General Risk Assessment Process

What are the 5 steps to risk assessment?

It is recommended that you adopt the 5 steps to risk assessment approach.  These steps are consistent with other types of risk assessments (fire risk assessment) that you might have carried out.  The importance of risk assessment will be seen as we go through the process.  The steps are:

1. Identify the hazards.
2. Identify people who might be harmed and how they might be harmed.
3. Evaluate the risks and decide on appropriate, proportionate controls.
4. Record finding and implement .
5. Review the assessment and update where necessary.

Let’s take a closer look at each of these steps.

It is important to consider all relevant hazards. Where relevant, it is recommended that a walk-around of the workplace is undertaken so that hazards are not overlooked.  Ask your employees, colleagues and others involved in your work activities to help you identify the hazards.

You should consider both routine activities (normal business) as well as non routine activities such as maintenance or repair work.  In deciding what your hazards are in the workplace you might find it easier to first think of the effect of the hazard.

Key Point: A hazard is anything with the potential to cause harm

Hazards can be divided into the different categories and a few examples are listed below:

Depending on your organisation and range of business activities, you might interact with many different ‘types’ of persons.  This could range from employees, contractors, members of the public and others who might be affected by your business activities.  Below is a selection of persons:

• Employees;
• Members of the public;
• New and expectant mothers;
• Young persons;
• Visitors to your premises;
• Contractors;
• Maintenance contractors;
• Volunteers;
• Employees of people with whom you share a site, building or premises;
• Occasional visitors, including persons making deliveries;
• Persons with specific disabilities;
• Remote workers – those working remotely away from an office.

How people can be harmed varies depending on the activity being undertaken.  It is helpful to group people into categories such as employees, visitors, and members of the public.  For each group of people, consider how they might be harmed, for example, visitors tripping over a poorly located cable.

Having now identified what hazards exist and who might be harmed by these hazards, one of the easiest ways of evaluating the risk is to compare what you currently do now with what is good practice.  Examples of good practice can be found on the HSE’s website or from specific industry guidance.

 How are risks evaluated?

A common method for evaluating risks is to consider with equal importance the impact (severity) of the risk occurring and the likelihood of it occurring, and then multiplying the impact score with the likelihood score to obtain an overall risk score (i.e. estimated risk).  This is called a risk matrix.  A 3×3 matrix or a 5×5 matrix are commonly used.  The key to using these methods is to be consistent in your approach.

It should be remembered that risk scoring often involves a degree of judgement or subjectivity. Where data or information on past events or patterns is available, it will be helpful in enabling more evidence-based judgements.

The likelihood and severity scores should be based on an agreed methodology.  An example of a methodology is shown below:

A risk matrix chart can now be used to work out the risk.  An example chart is shown below which matches up with the likelihood and severity tables above.

How to decide what level of action to take?

If we based our outcome on the risk matrix chart above we would have 3 levels of risk.  Low, Medium and High.  No need to complicate the process

How to decide which controls are suitable?

When deciding which controls are suitable and adequate to reduce the risk, you should consider the “hierarchy of control”. By using the top level controls, you are more likely to effectively control the risk of injury to staff and others affected by the activity. Reliance on lower level controls will mean that the risks of injury are greater.

The most effective controls are those which do not rely on human behaviour to implement, such as physical controls that prevent something happening. Controls that rely on people wearing personal protective equipment or following rules are therefore less effective.

A good acronym to remember when thinking of controls is ERIC PD

E – Eliminate the hazard
R – Reduce or substitute
I – Isolate the hazard from the person
C – Control, this could include engineering controls and administrative controls; eg safe system of work procedures, policies and procedures, training etc.
P – Personal Protective Equipment (PPE)
D – Discipline, ensuring that controls are monitored and employees are following the systems that have been setup.

There is no requirement to have your risk assessments written down if you have less than 5 employees.  We would however, recommend that in order to demonstrate that you have done all that is required (reasonably practicable) to control health and safety risks, it is documented.

Your documented format should follow the risk assessment steps as outlined above.

Few of our business activities and or workplaces remain the same, with the introduction of new ways of working, new equipment and methods of using it, but to name a few ways in which organisations change.  To maintain a preventative approach to managing risk, it is important that we regularly review our risk assessments as and when changes occur. Examples of when a review should take place are as follows:

• When there are significant changes to:
  • the activities or task being undertaken;
  • the equipment or materials being used;
  • the people involved (particularly important for assessments relating to medical conditions etc.);
  • the processes or procedures being followed; or
  • the environment or location where activities takes place.
• If there has been an accident, incident or near miss, a review should be carried out as part of the manager’s investigation so as to reduce the likelihood of the accident reoccurring.
• If an employee is returning to work after suffering an injury or illness, that is associated with work or could be affected by a work activity, the Line Manager should review any risk assessments relating to their work activities to identify whether any amendments or additional controls are required to ensure their injury or illness is not made worse.

A review of a risk assessment may be as simple as checking that the hazards listed still reflect what happens in practice, and that the control measures are still sufficient to reduce the risk.  It is recommended that persons with responsibility for managing risk assessments plan to review them at least annually.

Where the risk assessment relates to a health related matter or a new and expectant mother, then a review of the assessment should take place more frequently, normally at a time set between the assessor and the person which the risk assessment is for.  For example a new and expectant mother may in certain circumstances need the assessment to be reviewed weekly etc.

🎥 Introductory Video: The 5 Steps to Risk Assessment in Action

Undertaking a workplace risk assessment doesn’t have to be complicated. In this introductory video, you’ll see how the five steps are applied in a real office environment, giving you a clear starting point for your own assessments.

Prefer to watch the whole series? Start here and let it play through:

Risk Assessment Playlist (begins with the intro).

Frequently Asked Questions About the Five Steps to Risk Assessment

How Can We Help?

Following our 5 steps to risk assessment will enable you to start completing risk assessments. We’ve provided a snapshot of the key elements here, but if this is new to you, you may still need extra guidance and support.

From experience, the most important step in the risk assessment process is Step 1 — identifying hazards. It’s also the step that most people, whether new to risk assessments or experienced, find the hardest to get right.

To make this easier, we’ve created a practical guide that takes you through Step 1 in detail, giving you the knowledge and direction to make hazard identification less daunting. If you’d like a copy, just get in touch and we’ll send it to you.

We can also provide a bespoke risk assessment training course for your organisation. We’ll visit your site, gather the necessary information, and deliver training tailored to your operations and the people responsible for risk assessments.

Finally, we can assist with completing your risk assessments directly.

If any of these options would help you, please book a call to discuss your needs.

If you’d like to see these five steps in action, keep scrolling to watch our full risk assessment video series.

✅ Next: Watch the Full Risk Assessment Video Series

Now that you know the five steps, see them applied in real life. Our How to Carry Out a Risk Assessment Video Series walks you through each step using an office workplace example.

Watch the full video series here →