In this guide we discuss how to write a risk assessment, step-by-step. We also talk about what a risk assessment is, how risk assessments promote safer working environments, and who is qualified to carry out risk assessments.
Listen to our episode of ‘Safety Made Simple’ relating to risk assessments:
Why are risk assessments carried out?
As an employer, you must control the risks in your workplace to prevent employees and others who might be affected by your activities (such as contractors, visitors, and passers-by) from suffering injury or illness.
Risk assessments are a requirement under the Management of Health and Safety at Work Regulations 1999 as part of an employer’s duty of care. Completing risk assessments supports compliance with the law which protects your organisation’s hard-earned reputation and prevents harm.
What is a risk assessment at work?
A risk assessment at work is a systematic and proactive method of identifying potential hazards and evaluating the associated risks.
By meticulously scrutinising the workplace, the risk assessment process pinpoints areas of concern and helps employers assess the likelihood and severity of potential harm that employees, visitors, or anyone interacting with the workplace or where its operations take place.
How to write a risk assessment
Our consultants at Praxis42 are often asked, ‘How do I write a risk assessment?’ These are the main steps:
1. Identify hazards
The first step is to identify what could cause harm. Anything that has the potential to cause harm is defined as a hazard and there could be many of them in the workplace or in the activities that performed on behalf of the organisation.
Hazards can be categorised as follows:
- Physical hazards. These include machinery, objects, and tools.
- Biological hazards, such as viruses.
- Chemical hazards. Liquids, fumes, and dust fall under this category.
- Ergonomic hazards. This is about how people use their workstations and equipment.
- Psychosocial hazards. These are factors at work that may cause stress or other difficulties for people.
To be able to identify all the hazards in your workplace, you need to have a good understanding of what is happening. This involves looking at all aspects of work activities and the work environment, for example:
- The people carrying out the work, their abilities, skills and knowledge.
- The work environments. Consider temperature, lighting, ventilation, or noise.
- The equipment and products being used, such as chemicals.
- The work process as a whole.
- Previous accidents, incidents and near misses.
- Findings from audits, inspection or surveys.
Once you have a general understanding of what hazards there may be in your workplace, activities and operations you need to meticulously identify each one. There is no right or wrong way to do this. You can employ whatever method you feel is most appropriate, as long as you gather the required information.
Under health and safety law, employers must identify ‘reasonably foreseeable’ hazards. These are hazards that any ‘reasonable’ person could be expected to identify. For example, if there is a spillage of liquid on the floor, it is reasonable to think that if someone walks in it they could slip.
You might identify hazards by:
- Drawing on your own knowledge of a task or piece of equipment. If you have carried out a role for a number of years, you will have gained a wealth of knowledge and experience that enables you to spot hazards. You might identify trends where accidents commonly occur during a work process or in a particular environment.
- Walking around the workplace and watching jobs being undertaken firsthand. This will enable you to see where harm could potentially occur. Talking to people who are completing work and getting their perspectives on hazards is essential as is having a well-established consultation process
- Following advice issued by the manufacturers of the equipment and products you use. Manufacturers will tell you where harm could occur.
- Following approved codes of practice, guidance, best practice and industry guidance. There may be recommended safe ways to complete particular tasks or use certain products and equipment.
2. Identify who could be harmed and how
Anyone who is affected by the activities being carried out by your organisation must be taken into consideration in the risk assessment (employees, contractors, members of the public or visitors who may be in close proximity to work).
For example, a maintenance company working on a scaffold may have identified falling objects as a hazard. If their work is completed in an isolated location, then only their employees working at ground level may be affected. However, if work is taking place in a city centre, a member of the public that could be passing underneath must also be considered as they could also be at risk.
3. Calculate risk
Once hazards have been identified, the next stage is to calculate the risk. This calculation is risk = likelihood x severity
‘Likelihood’ is how likely it is that a particular hazardous event could occur. This is determined on a scale that quantifies the chance of it happening: the hazardous event is extremely unlikely, there is a remote chance the hazardous event may happen, the hazardous event may occur occasionally, the hazardous event is probable, the hazardous event is extremely likely. Each of these can be given a rating of one to five (one being extremely unlikely, and five being extremely likely).
Scoring is a subjective judgement based on prior knowledge and experience of accidents and incidents and gathered information, so it is advisable to ask relevant colleagues, employees, or experts for their opinions.
Here is a basic example:
A pothole in the pavement has the potential to cause harm because someone could trip and fall. If the pothole is on a busy pavement in a city centre where the footfall is high, the likelihood of a hazardous event may be five. If the pothole is on a back street not used by members of the public, the likelihood of a hazardous event is considerably lower.
‘Severity’ is the likely outcome of a hazardous event and calculated in the same way. The scale might be: negligible injury, minor injury, moderate injury, significant injury and severe injury. Again, these may be rated from one to five. In the worst-case scenario, someone could trip and break their wrist, which is a significant injury, giving a severity rating of four.
Now we can calculate the risk that the pothole poses. We have got 5 for likelihood x 4 for severity, giving us a risk rating of 20.
This process needs to be followed for each hazard you have identified. Once you have numerical values assigned to hazards, you can identify the most significant risks in your workplace or within the work process.
4. Control and reduce risks
Once you have established what the hazards are, who could be harmed, and the level of risk posed to those people, you can consider how to control risks ‘so far as is reasonably practicable’.
In health and safety law, ‘so far as is reasonably practicable’ is about weighing up the level of risk against the financial cost of controlling the risk and the time and resources involved.
It is not worth investing a lot of money, time, effort, and resources to control a low-risk hazard or calculated risk. If, for example, you are using a highly toxic cleaning product, you may just need to swap it for a less hazardous product.
On the other hand, a high-risk hazard will warrant more investment. This might involve buying new equipment, investing in employee training, or making physical changes to the workplace.
To reduce risk, you need to introduce control measures, which could achieve one of the following:
- Eliminate the hazard. For example, a window cleaner may use an extendable pole rather than a ladder to eliminate the risk of serious injury from a potential fall from height. Eliminating a hazard is the ideal solution, but it is not always possible.
- Reduce the likelihood of harm occurring. This may involve reducing the amount of time someone spends on a task or exposed to the hazard. The less time they are doing something or exposed to something, the less likely they are to be harmed.
- Isolate the hazard. A worker can be protected from a dangerous moving part of a machine by a guard or enclosure.
- Control the hazard by creating a safe system of work, such as how to use display screen equipment safely.
It may take time to find the best control measures. Once measures are in place, you need to recalculate the risk and if it isn’t low enough you may need to introduce further control measures. This stage can take some time and thought to get right.
5. Record findings
Once you have gathered all the information for the risk assessment, the next stage is to record your findings. There is no single way to do this, but some important points need to be considered.
Whatever format you decide to use, key information from each stage of the risk assessment process should be recorded with a focus on what the control measures are and how they are maintained.
If you have five or more employees, there is a legal requirement to document your risk assessment. However, if a risk assessment is not recorded it is very difficult for employees to follow it and to establish safe systems of work or provide related training.
A risk assessment is a tool that helps everybody in the workplace to reduce risks and stay safe. It can only do this if it is accessible and clearly communicated.
In addition, it is difficult to prove you are managing risks in accordance with the law without documentation.
When should a risk assessment be carried out?
A risk assessment is a dynamic document, and it should not just sit in a drawer. It is important to improve it over time. As your organisation or work activities change then so should your risk assessments.
In general, risk assessment reviews should ensure the following:
- All hazards have been identified.
- All control measures are suitable.
Risk ratings are acceptable.- Controls are being appled and used
Risk assessments should be reviewed at a set interval. For a low-risk task or work environment, this could be annually. For higher risk work, reviews will need to take place regularly or even after every time the task is completed.
Risk assessments should always be reviewed in the following circumstances:
Accidents and incidents
If there is an accident or incident the risk assessment will need to be reviewed. A risk assessment document demonstrates how you manage risk, so if there is an accident, you can check that the hazard that caused the accident was included in the risk assessment. You can also check whether the measures in place to control the hazard were sufficient.
If an accident happened as a result of a hazard that wasn’t documented in the risk assessment this could indicate that there need to be changes to the risk assessment process as a whole.
Significant changes
The other occasion when a risk assessment needs to be reviewed is when there has been a significant change. This could be a change to your work process, new equipment being used, different employees completing work, or changes to the workplace itself.
All these factors have the potential to introduce new hazards, requiring new risk ratings to be calculated and new controls to be introduced.
What is a ‘suitable and sufficient’ risk assessment?
The Management of Health and Safety at Work Regulations 1999 states that a risk assessment must be ‘suitable and sufficient’.
For your risk assessment to be deemed suitable and sufficient it must show that:
- All persons who could be affected by hazards have been considered (employees, visitors, contractors, and members of the public).
- All significant hazards have been identified. These are the foreseeable hazards.
- Control measures are suitable. This means that the measures introduced lower the risk rating to an acceptable level.
- Workers and their representatives have been consulted during the risk assessment process. Those who work with the hazards day-to-day are the most valuable source of information.
- The risk assessment has been completed by a ‘competent person’ (see below).
Who carries out a risk assessment?
Under health and safety law, a risk assessment must be completed by a ‘competent’ person.
The Health and Safety Executive (HSE) define a competent person as someone who has ‘the skills, knowledge and experience to be able to recognise hazards in your organisation and help you put sensible controls in place to protect workers and others from harm.’
The competent person could be you or someone else in your workplace. However, if you do not have the level of competency required, it is advisable to outsource your risk assessment to a health and safety consultant. It is important to choose a professional who knows how to write a risk assessment for your industry and can tailor their recommendations to your unique organisation.
Risk assessments must be comprehensive and robust to protect people’s safety and comply with the law. They are the foundation of a health and safety management system and vital for managing risks effectively.
