Risk Assessment Training and Template: HSE's Five Steps

There is no legally required "risk assessment course" in Great Britain. The law requires employers to make a suitable and sufficient risk assessment, and HSE says you can do it yourself or appoint a competent person to help. Competence means skills, knowledge and experience, and HSE says formal qualifications are not usually essential, although training can help. This guide covers Great Britain (England, Scotland and Wales), explains HSE's five steps, and gives you a simple template you can adapt.

What the law requires

Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires employers to make a suitable and sufficient assessment of the risks to their employees, and to others affected by their work, so they can identify the measures needed to comply with their legal duties. Self-employed people must assess the risks to themselves and to others affected by their work. The assessment must be reviewed if there is reason to think it is no longer valid or if there has been a significant change. Before employing a young person, an employer must also assess the risks to young people, taking into account factors such as inexperience.

If you employ five or more people, you must record the significant findings of the assessment and identify any groups of employees who are especially at risk. HSE's guidance puts it plainly: if you employ five or more people, you must record your significant findings, including the hazards, who might be harmed and how, and the controls in place.

HSE defines a hazard as something in the business that could cause injury or illness, and a risk as the chance that someone could be harmed by a hazard, and how severe that harm could be.

HSE's five steps to risk assessment

HSE sets out five steps. The headings below are HSE's own.

1. Identify hazards

Look around your workplace and think about what may cause harm. HSE suggests involving your employees, who will usually have good ideas, checking accident and ill health records, and including non-routine tasks such as maintenance or cleaning.

2. Assess the risks

Judge how likely harm is and how serious it could be. For each hazard, think about how employees, contractors, visitors or members of the public might be harmed. HSE says to pay attention to workers with particular requirements, such as young workers, migrant workers, new or expectant mothers and people with disabilities.

3. Control the risks

HSE asks whether you can get rid of the hazard altogether and, if not, how you can control the risk so that harm is unlikely. Options include redesigning the job, replacing materials or machinery, reorganising work and providing protective equipment. HSE notes you are not expected to eliminate all risks, but you must do what is reasonably practicable.

4. Record your findings

If you employ five or more people, you must record the significant findings. HSE adds that the priority is to control risks in practice, not to rely purely on paperwork.

5. Review the controls

You must review the controls you have put in place to make sure they are working. Review also when controls may no longer work, when changes bring new risks (new staff, processes, substances or equipment), when workers report problems, or after accidents and near misses. Update the record with any changes.

Who should carry out the assessment?

The legal duty sits with the employer, but the work can be shared. HSE says: "You can do it yourself or appoint a competent person to help you." Regulation 7 also requires employers to appoint one or more competent people to help them meet their health and safety duties, and says that a competent person already employed by the business should be appointed in preference to an outsider. The number of appointees and the time and resources available to them must be adequate for the size of the business and its risks.

According to HSE, a competent person should have the skills, knowledge and experience to recognise hazards in your business and help you put sensible controls in place. HSE's competence guidance describes competence as a combination of training, skills, experience and knowledge. External consultants are most useful where a business lacks that competence in-house, for example in large, complex or high-risk workplaces, and the employer keeps the legal duty even then.

Risk assessment training: what is and is not required

HSE's guidance on getting help says formal training is not legally required for a competent person, although it can help, and formal qualifications are not usually essential. Neither the regulations nor HSE's five steps page set a mandatory course, duration or renewal period for risk assessment. Regulation 13 does require adequate health and safety training for employees on recruitment and when they face new or increased risks, repeated where appropriate and during working hours.

In practice, training is worth considering when:

• someone is taking on the assessments for the first time
• the work is more complex or higher risk than a typical office or shop
• supervisors need to carry out or review assessments in their own areas
• an incident or near miss has shown that the existing assessments missed something

Because no renewal period is set, decide your own refresh cycle and record it. Our guide to how often health and safety training needs renewing in the UK covers how different courses compare, and a training matrix for compliance training helps you track who has done what and when it is due for review.

A simple risk assessment template

HSE provides its own template and example risk assessments for an office-based business, a local shop, food preparation and service, a motor vehicle repair shop, factory maintenance work and a warehouse. In the version of the page I checked (updated June 2024), the template records who might be harmed and how, what you are already doing to control the risks, what further action you need to take, who needs to carry out the action, and when the action is needed by. HSE's warning is worth repeating: do not just copy an example and put your company name to it.

The table below is a simple layout of our own, built around those HSE headings, with a hazard column and a review column added. Copy it into your own document and fill it in for your workplace.

The example row is only an illustration of how to fill the table in. The six-month review date is a placeholder, not an HSE requirement: HSE says to review when controls may no longer work or when something changes, so set the interval that suits your risks.

Common mistakes

• Copying an example. HSE says to think about the specific hazards and controls your business needs.
• Paperwork over practice. A neat record that does not match what happens on site does not control any risk.
• Never reviewing. A change in staff, equipment or process, or a near miss, should trigger a review.
• Forgetting special cases. Lone workers, young people and new or expectant mothers need specific thought. Our guide to manual handling training shows how one common hazard is handled.

Frequently asked questions

Do I need a qualification to do a risk assessment?

Not by law. HSE says formal qualifications are not usually essential for a competent person, and formal training is not legally required, although it can help.

Do small businesses need to write down their risk assessment?

Under regulation 3, you must record the significant findings if you employ five or more people. HSE still expects every employer to carry out the assessment, whatever their size.

How often must a risk assessment be reviewed?

The regulations do not set a calendar interval. They require review if there is reason to think the assessment is no longer valid or there has been a significant change. HSE adds that you should review after accidents or near misses and when workers report problems.

Can I use HSE's example risk assessments as they are?

Use them as a guide only. HSE says not to copy an example and put your company name to it.

Does this apply in Northern Ireland?

This article covers Great Britain. Northern Ireland has its own regulator, HSENI, and its own regulations.

Where to go next

Start by walking your workplace with a colleague, filling in the template for the three or four biggest hazards, and booking a review date. If you want to build your wider health and safety knowledge, browse the Learnsignal CPD hub.

This article is general information, not legal or compliance advice. Check the current HSE guidance and take advice on your own circumstances.