Workplace Risk Assessment: The Five Steps, and How Much to Write Down

Almost everything written about this reproduces “the five steps” and stops. Two things get left out that decide how much work you actually have to do: how much you must write down, and how far you must go. Both have proper answers.

Last reviewed: 20 September 2026 against HSE’s managing risks and risk assessment guidance (updated March 2025) and its steps and template pages (updated June 2024).

Is a risk assessment a legal requirement?

Yes. The duty sits in the Management of Health and Safety at Work Regulations 1999, which require a suitable and sufficient assessment of the risks to the health and safety of your employees, and of anyone else who might be affected by what you do — contractors, visitors, customers, the public. Above it sits the Health and Safety at Work etc. Act 1974 and its general duty to protect people so far as is reasonably practicable.

“Suitable and sufficient” is doing the work in that sentence. It does not mean exhaustive. It means proportionate to the risk: a two-person office does not need what a fabrication shop needs, and HSE does not expect it to.

The five steps

Step 3 is where most assessments are weakest. A document that identifies hazards and rates them carefully, then lists “staff to take care” as the control, has not controlled anything. The order matters too: PPE is the last resort, not the first answer, because it protects one person and only while they wear it correctly.

Why you will see three steps, four steps and five

Search this and you will be told confidently that HSE has five steps. You will also find HSE’s own overview page framing it as three actions. Neither is wrong, and the history explains it.

For years HSE published a leaflet called Five steps to risk assessment (INDG163), and that framing embedded itself in every training course in the country. That leaflet was withdrawn and replaced by Risk assessment: A brief guide to controlling risks in the workplace. HSE’s current web guidance still uses five headings — identify, assess, control, record, review — but with a meaningful change: controlling the risk is now a step in its own right rather than something tucked inside evaluating it. The shorter three-action summary on the overview page is the same thing compressed.

So if a template you have been handed says “five steps” it is not out of date in substance. But if it treats control as an afterthought of evaluation, it is using the older shape, and the newer emphasis is the better one to work to.

Hazard or risk? They are not the same

The distinction is not pedantry — assessments go wrong when it collapses. A hazard is anything with the potential to cause harm: a chemical, a ladder, a wet floor, a deadline that pushes people to rush. The risk is the likelihood that someone is actually harmed by it, and how badly.

Bleach in a locked store cupboard and bleach decanted into an unlabelled bottle by the sink are the same hazard and wildly different risks. Your controls change the risk; they rarely remove the hazard.

What “reasonably practicable” actually means

HSE puts it directly: “you’re not expected to eliminate all risks but you need to do everything ‘reasonably practicable’ to protect people from harm.”

It is a balance between the risk and the time, trouble and cost of controlling it — but the balance is weighted. You cannot decline a control simply because it is inconvenient or because business is tight. The greater the risk, the more you are expected to do about it, and cost only wins the argument when it is grossly disproportionate to the harm avoided. In practice, if a control is cheap and the harm is serious, there is no argument to have.

Do I have to write it down?

If you have five or more employees, yes — and this is where most people do more work than they need to. The requirement is to record the significant findings, not every hazard anyone can imagine. HSE says the record should show:

• the hazards — the things that may cause harm
• who might be harmed and how
• what you are doing to control the risks

Fewer than five employees and there is no legal duty to write it down, though doing so is sensible for the same reason as everywhere else: an unwritten assessment is indistinguishable from no assessment the moment an inspector, an insurer or a solicitor asks. A page is fine. A forty-page document nobody reads is worse than a single sheet that people actually follow.

Who should carry it out?

A competent person — which the law describes in terms of knowledge, experience, skill and training rather than a specific certificate. For most small businesses that is the owner or manager, and HSE’s clear position is that you do not need a consultant for ordinary workplaces.

Where it is worth getting help: complex processes, unusual hazards, or where nobody in the business has the knowledge to judge whether a control is adequate. Training is usually the cheaper answer than an outsourced document, because the person who knows the work is the person best placed to assess it — they just need the method.

Whoever does it, involve the people doing the job. They know which control gets bypassed when the line is busy, and an assessment written at a desk will not.

Who to think about

“Who might be harmed and how” means more than the person holding the tool. HSE specifically names groups who may be at greater risk:

• Young workers and those on work experience — less experience, less likely to speak up
• New and expectant mothers — a separate consideration once you are told
• Migrant workers — where language may affect instruction and training
• Workers with disabilities or particular health conditions
• Lone workers, night workers, agency and temporary staff, who may miss the briefing everyone else got
• Visitors, contractors, customers and the public, who do not know your hazards at all

When to review it

• After any significant change — new equipment, process, substance, premises or staffing
• After an accident or a near miss, which is evidence a control failed
• When new people arrive who are not covered by the assumptions you made
• When guidance or law changes
• Periodically anyway — annually is the common interval, though nothing in law fixes it

An assessment dated five years ago describing a workplace that has since changed is not a defence; it is evidence you stopped paying attention.

The other assessments you may need

The general risk assessment is the parent. Several specific duties sit underneath it, and people are often surprised to find they need more than one.

They are not duplicates. The general assessment identifies that a hazard exists; the specialised one works through it in the detail its own regulations demand. If your general assessment says “chemicals used in cleaning”, COSHH is where you decide what that means in practice.

HSE’s free template and examples

Before you buy a template, HSE publishes one free in Word and OpenDocument formats, plus six worked examples: an office-based business, a local shop or newsagent, food preparation and service, a motor vehicle repair shop, factory maintenance work, and a warehouse. If one of those is close to what you do, it is the fastest honest start available, and it is written by the regulator who will read yours.

Common mistakes

What this guide does not cover

It does not cover fire risk assessment, which sits under a separate regime, nor sector-specific regimes such as CDM in construction. It is written for Great Britain; Northern Ireland has its own equivalent regulations. It describes the method rather than producing your assessment — that has to be specific to your workplace.

Risk assessment training

Our Level 3 Risk Assessment course runs to a minimum of seven hours and covers how assessments should be conducted, the legal requirements, how to organise and implement a risk assessment programme, and how to identify the training that an assessment reveals is needed. It is built around the point HSE makes about competence — that a risk assessment must be carried out by someone with the knowledge, experience and skill to judge whether a control is adequate. Learners complete an assignment based on their own workplace, so what comes back is an assessment of somewhere real. The certificate is valid for three years.

It sits alongside our wider health and safety courses, which include Levels 1 to 3, manual handling and COSHH, as open course places and as group training at your premises for up to 12 people.

Deals

Health & Safety Courses

Frequently asked questions

Is a risk assessment a legal requirement?

Yes. The Management of Health and Safety at Work Regulations 1999 require every employer to make a suitable and sufficient assessment of the risks to employees and to anyone else affected by the work. It applies whatever the size of the business.

What are the five steps of a risk assessment?

Identify hazards; assess the risks; control the risks; record your findings; review the controls. HSE’s current guidance uses those five headings, with controlling the risk as a step in its own right rather than part of evaluating it.

Do I have to write my risk assessment down?

If you have five or more employees, yes — and you must record the significant findings: the hazards, who might be harmed and how, and what you are doing to control the risks. Below five employees there is no legal duty to record it, though it is still worth doing.

Does every risk have to be recorded?

No. The duty is to record the significant findings. Recording every trivial risk makes the document longer and less likely to be read or followed, which is the opposite of the intention.

What does 'reasonably practicable' mean?

It is a balance between the level of risk and the time, trouble and cost of controlling it — weighted so that cost only wins where it is grossly disproportionate to the harm avoided. HSE puts it as: you are not expected to eliminate all risks, but you must do everything reasonably practicable to protect people.

Who can carry out a risk assessment?

A competent person: someone with the knowledge, experience, skill and training to do it properly. There is no mandatory qualification, and for most workplaces it is the owner or a manager rather than a consultant.

How often should a risk assessment be reviewed?

After any significant change, after an accident or near miss, when new people or new guidance change the picture, and periodically in any case. Annually is a common interval, but no fixed period is set in law.

What is the difference between a hazard and a risk?

A hazard is anything with the potential to cause harm. The risk is how likely it is that someone is actually harmed, and how seriously. The same hazard can present very different risks depending on how it is controlled.

Do I need a separate COSHH or manual handling assessment?

Often, yes. They are specialised assessments under their own regulations — COSHH 2002 for hazardous substances, the Manual Handling Operations Regulations 1992 for handling. Your general assessment identifies that the hazard exists; the specialised assessment works through it in the required detail.

Is there a free risk assessment template?

Yes. HSE publishes one in Word and OpenDocument formats, along with six worked examples covering an office, a local shop, food preparation and service, motor vehicle repair, factory maintenance and a warehouse.

Sources

• HSE, Managing risks and risk assessment at work
• HSE, Steps needed to manage risk
• HSE, Risk assessment template and examples
• Management of Health and Safety at Work Regulations 1999; Health and Safety at Work etc. Act 1974

Not sure whether yours would stand up, or who in your team should be trained to write them? Call 0845 838 4643 or use the enquiry form on this page.