Risk assessment: the five steps, and the checks that keep it true

01

What a risk assessment is, and the law that requires one

The duty to assess risk at work comes from regulation 3 of the Management of Health and Safety at Work Regulations 1999, which apply in England, Scotland and Wales. It says: "Every employer shall make a suitable and sufficient assessment of (a) the risks to the health and safety of his employees to which they are exposed whilst they are at work; and (b) the risks to the health and safety of persons not in his employment arising out of or in connection with the conduct by him of his undertaking", for the purpose of identifying the measures needed to comply with health and safety law. Northern Ireland has the same duty in the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, also in regulation 3.

Four parts of regulation 3 shape the document most people mean by "risk assessment":

• Who it covers (regulation 3(1)): the employer's own employees, and everyone else the work affects: visitors, the client's staff, members of the public, other contractors. This mirrors the general duty in section 3 of the Health and Safety at Work etc. Act 1974 to conduct an undertaking so that people not in the employer's employment are not exposed to risks to their health or safety, so far as is reasonably practicable.
• When it must be reviewed (regulation 3(3)): if "there is reason to suspect that it is no longer valid" or "there has been a significant change in the matters to which it relates", and any changes the review shows are needed must be made.
• Young people (regulations 3(4) and 3(5)): an employer must not employ a young person, someone under 18, without first assessing the risks to them, taking into account their inexperience, lack of awareness of risks and immaturity.
• What must be written down (regulation 3(6)): where the employer employs five or more employees, "the significant findings of the assessment" and "any group of his employees identified by it as being especially at risk".

Regulation 3 is the general assessment. Other regulations require their own assessments for particular hazards, such as hazardous substances (see COSHH assessment) and manual handling (see HSE's Manual handling at work). Regulation 16 requires the general assessment to include the risks to new or expectant mothers and their babies wherever the workforce includes women of child-bearing age and the work could put them at risk. Fire is assessed separately too: in England and Wales the responsible person for premises must make a fire risk assessment under article 9 of the Regulatory Reform (Fire Safety) Order 2005.

The assessment is not an end in itself. Schedule 1 to the 1999 Regulations sets out the general principles of prevention the controls must follow, starting with "avoiding risks", then "evaluating the risks which cannot be avoided" and "combating the risks at source", and including "giving collective protective measures priority over individual protective measures". Regulation 5 then requires arrangements for the "effective planning, organisation, control, monitoring and review" of those measures.

Several other legal requirements of the 1999 Regulations follow from the assessment. Regulation 6 requires "such health surveillance as is appropriate having regard to the risks to their health and safety which are identified by the assessment"; regulation 8 requires procedures "to be followed in the event of serious and imminent danger to persons at work", such as a fire, an intruder or a gas leak found on a night patrol; and regulation 13 requires adequate health and safety training when people are recruited and again when they are exposed to new or increased risks, such as a change of responsibilities, new work equipment or a new system of work.

02

What a risk assessment covers in practice

HSE's overview, Managing risks and risk assessment at work, puts the legal duty in three plain parts: identify what could cause injury or illness in your business (the hazards), decide how likely it is that someone could be harmed and how seriously (the risk), and take action to eliminate the hazard or, if that is not possible, control the risk. Its list of common workplace risks runs from asbestos to work-related stress.

On the sites where cleaning and security teams work, an assessment usually needs to deal with these potential hazards:

• Slips, trips and falls: wet floors, trailing cables and poorly lit stairs (see slips and trips).
• Manual handling: waste sacks, furniture and loaded trolleys.
• Work equipment and electricity: floor machines, ladders and steps, and worn leads and plugs.
• Hazardous substances: cleaning chemicals, and the bodily fluids and sharps that cleaners and security officers both meet; these also need their own COSHH assessment.
• Working alone and at night: HSE's guidance on managing the risks of working alone tells employers to think about who will be involved and which hazards could harm those working alone, and names violence, stress and mental health, medical suitability and isolated locations.
• Violence and aggression: HSE defines work-related violence as "any incident in which a person is abused, threatened or assaulted in circumstances relating to their work", and its guidance on how employers can protect workers from violence and aggression at work covers assessing that risk. For anyone who challenges people, it is often the most significant finding.
• The building itself: roof access, plant rooms, car parks and vehicle routes.

The assessment is about people as well as hazards. HSE's Risk assessment: steps needed to manage risk asks you to think about employees, contractors, visitors and members of the public, and to take particular care over young workers, migrant workers, new or expectant mothers and people with disabilities. A relief officer on a first shift is easily missed by an assessment written for the regular team.

03

The five steps of a risk assessment

The five steps most people quote come from HSE's Risk assessment: steps needed to manage risk: identify hazards, assess the risks, control the risks, record your findings, and review the controls. HSE says you can do it yourself or appoint a competent person to help you.

1. Identify the hazards. HSE says to look around the workplace and think about what may cause harm, including how people work and how plant and equipment are used, what chemicals and substances are used, what safe or unsafe work practices exist and the general state of the premises. Walk the site at the times the work is done, because hazard identification from the office misses what the night shift sees, and think about hazards to health, such as manual handling, chemicals and stress, as well as to safety.
2. Assess the risks. Decide, in HSE's words, "how likely it is that someone could be harmed and how serious it could be", and who could be harmed and how, judging likelihood and severity with the control measures as they actually are on site.
3. Control the risks. Look at the control measures already in place and ask whether the hazard can be removed altogether; if not, how the risks can be controlled so that harm is unlikely. HSE's order of controls runs from redesigning the job and replacing the materials, machinery or process, through organising the work to reduce exposure, to providing personal protective equipment, the last resort. Involve the people who do the work: HSE says employees will usually have good ideas.
4. Record the findings. If you employ five or more people, HSE says you must record your significant findings, including the hazards, who might be harmed and how, and what you are doing to control the risks.
5. Review the controls. HSE says you must review the controls you have put in place to make sure they are working. It says you should also review them if they may no longer be effective or if changes in the workplace, such as to staff, a process, substances or equipment, could lead to new risks, and that you should consider a review if workers have spotted problems or there have been accidents or near misses.

Step 3 is finished when the control is in place on the site, not when it is written down, and step 5 is the evidence that the controls still work, not a date on the cover sheet. HSE's steps page warns: "Do not rely purely on paperwork as your main priority should be to control the risks in practice."

04

Writing it down: templates, risk matrices and telling the team

Regulation 3(6) requires a record of the significant findings, not a particular form. HSE's free risk assessment template and examples keeps a simple record of who might be harmed and how, what you are already doing to control the risks, what further action you need to take, who needs to carry out the action and when it is needed by. Its examples cover an office-based business, a local shop, food preparation and service, a motor vehicle repair shop, factory maintenance work and a warehouse. HSE warns: "Do not just copy an example and put your company name to it as that would not satisfy the law and would not protect your employees."

A useful risk assessment for a contracted service usually has three layers:

• Generic assessments for each kind of work: washroom cleaning, floor care, static guarding, mobile patrol.
• A site-specific assessment for each building, written after a walk round with the client: its hazards, who else works there, the areas out of bounds and any task done only there.
• Task or method statements for higher-risk one-off work, such as high-level cleaning from a platform or a deep clean in an occupied plant room.

A risk matrix is a common way of recording step 2: likelihood and severity each scored, often from 1 to 5, and multiplied to give a rating that is shown as red, amber or green. Neither the Regulations nor HSE's five steps require one. It can help to rank which risks to deal with first, and it can mislead: two people will score the same hazard differently, and a low number can make a risk look settled when the control behind it is not in place. If you use a matrix, record the control measures the score depends on, and score the risk as it is with those controls actually working on site.

Writing the assessment down is half the duty; telling people what it says is the other. Regulation 10 requires every employer to give its employees "comprehensible and relevant information on (a) the risks to their health and safety identified by the assessment; (b) the preventive and protective measures". For a cleaning or security team that usually means a site induction, the significant findings in plain words in the site file or the officer's assignment instructions, and a briefing whenever the assessment changes.

Whoever carries out the assessment needs to understand the work. Regulation 7 requires an employer to appoint one or more competent persons to help it meet its duties, someone with "sufficient training and experience or knowledge and other qualities" to do so. On most contracts that is the contract manager, working with the site supervisor who knows how the work is actually done.

05

Shared sites, contractors and keeping it under review

Most cleaning and security work happens in someone else's building, so at least two employers have duties on the same site. Regulation 11 says that where two or more employers share a workplace, whether temporarily or permanently, each must co-operate with the others so far as necessary for them to comply, take all reasonable steps to co-ordinate their measures, and "take all reasonable steps to inform the other employers concerned of the risks to their employees' health and safety arising out of or in connection with the conduct by him of his undertaking". Regulation 12 adds that the host must give the employer of visiting workers comprehensible information on the risks its activities create and the measures it has taken.

In practice that is an exchange, and it should happen before the contract starts. The client tells the contractor about the building: asbestos, plant rooms, the fire procedure, other contractors. The contractor tells the client about its work: chemicals, machines, lone working, wet floors. Each writes its own assessment, and neither can rely on the other's to cover its own people.

Regulation 3(3) sets no fixed review interval; it requires a review when there is reason to suspect the assessment is no longer valid or there has been a significant change. An annual review date is good practice, not law, and an assessment reviewed regularly against what actually happens on site stays truer than one reviewed only on its date. The events that should prompt a review on a contracted site include:

• an accident, a near miss or a case of work-related ill health (see near-miss reporting);
• a new task, machine, chemical or working pattern, such as a move from day to night cleaning;
• a change to the building, such as a refurbishment or a new tenant;
• a new member of staff in a group the assessment identified as especially at risk, such as a young person or a new or expectant mother;
• a complaint, an audit finding or a supervisor's check that shows a control is not working.

06

Where the record fails, and what SiteClara does about it

Most risk assessments do not fail on paper: the one in the site file says the right things. What fails is the routine it relies on. The wet floor signs are in the wrong cupboard, the hourly check-in slipped months ago, and the hazard the night cleaner noticed was mentioned to whoever was passing. Nobody knows until there is an accident, and then nobody can show when the control was last checked or by whom.

SiteClara records those routine checks where they happen. A printed QR poster, with an NFC tag behind it if staff prefer to tap, sits at each place a check is scheduled: the cleaners' cupboard, the plant room door, a point on the patrol route. Staff scan or tap with their own phone, with no app to install, see the checks due there, and mark each one done or explain what stopped them, with a photo when one is asked for. The time and the named person are recorded as it happens. A hazard found on the round, such as a damaged lead, a blocked route or a broken light on the stairs, is reported there and goes onto the team's list of jobs until someone closes it.

The supervisor sees which checks are due, done and missed, and records the reason one was missed. Each day they approve a report that goes to nominated management or client contacts the next morning, showing what was completed, what was reported and what is still open. That is a working record, made at the time, of whether the controls are in place.

07

Questions people ask

Is a risk assessment a legal requirement?

Yes, for every employer. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to its employees and to anyone else affected by its work, and to review it when it may no longer be valid. Only an employer with five or more employees must write the significant findings down, but every employer must make the assessment. Regulation 3(2) puts the same duty on a relevant self-employed person, for the risks to themselves and to others affected by their work.

Who can carry out a risk assessment?

The employer is responsible for it, and HSE's Risk assessment: steps needed to manage risk says: "You can do it yourself or appoint a competent person to help you." Regulation 7 of the 1999 Regulations requires an employer to appoint one or more competent persons to help it meet its duties, someone with "sufficient training and experience or knowledge and other qualities", and to prefer a competent person among its own employees to an outside one.

What should a risk assessment include?

Where there are five or more employees, regulation 3(6) requires a record of the significant findings and of any group of employees identified as especially at risk. HSE's steps needed to manage risk says the record should include the hazards, who might be harmed and how, and what you are doing to control the risks.

Is there a free risk assessment template?

Yes. HSE's Risk assessment template and examples page offers its template in Word and Open Document formats, for a simple record of who might be harmed and how, what you are already doing, what further action is needed, who needs to carry it out and when it is needed by. No particular form is required by law, and HSE warns against copying one of its examples and putting your company name to it.

When should a risk assessment be reviewed?

Whenever there is reason to suspect it is no longer valid, or there has been a significant change in the matters it covers, under regulation 3(3). HSE's steps needed to manage risk adds that you should review the controls when they may no longer be effective or when workplace changes could bring new risks, and consider a review when workers have spotted problems or there have been accidents or near misses. The law sets no fixed interval; an annual review date is common practice.

08

Further reading, and a list to take away

The Health and Safety Executive's online pages, starting from Managing risks and risk assessment at work, have replaced its leaflet Risk assessment: a brief guide to controlling risks in the workplace (INDG163), whose old address now redirects there. For larger or higher-risk organisations HSE points to Managing for health and safety (HSG65, revised 2013), which explains the Plan, Do, Check, Act approach to managing health and safety. The 1999 Regulations are on legislation.gov.uk, and the Health and Safety Executive for Northern Ireland enforces the Northern Ireland Regulations.

For a risk assessment that holds up, check that:

• there is a site-specific assessment for every building, not only a generic one for the type of work;
• it covers everyone affected: your staff, the client's staff, visitors, the public and other contractors;
• groups especially at risk are identified, including young people, new or expectant mothers and lone workers;
• removing or reducing the hazard was considered before personal protective equipment;
• the significant findings are written down if you employ five or more people, and the team has been told what they say;
• the client and the contractor have exchanged what each knows about the site and the work;
• the control measures it relies on are checked on a schedule, and a missed check is recorded with a reason;
• it is reviewed after an accident, a near miss or a significant change, as well as on its review date.