Risk assessment: what the law actually asks for

The legal duty in one paragraph

The duty comes from section 2 of the Health and Safety at Work etc. Act 1974, which requires you to ensure the health, safety and welfare of employees so far as is reasonably practicable. The Management of Health and Safety at Work Regulations 1999 turn that general duty into a process: assess the risk first, then act on what you find. Regulation 3 is the assessment duty. Regulation 5 requires arrangements for planning, organising, controlling, monitoring and reviewing the measures. Regulation 10 requires you to tell your workers what you found.

Certain hazards carry their own assessment duties on top of the general one. Substances hazardous to health are covered by COSHH 2002, manual handling by the Manual Handling Operations Regulations 1992, display screen work by the DSE Regulations 1992, noise and vibration by the 2005 Control Regulations, and fire by the Regulatory Reform (Fire Safety) Order 2005 in England and Wales. Where a specific regulation applies, the specific assessment applies with it.

Where the task involves lifting, carrying or pushing, the general assessment is not enough on its own and you need a manual handling assessment for the specific job.

What suitable and sufficient means in practice

The phrase is not defined in the regulations, so it is judged by what an inspector or a court would consider proportionate to the risk. A small office does not need the depth of a fabrication shop. What is consistent is that the assessment must be specific to your work, not a generic document with your logo on it.

In practice an assessment is suitable and sufficient when it does all of the following.

• Identifies the significant hazards actually present in your work, not a library list.
• Names who might be harmed, including contractors, visitors, members of the public, young people, new and expectant mothers and lone workers.
• Records what you already do to control each hazard.
• Decides whether anything further is reasonably practicable, and who will do it by when.
• Reflects how the work is really done, which usually means talking to the people who do it.

The same five employee threshold decides when you need a written health and safety policy, so most firms cross both lines on the same day.

Do you have to write it down?

If you have five or more employees, yes, the significant findings must be recorded. Below five employees the assessment still has to happen, it simply does not have to be written. Almost everyone writes it down anyway, because it is the only practical way to prove the assessment existed before the incident rather than after it.

Counting employees includes part time and seasonal staff. Agency workers and labour only subcontractors are usually counted as your employees for these purposes because you direct their work. If you are close to the threshold, treat yourself as being over it.

Fire sits outside this process entirely and carries its own duty, covered in our guide to fire risk assessment duties.

Scoring, matrices and the myth of the right number

Nothing in the law requires a numerical score. Matrices are a communication tool: they help you rank work and show a client that you thought about severity and likelihood. They do not make an assessment compliant, and a high score with no action recorded is worse than no score at all.

If you use scoring, be consistent. Score the risk as it is with the existing controls in place, then score the residual risk once the further actions are done. Two different people assessing the same task should land close to each other. If they do not, your descriptors need tightening rather than your maths.

Who is competent to write one?

Regulation 7 requires you to appoint one or more competent persons to help you comply. Competence is a combination of training, knowledge, experience and the sense to know the limits of your own expertise. For everyday office, retail or light workshop risk, a trained supervisor with a general certificate level qualification is usually enough. For asbestos, confined spaces, explosive atmospheres, complex machinery guarding or occupational health exposure, bring in a specialist.

You can buy in help, but you cannot buy out the duty. The employer remains responsible for the assessment even where a consultant drafted it, which is why a consultant document that nobody in the business has read is a common enforcement finding.

Reviewing it

There is no legal review interval. The regulations say the assessment must be reviewed if it is no longer valid or if there has been a significant change. Most organisations set an annual review as a backstop and then review on trigger events, which is the approach inspectors expect to see.

Trigger a review after an accident or near miss involving the task, when equipment, substances or premises change, when a new or young worker joins, when a worker reports a pregnancy, when the work moves to a new site, and when guidance or law changes.

The common failures

Enforcement notices for risk assessment rarely say the assessment was missing. They usually say it was not specific, not communicated or not implemented. Watch for a document that describes a task nobody performs any more, controls that depend on equipment that is not on site, actions with no owner or date, and a signature sheet with no evidence that anyone read the content.

The final test is simple. Ask a worker who does the job what the main risks are and what they are supposed to do about them. If the answer matches the document, the assessment is working. If it does not, the document is not the problem, the process is.

Common questions

How long should a risk assessment be?

As long as the risk demands and no longer. A two page assessment that names the real hazards and the real controls beats a twenty page template nobody reads.

Do I need a separate risk assessment for each site?

You need one that reflects the conditions at each site. A generic core assessment plus a short site specific supplement is acceptable and common.

Is a risk assessment the same as a method statement?

No. The assessment identifies hazards and controls. The method statement sets out the sequence of work that delivers those controls. Clients often ask for both together as RAMS.

Related guides

• manual handling assessment
• when you need a written health and safety policy
• fire risk assessment duties