Risk
Assessment
Perry Scott Nash House / Primett Road / Stevenage / Hertfordshire / SG1 3EE / Tel 01438 745771 / Fax 01438 745772
Email info@[Link] / Website [Link]
HEALTH & SAFETY MADE EASY - RISK ASSESSMENTS
An IHS Guide
Produced by: Pat Perry
August 2006
Revised June 2008
2 of 24
PART 1.0: QUICK REFERENCE GUIDE
What is a Risk Assessment?
A Risk Assessment is a careful examination of what, in your workplace, could cause harm to
your employers or others, the likelihood of that harm occurring and what steps you need to
take to reduce the risks of injury or ill health to an acceptable level.
Is it a legal requirement to carry out Risk Assessments?
Yes. Every employer (and the self employed) has a duty to undertake an assessment of the
hazards and risks associated with work activities and to implement controls which either
eliminates the hazard or reduces the risk to acceptable levels.
The Management of Health and Safety at Work Regulations 1999 set down the key
requirements for risk assessments, but risk assessments are also required under:-
Control of Substances Hazardous to Health Regulations 2002
Control of Lead at Work Regulations 2002
Control of Asbestos at Work Regulations 2006
Dangerous Substances and Explosive Atmospheres Regulations 2002
Noise at Work Regulations 2005
Health and Safety (Display Screen Equipment) Regulations 1992
Manual Handling Operations Regulations 1992
Personal Protective Equipment at Work Regulations 2002
Regulatory Reform (Fire Safety) Order 2005
The provision for Risk Assessments under the Management Regulations is general but
completing a Risk Assessment under these regulations may satisfy the requirements of the
specific regulations. Conversely, completing the specific assessments will broadly satisfy
your duties under the Management Regulations.
Does absolutely every single job activity require a Risk Assessment?
No. You must assess those activities that have the potential to cause harm.
The requirement of the Management of Health and Safety at Work Etc Act 1999 is as
follows:-
“Every employer shall make a suitable and sufficient assessment of:-
a) The risks to health and safety of his employees to which they are exposed whilst
they are at work, and
b) The risks to the health and safety of persons not in his employment arising out of
or in connection with the conduct by him of his undertaking,
for the purpose of identifying the measures he needs to take to comply with the
requirements and/or prohibitions imposed upon him under the relevant statutory provisions.
If a work activity does not pose any health and safety risks then there is no need to carry
out a Risk Assessment, although a Risk Assessment of sorts will be carried out in order to
establish that the job task has no hazards and risk attached to it.
3 of 24
Is there a standard format for a risk assessment?
No, mainly because Risk Assessments are individual to job tasks and need to be “site
specific”!
The HSE do publish guidance on how to complete Risk Assessments and they include a Risk
Assessment template. See the free publication from the HSE INDG 163 (rev 2), published in
June ’06.
There is no right or wrong way to complete a Risk Assessment. The law requires that it is
“suitable and sufficient”.
A Risk Assessment must contain suitable information to be useful to an employee to
understand what hazards they may be exposed to when carrying out the task.
Generally, any format that includes the following will be suitable:-
Description of the job task
Location of activity
Who will carry it out
Who else might be affected by the task
What are the hazards identified
What could go wrong
What might the injuries be and how severe might they be
How likely are the risks
What can be done to reduce or eliminate the hazards
What information do employees or others need to work safely
When might the risk assessment be reviewed
What do the terms “hazard” and “risk” mean?
A hazard is something with the potential to cause harm.
The risk is the likelihood that the potential harm from the hazard will be realised.
The extent of the risk will depend on:-
The likelihood of the harm occurring
The potential severity of that harm (resultant injury or adverse health effect)
The extent of people who might be affected e.g. several people, vast groups,
communities at large (e.g. from chemical releases).
What does “suitable and sufficient” mean?
The phrase suitable and sufficient is not defined in the regulations, or within the Health and
Safety at Work Etc Act 1974.
The Approved Code of Practice on the Management of Health and Safety at Work
Regulations 1999 states that:-
“The level of risk arising from the work activity should determine the degree of
sophistication of the risk assessment”.
4 of 24
Insignificant risks can generally be ignored, as can routine activities associated with life in
general.
Risk Assessments are expected to be proportionate to the hazards and risks identified.
Enforcement Officers do not expect to see huge volumes of paperwork – the simpler the
Risk Assessment and the clearer the information, the easier the employee will find following
safe procedures.
5 of 24
PART 2.0: FURTHER INFORMATION
RISK MANAGEMENT
The duty on every employer, or person in control of premises, is to manage the risks to
health and safety to which people may be exposed as a result of the undertaking.
The duty to manage risks is not the same as being expected to completely eliminate risks –
that would almost be impossible.
The Health and Safety Executive have revised their guidance advice to emphasise the fact
that trivial and insignificant risks do not have to be subject to risk assessment. Employers
should focus on those activities that create hazards that could have significant consequences
on the health and safety of people.
Employers have a duty to reduce significant risks to as low as is reasonably practicable.
The risk and the severity of the consequences must be weighed against the cost of
implementing controls and the effect those controls will have on reducing the risk.
Employers are not expected to spend huge sums of money counter-acting risks that might
only occur infrequently.
The following questions and answers should give more detailed information on how to
approach Risk Assessments.
Do I need to employ a Consultant to carry out my Risk Assessments?
No, not unless the work processes are complex or you feel unable to carry out the task
yourself or you don’t have anyone at your workplace capable of carrying them out.
Risk Assessments are not complicated or difficult to do but they do need a certain amount of
knowledge about hazard and risk, legal requirements for health and safety and knowledge
of the work activity being carried out.
Often the best people to help you complete Risk Assessments are your employees –
remember you are looking out for anything which happens in your workplace which could
cause injury or ill-health.
Consultants can provide a wealth of knowledge and experience and may be able to make
the whole process simple and painless. On the other hand … they could over complicate
things!
Are generic Risk Assessments acceptable?
The purpose of a Risk Assessment is to identify hazards and risks associated with specific
tasks carried out in specific work locations.
If all the tasks and all the locations are the same then one Risk Assessment should suffice
for all activities and a generic assessment will be ok. But, if either the task itself or the
location differs in any way from place to place, then a “site specific” Risk Assessment will be
needed.
6 of 24
Generally, generic Risk Assessments are seen by enforcing authorities as mere “tick box”
exercises which do not add much to the management of risk.
Remember, your Risk Assessment is to help you, as the employer, to prevent the likelihood
of injury or ill-health to your employees. So, you really need to review exactly what your
employees do and how they do it – not what you think they do (as often this is not the
same -… bad habits and all that!).
Who can carry out Risk Assessments?
Whoever carries out a Risk Assessment must be “competent” to do the job.
Competency is not defined in the legislation but such persons must have suitable training
and experience or knowledge in order to identify hazards and risks associated with the job
tasks.
Managers, employees, consultants, individuals or teams can undertake risk Assessments.
Complex work processes and tasks may need external specialist Consultants to assist with
the Risk Assessment. But the employer is always responsible for ensuring that a suitable and
sufficient Risk Assessment is completed.
Risk Assessments could be divided into different work or departmental areas so that those
who know what happens in their department use their expertise to complete their own
assessments.
How should a Risk Assessment be completed?
A Risk Assessment is really a logical review of what is done by whom, what can go wrong,
what the consequences are, what can be done better, what procedures can be put in place
to reduce the hazards and risks.
The HSE advocate a FIVE STEP approach:-
Step 1 : Identify the hazards
Step 2 : Determine who could be harmed and how
Step 3 : Evaluate the risks and decide if control measures are needed – if they are
already in place are they adequate or does more need to be done
Step 4 : Records your findings
Step 5 : Review and revise the assessments as appropriate
What needs to be done to identify hazards?
Hazard identification is not a complicated process and shouldn’t become so.
Walk around the workplace and look at what could cause harm to both employees and
others. Also, consider whether there would be any additional risks to young people and
pregnant or nursing mothers.
Concentrate on significant hazards which have the potential for quite serious injury or ill
health or which could affect many people.
Speak to employees and ask them what they would identify as hazards associated with their
jobs – run a hazard identification campaign.
7 of 24
Hazards could be associated with:-
Equipment – how it is used, guards, controls, noise
Work processes – how things are done, systems to be followed
Environmental conditions – floors, heating, ventilation etc
Materials in use – chemicals, gases, substances etc
Common Hazards
Fire
Slips, trips and falls from uneven or slippery floor surfaces
Falling objects
Electricity
Hazardous substances
Transport vehicles
Using equipment
Excessive temperatures
Lack of ventilation
Poor lighting
Confined spaces
Explosive atmospheres
Changes in floor level
Use of portable equipment
Use of hand tools
What people must be considered as being exposed to the risks from work
activities?
Employees of the employer
Young workers and those on work experience
New and expectant mothers
Cleaners – whether contract or “in-house”
Visitors to the premises
Maintenance workers – both contract and in-house
Members of the public
Employees of other employers with whom you share the building or premises
Delivery drivers
Sales representatives
People with disabilities – may need extra control measures to protect them from risk
Peripatetic workers – those working away from the office, usually visiting other
workplaces or peoples homes e.g. midwives
Volunteers
Must Risk Assessments be categorised into high, medium or low risks?
Not necessarily by law, but it is good practice to identify the extent of harm that an
employee or other person could be exposed to.
Even after all precautions have been taken some risk i.e. potential cause of injury or ill-
health may remain. This is often referred to as:
“residual risk”
8 of 24
Residual risk is either “high, medium or low”, or very likely, probable, unlikely.
Some risk management approaches allocate numerical scores to various types of risk and
the severity of those risks. By multiplying one score by the other they arrive at a “risk
rating”. Scores above a set target become unacceptable and measures must be put in place
to reduce the risks.
What are some of the common control measures that can be put in place to
reduce the risks from job activities?
The aim of risk assessment is to reduce the residual risk associated with a task to as small
as possible.
First, try to eliminate the hazard altogether – why do something or use something if you
don’t have to?
Where the hazard cannot be eliminated it must be reduced to acceptable levels by
implementing control measures.
A common approach is by following the “hierarchy of risk control”, namely:-
Try a less risky option i.e. substitute something less hazardous
Prevent access to the hazard e.g. guarding
Organise work to prevent exposure to the hazard
Issue personal protective equipment
Protect the workforce as a whole e.g. through exhaust ventilation
Provide welfare facilities to aid removal of contamination, to take rest breaks etc
Provide first aid facilities
When should Risk Assessments be reviewed?
The Management of Health and Safety at Work Regulations 1999 requires Risk Assessments
to be reviewed if:-
There is reason to suggest that it is no longer relevant or valid
There has been significant change in the matters to which it relates
If changes to the Risk Assessment are required, the employer has a duty to make the
changes and re-issue the risk assessment.
Employers are not expected to anticipate risks that are not foreseeable.
If events happen however, which alter information available or the perception of risk, the
employer will be expected to respond to the new information and assess the hazards and
risks in the light of the increased knowledge.
Accidents and near misses should be investigated as these incidents will indicate whether
more knowledge is available on the hazard or risk associated with the job. The Risk
Assessment may need to be reviewed because:-
Something previously unforeseen has occurred
The risk of something happening or the consequences of the event may be greater
than expected or anticipated
9 of 24
Precautions prove less effective than anticipated
New equipment, new working environment, new materials, different systems of work etc will
all require existing Risk Assessments to be reviewed.
What will an Enforcement Officer expect from my risk assessments?
Enforcement Officers will want to see that you:-
Have completed Risk Assessments
Considered site specific issues
Completed comprehensive checks of the workplace
Involved workers
Considered the hazards and risks to others
Dealt with immediate hazards to reduce risks
Have a system for reviewing Risk Assessments
Have suitable records
Have provided information, instruction and training to your employees
Have introduced suitable and sufficient measures
Site specific Risk Assessments are probably the most important aspect. EHO’s and HSE
Inspectors are not keen on “generic” Risk Assessments unless steps have been taken to
ensure that any special site hazards and precautions have been added to the Risk
Assessment.
To Enforcement Officers, risk assessment is not a paper exercise to be pulled off the shelf in
a Manual. It is a pro-active approach by an employer to consider what could harm his
employees and others and what measures he intends to take to reduce the risks of injury
and ill-health.
10 of 24
EXAMPLE
RISK ASSESSMENT
Name of Business:
Task/Activity (Describe the job being undertaken).
Who is at risk from the activity? (Include employees, customers, contractors and
anyone else who may be in the area).
What are the hazards (dangers)? (Describe what harm could come to people carrying
out the activity or when they are in the area).
What are the potential outcomes from the hazards? (Describe what type of injury
someone could experience and how severe it might be. Is it likely to happen every time or
only on infrequent occasions).
What is the likelihood of the risk occurring? (Describe whether the risk of injury and
the likelihood of it happening is something that will happen rarely, sometimes, all the time).
Low or infrequently Medium or sometimes High or often
11 of 24
How do we currently control these risks? (What safe systems of work, procedures,
protective clothing or equipment are in place).
References (Where to get further information).
What else can we do/what else is required? (Does anything extra need to be done to
reduce the risk of harm or injury even more).
Who prepared the risk assessment and when?
Who needs to know about these findings?
12 of 24
PART 3.0 - Toolbox Talk
Risk Assessment
13 of 24
Risk Assessment – What Is It?
• A careful examination of what could cause harm to
people, so that you can weigh up whether you have
taken enough precautions or should do more.
• The aim is to make sure that no one gets hurt or
becomes ill.
• It is a legal requirement.
Perry Scott Nash Associates Limited 14 of 24
What is a Hazard?
“Something with the potential to cause harm”
Examples: Electricity, Hazardous Substances, Working
at Heights, Vehicles.
Perry Scott Nash Associates Limited 15 of 24
What is Risk?
“The likelihood of harm resulting from a hazard”
Risk = Severity x Probability
Risk can be: High – very likely
Medium – possible, likely
Low – very unlikely
Perry Scott Nash Associates Limited 16 of 24
Management of Health & Safety at
Work Regulations 1999
• Legal duty on employers to carry out risk assessments
as first steps in ensuring safe and healthy workplace
• Written record (5 or more employees)
• Identify preventative and protective measures
• Review assessments if no longer valid
• Risk assessments must be “Suitable and Sufficient”
Perry Scott Nash Associates Limited 17 of 24
What is “Suitable & Sufficient”?
• Identify all hazards
• Identify specific regulations
• Systematic approach
• Include non-routine operations
• Identify who is at risk
• Take existing control measures into account
Perry Scott Nash Associates Limited 18 of 24
5 Steps to Risk Assessment
1. Look for and list the hazards
2. Decide who might be harmed and how
3. Evaluate risks arising from hazards and
decide whether existing controls are
adequate
4. Record the findings
5. Review assessment when necessary
Perry Scott Nash Associates Limited 19 of 24
Step 1: Identify the hazards
• Walk around the workplace and look afresh at
what would cause harm
• Ignore the trivial and concentrate on
significant hazards
• Ask your employees what they think
• Use manufacturers instructions or data
• Refer to accident/incident records
Perry Scott Nash Associates Limited 20 of 24
Step 2: Decide who can be harmed
Employees are the main group, but don’t forget:
Young workers, trainees, new and expectant
mothers etc may be at particular risk
Cleaners, visitors, contractors, maintenance
workers etc who may not be in the workplace
all the time; and
Members of the public, or people you share a
workplace with if there is a chance that they
could be hurt by your activities
Perry Scott Nash Associates Limited 21 of 24
Step 3: Evaluate the risk
• Consider how likely it is that each hazard
could cause you harm
• Even after all precautions have been taken,
some risk usually remains
• Decide for each significant hazard whether
this remaining risk is high,medium or low
• Have you done all the things the law requires
you to do?
• Are there industry standards?
Perry Scott Nash Associates Limited 22 of 24
Step 3: Evaluate the risk
• The aim is to make all risks small
• In taking action, the aim is:
a) Get rid of the hazard altogether
b) Control the risk so that harm is unlikely
• When controlling risks, you need to follow
the “principles of prevention”
Perry Scott Nash Associates Limited 23 of 24
Principles of Prevention
• Try a less risky option
• Prevent access to the hazard (e.g. by
guarding)
• Organise work to reduce exposure to the
hazard
• Issue personal protective equipment
• Provide welfare facilities (e.g. washing
facilities to remove contamination, first aid
etc)
Perry Scott Nash Associates Limited 24 of 24