Understanding risk assessment: a beginner's guide

In this resource

• Introduction to working at height
• Step‑by‑step risk assessment process
• Risk rating methodology
• Hierarchy of control measures
• Sample risk assessment
• Key takeaways
• Checklist

Introduction

Working at height introduces several hazards that can cause serious injuries or fatalities if not properly controlled.

A risk assessment must consider situations where workers could:  

• fall from height, such as unprotected edges on a roof or scaffold 
• fall through an opening, such as a skylight 
• fall into a hazard, such as a tank or excavation

Note: There may be other hazards in the area (for example excessive noise). These should be included in the overall risk assessment, even if they are not shown in this example.

Step 1: Identify hazards

Look for any hazard that could cause a worker to fall. Examples include:  

• working at height
• using a ladder
• using a mobile elevated work platform
• fragile surfaces
• edges without protection
• poor weather conditions
• debris or tools dropped from height
• falling into a space such as a storage tank
• equipment failure

Involve workers and supervisors in identifying hazards.

Step 2: Who might be harmed?

Include everyone who could be harmed, such as:

• workers (especially those with medical conditions)
• contractors and subcontractors
• visitors
• members of the public

Step 3: Evaluate the risks

Consider the likelihood of harm and how serious the consequences could be, using the risk matrix in Figure 1.

Risk scoring involves judgement. Different people may rate the same risk differently. Carrying out the assessment with someone else helps you agree on fair scores and identify anything you might miss on your own.

Risk ratings should be agreed by a competent person, such as an occupational safety and health (OSH) professional.

The matrix is a guide to help you think about how likely something is and how serious it could be. Use your knowledge and experience to make the best decision.

Risk rating examples:

Likelihood of harm (L)

You are assessing how likely it is that harm will occur. The less likely it is, the lower the score.

Low risk (1–2)

Tasks with a low likelihood of harm, such as:

• little exposure to hazards 
• a stable environment 
• simple tasks with few steps 
• existing controls such as fixed handrails or barriers

Medium risk (3–12)

As the complexity of the task increases, so does the likelihood of harm. Medium scores apply when:

• existing controls need maintenance 
• procedures are moderately complex 
• equipment requires training to use safely 
• safety measures depend on worker behaviour (PPE) 
• workers are under pressure to finish the task

High risk (12–25)

These tasks involve hazards that are difficult to eliminate or control. Conditions may be unpredictable or change quickly, such as outdoor work in extreme weather or dynamic construction sites.

Characteristics include:

• complex work requiring detailed planning 
• potential for life‑threatening injuries or long‑term health effects 
• multiple layers of control needed (permits, PPE, specialist equipment) 
• variable or extreme weather conditions 
• other workers or the public having access to the area

Consequences of harm (C)

You are considering how serious the harm could be. Low scores apply to minor injuries; the highest scores apply to life‑changing harm.

Low risk (1-2)

Consequences are minor, such as:

• first aid injury (minor cut) 
• a minor medical treatment case with no work restrictions

Medium risk (3-12)

Consequences are more serious and may result in time off work but no long‑term disability.

Examples include:

• a fall causing a laceration needing sutures 
• prolonged time off due to injury (ligament damage) 
• restricted duties (for example concussion)

High risk (12-15)

Consequences cause long‑term health or lifestyle impacts.

Examples include:

• death 
• amputations 
• life‑limiting disability (such as paralysis)

Risk rating = Likelihood (L) × Consequence (C)

Step 4: Control measures

Choose appropriate and practical controls based on the level of risk. Higher‑level controls are more effective than lower‑level controls such as signs or PPE.

Note: These examples follow the hierarchy of control. They are not exhaustive and may not suit every situation.

Eliminate

• avoid working at height

Substitution

• use scaffolds or mobile elevated work platforms instead of ladders
• use temporary roofing systems or sheeting instead of open scaffolds during outdoor work

Engineering controls

• install guard rails and edge protection on elevated areas, such as mezzanine floors
• erect safety nets to catch falling objects
• ensure access to welfare facilities (for example provide drinking water in hot conditions)

Administrative controls

• develop fall protection and fall arrest procedures 
• provide training on safe work practices and PPE 
• communicate risks to workers 
• provide supervision; don’t allow lone working 
• ensure workers are medically fit to work at height

Personal protective equipment

• non‑slip shoes and gloves 
• protective headgear with secure straps 
• fall arrest systems

Step 5: record and review

Document the findings and action plan using a risk assessment template, such as the example below. Communicate the results and controls to the workers carrying out the task.

Risk assessments should be reviewed at least once a year, or sooner if conditions change.

Example Risk Assessment

Task:

Cleaning external gutters (height: 2.5–3.5 m)

Description:

Workers use an extension ladder to access gutters and remove debris.

Key takeaways

• Falls from height are a leading cause of workplace fatalities – risk assessment is essential.
• Use a structured approach: hazard identification → risk evaluation → control selection.
• Apply the hierarchy of controls: eliminate hazards before relying on PPE.
• Risk ratings help prioritise actions but require judgement and collaboration.
• Regular review and clear communication are essential for ongoing safety.

Checklist for working at height risk assessments

• Have all fall hazards been identified? 
• Are all affected people considered (workers, contractors, public)? 
• Has a risk matrix been used to score likelihood and consequence? 
• Are control measures selected according to the hierarchy (eliminate → PPE)? 
• Are ladders, scaffolds and equipment inspected and suitable? 
• Have weather and environmental conditions been considered? 
• Is adequate training and supervision in place? 
• Have findings been documented and communicated? 
• Is there a review schedule (annual or when conditions change)?

Summary

Working at height presents significant risks that require careful planning and robust control measures. A structured risk assessment helps identify hazards, evaluate risks and select effective controls.

By applying the hierarchy of controls, maintaining good communication and reviewing assessments regularly, organisations can reduce the likelihood of serious incidents and support a strong safety culture.

This guide aligns with IOSH's competency framework at the 'understand' level for risk assessment and analysis, risk identification and profiling, and risk prioritisation.