Management Guide
Health & Safety Risk Assessments
Introduction
This management guide outlines why the risk assessment process is the cornerstone of health and safety
management, and provides practical guidance on how risk assessments should be carried out. Risk
assessments are concerned with the identification of hazards and the analysis of the risks attached to them.
Every employer must make a regular assessment of their premises to assess a number of risks. Selfemployed workers have a duty to assess risks to themselves and others.
As individuals we carry out risk assessments subconsciously all the time – where and when to cross the road,
for example, or whether to pull out of a junction in a car. We do these assessments quickly, and we base
them on experience, the available information, common sense and our own judgement. The same principles
can often be applied when conducting risk assessments at work.
Risk can be calculated in the following ways:
Risk = severity x probability
Definitions
Hazard
Risk
Control measure
Something with the potential to cause harm. For example, hot surfaces, a
hazardous substance, working at height or the behaviour of a person.
The chances or likelihood of the harm occurring, together with an indication
of how serious the harm may be, for example, the chance that someone
could touch a hot surface, or fall from a ladder, and the possible
consequences.
Action taken to prevent someone being harmed, for example, guarding the
hot surface, labelling and storing the hazardous substance securely or
training staff on dealing with challenging behaviour
Legal Requirements
Risk assessments at work were officially introduced by the Health and Safety at Work Act 1974,
because employers were required to take reasonably practicable precautions to protect their
employees. This involves a balanced judgment of the magnitude of the risk, and the effort needed to
remove or reduce it, in terms of time, trouble and cost.
The legal requirement for risk assessments was developed in 1992 by the introduction of the
Management of Health and Safety at Work Regulations (amended 1999). These regulations state
that significant findings from risk assessments must be recorded.
Other regulations require specific assessments and significant findings to be recorded, such as the
Control of Substances Hazardous to Health Regulations 1992, the Manual Handling Operations
Regulations 1992 (amended 2002), the Health and Safety (Display Screen Equipment) Regulations
1992, and the Personal Protective Equipment at Work Regulations 1992.
Types of Risk Assessment
There are two different types of risk assessments:
Quantitative risk assessments produce a probability estimate, based on known risk information
applied to the particular situation under consideration.
Qualitative risk assessments are subjective, based on personal judgement backed by data on risk.
These are similar to the risk assessments that we make in our everyday lives.
Qualitative risk assessments are generally suitable for purpose, except in circumstances of high risk
or public concern.
Who should carry out the assessments?
Service Line Managers are responsible for ensuring risk assessments are carried out for the areas
they are responsible. However risk assessments are always best carried out by more than one
person, preferably involving some of the team for the work area you are assessing. This will make
the assessment more meaningful and reflect real work practices.
Where it is foreseeable that hazards can change during the course of work (for example, when
working in potentially violent situations, adverse weather) then ongoing assessment is needed to
ensure that the control measures in place continue to be adequate. The manager is responsible for
ensuring that arrangements for working in these circumstances are in place. This includes ensuring
that employees are competent in making decisions to change safe working practices to take account
of varying hazards, are aware of their levels of responsibility and where judgements may be beyond
their competency.
Where there are significant changes to planned work then arrangements must be in place for
employees to stop work or withdraw from the workplace and contact their manager to seek advice
and discuss additional risk controls.
If new situations come to light then this must inform future processes. Managers must ensure that
feedback is obtained where these circumstances arise in order to review the existing processes.
How to carry out a risk assessment
There is no standard way to carry out risk assessments as workplaces vary in size, layout, number of
employees, level of risk, types of activity etc. However risk assessments should not be seen as a
paperwork exercise. The assessment team should observe the workplace or activities in practice as
well as reviewing any written work procedures, guidance and accident trends.
The basic information that the record of a risk assessment should contain is:




the date, location and assessor
the proposed date of review
a statement of the significant hazards identified
a statement of the existing control measures and the extent to which they control the risk



what extra control measures are required
reference to legislation, guidance, standards, manuals, standard operating procedures and
other relevant documentation
who is exposed to the hazard.
What not to risk assess
Insignificant risks do not usually need to be assessed, nor do risks associated with general life
activities e.g. making a cup of tea, unless the work environment or activity significantly alters the risk
associated with the activity. In practice, this means that assessments based on completely
improbable sets of circumstances or activities with trivial safety consequences should not be subject
to risk assessment.
Five basic steps to carrying out a risk assessment
There are 5 basic steps to carrying out a risk assessment:
1.
2.
3.
4.
5.
Identify the hazards
Decide who may be harmed and how
Evaluate the risks (likelihood of injury, severity of injury) and decide on control measures
Record your findings and implement them
Review your assessment and update as necessary
1. Identify the hazards
How could people be harmed? What available information is there to develop a list of significant
hazards? Has anything been overlooked that is considered to be part of ‘day-to-day’ activity?
2. Decide who may be harmed and how
What groups of people and/or individuals are at risk, e.g. visitors, people working with machinery?
Are there particular hazards for the work area, activity or premise that you are considering? How
might people be harmed? Are there any individuals who are more at risk, e.g. trainees, expectant
mother, people with disabilities?
3. Evaluate the risks and decide on control measures
What can be done to reduce or eliminate the risks identified? What is reasonably practicable? What
are you already doing to control the risk? The table below can be used as a template for evaluating
risks.
Probability Rating
Probable – likely to occur immediately or soon
Reasonably probable – probably will occur in time
Remote – may occur in time
Extremely remote – unlikely to occur
Value
4
3
2
1
Severity Rating
Catastrophic – imminent danger exists; the hazard is capable of causing death
and/or illness on a wide scale
Critical – the hazard can result in serious illness or severe injury
Marginal – the hazard can cause illness or injury, but the results would not be
as serious as a critical hazard
Negligible – the hazard will not result in serious illness or injury; there is only
Value
4
3
2
1
a remote possibility of injury beyond minor first aid
To establish a Risk Rating multiply the "Probability" rating value by the "Severity" rating value.
Probability
Probable (4)
Reasonably
probable (3)
Remote (2)
Extremely
remote (1)
Severity
Catastrophic
Critical (3)
(4)
16
12
12
9
8
4
6
3
Marginal (2)
Negligible (1)
8
6
4
3
4
2
2
1
The above table helps to identify where action must be taken and how quickly. However long term
health hazards should not be ignored.
4. Record your findings and implement them
Write down the results of your risk assessment in a simple and concise way, and where possible
refer to procedures and other documentation rather than re-write detail in the risk assessment.
The introduction of control measures to reduce risk should be carried out in a structured and
systematic way, as follows:
1.
2.
3.
4.
5.
6.
Hazard elimination
Substitution
Use of barriers
Use of procedures
Use of warning systems
Use of personal protective equipment
5. Review your assessment and update as necessary
Assessments need to be carried out by a competent individual, and once recorded they need to be
reviewed over time to ensure that they are updated appropriately and in line with changing working
conditions. Review does not necessarily mean carrying out a new risk assessment, but checking over
the existing assessment to ensure it is still valid and then updating the assessment or making
changes as necessary.
Dissemination of information to employees, contractors and visiting staff.
The significant findings from risk assessments should be made available to, and discussed with, all
those persons identified as being at risk as a result of work activities. Where necessary training and
adequate supervision should be provided.