How to Write a Risk Assessment (UK): 5 Steps with Example

Most trades write a risk assessment because somebody asked for one. A principal contractor wants it before you start, a facilities manager needs it on file, a school will not let you through the door without it. So it gets written the night before, from a template, and it says what every other risk assessment says.

This guide is about writing one that is actually yours. It covers what the law requires, the five steps HSE sets out, how to score risk on a 5 x 5 matrix, and a full worked example for a job most electricians will recognise. There is a copy-paste template at the end, and a list of the mistakes that get an assessment sent back.

What Is a Risk Assessment?

A risk assessment is a written record of three things: what on this job could hurt someone, who it could hurt and how, and what you are doing about it. Two words in that sentence carry the whole idea. A hazard is anything with the potential to cause harm: a live conductor, an open floor void, wet cement, a member of the public walking through your work area. The risk is how likely that harm is to happen and how bad it would be.

The assessment is the thinking. The form is just where the thinking is written down so someone else can check it. That distinction matters, because the law requires the thinking whether or not anything is written, and a reviewer can tell within a paragraph whether any thinking took place.

Is a Risk Assessment a Legal Requirement?

Yes. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to their employees and to anyone else affected by the work. Regulation 3(2) puts the same duty on every self-employed person for the risks to themselves and to others. There is no exemption for small firms or short jobs.

What changes with size is the paperwork. If you employ five or more people, regulation 3(6) requires you to record the significant findings and any group of employees identified as especially at risk. Below five, the law does not make you write it down. In practice that exemption is worth very little on site: the client, the principal contractor and your insurer will all want to see the assessment, and a written record is the only way to show one was made. Write it down regardless.

Risk Assessment, Method Statement, RAMS

A risk assessment says what could go wrong and what controls are in place. A method statement says how the work will be carried out, in order, so that those controls actually happen. Together they are the RAMS pack a principal contractor asks for. If you have been asked for RAMS and are not sure what is expected, our guide to what a RAMS document is covers the pack as a whole. This page is about the first half.

What a Risk Assessment Must Include

There is no statutory form. HSE publishes a template and a set of example assessments, and the columns on it are the columns every reviewer expects to find, whatever the layout:

• The job, the site and the date. An address, a description of the work, who assessed it and when. Without these the document could be for any job, and a reviewer will treat it as if it were.
• The activities covered. Strip-out, first fix, testing. Naming the activities is what stops one assessment being quietly reused for a job it never considered.
• The hazards. One per line. Specific to the work and the place, not a list copied from a template.
• Who might be harmed and how. Your own people, other trades, the householder, the public, the school's caretaker. And the mechanism: shock, fall, struck by, breathed in.
• What you are already doing to control the risk. The real controls, in the order the law prefers, which is covered below.
• The risk score, before and after controls. Likelihood and severity, so a reader can see which lines carry the weight.
• Further action, who owns it, and by when. Anything not yet in place. A risk assessment with no further actions on a real job is usually a sign nothing was looked at very hard.
• Review date and sign-off. When it gets looked at again, and the name and signature of the person standing behind it.

HSE's Five Steps to Risk Assessment

HSE's guidance on managing risk at work comes down to five steps. They are the structure of every good assessment, and they are what an inspector or a reviewer has in mind when they read yours.

1. Identify the Hazards

Walk the job before you write a word. In your head if you have not been to site yet, on foot if you have. Start at the van and end at handover: access, the work area, the tools and materials, the substances, the people who will be around you, and what the work itself creates, like dust, noise and fume. HSE's advice is to involve the people doing the work, because they usually know where the real problems are. On a two-person job that is a five-minute conversation, and it is the most valuable five minutes in the whole process.

Think about the premises as well as the task. Most trade work happens in someone else's building: a school corridor, an office floor that stays open, a customer's kitchen. The occupants are hazards to your work and your work is a hazard to them, and both directions belong on the form.

2. Assess the Risks

For each hazard, decide who could be harmed and how, then judge how likely the harm is and how serious it would be. HSE names groups that need particular thought: young workers, new or expectant mothers, migrant workers who may not have English as a first language, people with disabilities. On site, add lone workers, the public and children. The scoring method below turns this judgement into a number, but the number is only as good as the judgement behind it.

3. Control the Risks

Look at what you already do, then ask whether it is enough. HSE's standard is that you do everything reasonably practicable to protect people, which means weighing the risk against the cost, time and effort of reducing it. Nobody expects zero risk. They do expect you to have worked through the options in the right order:

1. Eliminate the hazard altogether. Prefabricate off site, isolate the supply, schedule the work when the building is empty.
2. Substitute for something less dangerous. A water-based product for a solvent one, a podium step for a ladder.
3. Engineering controls that keep people away from the hazard. Guarding, extraction, edge protection, a physical barrier around the work area.
4. Administrative controls that change how the work is done. Permits, exclusion times, briefings, supervision, signage.
5. Personal protective equipment, last. PPE protects one person, only when worn correctly, and fails silently.

A risk assessment whose controls are all in the last category has skipped four steps, and reviewers notice, because it is the most common failing in the documents they see.

4. Record Your Findings

Write down the significant findings: the hazards, who is affected, the controls, and what still needs doing. Keep it proportionate. HSE's own examples run to two or three pages for a whole business, and a half-day job does not need more than a page or two. Length is not thoroughness. What matters is that every line is about this job.

One warning HSE puts in writing on its examples page, and which applies to every template on the internet: do not copy an example and put your company name to it. HSE's words are that doing so would not satisfy the law and would not protect your employees. The examples show you what the thinking looks like. They cannot do it for you.

5. Review the Controls

Regulation 3(3) requires the assessment to be reviewed if there is reason to suspect it is no longer valid or there has been a significant change. In trade terms: a new site, a change of method, different people, new equipment, a near miss, or a hazard you found on day one that was not on the form. Put a review date on the document so it does not run on unread, and treat every new job as a review, because the site has changed even if the task has not.

How to Score Risk: the 5 x 5 Matrix

Most trade risk assessments in the UK score each hazard by multiplying likelihood by severity, each on a scale of one to five. The result is a number from 1 to 25 that tells the reader which lines matter most.

Likelihood is how probable the harm is, given the situation as it actually is on the day: 1 rare, 2 unlikely, 3 possible, 4 likely, 5 almost certain. Severity is the worst credible outcome: 1 minor injury needing first aid, 2 an injury needing medical treatment, 3 a serious injury with time off work, 4 a major injury with lasting effects, 5 a fatality.

The bands are what you act on. Low, 1 to 4: acceptable, keep the controls in place. Medium, 5 to 9: acceptable with the controls listed, and worth a further action if one is cheap. High, 10 to 16: the work needs additional controls or closer supervision before it starts, and it belongs in the method statement as a hold point. Critical, 17 to 25: do not start until the risk has been brought down.

Two rules keep the scoring honest. First, controls reduce likelihood, almost never severity. A harness does not make a fall from a roof less fatal; it makes the fall less likely to happen. If your residual score drops because severity went down, ask yourself what actually changed. Second, any hazard that could kill someone never sits below High in the final band, however unlikely you have made it. That is not arithmetic, it is a safety choice: a fatal outcome stays visible on the page and stays supervised on site.

Score each hazard twice: once as you found it, and once with your controls in place. The gap between the two numbers is the evidence that the controls are worth something.

Worked Example: Consumer Unit Replacement in an Occupied House

A sole trader electrician replacing an old fuse board with a new consumer unit in a terraced house. The family stays in the house during the work. One day on site. The numbers below are illustrative and the details come from the job as found; on your own job, they come from your walk round.

Job and Assessor

Consumer unit replacement, 14 Example Street, Leeds. Assessed by the electrician carrying out the work, dated the day before the job, reviewed on arrival. Activities: isolation, removal of the existing board, installation of the new unit, connection, testing and certification, handover.

Hazards, Controls and Scores

1. Electric shock or arc flash during isolation and connection. Who and how: the electrician, by contact with live parts at the cut-out, the tails or the board. Score as found: likelihood 3 x severity 5 = 15, High. Controls: no live working. Isolate at the main switch, and where the supply cannot be isolated from the consumer side, arrange the cut-out fuse with the network operator rather than pulling it. Lock off and tag. Prove dead with an approved voltage indicator checked against a proving unit before and after. Insulated tools. Work sequence written into the method statement with a hold point before any conductor is touched. Residual: likelihood 1 x severity 5 = 5, held at High because the outcome is fatal. This line stays supervised.
2. Asbestos in the existing fuse board. Who and how: the electrician and the household, by breathing fibres released from flash guards or backing boards in an older rewireable board. Score as found: likelihood 2 x severity 5 = 10, High. Controls: inspect the board type and age before touching it. If asbestos is suspected, stop, do not disturb it, and have it assessed. Asbestos is controlled under the Control of Asbestos Regulations 2012, not by this assessment, so the control here is the stop. Residual: likelihood 1 x severity 5 = 5, held at High. Written into the method statement as the first hold point of the day.
3. The occupied house: children, adults and pets entering the work area. Who and how: the household, by contact with exposed conductors or tools, and by tripping on leads and the old board. Score as found: likelihood 3 x severity 4 = 12, High. Controls: agree the power-off periods with the householder before starting. Close the hallway with a barrier and a sign. Tools and the exposed board never left unattended. Leads run along the skirting and taped. Old board bagged and removed the same day. Residual: likelihood 1 x severity 4 = 4, Low.
4. Drilling into walls: hidden cables or pipes, dust and noise. Who and how: the electrician, by striking a live cable or a water pipe when fixing the new unit; the household, by dust and noise. Score as found: likelihood 3 x severity 3 = 9, Medium. Controls: scan with a cable and pipe detector before every fixing. Circuits isolated while drilling. Dust sheet, on-tool extraction or a hoover held to the drill, FFP3 mask for masonry dust. Householder warned before drilling starts. Residual: likelihood 1 x severity 3 = 3, Low.
5. Fire from a poor termination after the work. Who and how: the household, by an overheating connection once the installation is energised and the electrician has left. Score as found: likelihood 2 x severity 4 = 8, Medium. Controls: terminations torqued to the manufacturer's figures. Full inspection and testing to BS 7671 before energising. Certificate issued and the householder shown the main switch and RCD test button. Residual: likelihood 1 x severity 4 = 4, Low.

Further Action, Review and Sign-Off

Further action: confirm with the network operator whether the cut-out fuse will be pulled and by whom, before the day. Review: on arrival, after checking the board type, and if the household situation differs from what was described. Signed by the electrician, with the date.

Notice what the example does. Every hazard names a person and a mechanism. The controls start with elimination and end with PPE. The two fatal hazards keep their High band after controls, and both become hold points in the method statement. That is what a reviewer means by suitable and sufficient.

Copy-Paste Risk Assessment Template

Fill in every bracket from the job as you found it. If a line does not apply, delete it rather than leaving a generic entry, because a generic entry is what gives a reviewer the impression the rest is generic too.

RISK ASSESSMENT

JOB
Site address: [address]
Description of work: [what is being done]
Activities covered: [list]
Assessed by: [name]        Date: [date]        Review: [trigger and backstop date]

HAZARD 1: [hazard, specific to this job and place]
Who might be harmed and how: [people and mechanism]
Score as found: L[1-5] x S[1-5] = [score] ([Low/Medium/High/Critical])
Controls in place, in hierarchy order:
  Eliminate or substitute: [what, or "not practicable because"]
  Engineering: [barriers, extraction, isolation]
  Working method: [permits, timing, supervision, briefing]
  PPE: [items and standard]
Residual score: L[1-5] x S[1-5] = [score] ([band])
Further action: [what, who, by when]

HAZARD 2: [repeat]

PEOPLE AT PARTICULAR RISK
[young workers, new or expectant mothers, lone workers, public, children, occupants]

EMERGENCY ARRANGEMENTS
First aider: [name]    Nearest A and E: [hospital]    Fire: [assembly point]

SIGN-OFF
Assessed by: [name, signature]    Briefed to: [names, date]

Filled in properly for a real job, that template takes an evening. Safetyfox takes the same information as a short set of questions about the job and writes the assessment from your answers, scored and laid out, for you to read and change before you use it.

Common Mistakes That Get a Risk Assessment Sent Back

• No site. An assessment with no address, no date and no named assessor is generic by definition, whatever it says inside.
• Hazards from a template, not from the job. Scaffolding on a decorating job, excavation on a kitchen refit. A reviewer stops trusting the document at the first hazard you do not have.
• Nobody gets harmed. A hazard column with an empty "who" column. The whole point is who, and how.
• PPE as the only control. Gloves, glasses and boots do not answer the question of why the hazard is still there.
• Scores that contradict the words. A hazard described as fatal and scored Low. Or every line scored Medium, which tells the reader nothing was judged.
• Controls that reduce severity. Falls are not less fatal because someone is wearing a harness. Reduce the likelihood, and leave the severity alone.
• No residual score. Without the second number, nobody can tell whether the controls did anything.
• No review, no signature. A document that nobody has signed and that will never be looked at again reads as a form filled in to get through a gate.

Write the Assessment, Then Brief It

A risk assessment that stands up names the site, names the people, works through the controls in the right order, scores honestly and is read by the people doing the work before they start. Once the assessment exists, the method statement follows from it. Our guide to RAMS documents explains how the two fit together and what a principal contractor checks when the pack arrives.