UK compliance guide
How to do a risk assessment
To do a risk assessment, follow the HSE’s five steps: identify the hazards; decide who might be harmed and how; evaluate the risk and decide on controls; record your significant findings (a legal duty if you employ five or more people); and review it when things change. Score each risk by likelihood × severity, apply the hierarchy of control to bring it down, and keep the record current. A completed example and a printable template are below.
Written by Thomas Featherstone, NEBOSH IGC-qualified and IOSH Managing Safely trained · Reviewed July 2026
The 5 steps to a risk assessment
The Health and Safety Executive sets out a simple, well-established five-step method. It works for any UK workplace, from an office to a construction site.
| Step | What to do |
|---|---|
| 1. Identify the hazards | Walk the workplace and note anything with the potential to cause harm — machinery, chemicals, working at height, manual handling, electricity, slips and trips, stress. Check manufacturer instructions, accident records and near-miss reports, and ask the people who do the work. |
| 2. Decide who might be harmed and how | For each hazard, identify who could be hurt — employees, contractors, visitors, members of the public — and how. Pay particular attention to new or expectant mothers, young workers, lone workers and anyone with a disability. |
| 3. Evaluate the risk and decide on controls | Judge how likely harm is and how serious it could be, then decide what more you need to do. Apply the hierarchy of control: eliminate the hazard first, then substitute, then engineering controls, then safe systems of work and information/training, with PPE as the last resort. |
| 4. Record your significant findings | If you employ five or more people you must record the significant findings — the hazards, how people might be harmed, and the controls in place. Keep it simple, practical and specific to your workplace, not a generic template. |
| 5. Review and update | Review the assessment regularly and whenever something changes — new equipment, a new process, an accident or near miss, or when it may no longer be valid. Update the controls and re-record. |
Scoring risk: likelihood × severity
A widely used approach is to rate likelihood (how likely harm is) and severity (how bad it could be) from 1 to 5, then multiply them for a risk rating out of 25. It is a judgement aid, not a precise science — the point is to prioritise and to decide whether more control is needed.
| Likelihood | Meaning |
|---|---|
| 1 — Rare | Very unlikely to happen; would be a surprise. |
| 2 — Unlikely | Could happen but not expected. |
| 3 — Possible | Might happen occasionally. |
| 4 — Likely | Will probably happen at some point. |
| 5 — Almost certain | Expected to happen frequently. |
| Severity | Meaning |
|---|---|
| 1 — Negligible | First aid only, no lost time. |
| 2 — Minor | Minor injury, a few days off at most. |
| 3 — Moderate | Injury needing medical treatment / over-7-day absence. |
| 4 — Major | Serious specified injury, long-term harm. |
| 5 — Catastrophic | Fatality or permanent disabling injury. |
A completed example
Task: changing a ceiling light fitting on a stepladder in a small office. Note how each control lowers the residual risk. This is an illustration — always assess your own task, people and workplace.
| Hazard | Who & how | Existing controls | Risk | Further action | Residual |
|---|---|---|---|---|---|
| Fall from height changing a ceiling light fitting | Maintenance worker — fall from a stepladder | EN131 stepladder, pre-use check, area cordoned, one person foots the ladder | 8 · Medium | Log the pre-use ladder check, brief on three points of contact, use platform steps for jobs over a few minutes | 4 · Low |
| Electric shock from the lighting circuit | Maintenance worker — contact with live parts | Isolate and lock off the circuit, test dead before work, competent person only | 10 · High | Add lock-off to the permit checklist and record the isolation | 5 · Medium |
| Manual handling of the light unit and tools | Maintenance worker — musculoskeletal injury | Light load, carried short distance | 4 · Low | Use a tool belt / small bag to keep hands free on the ladder | 2 · Low |
The initial risk for the electrical hazard (2 × 5 = 10, High) only drops to an acceptable level once the circuit is isolated and locked off — which is exactly the sort of control the assessment exists to make explicit.
When to review a risk assessment
A risk assessment is a living document. Review it when any of the following happens:
- New equipment, substances or work processes are introduced.
- An accident, near miss or case of ill health occurs.
- Staff, contractors or the public raise a concern.
- The workplace layout, premises or staffing changes.
- There is reason to believe the assessment is no longer valid.
- At a set periodic review (many SMEs review annually as a minimum).
Free risk assessment template
Use the structure on this page as your template: list each hazard, who might be harmed and how, the existing controls, a likelihood × severity score, any further action, and the residual score. Print this guide to keep the method and worked example to hand, or build assessments digitally in the Hub with scoring and review reminders done for you.
Risk assessment FAQs
Common questions
Is a risk assessment a legal requirement in the UK?
Yes. The Management of Health and Safety at Work Regulations 1999 require every employer to carry out a suitable and sufficient risk assessment of the risks to employees and others affected by their work, and to record the significant findings if they employ five or more people.
What are the 5 steps of risk assessment?
The HSE's five steps are: 1) identify the hazards, 2) decide who might be harmed and how, 3) evaluate the risks and decide on controls, 4) record your significant findings, and 5) review and update the assessment.
How do you score risk?
A common method is to multiply likelihood (1-5) by severity (1-5) to get a risk rating out of 25. Lower scores are broadly acceptable; higher scores need further controls to bring the residual risk down before work proceeds.
How often should a risk assessment be reviewed?
There is no fixed legal interval, but you must review it whenever something changes or it may no longer be valid — for example after new equipment, a new process, or an accident. Many SMEs also set a periodic review, commonly annually.
Who can carry out a risk assessment?
A competent person — someone with sufficient training, knowledge and experience of the work. For many routine activities this is a manager or supervisor who knows the task; complex or high-risk work may need specialist input.
What is the difference between a hazard and a risk?
A hazard is anything with the potential to cause harm (for example a wet floor). The risk is the likelihood that the hazard will cause harm and how serious that harm could be.
Official sources
- HSE — Managing risks and risk assessment at work
- HSE — Steps needed to manage risk
- Management of Health and Safety at Work Regulations 1999
This is a plain-English summary for UK SMEs, not legal advice, and the example is illustrative. Always assess your own workplace and check current guidance on hse.gov.uk.
Stop starting from a blank page
Build risk assessments with scoring and reminders built in
Featherstone Safety Hub guides you through each hazard, calculates the risk rating with a built-in matrix, prompts the hierarchy of control and sets review dates so assessments never quietly go out of date. 14-day free trial, no card required to look around.