A risk assessment is one of the most practical tools any workplace can use to prevent injuries and illnesses before they happen. Yet many people treat it as a paperwork exercise to be completed once and filed away. Done properly, a risk assessment is a living process that helps you understand where harm could come from, who might be affected, and what realistic steps will keep people safe. This guide walks through how to carry out a workplace risk assessment step by step, in plain language, so you can apply it to almost any work environment.

What a Risk Assessment Actually Is

At its simplest, a risk assessment is a careful examination of what in your workplace could cause harm to people. The goal is not to eliminate every conceivable danger, which is rarely possible, but to make sure you have taken reasonable precautions. Two ideas sit at the heart of the process. A hazard is anything with the potential to cause harm, such as a trailing cable, a chemical, or a heavy load. A risk is the likelihood that the hazard will actually cause harm, combined with how serious that harm could be. Good assessments separate these two ideas clearly.

Step One: Identify the Hazards

Start by walking through the workplace and looking at how work is really done, not just how the manual says it should be done. Talk to the people doing the job, because they often know about problems that are invisible from an office. Review accident and near-miss records, as these point directly to where things have gone wrong before. Consider physical hazards like machinery and noise, chemical hazards, ergonomic hazards such as repetitive lifting, and psychosocial hazards like excessive workload. Writing each hazard down as you find it keeps the process organised.

Step Two: Decide Who Might Be Harmed and How

For each hazard, identify who could be affected. This includes employees, but also contractors, visitors, cleaners working out of hours, and members of the public. Pay particular attention to people who may be at greater risk, such as new or young workers, expectant mothers, and anyone with a disability. Being specific about how harm could occur, for example “operators could suffer hand injuries from the unguarded blade,” makes the next steps far easier.

Step Three: Evaluate the Risk and Decide on Controls

Now weigh how likely harm is and how severe it could be, then decide what to do about it. The most reliable approach is the hierarchy of controls, which ranks measures from most to least effective. The strongest option is to eliminate the hazard entirely. If that is not possible, try to substitute it with something safer, then apply engineering controls such as guards or ventilation, followed by administrative controls like training and safe systems of work. Personal protective equipment sits at the bottom because it only protects the individual wearing it and does nothing to remove the hazard itself.

Step Four: Record Your Findings

Write down the significant hazards, who is at risk, the controls already in place, and any further action needed. The record does not need to be elaborate, but it should show that a proper check was made and that sensible precautions are in place. Assigning a responsible person and a target date to each action item turns the assessment into something that actually gets done rather than a list of good intentions.

Step Five: Review and Update Regularly

Workplaces change. New equipment arrives, processes are altered, and people come and go. Review your risk assessment whenever there is a significant change, after an incident, and at sensible intervals even when nothing obvious has changed. A risk assessment that is two years out of date may be worse than none at all, because it gives false confidence.

Common Mistakes to Avoid

Several pitfalls show up again and again. Copying a generic template without tailoring it to your actual workplace produces a document that looks complete but protects no one. Focusing only on dramatic hazards while ignoring everyday ones, such as slips and manual handling, misses the injuries that happen most often. Finally, treating the assessment as the end point rather than the beginning means the controls are never checked to see whether they work in practice.

Building Your Skills Further

Risk assessment is a core skill in every recognised safety qualification. If you want to develop a deeper, structured understanding of hazard identification and control, a course such as IOSH Managing Safely is designed exactly for managers and supervisors who need practical, job-ready knowledge. Those aiming for a broader foundation in general industry practices may also find our OSHA General Industry training useful.

Frequently Asked Questions

How often should a risk assessment be reviewed?

There is no single fixed interval, but you should review it whenever there is a significant change to the work, after any incident, and periodically to confirm the controls are still effective. Many organisations review annually as a minimum.

Do small businesses really need risk assessments?

Yes. The size of the business does not change the duty to protect people. The assessment may be simpler for a small operation, but the basic process of identifying hazards and applying sensible controls still applies.

Who should carry out the assessment?

It should be done by someone competent, meaning they have the knowledge, experience, and training to identify hazards and judge risks sensibly. This is often a manager or supervisor who has completed safety training, sometimes supported by specialist advice.

Final Thoughts

A workplace risk assessment is not about producing perfect paperwork. It is about thinking clearly and honestly about where harm could come from and taking reasonable, practical steps to prevent it. When it becomes part of how a team works rather than a box to tick, it genuinely reduces injuries and builds a stronger safety culture over time.