Risk assessment is the foundation of health and safety at work. It is a careful look at what could cause harm, so that you can decide whether enough is being done to prevent it.

Every employer is required by law to assess the risks in their workplace. In this module, you will learn the difference between a hazard and a risk, and the five steps of risk assessment.

• A hazard is anything with the potential to cause harm, such as a wet floor, a chemical, electricity, a ladder or a moving vehicle.
• A risk is the likelihood that someone will actually be harmed by the hazard, together with how serious the harm could be.

For example, a bottle of bleach is a hazard. If it is stored safely and used correctly, the risk is low. If it is decanted into an unlabelled drinks bottle, the risk is high.

The employer is ultimately responsible for making sure that risk assessments are carried out, either personally or by another suitable person. A competent person is someone with the appropriate training, skills, experience and knowledge to carry out the assessment. In practice, members of management and supervision with experience and knowledge are well suited to the task, and they may be helped by specialists. Workers are not responsible for carrying out the assessment, but they should still be involved.

Their experience and knowledge are valuable for spotting hazards that might otherwise be missed, because they do the work every day. If you are in charge of carrying out risk assessments, or you manage or supervise employees, a detailed risk assessment course will give you more in-depth information on how to carry them out and keep them effective.

The employer is responsible for making sure that risk assessments are carried out. They may do it themselves, or appoint a competent person: someone with the right training, knowledge and experience.

Employees should be involved. The people who do the job every day often know best what can go wrong, and their knowledge makes the assessment more accurate.

To find the hazards in your workplace:

• Walk around the workplace, and look at what could reasonably be expected to cause harm.
• Ask employees what they think, and what problems they have noticed.
• Check manufacturers’ instructions and safety data sheets.
• Look at accident and ill-health records.
• Think about long-term health hazards, such as noise or dust, as well as safety hazards.

To identify hazards you must understand the processes and work activities in your workplace. Start by walking around and looking for anything that could cause harm, such as machinery, chemicals, the condition of the workplace and specific work activities, and make a list. Consider the activities that take place, such as lifting and moving materials, and whether they are done by hand or with equipment. Think about occasional activities as well, including machinery maintenance, cleaning operations and work done by contractors.

Think about long-term health problems, such as those caused by exposure to noisy machinery or to chemicals. Finally, review the first aid and accident records, because they may point to hazards you had not thought of. A complete list of hazards gives you the basis for every later step of the assessment.

For each hazard, think about who could be harmed and how. Remember people who may be at greater risk:

• New and young workers, and trainees.
• Pregnant and breastfeeding employees.
• People with disabilities.
• Night workers and lone workers.
• Cleaners, contractors, visitors and members of the public, who may not know the workplace.

Once you have identified the hazards, decide who could be harmed by them. Ask two questions. Who could be harmed by this risk? Usually it will be employees, but it may also include people nearby at the time. And in what ways could they be harmed? Consider the groups of people who might be affected. These include employees, such as part-time, lone and night shift workers.

They include maintenance staff and visiting contractors, and cleaners, delivery drivers and others who come into your workplace. They include members of the public, especially in relation to traffic movements and construction activities. If you share your premises with another business, think about how their work could affect you and how your work could affect them.

Next, decide how likely it is that harm will occur, and how serious it could be. Then look at what is already being done, and decide whether more is needed.

The law does not expect you to remove every risk, but to do what is reasonably practicable to protect people. Where the risk is high, more must be done to control it.

Risks are always present, and the law does not require you to remove them all. However, you should know the main risks in your workplace and how to manage them. Many activities already have controls in place, so examine them and ask some questions. Are the current controls enough to prevent or minimise the risk? Are they in good condition, for example do dust extractors work properly and are walkway markings clearly visible?

Is anything missing? You may have clearly marked walkways but poor lighting at night. Could you collect more information about the hazard, for example from the manufacturer's or supplier's instructions? Have any hazards been overlooked? If controls have been missed or need changing, you may need to review supplier information, observe how people do their tasks, or get specialist advice, especially for health risks like noise.

Control measures should be chosen in this order, starting with the most effective:

• Eliminate the hazard altogether.
• Substitute something less hazardous.
• Use engineering controls, such as guards, barriers and extraction.
• Use administrative controls, such as safe systems of work, training, signs and rotation.
• Provide personal protective equipment, as the last resort.

Personal protective equipment, or PPE, is anything worn or held to protect against a risk, such as safety footwear, gloves, eye protection, hearing protection, hard hats and high-visibility clothing.

• It must be provided free of charge by the employer, where risks cannot be controlled in other ways.
• It must fit, suit the task and the wearer, and be kept in good condition.
• Employees must use it as trained, look after it, and report any damage or loss.

Personal protective equipment, or PPE, is any equipment worn or held by a person at work to protect them against health or safety risks. The risk assessment of your workplace identifies what PPE is needed, but PPE should be used only as a last resort, after all other control measures have been considered. If you can use local exhaust ventilation to remove fumes, for example, that should come before relying on respiratory protective equipment alone.

PPE is your final line of defence. When it is provided, it must be free of charge to employees, checked for suitability before use, maintained and stored properly, and supported by instructions for safe use. It must suit the wearer and the specific risks, and be worn whenever it is required. Examples include gloves, safety glasses or goggles, overalls, ear protection and respiratory protective equipment.

If you have five or more employees, the significant findings must be written down. The record should show:

• The significant hazards.
• Who could be harmed, and how.
• The controls in place, and any further action needed, with who will do it and by when.

Keep it simple and practical, and share it with the people it affects.

Once you have decided on and put your controls in place, step four is to record the significant findings. You do not need to list every hazard and risk in the workplace. Focus on those that present a foreseeable and controllable risk of harm. Make sure the assessment is specific to your workplace, with detailed information, and check that all control measures are appropriate and applicable.

The law sets out when the findings must be written down, and a written record is good practice for every workplace. The final step is to review regularly whether changes in the workplace may affect the assessment. Ask whether new processes have been introduced, whether improvements are still needed, whether employees have given feedback, whether new equipment or machinery has arrived, whether new employees need training, and whether new work systems have been set up.

Workplaces change, so risk assessments must be reviewed regularly, and whenever there is reason to think they are no longer valid, for example:

• New equipment, substances or processes.
• Changes to the workplace or the work.
• After an accident, a near miss or a case of ill health.
• When a new or vulnerable worker joins.