A risk assessment is a systematic examination of a workplace or activity to identify what could cause harm, evaluate the likelihood and severity of that harm, and decide on practical measures to prevent it. It is the cornerstone of modern health and safety management, required by law in many countries and applied across industries from construction to healthcare.
The process is designed to be proactive rather than reactive. Instead of waiting for an accident to happen, employers and duty holders are expected to anticipate potential hazards and take steps to control them. The UK Health and Safety Executive (HSE) describes it as a careful examination of what could cause harm to people, enabling precautions to be taken.
Risk assessments are not intended to be bureaucratic paperwork exercises. Their real value lies in preventing injury and ill-health, ensuring legal compliance, promoting a safety culture, and reducing financial losses from fines or prosecutions.
What is the Purpose of a Risk Assessment?
The primary purpose is to protect people from harm. By identifying hazards and evaluating risks, organisations can implement controls that reduce the chance of accidents and occupational diseases. This fulfils a legal duty of care owed to employees, contractors, visitors, and the public.
Risk Assessment at a Glance
A systematic process to identify hazards, evaluate risks, and implement controls to prevent harm.
5 steps: Identify hazards, assess risks, control risks, record findings, review and update.
Risk Matrix: A grid plotting likelihood against severity to prioritise risks.
Required by law in most workplaces; applied in healthcare, schools, sport, events, and care settings.
Key Insights on Risk Assessment
- Risk assessment is a legal requirement under health and safety law in most jurisdictions, not just a best practice. The HSE mandates it under the Management of Health and Safety at Work Regulations 1999.
- The 5-step process is universally applicable but must be contextualised for specific industries (e.g., dynamic risk assessment in nursing).
- Involving employees in the process strengthens outcomes and improves hazard identification.
- Non-compliance risks penalties, including fines and prosecution.
- Employers must assess physical, chemical, biological, ergonomic, and psychosocial hazards.
Risk Assessment: Key Facts
| Fact | Detail |
|---|---|
| Legal basis | Health and Safety at Work etc. Act 1974 (UK) and similar laws globally. |
| Required for | Any employer or self-employed person with 5+ employees. |
| Documentation | Must be ‘suitable and sufficient’ and recorded if 5+ employees. |
| Review cycle | Should be reviewed regularly and whenever circumstances change. |
| Common tools | Risk matrix, risk register, dynamic risk assessment. |
| Hazard types | Physical, chemical, biological, ergonomic, psychosocial. |
| Who is at risk | Employees, contractors, visitors, vulnerable groups. |
| Hierarchy of controls | Eliminate, Substitute, Engineering, Administrative, PPE. |
| Purpose | Prevent harm, ensure compliance, reduce accidents. |
| Not to be confused with | A risk matrix or risk register, which are tools within the process. |
What Are the 5 Steps of Risk Assessment?
The Health and Safety Executive (HSE) recommends a straightforward five-step framework that is applicable across virtually all workplaces. Understanding this process is essential for anyone asking what is a risk assessment in practice.
The steps are: identify hazards, decide who might be harmed and how, evaluate risks and decide on precautions, record findings and implement them, and review and update the assessment regularly.
Step 1: Identify the Hazards
This involves spotting anything that could cause harm. Common methods include workplace walkthroughs, consulting employees, and reviewing incident records. Hazards can range from trailing cables and chemical spills to stress and biological agents like viruses.
Step 2: Decide Who Might Be Harmed and How
Consider not just permanent staff but also contractors, visitors, and vulnerable groups such as young workers or pregnant employees. The assessment should map how each group might be exposed to the identified hazards.
Step 3: Evaluate Risks and Decide on Precautions
This step uses a risk matrix to analyse likelihood versus severity. The hierarchy of controls is then applied: elimination is best, followed by substitution, engineering controls, administrative measures, and personal protective equipment (PPE) as a last resort.
Step 4: Record Findings and Implement
Significant risks must be documented. If an organisation has five or more employees, written records are a legal requirement. The record should detail the hazards, the risks, and the controls put in place.
Step 5: Review and Update
Risk assessments are not static documents. They should be reviewed regularly—for example, annually—and whenever significant changes occur, such as new equipment, processes, or after an incident.
In certain fast-paced environments like healthcare and sport, a dynamic or real-time risk assessment is used. This adapts the 5 steps on the spot: continuously scanning for new hazards, re-evaluating, and adjusting controls immediately. For example, a nurse may reassess a patient’s mobility before each transfer, or a coach may modify a drill if weather conditions change.
What is a Risk Assessment in Health and Safety?
In the context of health and safety, a risk assessment is the formal process used by employers to comply with legal duties. It covers physical risks such as machinery and manual handling, as well as broader concerns like fire safety, stress, and workplace violence.
The HSE Northern Ireland defines it as “simply a careful examination of what could cause harm to people, to enable precautions to be taken to prevent injury and ill-health.” This definition captures the essence of the practice across all sectors.
Risk Assessment at Work
For general workplaces, the assessment must cover all activities and environments. This includes office settings, warehouses, factories, and construction sites. The focus is on practical controls that reduce risk to an acceptable level.
Risk Assessment in Healthcare and Nursing
Healthcare settings involve unique hazards including biological agents (infections), ergonomic risks (lifting patients), and psychosocial factors (stress and burnout). Dynamic risk assessment is particularly important here, as patient conditions change rapidly. Nursing staff often conduct ongoing assessments for falls, sharps injuries, and chemical exposure.
Risk Assessment at School
Schools must assess risks for both employees (teachers and support staff) and students. Common areas include playgrounds, science labs, sports facilities, and off-site trips. The duty of care extends to safeguarding and supervision.
Risk Assessment in Sport
Events and training sessions require assessments for weather conditions, equipment failure, player health, and facility safety. Coaches increasingly use dynamic assessments to make real-time decisions during matches and drills.
Many people confuse a risk assessment with a risk matrix. A matrix is a visual tool used within the assessment process—it plots likelihood against severity but is not the assessment itself. Similarly, a risk register is a dynamic document that tracks risks over time, not a one-time assessment.
Development of Risk Assessment Practice
The modern practice of risk assessment has evolved over decades, shaped by legislation and changing workplace environments. The following timeline highlights key milestones.
- 1974: Health and Safety at Work Act (UK) establishes employer duty of care.
- 1992: Management of Health and Safety at Work Regulations introduce formal risk assessment requirements.
- 1999: Regulations extended to cover all workplaces, including temporary and mobile sites.
- 2000s: Risk assessment expands beyond workplace safety to healthcare, environmental, and financial sectors.
- 2020+: Dynamic risk assessment gains prominence in nursing and frontline emergency services.
Risk Assessment: What We Know vs. What Remains Open
While the core principles of risk assessment are well established, certain aspects have nuances that are worth understanding.
| Established Information | Information That Remains Unclear |
|---|---|
| The 5-step framework is a globally recognised standard for workplace risk assessment (HSE, OSHA). | The exact number of steps can vary by jurisdiction (some use 4 or 6 steps). |
| Risk assessment is a legal requirement in most regulated workplaces. | Dynamic risk assessment is less standardised than formal risk assessment; its methodology varies by profession. |
| A risk matrix is a common but not mandatory tool. | Application in emerging fields (AI safety, climate risk) is still evolving. |
Why Risk Assessment Matters and Common Misconceptions
Risk assessment is the foundation of proactive safety management. It shifts focus from reacting to incidents to preventing them. In healthcare and nursing, it directly impacts patient safety and clinical outcomes. In schools, it protects children and staff during everyday activities and special trips. In sport, it ensures participants can train and compete with minimal risk.
Despite its importance, several misconceptions persist. A risk assessment is not the same as a risk matrix, and a risk register is a living document, not a one-off task. Understanding these distinctions is critical for effective implementation.
Sources and Official Definitions
The following definitions from authoritative bodies provide clarity on the nature and purpose of risk assessment.
“A risk assessment is simply a careful examination of what could cause harm to people, to enable precautions to be taken to prevent injury and ill-health.”
“Risk assessment is a step-by-step process for controlling health and safety risks caused by hazards in the workplace.”
“Risk assessment is the process of identifying what hazards exist, or may appear in the workplace, how they may cause harm and to take steps to minimise harm.”
— UNISON National
Summary: What is a Risk Assessment?
A risk assessment is a systematic, legally required process for identifying hazards, evaluating risks, and implementing controls to prevent harm. It is applied across all industries—from construction to healthcare, schools to sport—and is supported by tools like the risk matrix and risk register. The 5-step HSE framework remains the most widely used methodology, while dynamic risk assessment addresses the needs of fast-changing environments.
Frequently Asked Questions
What is risk management?
Risk management is the broader process that includes risk assessment plus ongoing monitoring, control implementation, and strategic decision-making. Risk assessment is the identification and analysis step within risk management.
What is a risk register?
A risk register is a document or database that lists identified risks, their likelihood and impact, current controls, and responsible owners. It is a living document updated throughout a project or operational period.
What is risk mitigation?
Risk mitigation refers to the actions taken to reduce the likelihood or impact of a risk. This is step 3 (control risks) of the standard 5-step risk assessment process.
What is the difference between a risk assessment and a risk matrix?
A risk assessment is the full process of identifying, analysing, and controlling risks. A risk matrix is a specific tool—a grid plotting likelihood against severity—used within the assessment to prioritise which risks need immediate action.
Who should perform a risk assessment?
The employer or a competent person appointed by the employer should perform the risk assessment. Involving employees and their representatives strengthens the process and improves hazard identification.
How often should a risk assessment be reviewed?
Risk assessments should be reviewed regularly, typically annually, and whenever significant changes occur such as new equipment, processes, or after an incident.
Is a risk assessment a legal requirement?
Yes. In the UK, the Management of Health and Safety at Work Regulations 1999 requires employers to conduct risk assessments. Similar laws apply in many other countries.
What is a dynamic risk assessment?
A dynamic risk assessment is a real-time, ongoing process used in changing environments such as healthcare and sport. It involves continuously scanning for new hazards and adjusting controls on the spot.
What are the 5 steps of risk assessment?
The 5 steps are: identify hazards, decide who might be harmed and how, evaluate risks and decide on precautions, record findings and implement them, and review and update.
What is the purpose of a risk assessment in healthcare?
In healthcare, risk assessments protect patients and staff from biological, ergonomic, and psychosocial hazards. They are critical for infection control, manual handling, and patient safety.
Thomas Whitmore is Politics & Public Affairs Editor at TheUKDaily.uk, covering Parliament, government policy, elections, public spending and political accountability.