The 5 Steps to Risk Assessment: HSE's Framework Explained

Every UK employer has a legal duty to assess the risks their work activities create, but a surprising number of workplaces still treat "risk assessment" as a form to fill in once and forget. The Health and Safety Executive's five-step framework is the foundation almost every other workplace health and safety obligation builds on, from manual handling to electrical safety, so getting the process right matters more than getting any single assessment perfect.

Why risk assessment is a legal requirement

The Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999 require every employer to assess risks to employees and anyone else who could be affected by their work activities. Employers with five or more employees must record the significant findings in writing. This isn't a paperwork exercise for its own sake — it's meant to drive real decisions about what precautions a workplace actually needs.

Step 1: Identify the hazards

A hazard is anything with the potential to cause harm — a piece of machinery, a chemical, a slippery floor, a stressful workload, or a lone-working arrangement. HSE recommends walking the workplace, talking to staff about what they've noticed, checking manufacturers' instructions and safety data sheets, and reviewing accident and near-miss records to identify hazards that might not be obvious from a desk.

Step 2: Decide who might be harmed and how

For each hazard identified, the assessment needs to consider who could be affected — not just employees doing the task directly, but also contractors, visitors, members of the public, young workers, new or expectant mothers, and people with disabilities, all of whom may face a different level of risk from the same hazard.

Step 3: Evaluate the risks and decide on precautions

Having identified hazards and who they affect, the next step is judging how likely harm is and how severe it could be, then deciding what needs to be done to remove or reduce that risk. HSE recommends applying a hierarchy of control: first try to eliminate the hazard entirely, then substitute it with something less dangerous, then use engineering controls, then administrative controls (such as training or safe systems of work), and only rely on personal protective equipment as a last resort.

Step 4: Record the findings and implement them

Employers with five or more staff must write down the significant findings, including the hazards identified, who's at risk, and what's being done to control the risk. Recording findings isn't just a compliance box-tick — it creates a reference point for training new staff, demonstrates due diligence if something goes wrong, and gives a baseline for the next review.

Step 5: Review and update

A risk assessment is a live document, not a one-off exercise. It should be reviewed whenever there's a significant change — new equipment, a different process, a workplace move, or after an accident or near miss — and periodically even if nothing obvious has changed, since working practices can drift over time without anyone noticing.

Common mistakes employers make

The most frequent failure isn't skipping the process entirely, it's treating it as generic. Copying a template risk assessment from another organisation without adapting it to the actual workplace, hazards and staff involved leaves gaps that only show up after an incident. Equally common is completing the assessment and then never reviewing it again, even years after the working environment has changed substantially.

Risk assessment and small businesses

Smaller employers sometimes assume risk assessment is only relevant to industrial or high-hazard workplaces, but the duty applies just as much to a small accountancy practice or a professional office. Common office-based hazards include trailing cables, poorly adjusted workstations, and lone working outside normal hours — none of which are dramatic, but all of which are foreseeable and therefore need to be considered. HSE provides free example risk assessments and templates for lower-risk sectors specifically so smaller employers aren't starting from a blank page.

Frequently asked questions

Do all employers have to write down their risk assessment? Only employers with five or more employees are legally required to record significant findings in writing, though it's good practice for smaller employers to do so too.

How often should a risk assessment be reviewed? There's no fixed legal interval — it should be reviewed after any significant change to the work, equipment or workforce, and periodically (commonly annually) even without an obvious trigger.

Who is responsible for carrying out a risk assessment? The employer is legally responsible, though the actual assessment is often carried out by a competent person, which can be a manager, a health and safety officer, or an external consultant depending on the complexity of the work.

What's the difference between a hazard and a risk? A hazard is something with the potential to cause harm; a risk is the likelihood that harm will actually occur, combined with how severe it would be.