The five steps to a risk assessment (HSE framework)
Step 1: Identify workplace hazards
The first step is a systematic search for anything in the workplace that has the potential to cause harm. Hazards fall into several broad categories:
- Physical hazards include manual handling, slips, trips and falls, working at height, fire, driving for work, and using poorly maintained equipment.
- Occupational health hazards include noise, vibration, dusts, and work-related stress.
- Chemical hazards include cleaning agents, industrial solvents, and pesticides.
- Biological hazards include viruses, bacteria, and allergens.
- Psychosocial hazards include violence, bullying, and harassment.
To identify these hazards effectively, walk the workplace and observe what is actually happening. Review manufacturers’ manuals and safety data sheets. Analyse previous incident and near-miss reports. Speak to the people doing the work as they have firsthand knowledge of where problems occur and where existing controls fall short. Safety audits and inspections are also valuable methods for identifying hazards across your workplace.
No hazard identification process should rely on a single method. A combination of observation, documentation review, and worker consultation gives the most complete picture.
Step 2: Decide who might be harmed and how
Once hazards are identified, the next step is to think carefully about who is at risk. This goes beyond direct employees. Any risk assessment should consider:
- Contractors, agency workers, and maintenance personnel who may not be on-site every day but are exposed to hazards when they are.
- Visitors and members of the public who access the premises.
- Cleaners, delivery drivers, and others whose contact with the workplace may be brief but real.
Certain groups require particular attention because they face elevated risk. For example, young workers may lack experience or awareness of specific hazards. Pregnant and post-natal employees may be more vulnerable to certain physical or chemical safety risks. Protecting your workers around chemicals is especially important when assessing roles where exposure is likely. Night and shift workers may face hazards that are not present during standard hours.
People with disabilities or those for whom English is not a first language may need additional controls or communication adjustments.
For organisations with multiple sites and shifting contractor populations, this step requires a robust system for tracking who is on-site and under what conditions.
Step 3: Evaluate the risk level and implement controls
Risk evaluation involves estimating both the likelihood of harm occurring and the severity of that harm if it does. Combining these two factors gives a risk rating. Most organisations use a risk matrix to make this assessment consistent and auditable.
A simple rating system works as follows:
- Low risk: The likelihood of harm is low and the severity is minor. For example, occasional computer use at a well-arranged workstation.
- Medium risk: The likelihood, severity, or number of people exposed is greater. For example, manual handling of heavy loads without mechanical aids. Controls are required to bring the risk down.
- High risk: There is a real likelihood of serious injuries or fatalities. For example, vehicles reversing in an area where pedestrians are present without adequate controls. These risks must be prioritised and treated immediately.
Once the risk rating is established, the decision is whether to accept the risk or treat it. When determining which controls to put in place, the hierarchy of control provides the correct order of priority:
- Eliminate the risk entirely if possible. Remove the hazard or the activity that creates it.
- Substitute the hazard with something less dangerous. Replace a hazardous chemical with a safer alternative.
- Apply engineering controls to isolate people from the hazard. Install guarding on machinery. Separate pedestrian and vehicle routes.
- Apply administrative controls such as safe systems of work, training, job rotation, and procedures that reduce exposure.
- Provide personal protective equipment (PPE) as the last line of defence. PPE should always be used alongside other controls, not instead of them.
In practice, most risk controls involve a combination of these measures. The goal is to reduce residual risk to the lowest reasonably practicable level.
Step 4: Record your findings
Risk assessments must often be documented. This is a legal requirement for employers with five or more employees in Great Britain, and documentation is required for all employers in Ireland as part of a written risk assessment and Safety Statement.
A risk assessment record should capture the hazards identified, the people at risk, the current controls in place, the residual risk rating, any additional controls required, the person responsible for implementing those controls, and the target completion date.
The format can vary. Many organisations use a risk assessment template, and EHS software platforms allow assessments to be completed, stored, and retrieved digitally. For enterprise organisations managing assessments across multiple sites, a centralised digital system is the most effective way to maintain consistency, ensure version control, and make findings accessible to the people who need them.
Completed risk assessments must be communicated to the workers they affect.
Step 5: Review and update the assessment
Risk assessments are not a one-time activity. They must be reviewed regularly and revised whenever circumstances change.
A review should be triggered by any of the following:
- A change in work processes, equipment, or materials
- An incident or near miss
- The introduction of new legislation or guidance
- Significant changes to the workforce
- A scheduled periodic review
HSE guidance recommends that risk assessments be kept current and revisited at regular intervals even in the absence of obvious triggers.
For enterprise safety teams, building a review schedule into an EHS management system ensures that assessments do not become outdated. Automated reminders, version history, and audit trails all support a robust review process.
