Risk assessments are one of those things that sound far more complicated than they actually are. Whether you’re an employer trying to meet your legal obligations or a small business owner working through workplace safety for the first time, understanding the fundamentals makes the entire process far more manageable than the paperwork might suggest.
The good news is that conducting a basic risk assessment does not require a specialist qualification or years of experience. What it does require is a clear method, a logical mindset, and a genuine commitment to keeping people safe.
How to Conduct a Basic Risk Assessment: Getting Started the Right Way
Before you begin writing anything down, it helps to understand what a risk assessment actually is. At its core, it is a structured way of identifying hazards in your workplace or activity, evaluating how likely those hazards are to cause harm, and deciding what action you need to take to reduce or eliminate that risk.
The Health and Safety Executive (HSE) recommends a straightforward approach that works for most small to medium businesses. You do not need to overcomplicate it. If you employ five or more people, you are legally required to record your findings, but even if you employ fewer, going through the process is considered best practice and can protect you significantly if something goes wrong.
Are you in need of a risk assessment? Speak with a member of our Professional Risk Assessment Team
What Are the 5 Main Steps of a Risk Assessment?
The five-step framework is the backbone of almost every basic risk assessment carried out in the UK. Following it in order keeps your assessment thorough and ensures you do not miss anything important.
| Step | Action Required | Example |
|---|---|---|
| 1 | Identify the hazards | Wet floors, heavy lifting, electrical cables |
| 2 | Decide who might be harmed and how | Employees, visitors, contractors |
| 3 | Evaluate the risks and decide on precautions | Signage, PPE, staff training |
| 4 | Record your findings and implement them | Written assessment, action log |
| 5 | Review your assessment and update as needed | Annual review or after an incident |
Start by physically walking around the area or working through the activity you are assessing. You are looking for anything that could reasonably cause harm, from obvious physical hazards like trailing cables to less visible risks such as stress or manual handling issues. Speak to employees too as they often notice things that managers miss entirely.
Once you have your list of hazards, think carefully about who is at risk and under what circumstances. New employees, young workers, pregnant staff, and visitors to the premises may all face different levels of risk from the same hazard, and your assessment needs to reflect that.
What Are the 5 P’s of Risk Assessment?
The 5 P’s framework is a useful alternative lens through which to approach your risk assessment, particularly if the standard five steps feel too procedural for your situation. It stands for: People, Premises, Processes, Plant (equipment), and Products.
| Category | Focus Area | Common Risks |
|---|---|---|
| People | Staff, visitors, contractors | Human error, inexperience, fatigue |
| Premises | Building, outdoor spaces | Structural hazards, poor lighting |
| Processes | Working methods, procedures | Unsafe practices, lack of training |
| Plant | Equipment, machinery | Faulty tools, missing guards |
| Products | Materials used or produced | Chemical exposure, allergens |
This model works particularly well in manufacturing, construction, and hospitality settings where there are multiple risk categories operating simultaneously. Running through each of the five P’s ensures that your assessment is genuinely comprehensive rather than focused solely on the most obvious hazards in the room.
The People category is worth particular attention. Thinking not just about employees but about everyone who might come into contact with your work environment, including delivery drivers, cleaning contractors, or members of the public, is a step that many first-time assessors overlook. protocols. The Health and Safety Executive emphasises the importance of considering all reasonably foreseeable circumstances that could affect workplace safety, including equipment failures, human error, and external factors beyond direct organisational control.
Can I Do My Own Risk Assessment?
Yes, and in most cases you absolutely should. The law does not require you to hire a consultant or bring in an external health and safety specialist to carry out a basic risk assessment. What it does require is that the person conducting the assessment is what the HSE describes as a “competent person,” someone who has the knowledge, training, and experience to identify risks and understand what to do about them.
For most low-risk environments, such as offices, small retail premises, or simple workshop settings, a competent business owner or manager is perfectly capable of carrying out a thorough and legally compliant risk assessment. The key is being honest with yourself about the risks that exist and not simply documenting what you want to see rather than what is actually there. The HSE’s risk assessment guidance is an excellent starting point and covers everything a first-time assessor needs to know.
Using Your Risk Assessment to Build a Safer Workplace
Completing a written risk assessment is not the finish line; it is closer to the starting pistol. Once you have identified your hazards, assessed the likelihood and severity of harm, and put control measures in place, the real work is making sure those controls are actually used day to day. A document that sits in a filing cabinet and never reaches the people it is designed to protect is not serving its purpose.
Reviewing your risk assessment regularly is just as important as creating it in the first place. Under the Management of Health and Safety at Work Regulations 1999, employers are required to review risk assessments whenever there is reason to believe they are no longer valid, after an incident, or following any significant change to working practices or the physical environment. Building a short review into your annual calendar, rather than waiting for something to go wrong, is by far the most sensible approach.
Have any questions? Talk to a member of our Expert Risk Assessment Team
How to Do a Basic Risk Assessment: A Practical Summary
Understanding how to do a basic risk assessment comes down to adopting a consistent, methodical approach and treating the process as an ongoing responsibility rather than a one-off task. The frameworks available, whether you use the five steps, the five P’s, or a combination of both, all point in the same direction: identify what could go wrong, figure out who is at risk, and take proportionate action to prevent harm.
For small businesses especially, the risk assessment process can feel like an administrative burden, but it is worth reframing it as an investment. A well-executed assessment protects your staff, reduces your liability, and demonstrates to employees, clients, and insurers alike that you take safety seriously. The time it takes to do it properly is almost always less than the time and cost involved in managing the aftermath of a preventable accident.
The basics are genuinely achievable for most business owners without specialist input. Staying informed, keeping your documentation up to date, and revisiting your assessment whenever your working environment changes will keep you on the right side of the law and, more importantly, keep the people in your workplace safe.
How to Do a Basic Risk Assessment: Frequently Asked Questions
Yes, under the Management of Health and Safety at Work Regulations 1999, all employers must carry out a suitable risk assessment. Businesses with five or more employees are also required to record their findings in writing.
There is no fixed legal timeframe, but assessments should be reviewed after any incident, significant change to the workplace, or at least annually. Regular reviews ensure that control measures remain relevant and effective.
A hazard is anything that has the potential to cause harm, such as a wet floor or exposed wiring. A risk is the likelihood that the hazard will actually cause harm and the severity of that harm if it does.
No formal qualification is required, but the person conducting the assessment must be deemed competent by the HSE. This means having sufficient knowledge and experience to identify hazards and determine appropriate control measures.
The HSE uses this phrase to describe a risk assessment that is proportionate to the level of risk involved. It does not need to be overly detailed for low-risk environments, but it must genuinely reflect the hazards present.
Absolutely, and many businesses now use digital tools or templates to complete and store their assessments. The format does not matter as long as the content is accurate and the document is accessible to those who need it.
A dynamic risk assessment is one carried out in real time in response to rapidly changing circumstances, often used by emergency services or lone workers. It involves quickly identifying new hazards and adjusting actions accordingly as a situation develops.
Risk assessment is a process used across industries to evaluate potential hazards and implement measures to reduce harm. For a comprehensive definition and historical context, the Wikipedia page on risk assessment offers a thorough breakdown of the topic.
Control measures are the actions you take to reduce or eliminate the risks identified in your assessment, such as installing safety guards, providing PPE, or introducing a new working procedure. They should be proportionate to the level of risk identified.
While a competent person leads the process, it is good practice to consult with employees at all levels, as frontline workers often have direct insight into the hazards they face daily. Involving your team also improves engagement with the resulting safety measures.
Yes, lone workers face unique risks and employers have a specific duty of care towards them. The HSE provides dedicated guidance on lone worker safety, and any risk assessment should address the specific circumstances under which lone workers operate.
You should update your risk assessment immediately to reflect the new hazard and introduce any necessary control measures without delay. Waiting until the next scheduled review is not appropriate when a new or significant risk has emerged.
There is no single mandatory template, and the HSE provides several example templates on its website to help businesses get started. The HSE risk assessment template page is a practical resource for anyone completing their first assessment.
Failure to conduct a risk assessment can result in enforcement action from the Health and Safety Executive, including improvement notices, prohibition notices, or prosecution. Beyond the legal consequences, the absence of an assessment significantly increases the likelihood of a workplace accident occurring.