks require the most attention. This is included in your protecting online risk assessments and RAMS.

Step 4: Control Measures

You now know who is likely to be hurt, how, and by what, so it’s time to consider what you can put in place to avoid or reduce the risks. Control measures are the actions you take to reduce the severity and/or likelihood of a hazard causing harm.

Consider all the different ways that you could remove or reduce this risk. Is there particular clothing that would protect your workers? Would regular cleaning help? Do you need to improve lighting in the area? Anything from changes to the environment, working practices, and training can help.

Another handy acronym to have at your disposal is ERIC PD. Eliminate, reduce, isolate, control, PPE and discipline. It’s important to go through control measures in that order. Many rely on PPE as the sole control measure, however, this should only ever be considered as a last resort.

Control measures often work best in combination with each other. They don’t have to be expensive to be effective, and they should be ‘sensible’. This means that they shouldn’t get in the way of employees getting the job done, but should protect them while they do so.

A great starting point for control measures is simply to use protecting.co.u. There is a huge amount of content available particularly around high-risk work, such as working from height and operating vehicles on site, that details how to plan for safety in these particular areas.

Step 5: Write the risk assessment

It’s time to write the risk assessment itself. The risk assessment should be clear and concise and cover the information you have pieced together in the previous steps.

Check out our free risk assessment template to see an example of a risk assessment.

It’s really important to take your time when you write a risk assessment. Consider all possibilities, and take every risk into account.

Risk assessments are the first place that HSE Inspectors go after a near-miss/accident has been reported. If they find fault, your business could face a substantial fine. Beware of the three most common faults that inspectors find in risk assessments:

The wrong hazards: From failing to identify all hazards linked to an activity to not explaining the hazard enough. Including the wrong hazards in your risk assessment may lead to your document being rejected, or worse.

The wrong people: It’s a common mistake to forget about the public when considering the person at risk of a hazard. Ensure you consider all the possible people who could be harmed, don’t just think about your employees.

Not giving the full picture: take the time to really think about your risk assessment, and whether you have covered all possibilities. Have you included reactive work as well as planned? Have you included every reasonable control measure? Have you provided detail on how the measures can reduce the risk?

Your risk assessment needs to make it clear how lives will be protected.

Step 6: Regular review

Few workplaces stay the same. Sooner or later, you will bring in new equipment, substances or procedures or hired new team members that could lead to new hazards. As a result, it makes sense to review what you are doing on an ongoing basis.

It is standard practice to review a risk assessment on an annual basis as a minimum. However, you need to set a review process that works for your organisation.

Remember: a risk assessment is only complete when the job is. As your job progresses, make sure to review your risk assessment on an ongoing basis and ask yourself:

• Have there been any significant changes?
• Are there improvements you still need/can make?
• Have your workers spotted a problem?
• Have you learnt anything from accidents or near misses?

You don’t have to get your risk assessment right the first time. Do the best you can, then continue to enhance it as the project progresses.

It’s as important to write your risk assessment in a way that is simple to understand.

Risk assessments are only effective if those involved understand what they need to do to stay safe.

A risk assessment tends to cover an entire project, such as installing a new bathroom. This means that the work included can be varied, involving different trades and activities.

Deliver a quick understanding of the task at hand

As a result, it’s helpful if the hazards are grouped by task. This makes it easy for the reader to gain a quick understanding of every single risk involved in a specific task.

Then under each task, there should then be a record of every hazard involved. Each hazard should have an assigned risk value, and it’s common practice to use the traffic light system for this to make it really clear how dangerous a task can be.

30.7 million working days lost due to work-related ill health and non-fatal injuries in 2017/18

The higher the risk, the more you are meant to do about it. Using the traffic light system, if a risk is marked red the potential to cause serious harm is high. Readers then know to pay close attention to the control measures to ensure they can complete the task safely.

The hazards with the highest level of risk should be listed first to ensure it gets the most attention. Include a risk matrix at the start of the risk assessment so readers can understand how the values have been worked out.

Clear and concise controls

It must be very easy to understand how to remove, or reduce, the risk involved in a task. Take your time writing control measures, but keep them short and to the point. You want them to be quickly understood by everyone reading them on a busy site.

Control measures should be listed according to efficiency. Most effective should be presented first, followed by the remaining control measures, finishing with the least effective.

Then make it very clear who is at risk of harm. Common categories used are

• All operatives on site.
• The operative carrying out the work
• The general public
• Your client’s employees

These won’t work for every environment, so create categories relevant to your work.

Write a new document for each job

The temptation to copy a risk assessment from a previous job can be strong, but no two jobs are the same. Each one has its own risks and controls that need to be considered and included. Take the time to start each risk assessment with fresh eyes, and consider the individual tasks carefully.

Know the site rules

Make sure your first stop when you are getting to know your workplace hazards is the site/office manager. It is crucial that any specific rules for the site are included in your risk assessment. Think about first aid guidelines, waste management and site access rules.

Regularly review control measures

A control measure that seems so straightforward that you can copy and paste it from job to job still needs to be reviewed every time. Each site is different; so control that worked on one site may not necessarily work in the same way on another one. Use a risk matrix to quickly amend the risk value, reducing or increasing the likelihood or severity of each task.

Make sure there is someone responsible for enforcing control measures

It’s great to come up with control measures that keep workers safe, but if there isn’t anyone making sure they’re followed, the exercise was pointless.

There should be a named person responsible for every control measure. They are responsible for ensuring control measures are followed, that the risk is reduced, and the control measure is updated after any changes.

Have a system in place to make it easy to update

A fundamental element of a successful risk assessment is that it can be updated easily. Say a task crops up unexpectedly, some extra contractors have been added to the job, or you’ve had a near miss or accident. Situations like this mean that you need to update your risk assessments and do it quickly to prove you’re on top of the new situation. By using protecting not only can you create risk assessments in minutes but you can update them in just seconds.

Having an open dialogue with workers will help you stay aware of changing conditions. The latest version of a risk assessment should be found easily, and you must be able to make and share updates with the team immediately after a change is made.