How to Run a Workplace Risk Assessment: Step by Step

This guide follows a risk assessment in order, using what regulators and the ILO publish.

The short answer

A workplace risk assessment is a structured judgement of how likely it is that someone could be harmed by a hazard, and how seriously, followed by a decision on what to do. HSE, the British regulator, sets out five steps: identify the hazards, assess the risks, control the risks, record your findings and review the controls. Do them with the people who do the work, give each action an owner and a date, and reopen the assessment after changes. Duties differ by country, and this article is general information, not legal advice.

What a risk assessment is, and what it is not

• A hazard is a source of potential harm. The ILO defines it as the inherent potential to cause injury or damage to people's health. See hazard identification.
• A risk combines how likely harm is with how serious it could be. OSHA adds that risk is the product of hazard and exposure.
• A risk assessment evaluates those risks. HSE treats it as one step in a wider process. See risk assessment and HIRA.
• Risk management is that wider process, with decisions, action and monitoring around the assessment. See risk management.

A risk matrix is one way of recording a judgement, a register is a record, and a score is not a control.

What the law asks, and why it differs

These are the provisions as the sources state them. Check the law that applies to you.

Great Britain. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a "suitable and sufficient assessment" of the risks to employees at work and to others affected by the undertaking. It must be reviewed if there is reason to suspect it is no longer valid or there has been a significant change. An employer with five or more employees must record the significant findings and any groups identified as especially at risk. The legislation.gov.uk page warns that revised text may not be fully up to date.

United States. Section 5(a)(1) of the Occupational Safety and Health Act, the general duty clause, requires a workplace free from recognised hazards that are causing or likely to cause death or serious physical harm. It is a duty about hazards, not an assessment form. Some standards do require one. 29 CFR 1910.132(d) requires an assessment for hazards that call for personal protective equipment, with a written certification. 29 CFR 1910.119(e) requires a process hazard analysis for covered processes, using a listed method, revalidated at least every five years. OSHA's hazard identification page is recommended practice, not a standard.

European Union. EU-OSHA describes Directive 89/391/EEC, dated 12 June 1989, as setting minimum requirements, with Member States free to keep or introduce stricter ones. It lists risk assessment as a key element, with documentation and periodic reassessment among its parts. National law transposes it.

International. ILO-OSH 2001 is guidance, not law. It says hazards and risks should be assessed on an ongoing basis, and before new methods, materials or machinery are introduced.

The five steps

1. Identify the hazards. Walk the workplace and look at how people work, how plant is used, the substances in use and the state of the premises. Read accident and ill-health records. Include non-routine work such as maintenance and cleaning, and health hazards such as manual handling, chemicals and work-related stress. Consider how employees, contractors, visitors and the public could be harmed, and ask the workers. CCOHS adds methods such as inspections, job safety analysis and employee hazard reports.

2. Assess the risks. Decide how likely harm is and how serious it could be. For each hazard, write down who might be harmed and how, what you already do, what further action is needed, who will do it and by when. OSHA suggests weighing severity, likelihood and the number of workers exposed, and dealing with the greatest risks first.

3. Control the risks. Ask whether the hazard can be removed. If not, make harm unlikely: redesign the job, replace the material or process, reduce exposure, add safe-working measures, and provide protective equipment and make sure it is worn. HSE says you must do what is reasonably practicable, balancing the risk against the cost, time or trouble of a measure. Nobody is asked to remove all risk.

4. Record your findings. HSE says employers of five or more people must record the significant findings: the hazards, who might be harmed and how, and what is being done. It warns not to rely purely on paperwork: controlling risks in practice comes first.

5. Review the controls. Check that they work, review after changes, worker reports, accidents or near misses, and update the record.

A worked example (invented)

This example is invented and describes no real workshop. A workshop with six staff makes steel gates. A supervisor and two fabricators walk the workshop and yard. The scores are their own judgements, likelihood times severity on the 1 to 5 scales of our matrix template, with existing controls in place.

The fume row goes to a specialist because OSHA says assessing health hazards may require specialised knowledge. The lorry row shows why severity matters: at 2 x 5 an event is unlikely but could be fatal, so the row is High and is acted on even though few lorries call. The sheet is reviewed once the saw is installed.

Scoring: a prioritising aid, not a measurement

A 5x5 matrix turns two judgements into a number from 1 to 25. That orders the work and prompts discussion. It measures nothing. CCOHS says there is no single simple way to determine the level of risk, that ranking requires objective judgement, that the team must define the parameters for each score, and that its matrices are examples. The HSE page we read prescribes no grid.

Equal scores are not equal risks: 5 x 1 and 1 x 5 are both 5, but one is a frequent scratch and the other a rare death. Scores differ between assessors unless each level is defined in writing. A "medium" controls nothing, and OSHA says employers must keep controlling all serious recognised hazards, not only the greatest. Our matrix template has written scales and bands, and the job safety analysis template applies them to one task, as explained under JSA.

Choosing controls

ILO-OSH 2001 gives an order of priority: eliminate the hazard; control it at source by engineering or organisational measures; minimise it through safe systems of work, including administrative measures; and, where residual risk cannot be controlled collectively, provide protective equipment at no cost to the worker. The hierarchy of controls page explains the reasoning and the versions in use. For each hazard ask whether a higher control was considered and, if rejected, why. Cost and feasibility may enter (see ALARP).

When to review

HSE gives triggers, not an interval: a control that may no longer work, changes to staff, process, substances or equipment, worker reports, and accidents or near misses. A fixed date is a safety net, not a substitute. The five-year revalidation in 29 CFR 1910.119 is specific to that standard.

What records to keep

HSE's template has columns for who might be harmed and how, what you already do, the further action, who does it and by when. We suggest adding the date, assessor, people consulted, scale and its version, the risk remaining after controls and who accepted it, and the review date. Keep earlier versions.

The six most common mistakes

Mixing up hazard, risk and injury. Writing "back injury" where the hazard is a heavy lift makes the later steps vague.

Copying someone else's assessment. HSE warns against copying an example and adding your company name.

Leaving out people and awkward tasks. A desk-written assessment misses non-routine work, contractors and unseen health hazards.

Treating the score as a measurement. A grid figure carries a precision it does not have.

Stopping at the rating. A risk with no action, owner and date has not been controlled, and relying on protective equipment skips higher controls.

Never reopening it. An assessment right on the day can be wrong after a new machine, substance or near miss.

What 212 vendor profiles record about risk assessment

We checked the records of 212 QHSE, EHS and ESG software profiles through 14 October 2026. In the 212 profiles researched, a missing statement means we found none, not that the product lacks the feature. No product is named, and the methodology describes the profile set.

In the 212 profiles researched, 51 (24%) record at least one capability named as a risk assessment, hazard identification, job safety analysis, bow-tie or risk register capability, documented or stated conditionally. For the other 161 we found no such statement.

Only 10 of the 51 name more than one of the five. Only capabilities named in a record are counted, so these are a floor.

Of those 51 profiles, 28 document an offline workflow for the product in some form (13 documented and 15 partial). That field covers the whole product, not risk assessment alone, and in only 5 of the 51 does the wording of the risk capability itself mention offline use. For the other 23 the offline field records no documented or partial offline workflow. If you assess on a roof or in a plant room, ask to see one completed with no connection.

Limits appear in the records too. In 9 of the 51 (18%) the wording says the capability does not by itself establish, prove or replace something, for example that a configured risk screen does not replace competent assessment. One says its tools support processes rather than guaranteeing compliance. In total, 23 of the 51 (45%) state such a limit or ask the buyer to confirm, validate or demonstrate part of the capability before relying on it.

None of this shows that software establishes compliance, and none of it ranks a product. Software can hold the record, route actions and prompt reviews; the judgement stays with people. See the risk assessment software guide, the job safety analysis software guide and the library.

Disclosure. One of the 212 profiles belongs to a vendor that pays for sponsored placement on this site, and the editor works at that vendor. Its record was read by the same rules as every other and is counted in every figure above like any other profile. It is not named in this article.

FAQ

Do I need a written risk assessment?

It depends on where you are. In Great Britain, regulation 3 requires an employer with five or more employees to record the significant findings, and smaller employers still have to assess. US and EU duties are framed differently, as above, and national or state rules may add more.

Does a risk assessment have to use a 5x5 matrix?

No source we read requires one. HSE's steps ask you to decide how likely harm is and how serious it could be, and CCOHS presents its matrices as examples. If you use one, define each level in writing.

How often should a risk assessment be reviewed?

HSE gives triggers rather than an interval: changes, worker reports, accidents and near misses. Regulation 3 requires review when an assessment may no longer be valid or after a significant change. Some standards set their own intervals.

Can software carry out a risk assessment for me?

It can store the record, route actions and prompt reviews, but it cannot judge who might be harmed on your site. Treat a tool as a record, and ask for a worked assessment in a demonstration.

Sources

Read on 17 October 2026 (the eCFR blocked automated requests, so the standards were read on OSHA's pages):

• HSE: Steps needed to manage risk
• HSE: Managing risks and risk assessment at work
• HSE: Risk assessment template and examples
• legislation.gov.uk: Management of Health and Safety at Work Regulations 1999, reg. 3
• OSHA: Hazard identification and assessment
• OSHA: Occupational Safety and Health Act, section 5
• OSHA: 29 CFR 1910.132, personal protective equipment
• OSHA: 29 CFR 1910.119, process safety management
• EU-OSHA: The OSH Framework Directive, introduction
• ILO: ILO-OSH 2001 guidelines on OSH management systems (PDF)
• CCOHS: Hazard identification
• CCOHS: Risk assessment
• The QHSE Standard: methodology and the profile evidence files behind the vendor counts