A risk assessment is a careful look at what in your workplace could cause harm, so you can decide whether you are doing enough to prevent it. It is a legal requirement in many countries and the starting point of every effective health and safety management system.
Hazard vs risk
A hazard is anything with the potential to cause harm — a chemical, a moving machine, a wet floor. Risk is the likelihood that harm will actually occur, combined with how severe it would be.
Step 1: Identify the hazards
- Walk the workplace and observe real tasks, including non-routine work like maintenance and cleaning.
- Talk to workers — they know where near misses happen.
- Review accident records, manufacturer instructions and safety data sheets.
Step 2: Decide who might be harmed and how
Consider employees, contractors, visitors, young or new workers, pregnant workers and members of the public. Different people face different risks.
Step 3: Evaluate the risk and decide on controls
Use a simple risk matrix. Score the likelihood (rare to almost certain) and the severity (minor to fatal), multiply them, and rank the result as low, medium, high or extreme. Then apply the hierarchy of controls:
- Eliminate the hazard
- Substitute with something safer
- Engineering controls (guards, ventilation)
- Administrative controls (procedures, training, rotation)
- PPE
Step 4: Record your findings and act
Write down the hazards, the people at risk, the controls in place and the further actions required — with an owner and a due date for each. Share the results with the people affected.
Step 5: Review and update
Review the assessment after an incident, when equipment, materials or processes change, and at regular intervals. A risk assessment is a living document, not a one-off file.
Common mistakes
- Copying a generic assessment without visiting the site
- Ignoring non-routine tasks
- Relying only on PPE and training
- Not following up on actions
Key takeaway: Look, think, control, record, review — and involve the people who do the work.
Frequently asked questions
Who should carry out a risk assessment?
A competent person who understands the work, preferably with input from workers and supervisors.
Do small businesses need written assessments?
Requirements differ, but writing it down helps you manage actions and prove compliance. See our risk assessment training.