As an employer, you're required by law to protect your employees, and others, from harm.

Under the Management of Health and Safety at Work Regulations 1999, the minimum you must do is:

• identify what could cause injury or illness in your business (hazards)

• decide how likely it is that someone could be harmed and how seriously (the risk)

• take action to eliminate the hazard, or if this isn't possible, control the risk

Assessing risk is just one part of the overall process used to control risks in your workplace.

​

Risk management is a step-by-step process for controlling health and safety risks caused by hazards in the workplace.

You can do it yourself or appoint a competent person to help you.

• Identify hazards

• Assess the risks

• Control the risks

• Record your findings

• Review the controls

Identify hazards

Look around your workplace and think about what may cause harm (these are called hazards). Think about:

• how people work and how plant and equipment are used

• what chemicals and substances are used

• what safe or unsafe work practices exist

• the general state of your premises

Look back at your accident and ill health records as these can help you identify less obvious hazards. Take account of non-routine operations, such as maintenance, cleaning or changes in production cycles. 

Think about hazards to health, such as manual handling, use of chemicals and causes of work-related stress.

For each hazard, think about how employees, contractors, visitors or members of the public might be harmed.

Vulnerable workers

Some workers have particular requirements, for example young workers, migrant workers, new or expectant mothers and people with disabilities.

Talk to workers

Involve your employees as they will usually have good ideas.

Assess the risks

Once you have identified the hazards, decide how likely it is that someone could be harmed and how serious it could be. This is assessing the level of risk.  

Decide:

• Who might be harmed and how

• What you're already doing to control the risks

• What further action you need to take to control the risks

• Who needs to carry out the action

• When the action is needed by

Control the risks

Look at what you're already doing, and the controls you already have in place. Ask yourself:

• Can I get rid of the hazard altogether?

• If not, how can I control the risks so that harm is unlikely?

If you need further controls, consider:

• redesigning the job

• replacing the materials, machinery or process

• organising your work to reduce exposure to the materials, machinery or process

• identifying and implementing practical measures needed to work safely

• providing personal protective equipment and making sure workers wear it

Put the controls you have identified in place. You're not expected to eliminate all risks but you need to do everything 'reasonably practicable' to protect people from harm. This means balancing the level of risk against the measures needed to control the real risk in terms of money, time or trouble.

You can find more detailed guidance on controls relevant to your business.

Record your findings

If you employ 5 or more people, you must record your significant findings, including.

• the hazards (things that may cause harm)

• who might be harmed and how

• what you are doing to control the risks 

To help you, we have a risk assessment template and examples. Do not rely purely on paperwork as your main priority should be to control the risks in practice.

Review the controls

You must review the controls you have put in place to make sure they are working. You should also review them if:

• they may no longer be effective

• there are changes in the workplace that could lead to new risks such as changes to:

  • staff

  • a process

  • the substances or equipment used

Also consider a review if your workers have spotted any problems or there have been any accidents or near misses.

Update your risk assessment record with any changes you make.

​

Risk assessment template and examples

Template

You can use a risk assessment template to help you keep a simple record of:

• who might be harmed and how

• what you're already doing to control the risks

• what further action you need to take to control the risks

• who needs to carry out the action

• when the action is needed by

• Risk assessment template (Word Document Format) (.docx)

• Risk assessment template (Open Document Format) (.odt)

Example risk assessments

These typical examples show how other businesses have managed risks. You can use them as a guide to think about:

• some of the hazards in your business

• the steps you need to take to manage the risks

Do not just copy an example and put your company name to it as that would not satisfy the law and would not protect your employees. You must think about the specific hazards and controls your business needs.

• Office-based business (PDF)

• Local shop/newsagent (PDF)

• Food preparation and service (PDF)

• Motor vehicle repair shop (PDF)  

• Factory maintenance work (PDF)

• Warehouse (PDF)

​

More detail on managing risk

More detailed guidance for businesses on controlling the risks of a wide range of specific hazards can be found in The health and safety toolbox: How to control risks at work.

Advice for employers in larger and higher-risk businesses and organisations can be found in Managing for health and safety (HSG65).

Employers in major hazard industries require more detailed arrangements for managing risks.

We also provide advice on our topics and industries pages.

The Regulations

You can read the full text of the Management of Health and Safety at Work Regulations 1999 on the legislation.gov.uk website.