IOSH
Understanding risk assessment: a beginner’s guide
How to identify hazards, assess risk and put the right controls in place
This guide takes you through the key steps, from spotting hazards to deciding what action to take.
What is the difference between hazard and risk?
A hazard is anything with the potential to cause harm. For example, a wet floor could cause someone to slip.
A risk is the likelihood that the hazard will cause harm, combined with how serious the harm could be. If a wet floor is blocked off, the likelihood of slipping is reduced. If the spill is cleaned up, the hazard is removed and the risk is eliminated.
Hazards: six common groups
-
Mechanical
Risks from machinery or equipment – being crushed between moving and fixed parts, struck by ejected components or harmed by mechanical tools.
-
Ergonomic
Repetitive movements, manual handling and poorly set-up workstations.
-
Physical
Sources of physical energy: vibration (hand–arm vibration syndrome), electricity (electric shock) and noise (hearing loss).
-
Psychosocial
From how work is organised or experienced – job demands, bullying or harassment, long shifts, overtime or lone working.
-
Chemical
Can cause harm to people or the environment, including chemical burns, skin conditions or respiratory problems.
-
Biological
Bacteria, viruses and fungi.
Health and safety risk assessments: the essentials
-
What is a risk assessment?
The process of identifying hazards in the workplace and deciding what you can do to prevent or reduce harm. This includes:
- identifying hazards – recognising what could cause harm
- analysing risks – who might be harmed and how
- assessing risks – how serious the harm could be and how likely it is
- controlling risks – deciding what actions to take to reduce harm
- recording and reviewing the findings – documenting the risks, controls and planned review dates.
-
When is a risk assessment carried out?
Risk assessments are needed at several points, including:
- at the start of a project (baseline assessment)
- periodically, such as every two years
- when there are changes to the workplace or processes
- after an accident, to help prevent it happening again
- when the law requires a specific assessment, such as for display screen equipment (DSE).
-
Why do risk assessments matter?
Risk assessments are often required by law, but more importantly, they:
- help prevent accidents and ill-health
- protect your organisation from liability
- show you care about workers’ wellbeing
- support informed decision making
- form the foundation of good health and safety management.
How to carry out a risk assessment?
-
Identify hazards
Walk around your workplace with fresh eyes. Look for anything that could cause harm. Talk to workers – they often notice hazards that management may miss.
Top tip: don’t just look for obvious dangers. Consider what could go wrong during routine tasks, maintenance or emergencies.
-
Analyse the risk
Consider who might be harmed and how, including:
- workers
- customers and visitors
- contractors
- members of the public
- vulnerable workers (pregnant, disabled, migrant, young or older workers).
Think about how each group might be affected differently by the same hazard.
-
Assess the risk
Once you know who might be harmed, decide:
- how likely the harm is (from very unlikely to almost certain)
- how serious the consequences could be (from minor injury to fatality).
You will need to make a judgment on likelihood that the harm will arise and a realistic decision about the consequences. Your decision should be based on past experiences, accident reports, and how often workers are exposed to hazards.
The worst-case scenario is that death may occur but realistically this is unlikely. A matrix, such as the one below, can be used to rate risks. This helps with the next step: deciding what action to take to reduce the risk and how urgent it is.
Use past experience, accident reports and exposure levels to judge this. A simple risk matrix can help you prioritise which risks need attention first.
Remember: risk ratings help prioritise action – they’re not exact calculations.
-
Plan to control the risk
Based on your ratings, decide what controls you’ll put in place. Higher risks need more urgent action. Controls include:
- eliminating the hazard
- substituting with something less hazardous
- engineering controls (machine guards, local exhaust ventilation)
- administrative controls (training, job rotation)
- personal protective equipment (PPE).
-
Record and review
Risk assessments and action plans should be live documents. Recording your findings helps make sure workers understand the risks and the controls they must follow.
Who should take part in a risk assessment?
The people involved in a risk assessment depend on the size of the organisation. Those to consider include:
- a competent person to lead the process, someone with the right mix of knowledge, skills, experience and behaviours
- managers, to explain work processes and identify hazards
- workers, to describe how tasks are carried out
- worker representatives or trade union representatives
- occupational safety and health specialists (safety, health, hygiene)
- external experts for high‑risk equipment or processes
- human resources.
Common challenges and how to overcome them
-
“I don’t know where to start.”
Begin with high‑risk activities or where problems have occurred.
-
“The risks seem too complex.”
Break processes into smaller steps and assess each one.
-
“Workers don’t follow the controls.”
Involve them in the process and ensure leaders support the controls.
-
“Management says we don’t have time.”
Explain that preventing accidents saves time, money and effort later.
Summary
- Risk assessment is about preventing harm, not ticking boxes.
- Focus on what could realistically cause significant harm.
- Involve workers – they have valuable insights.
- Keep assessments simple and practical.
- Review and update regularly.
- Challenge poor assessments.
- Build your skills gradually with training and practice.
Practical resources
Risk rating matrix
You can use a risk rating matrix to help you assess risks. This one is illustrative only, organisations should adapt their own system.
Example of a risk assessment
This example can be used in any workplace.
| Question | Answer |
|---|---|
| What is the hazard? | Wet floor |
| Who might be harmed? | Employees and visitors |
| How might they be harmed? | Slips and falls |
| Existing controls | Warning signs |
| Risk rating | Moderate |
| Action required | Clean up spill immediately and review cleaning procedures |
-
Risk assessment checklist
Use this quick checklist to make sure your risk assessment process is thorough and up to date.
- Identify hazards – walk the workplace and consult workers.
- Analyse who might be harmed and how.
- Assess the risk – likelihood and severity.
- Decide on controls – eliminate, substitute, engineer, administrate, PPE.
- Record findings.
- Review regularly.
- Involve workers and competent persons.
- Focus on significant risks.
Do you find this page useful?
Thank you for your feedback
Your feedback helps us improve our website.
Frequently asked questions
-
How do I know if I’ve identified all the hazards in my workplace?
You can be confident you've covered the main areas if you’ve:
- combined a physical walkthrough of the workplace with worker feedback, and
- checked each of the six hazard groups – mechanical, ergonomic, physical, psychosocial, chemical and biological.
Remember to look beyond obvious dangers to routine tasks, maintenance and emergencies too.
-
When should I update my risk assessment?
Update your risk assessment at the start of a new project, whenever the workplace or process changes, after an accident or periodically as a scheduled review.
Many organisations review every two years as a baseline. Some tasks, such as display screen equipment use, also carry their own legal requirement for assessment.
-
What do I do if I’m unsure how to rate the severity or likelihood of a risk?
Base your judgement on past experience, accident reports and how often workers are exposed to the hazard, rather than focusing only on the worst-case outcome.
A risk matrix can help structure this, but remember ratings are there to help prioritise action, not to produce an exact calculation. A reasonable, consistent judgement is enough.
-
How do I choose the most effective control measure?
Work down the hierarchy of controls where possible: elimination and substitution remove or reduce the hazard itself, and are generally the most effective.
Where that isn’t possible, use engineering controls (like machine guards), then administrative controls (like training).
Personal protective equipment is a last line of defence rather than the primary solution.
-
Who should I involve if my organisation is small or doesn’t have health and safety specialists?
At minimum, involve a competent person to lead the process. This can be an external consultant if you don't have one in-house, plus the managers and workers who understand how the work is actually done.
For high-risk equipment or specialist areas, bring in external expertise rather than trying to cover it internally.
