Risk assessment is at the heart of managing health and safety at work. It means identifying the hazards in your workplace, evaluating the risks they present, and putting suitable controls in place to reduce the chance of injury or ill health.

Under the Management of Health and Safety at Work Regulations 1999, every employer in Great Britain must make a suitable and sufficient assessment of the risks from their work activities.

This module explains the key terms, and why risk assessment matters.

By the end of this course, you will be able to:

• Explain the purpose of workplace risk assessment.
• Recognise common workplace hazards, and the injuries and ill health they can cause.
• Describe the legal duties of employers and employees under UK health and safety law.
• Identify hazards, assess risks, and choose suitable controls.
• Apply the five steps of risk assessment in any type of workplace.
• Protect employees, contractors, visitors and members of the public.

In this module, you will learn about:

• Why risk assessments are important.
• What a risk assessment is, and the five steps.
• The meaning of hazard, risk and control measure.
• What reasonably practicable means.
• The general principles of prevention.
• Who is responsible, and who should carry out a risk assessment.

According to the Health and Safety Executive, or HSE, in Great Britain in 2024 to 2025, an estimated 1.9 million workers suffered from work-related ill health, and around 680,000 workers were injured at work. In 2025 to 2026, 126 workers were killed.

An estimated 40 million working days were lost. Workplace injury and new cases of work-related ill health cost Britain an estimated 22.9 billion pounds a year.

Effective risk assessment helps employers prevent this harm, and meet their legal duties.

A structured workplace risk assessment brings many benefits:

• Better awareness of safety across the workplace.
• Better identification of hazards and risks.
• Fewer accidents, and less work-related ill health.
• Less chance of compensation claims and legal action.
• Greater employee confidence and morale.
• Lower levels of absence.
• A safer and healthier place for everyone.

A risk assessment is a careful look at what could cause harm in your work, so that you can decide whether enough is being done to prevent it. It is required for all workplaces and all work activities, whatever their size. There are five steps:

• Identify the hazards.
• Decide who may be harmed, and how.
• Evaluate the risks, and decide on control measures.
• Record the findings, and put the controls in place.
• Review the assessment regularly, and update it when things change.

• A hazard is anything with the potential to cause harm, such as injury, illness or damage. Manual handling, slippery floors, chemicals, electricity and working at height are all hazards.
• A risk is the likelihood that a hazard will actually cause harm, together with how severe that harm could be.
• A control measure is an action taken to remove a hazard, or to reduce the risk to an acceptable level.

For example, lifting heavy boxes is a hazard. Using a trolley is a control measure that reduces the risk.

The law requires employers to do what is reasonably practicable to protect employees and others.

This means balancing the level of risk against the time, cost, effort and resources needed to control it. Employers must put suitable controls in place, unless the cost or difficulty would be grossly out of proportion to the risk.

It does not mean removing every possible risk whatever the cost. Nor does it mean choosing the cheapest option, or waiting until an accident has happened.

Schedule 1 of the Management of Health and Safety at Work Regulations 1999 sets out the general principles of prevention. Employers must apply them when deciding on controls. They include:

• Avoid risks altogether, where possible.
• Combat risks at source, as close to the hazard as possible.
• Adapt the work to the individual, through good design of workplaces, equipment and methods.
• Replace dangerous substances or processes with safer ones.

• Prevent access to dangerous areas and equipment.
• Give collective protective measures, which protect everyone, priority over individual measures.
• Give suitable information, instruction and training to employees.
• Keep up with technical progress.

Remember: preventive control measures should always come before personal protective equipment, or PPE. We look at the order of controls, called the hierarchy of control, in Module 4.

The employer has the overall legal responsibility for making sure risk assessments are carried out and kept up to date. Employers with five or more employees must record the significant findings; keeping a written record is good practice for smaller employers.

Managers and supervisors often help carry them out, and must make sure controls are followed in their areas.

Employees must co-operate, follow the controls, and report hazards. Employers must also consult employees, or their representatives, on safety.

• Suitable and sufficient means that the risk assessment fits the actual tasks, activities and risks in your workplace. A generic assessment can be a useful starting point, but it is never acceptable on its own, instead of an assessment specific to your workplace.
• A competent person is someone with the necessary training, knowledge, skills, experience and practical ability to carry out a risk assessment properly. Holding a management role does not, on its own, make someone competent.

Being competent is not a title; it shows in what the assessor actually does. A competent person understands how to identify the hazards in the work, including those that are not obvious, such as long-term health risks or hazards that only appear during maintenance or cleaning. They can judge how likely each hazard is to cause harm and how serious that harm could be, and so decide the level of risk.

They recommend control measures that are suitable for the specific task and reasonably practicable for the business. And they know that the job is never finished: they review the assessment whenever workplace conditions or activities change. A competent assessor also understands that a risk assessment does not protect anyone on its own. It must be properly recorded, regularly reviewed, and supported by suitable information, instruction, supervision and health and safety training, so that the people doing the work know the risks and use the controls correctly.