Health and Safety Risk Assessments: A Practical Guide

If you run a business in the UK, you’re legally responsible for the health and safety of your employees and anyone else affected by your work. But what does that actually mean in practice? At the heart of your responsibilities sits the risk assessment – a process that sounds daunting but is absolutely manageable with the right know-how. This guide strips away the jargon and gives you clear, step-by-step advice on how to carry out effective risk assessments, understand your legal duties, avoid common mistakes, and build a safer workplace – whatever your industry or size.

In the UK, health and safety isn’t just a paperwork exercise – it’s a legal obligation, and it plays a crucial role in protecting your staff, customers, and business reputation. The Health and Safety at Work etc. Act 1974 makes it clear: every employer must ensure, so far as is reasonably practicable, the health, safety, and welfare of their employees. Risk assessments are the foundation of this duty.

A risk assessment helps you identify potential hazards in your business, evaluate the risks they pose, and decide on sensible controls to prevent accidents or ill health. Without a proper assessment, you’re essentially blind to the dangers that could cause harm, lead to costly incidents, or attract enforcement action from the Health and Safety Executive (HSE).

Beyond the legal requirements, there’s a strong business case. Work-related injuries and ill health cost UK businesses billions every year. According to the HSE, in 2022/23, workplace injuries and illnesses amounted to an estimated £20.7 billion. Effective risk assessments can help you cut business disruption, avoid fines and claims, and foster a safer, more productive environment.

• Legal requirement under the Management of Health and Safety at Work Regulations 1999.
• Protects your staff, customers, and reputation.
• Reduces the risk of fines, claims, and enforcement.
• Improves productivity by reducing accidents and absenteeism.
• Demonstrates your commitment to staff welfare.

Every UK employer, regardless of size or sector, must carry out a 'suitable and sufficient' risk assessment. This duty falls under the Management of Health and Safety at Work Regulations 1999 (Regulation 3). If you employ five or more people, you must also record the significant findings of your risk assessments and any groups of people especially at risk.

‘Suitable and sufficient’ means your assessment must cover all reasonably foreseeable risks, be proportional to the level of risk, and take account of those who may be affected – not just employees, but also contractors, visitors, and the public. You should review and update your assessment regularly, especially after significant changes (e.g. new equipment, work processes, premises, or after an incident).

The law doesn’t require you to eliminate all risk – that’s impossible. Instead, you must do everything ‘reasonably practicable’ to reduce risks to an acceptable level. This means balancing the level of risk against the time, trouble, and cost of controlling it. The HSE expects you to implement measures unless grossly disproportionate to the risk.

• Assess risks to employees, contractors, visitors, and the public.
• Record findings if you have five or more employees.
• Review and update regularly or after significant change.
• Address risks ‘so far as is reasonably practicable’.
• Consider groups at particular risk (e.g. young workers, pregnant employees, disabled staff).

Risk assessment doesn’t have to be complicated or academic. The HSE recommends a straightforward five-step approach that works for almost any business. Here’s how to apply it in practice – with pitfalls to avoid and real-world examples for UK small firms.

Start by walking around your workplace and observing how activities are carried out. Engage with your staff – they often spot hazards managers miss. Remember, a hazard is anything that may cause harm (e.g. trailing cables, chemicals, manual handling), while risk is the chance that harm will occur, and how serious the outcome could be.

Be methodical: break down your workplace into logical areas or tasks (e.g. office, workshop, delivery van) and tackle each in turn. Don’t forget less obvious hazards such as stress, lone working, or exposure to violence for customer-facing roles. Consider who might be harmed and how – think beyond employees to contractors, visitors, and vulnerable groups.

• Involve employees in the process for better results.
• Use HSE sector-specific templates as a starting point.
• Record only significant findings – focus on real risks.
• Prioritise controls with the biggest impact on safety.
• Set reminders to review assessments at least annually.

Not all businesses face the same hazards. An office’s biggest risks may be slips and trips, while a cafe faces hot surfaces and sharp knives, and a builder must control work at height and hazardous substances. The HSE provides free, sector-specific guidance and example risk assessments for dozens of industries – use these as a baseline, but tailor them to your actual work.

Don’t copy and paste generic risk assessments – they won’t protect you if something goes wrong. Instead, use HSE templates to prompt your thinking, then adapt the controls to reflect your business’s size, activities, and people. Pay special attention to any risks unique to your premises or work processes. For example, an independent retailer with a basement storeroom and regular delivery drivers faces different risks to a high street shop without these features.

You must also consider emerging risks, like stress, lone working, and mental health, which are increasingly recognised as significant hazards. The HSE now expects businesses to assess and manage work-related stress under the same legal framework as physical risks.

• Adapt HSE example assessments to your business, don’t just copy them.
• Include emerging risks like stress and lone working.
• Train staff on sector-specific hazards and safe practices.
• Check for risks from new technologies or working patterns.
• Monitor for changes in legislation affecting your sector.

If you employ five or more people, you must keep a written record of your risk assessments. This doesn’t have to be a complicated document – a simple, clear format is best. The HSE provides free templates, and many businesses build their own forms tailored to their activities.

At a minimum, your record should include: the hazards identified, who could be harmed and how, what controls are in place or needed, the person responsible for implementing actions, and the date of assessment/review. Avoid jargon and keep it accessible – your staff should be able to understand it easily.

You must also review your risk assessment regularly. The HSE recommends at least annually, but you should also update it every time you make significant changes (e.g. new equipment, changes in staff, new premises), or after any accident or near miss. Keep a record of reviews and any changes made.

• Keep assessments simple and clear – avoid jargon.
• Store records securely (paper or digital) and back them up.
• Share relevant controls with all affected staff.
• Review at least annually or after significant change.
• Document all reviews and updates for audit trail.

Many small businesses fall foul of health and safety law through simple, avoidable mistakes – often due to misunderstanding what’s required or cutting corners on paperwork. The most common error is treating risk assessment as a ‘tick box’ exercise, producing generic documents that don’t reflect the real risks in your business.

Another frequent issue is failing to act on the findings of your assessment. It’s not enough to identify hazards – you must actually implement and maintain the controls. The HSE will look for evidence that you put your assessment into practice, not just that you filled in a form.

Some businesses neglect less obvious risks such as work-related stress, or forget to review their assessments after significant changes. Others overlook vulnerable groups or new starters who may lack experience. These gaps can leave you exposed if something goes wrong.

• Don’t just copy someone else’s risk assessment – tailor it to your business.
• Act on your findings – put controls in place, don’t just record them.
• Review and update regularly, not just once a year.
• Include less obvious risks (e.g. stress, lone working, violence).
• Make sure staff know about and follow control measures.

Failing to carry out a suitable and sufficient risk assessment is a criminal offence under UK law. The penalties can be severe: the HSE can issue improvement or prohibition notices, prosecute offenders, and courts can impose unlimited fines and even imprisonment in the worst cases (e.g. after a serious accident or fatality).

Enforcement is not theoretical. According to HSE statistics, small businesses account for a significant proportion of enforcement action, because they’re often less likely to have robust health and safety systems. Even without prosecution, a serious workplace accident can result in compensation claims, increased insurance premiums, reputational damage, and loss of business.

Remember, you can also face civil claims from employees or members of the public if your negligence causes harm. Courts will look at your risk assessments and whether you followed them when determining liability.

• Improvement notices: require you to fix issues within a set timeframe.
• Prohibition notices: stop unsafe work immediately.
• Unlimited fines for breaches of health and safety law.
• Potential prison sentences for directors/managers in serious cases.
• Compensation claims and higher insurance costs after incidents.

The best risk assessments aren’t written for inspectors – they’re tools to help you run a safer, more efficient business. Involve your staff, keep the process simple, and see it as a way to spot hazards before they become costly problems. A practical, living risk assessment will help you adapt to changes, reassure your team, and demonstrate your professionalism to clients and regulators alike.

Remember, the HSE isn’t expecting perfection or huge bureaucracy. They want to see that you’ve thought sensibly about risks, involved those who do the work, and taken reasonable steps to control the dangers. For many small businesses, a few pages of clear, focused assessment – regularly reviewed and acted upon – is enough to stay compliant.

Don’t be afraid to ask for help if you’re unsure. The HSE, your local authority, trade associations, and the Federation of Small Businesses (FSB) all provide guidance and support. For high-risk or complex situations, it may be worth consulting a qualified health and safety advisor, but most everyday risks can be managed in-house with the right attitude and some practical know-how.

• Keep assessments short, focused, and practical.
• Review after any significant changes or incidents.
• Make staff part of the process for better buy-in.
• Store records securely and share controls clearly.
• Use HSE and FSB resources for templates and advice.