The 5 Steps To Risk Assessment (And How To Complete Them) (2024)

Risk assessment is the process of identifying what could harm people in your business, and deciding what action is needed to reduce the risk.

At work, your risk assessment process can follow these 5 steps:

1. Identify hazards
2. Assess the risks
3. Control the risks
4. Record your findings
5. Review the controls

Carrying out a risk assessment might sound complicated, but you've been learning how to risk assess your whole life. And if you've made it this far, you're probably pretty good at it!

You might not realise it but you are risk assessing things all day. When we are driving, working, playing, and even just crossing the road. We ask ourselves, is this safe?

It's a skill we discover as children and develop through experience. We learn when things are hot, not to touch them again.

Yes, some people might be more accident-prone than others. But, no matter how clumsy you think you are, we all have the ability to assess risks. To look at a situation and determine if it is safe to continue.

Risk assessment at work might seem more formal. It's a legal requirement after all. But it serves the same purpose and asks the same question. Is this safe?

That's all a risk assessment is, at its core - an assessment of risk.

But if we all know how to risk assess in everyday life, why do we need "5 steps"? And why has it become a legal requirement?

At work, employers have legal health and safety responsibilities (and so do employees). And you're not choosing do to these activities, you're being told to do them. So they need to be safe (it's the law!).

The hazards might be more complex, depending on the type of work you do. The risks might be more serious than touching something hot. But the overall aim is the same. We need to make sure the activity is safe, or it is made safe.

The 5 steps to risk assessment:

1. Identify the hazards
2. Decide who might be harmed and how
3. Evaluate the risks and decide on precautions
4. Record your significant findings
5. Review your assessment and update if necessary

These are the 5 steps you can work through when writing a risk assessment. Going through this step-by-step process will help you to make sure you have covered all the necessary bases. Ok, we now know the 5 steps, but how do we complete them?

Need to write a risk assessment? Use the free blank risk assessment template to follow along and create your own risk assessment.

1. Identify the hazards

The first step of risk assessment is to identify the hazards. A hazard is something with the potential to cause harm. For example, a substance could be a hazard, it might be toxic, you could spill it and create a slip hazard, or it could be flammable. Any of these things have the potential to cause harm.

A hazard is not a risk. Find out more in the difference between hazard and risk explained.

There may be one hazard or multiple hazards involved with a task or activity.

You don't have to identify every possible hazard, but you should aim to identify any significant hazards. These are things which could result in harm to people.

Hazards can be identified by reviewing the activity, and the working environment.

Consider:

• Equipment
• Transport
• Access
• Handling
• Chemicals
• Fire and Explosion
• Radiation / Biological Hazards
• Environment
• Individuals

Need more examples? Here's 52 examples of workplace hazards.

2. Decide who might be harmed and how

Now it's time to assess the risks, by looking at who might be harmed by the hazards and how.

For each hazard, you need to be clear about who might be harmed. This might be workers carrying out the activity, visitors, or even members of the public if you are working on or adjacent to public areas.

Don't just think about those carrying out the task. Of course, they might be the most obvious people that could be harmed. But what about others?

If the task creates dust or fumes, that could spread to other workers nearby. If you are working in public areas or occupied buildings, you need to think about people beyond your own team.

• The worker or operators
• Adjacent workers
• Particular groups of workers
• All workers
• Visitors
• Other occupants
• Members of the public

You might already be controlling some of the risks with your existing controls. For example, the activity might be noisy, but it will happen in a place that already requires ear protection.

This might reduce how someone could be harmed, but next, you'll decide if there's more you need to do to control the risks.

3. Evaluate the risks and decide on precautions

In step 3 of our risk assessment, we evaluate the risks and decide on precautions to control the risks.

We measure risk by likelihood and severity. This tells us if the risk is low or high. Likelihood is how likely harm could occur, for example, rare or certain. And severity is how serious that harm could be, for example, minor cuts or death.

You might choose to represent this risk level as Low, Medium, or High. Or use a 5x5 risk matrix, a 9x9 matrix or some other scale.

Use the free risk assessment calculator to help assess and prioritise your risk levels. We use a 9x9 calculation simplified into Low, Medium, and High results for your risk levels.

The higher the risk, the more of a priority controlling that risk should be.

Look at each hazard you identified (in Step 1) and the risks they create (in Step 2). How can you manage these risks responsibly?

The control measures you put in place should bring the risk down to an acceptable level before you start work. If the control measures are not in place that need to be, then work shouldn't start or continue until those risks have been controlled.

Risk doesn't have to be zero. There will often be some risk remaining (residual risk) - but it needs to be at an acceptable level. If the risk is still high, and someone could get seriously hurt, then it is unlikely you have done enough to control the risks.

Put in place actions and controls to reduce the risk as much as is reasonably practicable, to reduce the risk to an acceptable level.

Here are the 5 best risk assessment control measures with examples, to help you out with step 3.

4. Record your significant findings

Once you have completed the first 3 steps, it's time to record your significant findings. This is a legal requirement if you have 5 or more employees.

(6) Where the employer employs five or more employees, he shall record—

1. the significant findings of the assessment; and
2. any group of his employees identified by it as being especially at risk.

Although it's not a legal requirement to write your risk assessment down if you have less than 5 employees, it's useful to record your findings no matter what size of business you are.

Clients and others may ask to see it. Your team might need to see it. And businesses of all sizes are required to carry out risk assessments, so having it written down proves that you have done one and gives you a record.

A written risk assessment is a record of your findings and can be used to communicate the hazards and controls to your workforce, and as a record that the assessment has been carried out.

5. Review your assessment and update if necessary

Finally, make sure you review your risk assessment and update if necessary.

Things can change over time, review and revision may be necessary when conditions change or based on feedback from the team completing the activity.

How often you need to review your risk assessment will depend on several factors:

• If the way you work changes.
• If you introduce new technology or equipment.
• If health and safety regulations change.
• If you identify problems.

Even if nothing changes, review your risk assessments periodically and make sure your risk assessment stays up to date.

Find out more in how often do you need to review a risk assessment?

Need help with your risk assessments? We have a large library of risk assessment templates that you can edit and use for your business activities.