Risk assessments are one of those business obligations that can feel intimidating at first, particularly for small business owners who are managing every aspect of their operation without a dedicated health and safety team. The good news is that in most circumstances, yes, you can absolutely do your own risk assessment. Understanding what that involves, who qualifies to carry one out, and what the process actually looks like will help you approach the task with confidence rather than anxiety.
Can I Do a Risk Assessment Myself?
The short answer is yes, and for many businesses this is entirely appropriate. UK health and safety law does not require you to hire an external consultant to complete a risk assessment. What it does require is that the person carrying it out is competent, meaning they have sufficient knowledge, experience, and understanding of the work activities being assessed.
For a small low-risk business, such as an office environment or a small retail shop, the owner or a senior member of staff is often perfectly placed to carry out the assessment themselves. They know the workplace, they understand the day-to-day tasks, and they are aware of the specific hazards present. The key is to approach it seriously, document it properly, and act on what you find. under the Control of Substances Hazardous to Health Regulations). Each serves a distinct purpose, and many workplaces will require more than one type depending on their operations.
Are you in need of a risk assessment? Speak with a member of our Professional Risk Assessment Team
Who Can Legally Carry Out a Risk Assessment?
There is no legal requirement for a risk assessment to be completed by a certified health and safety professional, but there are important qualifications on who is considered suitable. Under the Management of Health and Safety at Work Regulations 1999, employers are required to appoint one or more “competent persons” to assist with health and safety matters. Competence in this context means having the appropriate knowledge and skills rather than holding a specific qualification.
In practice, this means a business owner, a trained manager, or even a designated employee can legally carry out a risk assessment provided they understand the hazards involved in the work. For higher-risk industries such as construction, manufacturing, or chemical handling, a greater level of expertise is expected and in some cases an external specialist may be necessary. You can find further guidance on competency requirements through the Health and Safety Executive.
| Risk Level | Recommended Assessor |
|---|---|
| Low (offices, retail) | Business owner or trained employee |
| Medium (warehousing, hospitality) | Appointed internal competent person |
| High (construction, manufacturing) | Specialist or qualified H&S professional |
| Specialist (chemicals, confined spaces) | External expert with specific accreditation |
What Are the 5 Main Steps of a Risk Assessment?
The Health and Safety Executive outlines a five-step process that forms the foundation of any competent risk assessment. This framework is widely recognised and gives you a clear, logical structure to follow whether you are assessing a small workshop or a busy customer-facing environment.
The five steps are: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record your findings and implement them, and finally review the assessment and update it as necessary. Each step builds on the last, and skipping any one of them weakens the overall quality and legal standing of the document. Working through each stage methodically ensures nothing is overlooked and demonstrates that your assessment has been carried out with genuine care.
| Step | Action Required | Key Consideration |
|---|---|---|
| 1. Identify Hazards | Walk the workplace, consult staff | Include non-obvious risks |
| 2. Who Might Be Harmed | Consider employees, visitors, contractors | Include vulnerable groups |
| 3. Evaluate the Risks | Assess likelihood and severity | Implement controls to reduce risk |
| 4. Record Findings | Written record for 5+ employees | Must be suitable and sufficient |
| 5. Review and Update | Revisit after incidents or changes | Regular scheduled reviews recommended |
How Much Does a Risk Assessment Cost in the UK?
If you choose to carry out your own risk assessment, the direct financial cost is minimal. It primarily requires your time and access to appropriate guidance, much of which is freely available through the Health and Safety Executive’s website. However, if you decide to bring in an external health and safety consultant, costs vary considerably depending on the size and complexity of your business.
For a straightforward small business assessment, a consultant might charge anywhere from £150 to £500. Larger or more complex assessments for industrial sites or businesses with multiple locations can run into several thousand pounds. The Health and Safety Executive’s guidance on risk assessment is a useful starting point for understanding what is expected before you decide whether to manage this in-house or bring in external support.ironment.
Have any questions? Talk to a member of our Expert Risk Assessment Team
Managing Your Own Risk Assessment: A Practical Approach
One of the most common misconceptions about risk assessments is that they need to be lengthy, complex documents filled with technical language. In reality, a straightforward written record that honestly identifies the hazards in your workplace, considers who could be affected, and outlines the steps you have taken to reduce risk is entirely sufficient for most businesses. The goal is not to produce an impressive-looking file; it is to actually make your workplace safer.
Businesses with five or more employees are legally required to record their risk assessment in writing under the Management of Health and Safety at Work Regulations 1999. Those with fewer than five employees are not legally obliged to keep a written record, though doing so is strongly advisable as it demonstrates due diligence and provides a reference point for future reviews. A well-documented assessment also protects you in the event of an insurance claim or a workplace incident.
Carrying out your own risk assessment is not just a legal obligation; it is one of the most practical things you can do to protect your team and your business. With the right approach, a clear framework, and access to good guidance, it is a task that most business owners are well equipped to handle without outside help.
Can I Do My Own Risk Assessment: Frequently Asked Questions
The primary legal requirement comes from the Management of Health and Safety at Work Regulations 1999, which obliges all employers to conduct suitable and sufficient risk assessments. Employees and the self-employed are also covered under this legislation if their work activities could affect others.
Yes, any employer with one or more employees has a duty to assess risks in the workplace, though businesses with fewer than five employees are not legally required to write them down. That said, recording findings is strongly recommended as it demonstrates due diligence and supports any future review.
A dynamic risk assessment is an on-the-spot evaluation carried out when circumstances change unexpectedly, most commonly used by emergency services, social workers, and healthcare professionals. It involves rapidly identifying hazards, assessing risks, and adjusting actions in real time without the luxury of a planned assessment process.
There is no fixed legal interval, but assessments should be reviewed whenever there is a significant change to the task, workplace, or workforce, and at regular intervals even if nothing has changed. Many organisations build annual or biannual reviews into their health and safety management cycles.
A COSHH assessment is a specific type of risk assessment required under the Control of Substances Hazardous to Health Regulations 2002, covering any work involving potentially harmful substances. It identifies exposure risks and sets out the controls needed to protect workers, such as ventilation, PPE, and safe storage procedures.
The employer holds ultimate responsibility for ensuring risk assessments are conducted, though the task itself can be delegated to a competent person with the relevant knowledge and training. In larger organisations, this is often a dedicated health and safety officer or an external consultant.
A hazard is anything with the potential to cause harm, such as a wet floor or a chemical substance, whilst a risk is the likelihood that the hazard will actually cause injury or illness combined with the potential severity of that harm. Distinguishing clearly between the two is fundamental to producing an accurate and useful assessment; for a broader definition, the Wikipedia page on risk assessment provides a helpful starting point.
Absolutely, and in many cases their involvement is essential. Workers who carry out a task daily will often identify hazards that a manager or external assessor would miss entirely.
Employers with five or more staff must record the significant findings in writing, including the hazards identified, the people at risk, and the control measures put in place. Keeping dated records also provides evidence of compliance if the assessment is ever challenged by an enforcement authority.
If the HSE or a local authority inspector finds that an assessment is insufficient, they can issue an improvement notice requiring corrective action within a set timeframe. In serious cases, particularly where inadequate assessments have contributed to injury, prosecution and financial penalties may follow.
Yes, lone working introduces specific hazards around communication, emergency response, and supervision that must be addressed within a dedicated risk assessment. The HSE’s guidance on lone working provides practical advice on managing these risks appropriately.
A generic risk assessment is a pre-prepared template covering a common task or activity that can be adapted for use across multiple sites or teams without starting from scratch each time. They are particularly useful in industries with standardised processes, though they must always be reviewed to ensure they reflect the specific conditions of each location.
The level of detail should be proportionate to the complexity and severity of the hazards involved; a simple office environment requires far less detail than a chemical manufacturing plant. What matters is that the assessment is suitable, sufficient, and genuinely reflects the real risks present.
Inherent risk is the level of risk present before any controls are applied, whilst residual risk is what remains after control measures have been implemented. A well-conducted risk assessment aims to reduce residual risk to a level that is as low as reasonably practicable, a standard often referred to in UK health and safety law as ALARP.