The Five Steps of a Risk Assessment, and the One Most People Skip

A risk assessment does not have to be complicated. It does have to be done. That is worth saying plainly, because the two most common failures pull in opposite directions. Some organisations produce nothing at all, on the basis that it looks like a big job. Others produce something enormous, and then never look at it again. Both end up in the same place.

The HSE five steps are genuinely simple.

Step 1: Identify the hazards

Walk round. Look at what could cause harm. Talk to the people doing the work, because they know things that are not visible on a walk round — the door that sticks, the shortcut everyone takes, the piece of kit that has been temperamental for months.

Check your accident book and near-miss records. They are a list of hazards you have already identified without meaning to.

Step 2: Assess the risks

Not just employees. Contractors, visitors, volunteers, delivery drivers, members of the public, and anyone with particular vulnerability — new or expectant mothers, young workers, lone workers, and people with a disability affecting mobility or hearing.

Deciding who might be harmed, and how, is the part that gets rushed. Staff could be injured is not an assessment. Warehouse staff could suffer crush injuries where pedestrian routes cross the forklift operating area tells you what to do next. The first version generates paperwork; the second generates a control.

Step 3: Control the risks

The question is whether you have done everything reasonably practicable — not everything conceivable, and not merely everything convenient.

Work down the hierarchy of control in order. Can you remove the hazard entirely? If not, can you substitute something less dangerous? Then engineering controls, then administrative controls such as procedures and training, and only then PPE.

Step 4: Record your findings

If you have five or more employees this is a legal requirement. Below that it is still sensible, because an unwritten assessment cannot be handed to anyone.

Record what you found, what you are already doing, what still needs doing, who owns each action and by when. Actions without an owner and a date are aspirations. The record needs to be usable by the person who has to follow it. A document that requires interpretation is not a control measure.

Step 5: Review the controls

Here is the thing. The mistake most organisations make is not getting step one wrong. It is never getting to step five.

A risk assessment that is three years old and has never been looked at again is not really protecting anyone. Worse, it can actively mislead — it records controls that may no longer exist, referencing equipment you have replaced, a layout you have changed, or staff who left in 2023.

Review it when something changes: new equipment, new process, new premises, a change in staffing, an incident or near miss, or a change in the law. And review it periodically anyway, because plenty changes without anyone flagging it as a change.

Why step five is where it falls down

Steps one to four have a natural end point. There is a document at the finish, and finishing feels like completion. It is satisfying, it can be filed, and it can be produced if anyone asks.

Step five has no end point. It is a habit, not a task, and habits without an owner do not survive contact with a busy year. Nobody job description says notice that the risk assessment is now inaccurate.

The practical fix is unglamorous: put a review date in the assessment itself, put it in someone calendar, and make it a named person responsibility rather than the organisation in general.

The test worth applying

If an inspector asked to see your risk assessments tomorrow, could you produce them? And when you read them, would they describe how the work is actually done today?

Those are different questions. A lot of organisations can answer the first and not the second. If your paperwork is gathering dust, that is worth addressing before someone asks to see it.