This website uses non-intrusive cookies to improve your user experience. You can visit our cookie privacy page for more information.

Beta This is a new way of showing guidance - your feedback will help us improve it.

Frequently asked questions

How do I do a risk assessment?

To do a risk assessment, you need to understand what, in your business, might cause harm to people and decide whether you are doing enough to prevent that harm. Once you have decided that, you need to identify and prioritise putting in place, appropriate and sensible control measures.

Start by:

  • identifying what can harm people in your workplace
  • identifying who might be harmed and how
  • evaluating the risks and deciding on the appropriate controls, taking into account the controls you already have in place
  • recording your risk assessment
  • reviewing and updating your assessment

Please see Controlling the risks in the workplace.

We have also produced:

This is not the only way to do risk assessment as there are no fixed rules about how a risk assessment should be carried out. However, we believe that the controlling the risks in the workplace guidance provides the most straightforward way for most businesses.

What should I include in my risk assessment?

Your risk assessment should include consideration of what in your business might cause harm and how and, the people who might be affected. It should take into account any controls which are already in place and identify what, if any, further controls are required.

You should be able to show from your assessment that:

  • a proper check was made
  • all people who might be affected were considered
  • all significant risks have been assessed
  • the precautions are reasonable
  • the remaining risk is low

You do not need to include insignificant risks. You do not need to include risks from everyday life unless your work activities increase the risk.

Any paperwork that is produced should help with communicating and managing the risks in your business.

We have produced:

When do I need to do a risk assessment?

You should carry out an assessment before you do work which presents a risk of injury or ill health.

You only need to do a risk assessment if you are an employer or a self-employed person. 

Voluntary organisations

Health and safety legislation does not, in general, impose duties upon someone who is not an employer, self-employed or an employee. If you are a voluntary organisation, our Health and safety made simple site takes you through the basic steps you need to follow to ensure you comply with the law in relation to your employees. You can also visit the Voluntary organisations section.

Who should my risk assessment cover?

Your risk assessment should cover all groups of people who might be harmed by your business. 

  • Think about workers affected because of risks associated with the particular jobs they do, such as setting, production and breakdown/repair and maintenance. Contractors and shift-workers may not be familiar with what you do and the controls you have in place
  • Think about new and young workers and migrant workers. They may be inexperienced, and/or lack maturity/ experience to recognise risks. They may not be familiar with your workplace culture - what is and what isn’t acceptable
  • Think about workers with poor literacy skills and both migrant and indigenous workers. If staff can't read, write or add up, this can affect their ability to read, understand and follow guidance and instructions
  • Think about new or expectant mothers and young people who may be more prone to health-related risks (physical, biological or chemical risks)
  • Think about people with disabilities whose disability may mean that reasonable adjustments are needed to enable them to do the work and minimise risks

Additionally, think about any other groups, such as members of the public and groups of people who share your workplace.

Your staff will be able to help you decide if there is anyone else you need to consider.

What do I need to record?

You only need to record your risk assessment if you employee five or more people.

You need to record:

  • the significant findings - what the risks are, what you are already doing to control them and what further action is needed
  • details of any particular groups of employees who you have identified as being especially at risk

We have produced Microsoft Word and Open Document Format templates to help you record your assessment. The template can also be used to record your health and safety policy.

You don't have to use the template if you prefer a different format. Just make sure that you include the relevant information.

Remember that any paperwork that is produced should help with communicating and managing the risks in your business.

Is there a template I can use?

Yes. We have produced:

This is not the only way to record your assessment. You can record the assessment in any convenient way so long as it is retrievable.

Remember that you only need to record your risk assessment if you employ five or more people and any paperwork that is produced should help with communicating and managing the risks in your business.

What does 'reasonably practicable' mean?

This means balancing the level of risk against the measures needed to control the real risk in terms of money, time or trouble. However, you do not need to take action if it would be grossly disproportionate to the level of risk.

What is a hierarchy of control?

Risks should be reduced to the lowest reasonably practicable level by taking preventative measures, in order of priority.  This is what is meant by a hierarchy of control.   The list below sets out the order to follow when planning to reduce risks you have identified in your workplace.  Consider the headings in the order shown, do not simply jump to the easiest control measure to implement.

  1. Elimination - Redesign the job or substitute a substance so that the hazard is removed or eliminated.
  2. Substitution - Replace the material or process with a less hazardous one.
  3. Engineering controls - for example use work equipment or other measures to prevent falls where you cannot avoid working at height, install or use additional machinery to control risks from dust or fume or separate the hazard from operators by methods such as enclosing or guarding dangerous items of machinery/equipment. Give priority to measures which protect collectively over individual measures.
  4. Administrative Controls - These are all about identifying and implementing the procedures you need to work safely. For example: reducing the time workers are exposed to hazards (eg by job rotation); prohibiting use of mobile phones in hazardous areas; increasing safety signage, and performing risk assessments.
  5. Personal protective clothes and equipment - Only after all the previous measures have been tried and found ineffective in controlling risks to a reasonably practicable level, must personal protective equipment (PPE) be used. For example, where you cannot eliminate the risk of a fall, use work equipment or other measures to minimise the distance and consequences of a fall (should one occur). If chosen, PPE should be selected and fitted by the person who uses it. Workers must be trained in the function and limitation of each item of PPE.

Is risk assessment a legal requirement?

Yes, if you are an employer or self-employed. It is a legal requirement for every employer and self-employed person to make an assessment of the health and safety risks arising out of their work. The purpose of the assessment is to identify what needs to be done to control health and safety risks. Regulation 3 of the Management of Health and Safety at Work Regulations 1999

You only need to record the assessment if you have five or more employees. See 'What do I need to record?'

What do I have to do in terms of fire safety?

As an employer (and/or building owner or occupier) you are required to carry out and maintain a fire safety risk assessment. This is under the Regulatory Reform (Fire Safety) Order 2005, which applies in England and Wales, and under Part 3 of the Fire (Scotland) Act. The fire safety assessment can be carried out either as a separate exercise or as part of a single risk assessment covering other health and safety risks.

You need to make sure that, based on the findings of the assessment, you take adequate and appropriate fire safety measures to minimise the risk of injury or loss of life in the event of a fire.

More information and guidance can be found at the firesafety community.

Who is responsible for doing a risk assessment?

As an employer or a self-employed person, you are responsible for health and safety in your business.

You can delegate the task, but ultimately you are responsible. You will need to make sure that whoever does the risk assessment:

What training/qualifications do I need to do a risk assessment?

You do not necessarily need specific training or qualifications to carry out a risk assessment. 

As an employer, however, you must appoint someone competent to help you meet your health and safety duties. A competent person is someone with the necessary skills, knowledge and experience to manage health and safety.

You could appoint one or a combination of:

  • yourself
  • one or more of your workers
  • someone from outside your business

You may need extra help or advice if you do not have sufficient experience or knowledge in-house. You may also need extra help if the risks are complex:

Getting help with health and safety

Do I need to use a consultant?

No. In most cases, you can do the assessment yourself with the help of your staff.

You may need extra help or advice if you do not have sufficient experience or knowledge in-house. You may also need extra help if the risks are complex:

Getting help with health and safety

Who do I involve in a risk assessment?

You must consult your staff or their representatives in the risk assessment process. They will have useful information about how work is done which will help you understand the actual risks.

For advice on how to involve employees visit HSE's worker involvement web pages.

How do I prioritise the actions from my risk assessment?

You may find that there are a number of issues which need action, so you need decide on your priorities for that action. In thinking through your priorities, think about the biggest or most serious risks first.

Having identified the priorities, you need to decide on the controls which you will put into place. In doing so, think about the following:

  • long-term solutions to those risks with the worst potential consequences
  • long-term solutions to those risks most likely to cause accidents or ill health
  • whether there are improvements that can be implemented quickly, even as a temporary solution until more reliable controls are in place

Remember, the greater the risk the more robust and reliable the control measures will need to be.

What are significant risks?

Significant risks are those that are not trivial in nature and are capable of creating a real risk to health and safety which any reasonable person would appreciate and would take steps to guard against.

What can be considered as 'insignificant' will vary from site to site and activity to activity, depending on specific circumstances.

When should I review my risk assessment?

You should review your risk assessment:

  • if it is no longer valid
  • if there has been a significant change

Your workplace will change over time. You are likely to bring in new equipment, substances and procedures. There may be advances in technology. You may have an accident or a case of ill health. You should review your assessment if any of these events happen.

Remember to amend your assessment as a result of your review.

There is no set frequency for carrying out a review. 

What if one of my employees' circumstances change?

You will need to review your risk assessment to check whether you need to make any changes in the measures you take to control risk. This is particularly important when, for example, people return to work following surgery etc, as new or expectant mothers or if an employee develops a disability.

Most employers will be able to find a way to make adjustments to work that are suitable for their employees.

For more information visit the following web pages:

Do I need to sign my risk assessment?

No.  There is no legal requirement for you to sign your risk assessment.

How long do I need to keep my risk assessment for?

There is no set amount of time that you need to keep your records relating to general risk assessment. It is good practice, however, to keep them while they remain relevant.

Do HSE carry out risk assessments for businesses?

No. We are an independent regulator and act in the public interest to reduce work-related death, illness and serious injury across Great Britain's workplaces. We also provide advice through our website and publications which are freely available to download.

If you need external help or advice, please go to the following web page:

Getting help with health and safety

What responsibilities do my employees have?

Employees also have responsibilities under health and safety law to:

  • take care of the health and safety of themselves and others
  • co-operate with you to help you comply with health and safety legislation
  • follow any instructions and training you give regarding the measures you have in place to control health and safety risks
  • let you know of work situations that present a serious and imminent risk
  • let you know of any other failings they identify in your health and safety arrangements

What if the work I do varies a lot, or moves from one site to another?

Assess the risks you can reasonably expect to find. When you take on work or go to a new site, cover any new or different risks with a specific assessment.

What if I share my workplace with other employers?

If you share a workplace with another employer, or self-employed person, you will both need to:

  • tell each other about the specific risks in your business that may affect the other employer
  • cooperate and coordinate with each other to control the health and safety risks

I have a question about risk assessment for a specific topic or in a specific industry sector.  Where can I get help?

Our website has guidance on specific topics and/or industry sectors to help you decide whether you are already doing enough or if further action is needed.  Alternatively, use the search box to find guidance containing keywords.

What is a hazard?

A hazard is anything that may cause harm, eg chemicals, electricity, working from ladders, noise etc.

What is risk?

Risk is the chance, high or low, of somebody being harmed by the hazard, and how serious the harm could be.

What are risk matrices?

Most businesses will not need to use risk matrices. However, they can be used to help you work out the level of risk associated with a particular issue. They do this by categorising the likelihood of harm and the potential severity of the harm. This is then plotted in a matrix (please see below for an example). The risk level determines which risks should be tackled first.

Using a matrix can be helpful for prioritising your actions to control a risk. It is suitable for many assessments but in particular to more complex situations. However, it does require expertise and experience to judge the likelihood of harm accurately. Getting this wrong could result in applying unnecessary control measures or failing to take important ones.

risk matrix

What is the difference between a risk assessment and a method statement?

A risk assessment is simply a careful examination of what, in your work, could cause harm to people, so that you can weigh up whether you have enough precautions or whether you should do more.

As an employer or self-employed person, you must do a risk assessment but you only need to record it if you employee five or more people.

A safety method statement is not required by law. It describes in a logical sequence exactly how a job is to be carried out in a safe manner and without risks to health. It includes all the risks identified in the risk assessment and the measures needed to control those risks. This allows the job to be properly planned and resourced.

Safety method statements are most often found in the construction sector. They are particularly helpful for:

  • higher-risk, complex or unusual work (eg steel and formwork erection, demolition or the use of hazardous substances)
  • providing information to employees about how the work should be done and the precautions to be taken
  • providing the principal contractor with information to develop the health and safety plan for the construction phase of a project

Whether safety method statements are used or not, it is essential to make sure that risks are controlled.

I have a complaint about my employer. Who can deal with it?

If you have a complaint about your employer or any other work activity, please go to our concerns webpage for further information.

HSE only deals with work-related health and safety. Where else can I get help?

HSE is the national independent regulator for work-related health, safety and illness. Other concerns may be dealt with by other government departments, local authorities or organisations. For example, food safety is regulated by the Environmental Health Department of your local council. A more detailed list of concerns and who is responsible can be found on the concerns webpage.

Updated 2019-11-27