Understanding risk assessment

Risk assessment has become a standard phrase in health & safety over the last decade.

However, although many people have heard of it, not so many know what it means.

The 1988 Control of Substances Hazardous to Health Regulations were the first to require employers to carry out and record Risk Assessments.

But it was the introduction of the 'six-pack' in 1993 (6 new sets of regulations introduced at the same time) that really brought risk assessment to the forefront of health and safety control strategies.

Much of the 'six-pack' has since been revised and updated, but risk assessment is still the fundamental approach that underpins much of what they require.

General or specific assessments

The Management of Health and Safety at Work Regulations 1999 (MHSWR) require all employers to assess the general risks to health arising from work.

Regulation 3 - risk assessment

Every employer shall make a suitable and sufficient assessment of:

  • the risks to the health and safety of his employees to which they are exposed whilst they are at work
  • the risks to the health and safety of persons not in his employment arising out of or in connection with the conduct by him of his undertaking

for the purpose of identifying the measures he needs to take to comply with the requirements and prohibitions imposed upon him by or under the relevant statutory provisions.  

There are more specific requirements for risk assessments in other legislation, including:


  • The Manual Handling Operations Regulations 1992
  • The Health and Safety (Display Screen Equipment) Regulations 1992
  • The Control of Substances Hazardous to Health Regulations

But, the requirement of regulation 3 of MHSWR is all-embracing.

The purpose of risk assessment

It is important for Safety Reps to be aware of the intentions behind risk assessment - many employers see the legal requirement just as a need to have a piece of paper with a few notes on it. This is NOT sufficient.

In the Approved Code of Practice accompanying the MHSWR, the Health & Safety Executive (HSE) give their own explanation:

"The purpose of the risk assessment is to help the employer or self-employed person to determine what measures should be taken to comply with the employer's or self-employed person's duties under the "relevant statutory provisions" and Part II of the Fire Regulations.

This covers the general duties in the Health & Safety at Work Act 1974 and Part II of the Fire Regulations and the more specific duties in the various Acts and Regulations (including these Regulations) associated with the HSW Act." Health and Safety Executive, Management of Health & Safety at Work Regulations 1999 Approved Code of Practice.

Section 2 of the Health & Safety at Work Act 1974 has specific duties that cover:
  • plant
  • systems of work
  • handling, storage and transport of articles and substances
    workplaces, including access and egress
  • working environment

So, to fully satisfy the legal requirements, a risk assessment should look at all of these areas and produce an action plan to tackle the identified risks.

Hazard and risk explained

The Approved Code of Practice (ACoP) says that a risk assessment should identify the hazards present, and then evaluate the extent of the risks involved, taking existing precautions into account.

In order to properly understand this, we need to know what the HSE mean by 'hazard' and 'risk'.

To quote again from the Approved Code of Practice to the MHSWR:
"a hazard is something with the potential to cause harm (this can include articles, substances, plant or machines, methods of work, the working environment and other aspects of work organisation); risk is the likelihood of potential harm from that hazard being realised. The extent of the risk will depend on the likelihood of that harm occurring; the potential severity of that harm; i.e. of any resultant injury or adverse health effect; and the population that might be affected by the hazards' i.e. the number of people who might be exposed."

Note that hazards are not only physical objects - methods of work can also constitute a hazard or a risk.

There are two particular areas where Safety Reps will want to ensure that Management are paying proper attention during risk assessment: the threat of violence to staff, especially those working away from their own workplaces and the dangers of occupational stress.

Method of assessment

There are no fixed rules for how an employer should actually carry out a risk assessment. It is up to the employer to decide the most suitable method.The HSE do, however, provide some general principles that should be followed.

They suggest that to meet the requirement of 'suitable and sufficient' in the regulation 3 (see page 6) a risk assessment should:

  • ensure that all relevant risks or hazards are addressed
  • ensure all aspects of work activity are reviewed, including routine and non-routine activities. This should cover those not under direct supervision such as people working out of the workplace, at other employers premises, homeworkers and those who visit the public in their homes
  • take account of non-routine work such as maintenance and cleaning;
    be systematic in looking at hazards and risks
  • take account of the way work is organised and the effects this can have on health
  • take account of risks to the public
  • take account of the need to address fire risks
  • identify groups of workers particularly at risk - eg young or inexperienced workers, disabled staff, new or expectant mothers

The HSE have published a guidance leaflet entitled 'Five steps to risk assessment' which may help some employers.

Principles of prevention

One key area of difference between the original 1992 management regulations and the 1999 updated ones is that the principles for preventing and controlling hazards and risks are now part of the regulations. They set a clear hierarchy for control measures:

Avoid the hazard/risk altogether - substitute a hazardous substance with a non- or less hazardous one, if possible.

Combat the risk at source - eg if steps are slippery, replace or treat them rather than just putting up a warning sign.

Adapt work to the individual - consider ergonomics when choosing work equipment or designing work areas. Eliminate monotonous work, where possible.

Adapt to technical progress - keep up to date and informed on new developments in ways of working that reduce or eliminate hazard/risk.

Give priority to collective protective measures - isolate workers from the hazard/risk by enclosing the process rather than giving out protective equipment.

Ensure adequate information, instruction and training - workers need to understand what they need to do to protect themselves.

Issue Personal Protective equipment only as a last resort - when all other methods of risk reduction fail to reduce the risk sufficiently.

Who should carry out risk assessment?

It is essential that whoever is responsible for carrying out risk assessments and planning the necessary follow-up action is aware of the requirements of all the 'relevant statutory provisions'.

But this is not a role that safety reps should be expected to undertake.

The Health & Safety at Work Act 1974 gives safety reps the basic right to be consulted by employers:

"with a view to the making and maintenance of arrangements which will enable him (the employer) and his employees to co-operate effectively in promoting and developing measures to ensure the health and safety at work of the employees and in checking the effectiveness of such measures." HASAWA Section 2(6)

As such, Safety reps should be consulted by their employers not only about who is to be appointed as 'competent persons' but also about how the risk assessment is to be carried out and about the necessary actions to reduce risks that arise from the risk assessments.

The code of practice on the Management regulations points out:

"the risk assessment process needs to be practical and take account of the views of employees and their safety representatives who will have practical knowledge to contribute." 

So, safety reps should be:


  • consulted about who is going to carry out the risk assessment
  • consulted about how the risk assessments are going to be done
  • involved in the identification of hazards and risks
  • consulted about decisions on risk levels and planned actions
  • given a copy of the final risk assessment documents.

In certain areas, safety reps will be far more experienced and better trained than management in health and safety and risk assessment. Management may be tempted to ask safety reps to actually carry out the risk assessment themselves.

Such requests should be politely refused - it is a management duty, not a safety reps responsibility to carry out risk assessment and the independence of the safety rep, in looking at the results, is vital to properly protect the interests of members.

Generic risk assessments

Where many of the risk factors will be similar or identical throughout the organisation, employers may produce 'model' or 'generic' risk assessments for all or part of their organisations.

There is no reason to object to a generic approach, but it is important, as is pointed out in the HSE's guidance, that the generic assessment is applied in each location, where managers must:

  • satisfy themselves that the 'model' assessment is appropriate to their type of work
  • adapt the 'model' to the detail of their own actual work situations, including any extension necessary to cover hazards and risks not referred to in the 'model'.

The need for regular review

Risk assessment is not a one-off event. It is (or should be) a continuous event that reacts to change.

Management of Health & Safety at Work Regulation 3 says that the risk assessment must be reviewed by the employer if:

  • there is reason to believe that it is no longer valid
  • there has been a significant change in the matters to which it relates

It is good practice for Assessments to be reviewed at regular intervals, as well, to ensure that changes have not slipped through.

Updated 8 Feb 2017

Share PCS:

Visit PCS social sites: