The short answer is yes. In the UK, there is no legal requirement for a risk assessment to be carried out by an external consultant or a formally accredited professional, provided the person conducting it is considered “competent.” The Health and Safety Executive (HSE) defines a competent person as someone with sufficient training, experience, knowledge, and other qualities to carry out the task effectively.
For most small businesses and self-employed individuals, this means that a business owner, manager, or designated employee can carry out the assessment themselves. If you have a reasonable understanding of the work activities involved, the hazards present, and the people at risk, you are likely in a strong position to conduct a thorough and legally compliant risk assessment without hiring outside help.
What Are the 5 Main Steps of a Risk Assessment?
Risk assessments in the UK follow a well-established five-step framework endorsed by the HSE. Understanding this structure is the foundation of doing the job properly, whether you are assessing a construction site, an office environment, or a retail premises.
| Step | Action |
|---|---|
| 1 | Identify the hazards |
| 2 | Decide who might be harmed and how |
| 3 | Evaluate the risks and decide on precautions |
| 4 | Record your findings and implement them |
| 5 | Review your assessment and update if necessary |
The five steps move from identification through to ongoing review. You begin by identifying anything that could cause harm, then consider who is at risk and under what circumstances. From there, you weigh the likelihood and severity of harm against existing controls, implement any additional precautions needed, and commit to reviewing the assessment whenever circumstances change.
Need a Risk Assessment? Speak with our Legionella Risk Assessment Team
What Are the 5 C’s of Risk Assessment?
The 5 C’s framework is a practical tool used by many health and safety professionals to structure their thinking during a risk assessment. It offers a slightly different lens through which to approach the process, particularly useful for those new to formal risk management.
| The 5 C’s | Meaning |
|---|---|
| Challenge | Question whether the activity needs to be done at all |
| Control | Identify existing controls already in place |
| Concern | Consider what could go wrong |
| Compliance | Ensure the activity meets legal requirements |
| Check | Verify that controls are working effectively |
What makes the 5 C’s useful is that they encourage a questioning mindset rather than a tick-box approach. Instead of simply recording hazards, this framework pushes you to ask whether risks can be eliminated entirely before considering how to reduce or manage them. For businesses carrying out their own assessments, combining this with the HSE’s five-step model tends to produce more thorough and defensible results.
How Much Does a Risk Assessment Cost in the UK?
If you choose to hire a professional to carry out a risk assessment on your behalf, costs vary considerably depending on the size and complexity of the site or activity being assessed. For a small business or single premises, a basic risk assessment from a health and safety consultant typically ranges from £150 to £500. Larger or more complex environments, such as construction sites or multi-site operations, can see costs rise to £1,000 or more.
It is worth noting that doing it yourself carries no direct financial cost beyond your time, which is precisely why many small business owners opt to handle it in-house. However, if your workplace involves significant hazards, specialist equipment, or a large workforce, the investment in professional support is often worthwhile. The HSE provides free guidance and downloadable templates at www.hse.gov.uk to support those conducting assessments without external help.
For businesses in certain higher-risk sectors, there may also be sector-specific guidance worth consulting. The UK Government’s workplace health and safety guidance outlines obligations by industry, helping you understand whether your situation calls for a more specialist approach before you begin.
How to Complete a Risk Assessment Yourself Confidently
Carrying out a risk assessment yourself is entirely achievable, and for many UK businesses it is the most practical route. The key is approaching it methodically, using the frameworks above as your guide, and being honest about both the hazards present and the effectiveness of your current controls. A risk assessment that is well-documented and regularly reviewed will hold up to scrutiny from the HSE or an insurer far better than one that is vague or outdated.
Begin by walking through your workplace or thinking carefully through your work activities with fresh eyes. It helps to involve employees in the process, since the people doing the work every day often have the clearest insight into where things can go wrong. Their input makes the assessment more accurate and demonstrates a culture of safety awareness that regulators view favourably.
Once your assessment is complete, keep a written record of it. If you employ five or more people, this is a legal requirement under the Management of Health and Safety at Work Regulations 1999. Even for smaller businesses, having a documented assessment protects you, your employees, and your business should an incident ever occur.
Can I Do a Risk Assessment Myself: Frequently Asked Questions
Yes, it is entirely legal to carry out your own risk assessment in the UK, provided you are considered competent to do so. The HSE defines competence as having the appropriate knowledge, training, and experience relevant to the hazards involved.
No formal qualification is required to conduct a risk assessment, though training courses such as IOSH Managing Safely can improve your confidence and capability. What matters most is that you have a genuine understanding of the work activities and the hazards they present.
A risk assessment must identify hazards, determine who could be harmed and how, evaluate the level of risk, record findings, and outline the control measures in place. It should also note who is responsible for implementing those controls and when the assessment will be reviewed.
There is no fixed legal timeframe, but it should be reviewed whenever there is a significant change to working practices, equipment, or personnel. A good rule of thumb is to revisit it at least annually, or immediately following an incident or near miss.
If you employ five or more people, you are legally required to record the significant findings of your risk assessment in writing. Businesses with fewer than five employees are not obligated to do so, though keeping a written record is strongly advisable for all workplaces.
A hazard is anything with the potential to cause harm, such as a wet floor or exposed wiring, while a risk is the likelihood that the hazard will actually cause harm in a given situation. Understanding this distinction is fundamental to carrying out an accurate and useful risk assessment.
Involving employees is not just permitted, it is actively encouraged by the HSE. Workers often have detailed knowledge of day-to-day hazards that a manager or business owner might overlook.
Failing to conduct a risk assessment where one is legally required is a breach of the Management of Health and Safety at Work Regulations 1999. This can result in enforcement action, fines, or prosecution, particularly if a workplace injury occurs and no assessment was in place.
Yes, risk assessments come in several forms including generic assessments, site-specific assessments, dynamic assessments, and task-specific assessments. The type most appropriate for your situation depends on the nature of the work and the variability of the environment. You can learn more on the Wikipedia page for risk assessment for a broader overview.
A dynamic risk assessment is an informal, on-the-spot evaluation carried out in response to changing or unexpected conditions, commonly used in emergency services and construction. It follows the same principles as a formal assessment but is conducted rapidly as a situation develops.
The level of detail should be proportionate to the level of risk involved. A small office with low-risk activities does not require the same depth of assessment as a construction site or chemical handling facility.
Yes, templates are a practical and widely accepted starting point. The HSE offers free downloadable risk assessment templates at www.hse.gov.uk, which are suitable for a wide range of workplace types.
A generic risk assessment covers hazards and controls common to a particular type of work or activity, and can be adapted for use across multiple sites or tasks. They are particularly useful for businesses with similar activities carried out in different locations.
Increasingly, yes. Workplace risk assessments are expected to consider psychosocial hazards such as excessive workload, bullying, or isolation, particularly following updated guidance from the HSE on work-related stress. The UK Government’s guidance on managing workplace stress provides a useful starting point for addressing these risks formally.