Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Risk Assessment

    Also known as: Workplace risk assessment, Health and safety risk assessment

    Definition

    The process of identifying hazards, working out who could be harmed and how, judging how likely and how serious the harm could be, and deciding whether the controls in place are enough.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/risk-assessment

    Scope: It is one step inside the wider management of risk and is more than a risk matrix or a hazard register. Whether it must be made, written down and by whom depends on the law of the country: in Great Britain regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires employers to make a suitable and sufficient one.

    Example for your evaluation: Follow one task from hazard to who is exposed, existing controls, further action, owner, due date and review trigger, with the scale and its version beside the score.

    Sources checked: . Examples are editorial illustrations.

    What HSE, the ILO, OSHA and the law say a risk assessment is

    HSE sets out risk management in five steps: identify the hazards, assess the risks, control them, record the findings and review the controls. A risk assessment is the second step. In HSE's wording a hazard is something that may cause harm, and assessing the risk means judging how likely it is that someone could be harmed and how seriously. HSE asks who might be harmed and how, what controls exist and what further action is needed, by whom and by when. The ILO guidelines on occupational safety and health management systems, ILO-OSH 2001, define risk assessment as the process of evaluating the risks to safety and health arising from hazards at work. They define risk as the combination of the likelihood of a hazardous event and the severity of the harm it causes.

    The law differs by country. In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999, as shown on legislation.gov.uk, requires an employer to make a suitable and sufficient assessment of the risks to its employees and to other people affected by its undertaking. The assessor must review it if there is reason to suspect it is no longer valid or if there has been a significant change, and an employer with five or more employees must record the significant findings. HSE says the standard for controls is reasonably practicable, which balances the risk against the time, money and trouble of a control, and that nobody is expected to remove all risk.

    OSHA's page on hazard identification and assessment calls the work a proactive, ongoing process. For each hazard it suggests weighing the severity of the possible outcome, the likelihood of an event and the number of workers exposed, and dealing with the greatest risks first, while stating that employers keep an ongoing obligation to control all serious recognised hazards. That page is guidance on the process, so the duty that applies in the United States has to be found in the law for the sector. ILO-OSH 2001 says hazards and risks should be identified and assessed on an ongoing basis, with measures applied in this order: eliminate, control at source, minimise by safe systems of work, and use personal protective equipment for residual risk. It adds that an assessment should precede new methods, materials, processes or machinery. This page is general information, not legal advice.

    Sources opened :

    What a risk assessment record holds in software

    • The activity, task or equipment assessed, with the assessor, date and people consulted.
    • Each hazard, who could be harmed and how.
    • The judgement of likelihood and seriousness, with the scale and its version.
    • Controls in place and controls added, in the order considered.
    • Each further action with an owner, a due date and evidence of completion.
    • The risk that remains after controls, and who accepted it.
    • The review date and triggers, with earlier versions kept.

    Risk assessment, risk management, HIRA and the risk matrix

    HSE's five steps put the assessment between finding hazards and controlling them, so it is one part of managing risk and not the whole. HIRA is a common name for the hazard identification and assessment process. A risk matrix is one way an organisation may record its judgement of likelihood and seriousness; it controls nothing and does not replace the reasoning behind a score. A risk register can hold the results of any of them.

    A hypothetical example: assessing a new pallet wrapper

    This case is invented and describes no real site. A warehouse buys a pallet wrapping machine. Before first use, a supervisor and two operators list the hazards: entanglement in the rotating arm, trapping at the turntable, heavy film rolls, and forklift traffic. The record states who could be harmed and how, the controls present, and the site's own score for likelihood and seriousness with the scale version.

    Removing the machine is not an option, so further actions are recorded in order: an interlocked guard, a marked exclusion zone for forklifts and a lifting aid, each with an owner and a date. The remaining risk is entered with the manager who accepted it. Three weeks later an operator reports that film jams make people reach in. The supervisor reviews the assessment, changes the guard and the jam procedure, and keeps the earlier version in the history.

    Common misunderstandings about risk assessment

    • The record is not the assessment. HSE says not to rely purely on paperwork, because controlling risks in practice is the main priority.
    • A score is not a control. OSHA says employers keep an ongoing obligation to control all serious recognised hazards, not only those addressed first.
    • An assessment is not finished once written. Regulation 3 requires review when it may no longer be valid or a significant change occurs.
    • A small employer is not exempt from assessing. In regulation 3 the five-employee figure applies to recording the significant findings.
    • The rule is not the same everywhere. Regulation 3 is a British provision, so check the law that applies.

    How risk assessment relates to other glossary terms

    Risk assessment links finding hazards to choosing controls, so the nearest terms are the process, the order of controls and the test of how far to go.

    • HIRA: the hazard identification and assessment process, which produces the assessment.
    • Hierarchy of controls: the order in which measures are considered once the risk is judged.
    • ALARP: a UK test of how far to reduce a risk, weighed against the sacrifice involved.
    • ISO 31000: risk management guidelines in which assessment is one part of the wider process.

    Records and evidence that usually exist for a risk assessment

    • The assessment, dated, with the assessor and people consulted.
    • The scale or criteria for likelihood and seriousness, with its version.
    • The record of significant findings and of any group at particular risk, where the law requires it.
    • The action list with owners, due dates and evidence of completion.
    • Inspection notes showing that the controls work in practice.
    • Review records that show what prompted each review.

    What a software tool needs to capture for risk assessment

    • Separate fields for hazard, exposure, existing controls and further action, not one comment box.
    • Configurable scales for likelihood and seriousness, with the version stored on every score.
    • Actions linked to the assessment, each with an owner, a due date and evidence.
    • Review triggers tied to change, incident and near-miss records, with the history kept.
    • A field naming the law or standard the assessment answers, since the wording differs by jurisdiction.
    • Export of the assessment with its history for an inspector.

    Catalog profiles documenting risk assessment workflows

    Listed profiles meet the risk assessment rule. A listing does not show that a product follows the law of your country or holds every record above, so ask for a worked assessment in a demonstration.

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 37 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is a risk assessment a legal requirement?

    In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires employers to make a suitable and sufficient assessment. Other countries word the duty differently, so check the law that applies to your site and sector.

    Does a small business have to write it down?

    On the text of regulation 3 as shown on legislation.gov.uk, the duty to assess applies to every employer, and the duty to record significant findings applies to employers with five or more employees.

    How often should it be reviewed?

    Regulation 3 requires a review if there is reason to suspect the assessment is no longer valid or there has been a significant change. HSE lists changes to staff, process, substances or equipment, problems spotted by workers, and accidents or near misses as prompts.

    More safety terms

    Related guides