Are your workplace risk assessments up to scratch? Read this post to discover the most up-to-date advice.
The UK government have told all businesses that want to operate to carry out a COVID-19 risk assessment, while the Irish government have told employers to review and update their occupational health and safety risk assessments and safety statement to take account of COVID-19.
While the legal requirement to produce risk assessments, and to review them when circumstances change is not new, COVID-19 means there is likely to be more scrutiny of risk assessments – by customers wanting to find out if it is safe to use a business, by employees who need to know if they can return to work without risking their health, and by regulators who will have an added focus on the suitability of risk assessments.
This is a good time to revisit HSE advice on risk assessment. In November 2019 the HSE uploaded new advice on risk assessments. The graphic compares the previous (2014) version of the five steps with the latest version.
2014 vs. 2019
Let’s consider what these differences might mean.
1. Identify Hazards
Some risk assessment schemas present people with a checklist of hazards to identify, making it more likely that significant hazards could be left out because they aren’t on the checklist. Perhaps dropping “the” from this step signifies that we should look more widely for hazards, identifying any reasonably foreseeable cause of harm.
For COVID-19 risk assessments, the obvious hazard is the virus itself, but new ways of working will introduce new hazards. For example, reduced staffing levels can increase lone working and workload, while one-way systems implemented to enable distancing can increase manual handling and emergency escape hazards.
No longer a step: Identify who will be harmed
Omitting this step does not mean the HSE no longer care about who will be harmed - it means the opposite. It has always been the case that to do a suitable and sufficient risk assessment you had to think about people at every step.
You couldn’t identify all the hazards if you didn’t think about contractors, visitors, and members of the public, as well as your employees.
You couldn’t evaluate risk without considering vulnerable people, such as expectant and new mothers, or people with disabilities.
You couldn’t select appropriate controls without asking if younger workers or workers with English as a second language would need more support to apply them.
2. Assess the Risks & 3. Control the Risks
Previously these two steps were mixed up inside a single step, with the focus on evaluation.
Separating these two steps allows a greater emphasis on controlling risk – on making workplaces safer and healthier.
Having identified a hazard in step 1, make sure you know who could be harmed and how, and what you are already doing to control the risk. Then move on to managing the controls.
Advice on COVID-19 reflects this emphasis. Alongside the risk assessment requirement, the other requirements to working safely during the coronavirus pandemic are about practical controls: work from home, implement hygiene procedures, maintain separation, and manage the transmission risk.
Another positive in both the UK and Irish governments’ advice for COVID-19 assessments is that employers should consult with workers.
Worker engagement makes for more effective risk controls, so it is good news that it is being addressed explicitly.
3. Record Your Findings
Although the HSE provides template tables if people wish to use them, it has never insisted on this format.
Only three things need to be recorded: the hazards, who might be harmed and how, and what you are doing to control the risks. This last item should include (or link to) information about who will carry out the actions, and when.
Where controls are already in existing documents such as method statements, or in existing systems such as computerised checklists, these can be referenced rather than repeated. Current HSE advice emphasises “Do not rely purely on paperwork as your main priority should be to control the risks in practice.”
The UK Government have urged employers to share the results of COVID-19 risk assessment with the workforce, and on the organisations' websites. Many organisations are using their Intranets to share the controls with their workforce, while retail businesses with an interest in encouraging people back to shops are sharing their control measures online publicly.
Could greater sharing of risk assessment findings be encouraged beyond COVID-19?
4. Review the Controls
The Management of Health and Safety at Work Regulations require a risk assessment to be reviewed if there is reason to suspect that it is no longer valid or if there has been a significant change “in the matters to which it relates”.
Some organisations regarded this as an annual or even biennial event. Risk assessments were pulled out of a folder after two years, updated with the newest company logo, re-dated, and filed for another two years.
While the requirement to review the risk assessment remains, this rewording is telling you to do more than that. Rather than waiting for a significant change or other “reason to suspect that it is no longer valid” the onus is on the employer to demonstrate that the controls are working.
Some controls need to be reviewed more often than others. For example, if one of your controls is a pre-use user check of a ladder, you might need to review this by checking with a sample of people using ladders each month that they understand what to do, and have the time to do it. A formal six-monthly ladder inspection might need to be recorded twice a year.
For all the new controls required for COVID-19 working, you will need regular reviews in the early days. Are checks being made that soap, towels, and PPE are always available? Is it practical to keep people 2 meters apart once they are working, or do you need to further reduce the number of people in an area or add additional controls?
Your COVID-19 risk assessment is not one to lock away to review in 12 months’ time.