How to write a risk assessment: the HSE five steps explained

A risk assessment is simply a careful look at what in your work could harm people, and whether you are doing enough to prevent it. Every employer in the UK must carry one out. It does not need to be long or complicated, but it does need to be honest and kept up to date.

The Health and Safety Executive (HSE) breaks the job into five steps.

Step 1: Identify the hazards

A hazard is anything that could cause harm: a chemical, working at height, a forklift, a trailing cable, a heavy box, a lone worker visiting clients, or a workload that causes stress.

Walk around your workplace and think about what could reasonably cause harm. Good ways to find hazards:

• Ask your staff. The people doing the job often know the risks best.
• Look at your accident book and any near misses or ill health records.
• Think about jobs that are not done every day, such as maintenance, cleaning and changeovers.
• Read manufacturers' instructions and safety data sheets.
• Think about long term health hazards such as noise, dust and stress, not just accidents.

Step 2: Decide who might be harmed and how

For each hazard, think about who could be hurt: employees, contractors, visitors, members of the public. Pay particular attention to people who may be more at risk, such as new or young workers, new and expectant mothers, and people working alone. Then note how they could be harmed, for example "back injury from lifting boxes onto high shelves".

Step 3: Evaluate the risks and decide on controls

Now judge how likely harm is and how serious it could be, and look at what you already do to control it. Ask yourself:

1. Can I get rid of the hazard altogether?
2. If not, how can I control the risk so that harm is unlikely?

HSE expects you to work through controls in a sensible order, starting with the most effective:

• Remove the hazard, or swap it for something less dangerous.
• Separate people from it, for example with guards or barriers.
• Reduce exposure through safer systems of work, training and supervision.
• Protect with personal protective equipment (PPE) as a last resort.

You are not expected to remove every risk, but you are expected to do what is reasonably practicable to protect people.

Step 4: Record your significant findings

If you employ 5 or more people, you must write down the significant findings. That means:

• the hazards,
• who might be harmed and how,
• what you are already doing, and what further action is needed.

Keep it short and practical. A clear table with one row per hazard works well. If further action is needed, give each action an owner and a date, then check it gets done.

Step 5: Review and update

A risk assessment is not a one off document. HSE says you must review the controls you have put in place to make sure they are working. You should also look at it again when:

• you bring in new equipment, substances or ways of working,
• there has been an accident, near miss or case of ill health,
• staff raise a concern,
• the team or the premises change.

Writing a review date on the assessment, and keeping to it, is one of the easiest ways to show an inspector that health and safety is under control.

Common mistakes to avoid

• Copying a generic template without checking it matches what really happens on your site.
• Listing hazards but no actions. The point is to decide what you will do.
• Never sharing it. Staff need to know the risks and the controls that apply to them.
• Filing it away. An assessment written three years ago for a different team will not protect anyone.

How MYRA helps

MYRA Compliance helps you build risk assessments quickly with AI assistance, assign actions with due dates, and keep every review date in view. You can also upload an existing assessment and MYRA will pull out the actions for you.

Find out more about risk assessments in MYRA Compliance.