How to Undertake a Risk
Assessment
A step by step guide to completing risk
assessments
Scott Trim
11/15/2010
Often confusing, pointless and bureaucratic, risk assessments can be daunting and difficult to
complete. This guide takes you through each step and simplifies the whole process.
Birmingham City University – Healthy and Safety
How to Undertake a Risk Assessment
What is a Risk Assessment?
Risk assessments are important tools that are used to identify work activities that could foreseeably
cause harm to staff, students, visitors or members of the public. Risk assessment is a logical process
which analyses each work activity to identify aspects of that activity that could cause harm, these are
called hazards.
Definition: HAZARD - Something with the potential to cause harm
Examples: Chemicals, trailing cables, electricity, working at height and using machinery.
Hazard and Risk
However it is important to remember that the presence of a hazard does not mean that it WILL
cause harm to a person, the likelihood of the hazard causing harm depends on many factors; the
frequency of the activity, the numbers of people exposed to the hazard, the level of training and
safety equipment being used and the degree to which the hazard is being controlled. The severity of
any harm that may be suffered is also important as the greater the level of potential harm the
greater our desire to prevent it. These two factors, likelihood and severity are collectively used to
estimate the level of risk.
Definition: RISK - the likelihood of harm being caused by the hazard and the severity of harm that
could be caused
Examples: Using chemicals without being trained, walking over trailing cables many times during a
day, working with faulty electrical equipment, working on a defective ladder and using unguarded
machinery.
Establishing Which Activities Pose a Risk of Harm
In order to ensure that we undertake risk assessments where they are required we need to identify
all of the activities that are undertaken within each school, faculty or department that may cause
harm. We only need to concentrate on those activities that have foreseeable risk of harm and we
can ignore the insignificant risks from routine activities such as making a cup of tea or using an office
photocopier.
This is simply a list or inventory of work based activities in your area of control or responsibility. To
help with this a checklist has been developed with lists of possible causes of harm from typical
university activities, this is called Risk Mapping. A risk mapping matrix has been developed to help
you with this and this can be found in Appendix 1 of this guidance.
Definition: FORESEEABLE HARM - the harm caused by work activities that are very obvious and
everyone would recognise.
Examples: working on a flat roof undertaking repairs to the edge of the roof on a very windy day.
Everyone would know that this is a dangerous activity.
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 2 of 14
Birmingham City University – Healthy and Safety
Estimating Risks Associated with Activities
An important aspect of risk assessment is that the measures put in place to reduce the risks are
proportional to the level or severity of risk. Often organisations ban activities or put in place
unreasonable degrees of control that appear over the top. Stories in the media of children having to
wear safety goggles to play conkers and local councils banning cheese rolling competitions are just
two examples.
To ensure that the approach at Birmingham City University is proportional and sensible we must
firstly identify what the level of risk actually is for the activity. To do this we use a risk matrix to help
identify both the likelihood of harm being caused and the severity of harm that is the most likely
outcome.
Again a sensible approach is required here as even a trip in an office could lead to a fatal accident,
but this is a very unlikely outcome in normal circumstances. In most cases accidents such as a trip in
an office would result in bruising or occasionally broken bones.
2. First Aid or Minor Property
Damage
3. <3 days absence or
moderate property damage
4. >3 days absence or
moderate property damage
5. Long term injury/ill health.
Major property damage
6. Death, disabling or
widespread property damage
Severity
1. No injury or damage
Risk Assessment = Level of Risk
If you look at the risk matrix below you will see that we have two scales to consider: severity of harm
and likelihood. We always consider the severity of harm first and then the likelihood.
1. Almost
Impossible
2. Very Unlikely
1
2
3
4
5
6
2
4
6
8
10
12
3. Unlikely <
50/50 chance
4. Likely > 50/50
chance
5. Very Likely
3
6
9
12
15
18
4
8
12
16
20
24
5
10
15
20
25
30
6. Virtually
certain
6
12
18
24
30
36
Likelihood
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 3 of 14
Birmingham City University – Healthy and Safety
The horizontal axis has degrees of harm ranging from no harm (value 1) up to fatal injuries and
severe losses (value 6). Use your judgement and identify the most likely harm that would result if a
person was exposed to the hazard bearing in mind what effective controls were in place already to
make the activity safe.
Definition: SEVERITY of HARM - the type of injury or harm most likely to be caused by work
activities.
Examples: If boiling water was being used for cleaning and no protective gloves were available it is
foreseeable that if the water was spilt and it went on a person’s hands the most likely harm would
be scalds. These scalds would need first aid treatment and potentially require a few days absence
from work; this would be rated as 3 on the severity scale.
Next we need to identify how likely it would be for this harm to happen, we need to look at the
activity and identify if anything is being done to minimise the harm being caused. This includes the
training people have received, how frequently the activity is undertaken, any specialist equipment
being used, and how the activity is being carried out.
Using this information we need to identify the likelihood from the scale in the matrix ranging from
almost impossible (value 1) through to virtually certain (value 6). Again use your judgement and
discuss the likelihood with your work colleagues, as long as you come to a consensus there is no
exact science in risk estimation.
Definition: LIKELIHOOD of HARM - the most probable outcome of someone being exposed to the
hazard and it causing actual harm.
Examples: If boiling water was being used for cleaning and no protective gloves were available and
the boiling water was in a leaking metal bucket stood on a chair, it is likely that someone will be
scalded by the water; this would have a risk rating of 4 on the likelihood scale.
To identify the levels of risk for each hazard simply work your way along the vertical and horizontal
axis and calculate the overall score. In the examples given above we have a severity rating of 3 and a
likelihood rating of 4 so the overall risk rating is 12.
Analysing the Level of Risk
Once we have identified potential hazards and estimated the magnitude of the risk we then need to
decide whether the risks are acceptable, tolerable or unacceptable, this is called risk evaluation. We
may decide that if a hazard is unlikely to cause harm and if it did the harm was minor, we would
accept this level of risk as low. Consequently we may not need to take any action to prevent the
hazard causing harm and we would evaluate the level of risk as acceptable.
Definition: ACCEPTABLE RISK a judgement that recognises a low level of risk because both the
likelihood and the severity of harm are low
Examples: Using an office shredder with safety features such as a guard, warning labels and stop
mechanisms is unlikely to cause harm as you would not be able to get any clothing, or hair caught in
it and the machine could be stopped if needed.
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 4 of 14
Birmingham City University – Healthy and Safety
Some risks would be considered to be tolerable, this is not ideal but we cannot reduce the risks any
further and will work around the levels of risk with training and other control processes.
Definition: TOLERABLE RISK - a judgement that recognises a medium level of risk where both the
likelihood and the severity of harm are significant but cannot be eliminated or reduced.
Examples: a chain saw (as used in landscaping and tree work) is a very dangerous piece of
equipment that cannot be guarded or made safe. We can only rely on the high skill levels of the
people using the chainsaw and the protective equipment they wear to make the use of the saw safe.
This is tolerated as there are few suitable alternatives and the risk is managed.
Finally some risks are unacceptable as they give rise to high levels of risk where the likelihood and
the severity of harm are both high. In the event that an activity is rated as having unacceptable risks
the activity would need to cease until other arrangements could be introduced to reduce the levels
of risk.
Definition: UNACCEPTABLE RISK - a judgement that recognises a HIGH level of risk because both the
likelihood and the severity of harm are severe and cannot be eliminated or reduced.
Examples: Allowing staff untrained in chemical handling to undertake cleaning activities in areas
where there are dangerous chemicals which could cause fatal illnesses following exposure.
To help with the analysis of risks the following table can be used as general guidance but again you
may use your judgement to identify your own analysis.
1-6
Insignificant
7-12
Low
13-29
Medium
30-35
High
>35
Critical
Acceptable /
Tolerable
Tolerable
Unacceptable
Identifying Ways of Reducing Risks
Risks levels can be reduced through risk elimination, risk reduction or risk mitigation.
Whilst it is desirable to eliminate all risks from work activities, it is recognised that this is not always
possible so managing the risk by reducing the likelihood, severity or both would be the most
preferable option if we cannot eliminate the risk completely.
To reduce the likelihood we can reduce how often the task is undertaken, reduce the quantities of
the substance used or put physical barriers between the person and the hazard. Using training, safe
working methods and personal protective equipment would also lower the likelihood but these are
considered to be less effective options as they rely on human behaviour.
To reduce the severity we can look at substituting hazardous chemicals with less hazardous ones or
using less hazardous equipment in place of older unsafe equipment.
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 5 of 14
Birmingham City University – Healthy and Safety
If this is not a possible option then mitigating the severity of injury using safety equipment or
protective devices would be considered to be a last resort.
This approach of using a priority of actions to deal with risk is referred to as a hierarchy of controls.
More effective controls
Hierarchy of Controls
Eliminate
The risk or the activity either by removing the hazard or
substituting a hazardous item for a non hazardous alternative.
Reduce
The amount of time exposed to the hazard or quantity of the
hazard that is likely to cause harm.
Isolate
The person from the hazard with a physical barrier or suitable
distance.
Control
The amount of people that have access to the hazard or ensure
that those exposed follow a safe method of working.
Personal
Suitable to protect those exposed from the hazard.
Protective
Equipment
Discipline and
Training
Asking people to use sensible practice and follow local rules
when undertaking hazardous activities.
Implementing Risk Control Measures
As a risk assessor, once you have identified ways of eliminating, reducing or mitigating the risks
associated with each activity you must ensure that the risk controls that you have identified are
reasonably practicable.
Reasonably practicable is a legal definition which aims to ensure that controls are effective in
eliminating or reducing risk, and that they are proportional to the magnitude of risk and can be
practically implemented.
Definition: REASONABLY PRACTICABLE - a judgement that balances the level of risk against the
time, costs, benefits and inconvenience required to implement solutions to the risk.
Examples: it would be disproportionate to ask a student to wear safety glasses when writing with a
pencil just in case the pencil lead broke and hit them in the eye. The risk is low so precautions can
be equally as low.
Once you have identified some sensible and practical solutions you need to discuss these with the
manager responsible for the activities you have assessed. As a risk assessor you are responsible for
identifying the potential risks and identifying improvements; the manager responsible for the
activity or the area is responsible for implementing the solutions. This would include ensuring that
staff are briefed or trained in any new working practices.
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 6 of 14
Birmingham City University – Healthy and Safety
Once you have agreement with the responsible manager you can document the detail of the
assessment and can both sign the document as a commitment to improvement.
However as the risk assessor it is your responsibility to keep a check on the manager and monitor
the implementation of the agreed actions.
Re-estimating the Levels of Risk
Once the actions have been agreed you need to recalculate the levels of risk to show that the risks
have been reduced by the action that has been taken. The process for this is exactly the same as the
previous risk rating and uses the same risk matrix.
It is important to understand that unless the hazard has been completely removed the level of
potential harm remains the same; it is only the likelihood that will be reduced.
In some instances even though all possible and reasonably practicable action has been taken to
control the risk there are some risks that still remain that cannot be eliminated, these are called
residual risks, these residual risks can be both tolerable and acceptable.
Definition: RESIDUAL RISK - a risk that remains after everything that can reasonably be done to
control the risk has been implemented.
Examples: staff using a craft knife to prepare art work displays can only rely on their training and
their personal competence of using the knife to prevent cuts.
Monitoring and Review
As the risk assessor you also have the responsibility to monitor and review the risk assessment once
it has been completed and signed off. You will need to monitor the effectiveness of the risk controls
that you have implemented as staff may be reluctant to change the method of working or may not
feel that wearing personal protective equipment is necessary.
You will also need to review the risk assessment if any significant changes are made to the work
activity such as a change in machinery or equipment.
You will also need to review the risk assessment annually even if no changes to the work activity are
made to ensure that the risk assessment is still current and that new equipment or materials have
been made available which are safer to use.
Definition: SIGNIFICANT CHANGES – any changes in the work activity that alters the level of risk in
any way, due to location, personnel, equipment or machinery.
Examples: if a dangerous piece of equipment is moved from one location to another the risks of
injury may change due to the new environment that the equipment is in.
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 7 of 14
Birmingham City University – Healthy and Safety
Risk assessments should also be reviewed when any of the control mechanisms fail leading to an
incident or accident or near-miss.
Definition: Accident - an unplanned or uncontrolled event leading to actual harm, loss or injury.
Examples: a box falling from a high shelf and hitting a person on the head causing concussion.
Definition: Incident - an unplanned or uncontrolled event leading to potential harm, loss or injury.
Examples: a box falling from a high shelf and not hitting anyone as no one was in the vicinity.
Finally, significant findings of risk assessments should be kept locally and, recorded and
communicated where necessary.
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 8 of 14
Birmingham City University – Healthy and Safety
BIRMINGHAM CITY UNIVERSITY - GENERAL RISK ASSESSMENT RECORD
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 9 of 14
Revised Risk Rating
Responsibility
for action and
timescales to
complete
Revised Likelihood
Action required to reduce the
risk to an acceptable level
Revised Severity
Tolerable Risk?
What control measures
are in place to prevent
this from happening
Initial Risk Rating
Consequences of
exposure to the hazards
Who or
what is at
risk of
injury or
loss
Initial Likelihood
Hazards Associated
with the Activity
LOCATION OF ACTIVITY
Initial Severity
DESCRIPTION OF ACTIVITY
Birmingham City University – Healthy and Safety
Date Risk Assessment Completed
Assessor Name
Manager Responsible for Assessment
Date Assessment Actions Completed
Date of Next Review (max 12 months)
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 10 of 14
Revised Risk Rating
Responsibility
for action and
timescales to
complete
Revised Likelihood
Action required to reduce the
risk to an acceptable level
Revised Severity
Tolerable Risk?
What control measures
are in place to prevent
this from happening
Initial Risk Rating
Consequences of
exposure to the hazards
Initial Likelihood
Hazards Associated
with the Activity
Who or
what is at
risk of
injury or
loss
Initial Severity
BIRMINGHAM CITY UNIVERSITY - GENERAL RISK ASSESSMENT RECORD
Birmingham City University – Healthy and Safety
Faculty/Department: …………………………
Appendix 1
RISK MAPPING PROFORMA
Ref.
Activities
1
Acceptance of school pupils on work placements
2
Activities affecting personal safety, e.g., handling money or
valuables, lone working, work in the community and work
with people where there is potential for violence
3
Use of Biological Agents
4
Use of fuels and high energy substances, and processes with a
potential to propagates fire or explosion
5
Use of hazardous substances, chemicals, dust or fume
6
Use of Computers
7
Work in Confined spaces
8
Construction and refurbishment
9
Use, handling and storage of Equipment;
10
Organising and running events;
11
Field work
12
General office work
13
Home working
14
Work near or with hot or cold surfaces, materials or liquids,
15
Independent practical work by final year or new postgraduate
students
16
Lecturing
17
Letting of premises and housing accommodation
18
Lifting, moving and handling
19
Use or maintenance of machinery;
20
Placement of students on work experience
21
Practical course work by students
22
work with pressure vessels and lines, including compressed
gases;
23
Provision of food
24
use of radioactive sources and ionising radiation generators
Applicable
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Risk
Classification
Degree of Risk Control
Page 11 of 14
Birmingham City University – Healthy and Safety
25
Repair, maintenance and servicing including work on
electrical systems
26
Use, handling, storage and disposal of sharps;
27
Organising and running societies,
28
Sports and exercise activities including organising and running
them
29
Use of temporary staff and visiting lecturers,
30
Travel on business in the UK
31
Travel overseas
32
Handling or disposal of waste
33
Welding
34
Work at night
35
Working with noisy equipment or in a noisy environment
36
Work at height
37
Work with electricity or strong magnetic fields
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 12 of 14
Birmingham City University – Healthy and Safety
1. Identify activities in which your staff/students are involved
2. Identify your assessed risk classification, ie., High, Medium High, Medium or Low (see table 1)
3. Assess the extent to which these risks are controlled in your department (see table 2)
Table 1:
Risk classification criteria for activities or other factors
Risk level
General criteria
Example of specific criteria for chemicals
High
There is potential for serious injury or ill health.
In certain cases a single incident could affect
many people. The risks arising from the activity
may be many with complex interactions.
Specialist knowledge is often necessary to
ensure that these risks are avoided or
minimised. Management control is essential to
inhibit realisation of the potential risk
Substances with serious or multiple risk
characteristics. Very toxic substances for which
there are no safe limits (e.g., carcinogens, skin and
respiratory sensitisers). Materials which are
radioactive, or unstable, high-energy substances,
or not fully characterised but have the above
characteristics. Specialist assessments are
necessary to define control measures including
monitoring, management and engineering
controls, and contingency plans which are likely to
be complex.
Medium
high
Could cause serious injury or ill health but the
likelihood, severity, or complexity is reduced
due to the level and effectiveness of controls
that are in place or the intrinsic features of the
activity. Control measures do not generally
need specialist knowledge. Good practice is
available. Management control is important to
ensure that control measures are applied and
are effective.
Toxic or highly flammable or reactive materials
that can be contained using standard controls.
There are specified safe limits for occupational
exposure. Control measures need to be specified.
Contingency plans are necessary but
straightforward.
Medium low
Could, if taken to the extreme, cause serious
injury or ill health, but application of good
practice minimises the risk. Staff, once aware of
the risks, are able to limit their realisation.
Substances classed as harmful, irritant, corrosive,
or flammable possibly in large quantities with welldefined control and contingency measures.
Low
Are not free of risk, but the risks are generally as
low as those to which people are exposed
outside of work. Common sense is likely to be
the most reasonable yardstick.
Non-hazardous substances, i.e., low chemical
reactivity, no adverse health or environmental
effects, not flammable, nor explosive.
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 13 of 14
Birmingham City University – Healthy and Safety
Table 2: Degree of Risk control
Criteria
Excellent
There is evidence that well-defined, effective controls are in place and being applied for
all significant risks. Staff demonstrate positive attitude and behaviour with application
of control measures. New risks are being identified and preventative measure instigated
before incidents occur.
Good
There is evidence that well-defined, effective controls are in place. Application is
reasonable though may not be perfect.
Moderate
There is evidence that some controls are in place but they lack rigour in terms of detail
or in their application; and there is likely to be evidence of failure to prevent the risk
occurring.
Poor
There is a lack of effective control. Evidence of lack of controls, or controls not
addressing the risk, or controls are not being applied, or accidents and incidents
occurring.
How to Undertake a Risk Assessment Ver.1.1 28/10/2010
Page 14 of 14