Understanding who bears legal responsibility for conducting risk assessments sits at the heart of workplace health and safety compliance in the UK. The Management of Health and Safety at Work Regulations 1999 place clear statutory duties on employers, yet a surprising number of business owners remain uncertain about their specific obligations and whether they can pass these responsibilities to someone else.
This guide examines the legal framework surrounding risk assessment duties, clarifies who must ensure these evaluations take place, and sets out the circumstances that trigger these requirements. Whether you run a sole trader operation, manage a small team, or oversee a large organisation, understanding these obligations protects both your workforce and your business from potential prosecution under UK health and safety legislation.
Who Can Legally Carry Out a Risk Assessment?
The law provides considerable flexibility regarding who can physically conduct a risk assessment, provided that person possesses the necessary competence. Employers can carry out assessments themselves, delegate the task to employees with appropriate expertise, or bring in external consultants who specialise in occupational health and safety.
The critical legal requirement centres on competence rather than specific qualifications or job titles. The Health and Safety Executive defines competence as having sufficient training, experience, knowledge, and other qualities to carry out the task properly. A well-trained supervisor may be perfectly capable of assessing routine office hazards, whilst complex industrial environments will often demand the specialist knowledge of a qualified safety professional.
It is worth noting that appointing someone to conduct assessments does not transfer legal accountability away from the employer. The employer remains responsible for ensuring the assessment is completed to the required standard, documented where necessary, and acted upon. This distinction matters enormously if a workplace incident leads to investigation or prosecution.
Competence also needs to be matched to the specific risks in question. Someone with strong experience in construction environments may not be the right person to assess risks in a food processing facility or a healthcare setting. Employers should give careful thought to this match when deciding who conducts assessments across different areas of the business.
Need a Risk Assessment? Speak with our Legionella Risk Assessment Team
Do I Need a Risk Assessment with Less Than 5 Employees?
One of the most persistent misconceptions in UK health and safety is that businesses below a certain size are exempt from risk assessment requirements. This is not accurate. Every employer in the UK must conduct risk assessments regardless of how many people they employ, making the obligation universal across all business scales.
The confusion typically stems from documentation rules rather than the assessment duty itself. Businesses with fewer than five employees are not legally required to record their findings in writing, though they must still identify hazards and put appropriate control measures in place. The Health and Safety Executive strongly recommends written records even for smaller businesses, as documented assessments provide clear evidence of due diligence and serve as a practical reference point for future reviews.
The table below summarises how documentation requirements vary by business size and employment status.
| Business Type | Risk Assessment Required | Written Records Required |
|---|---|---|
| 1 to 4 employees | Yes | No, but strongly recommended |
| 5 or more employees | Yes | Yes, legally required |
| Self-employed with employees | Yes | Depends on employee count |
| Self-employed, no employees | Only if work affects others | No |
The “fewer than five” threshold applies solely to written records. It does not reduce or remove the underlying duty to assess hazards and control risks. A sole trader working alone on client premises, for instance, must still consider the risks their work creates for others in that environment, even if they face no obligation to produce a written document.
Who is Required to Draw Up the Risk Assessment Document?
The responsibility for creating risk assessment documentation ultimately rests with the employer, though they may delegate the actual writing to competent individuals within their organisation or external professionals. This delegation does not transfer legal accountability, meaning employers remain liable for ensuring assessments are comprehensive, accurate, and regularly updated.
When appointing someone to prepare risk assessment documents, employers must verify their competence through relevant training, qualifications, or demonstrated experience in the specific workplace environment. The person creating these documents should understand both the hazards present in the workplace and the legal requirements surrounding risk assessment documentation under current health and safety regulations.
| Data Table: Risk Assessment Documentation Requirements |
| Minimum Content Requirements |
| Identification of significant hazards |
| Assessment of who might be harmed |
| Evaluation of existing control measures |
| Additional controls needed |
| Implementation timeline |
| Review date |
| Legal Compliance Standards |
| Must be suitable and sufficient |
| Should be proportionate to risk level |
| Must be reviewed regularly |
| Should be accessible to employees |
Understanding Your Legal Obligations for Workplace Risk Assessments
Compliance with risk assessment legislation protects businesses from prosecution whilst creating safer working environments that benefit both employees and operational efficiency. The legal framework, established through the Health and Safety at Work etc. Act 1974 and subsequent regulations, creates a clear hierarchy of responsibility that begins with the employer and extends through management structures to individual workers.
Employers who fail to conduct adequate risk assessments face potential prosecution, unlimited fines, and personal liability for workplace accidents that could have been prevented through proper hazard identification and control. The courts consistently demonstrate that ignorance of legal requirements provides no defence, making it essential for business owners to understand and fulfil their statutory obligations regardless of company size or industry sector.
The most effective approach to risk assessment compliance involves establishing systematic procedures that integrate hazard identification into regular business operations rather than treating it as a separate administrative burden. This integration ensures continuous monitoring of workplace conditions, prompt identification of new hazards, and regular review of existing control measures to maintain their effectiveness over time.
Key points for maintaining legal compliance:
Due for a Risk Assessment? Speak with our Legionella Assessment Team
Frequently Asked Questions
Can I delegate my risk assessment responsibilities to an employee?
You can delegate the practical task of conducting risk assessments to competent employees, but you remain legally accountable for ensuring the work is completed properly. The employee must have sufficient training and knowledge to identify hazards and assess risks appropriately.
What qualifications does someone need to carry out a risk assessment?
No specific qualifications are legally required, but the person must be competent with adequate training, experience, and knowledge of the workplace hazards. Professional qualifications like NEBOSH can demonstrate competence but aren’t mandatory for all situations.
How often must risk assessments be reviewed?
Risk assessments should be reviewed whenever there are significant changes to work activities, equipment, or personnel, and at least annually even if no changes occur. More frequent reviews may be necessary in high-risk environments or following accidents.
What happens if I don’t carry out risk assessments?
Failure to conduct risk assessments can result in prosecution by the Health and Safety Executive, with potential unlimited fines and imprisonment for serious breaches. You may also face civil liability if employees are injured due to unidentified hazards.
Can I use generic risk assessment templates?
Generic templates can provide a starting point, but assessments must be specific to your workplace hazards and circumstances. Simply downloading and filing a template without proper consideration of your actual risks will not satisfy legal requirements.
Do I need separate risk assessments for different areas of my business?
You may need separate assessments for different work areas, activities, or employee groups if they face different hazards. However, you can combine related activities into a single assessment if the risks and control measures are similar.
What is the difference between a hazard and a risk in risk assessment?
A hazard is something with potential to cause harm, whilst risk is the likelihood that harm will occur and its potential severity. For example, a wet floor is a hazard, but the risk depends on factors like how many people walk there and whether warning signs are present.
Can self-employed people carry out their own risk assessments?
Self-employed individuals must assess risks if their work could affect others, such as clients or members of the public. They can conduct their own assessments provided they have sufficient competence to identify relevant hazards and control measures.
What should I do if I identify high-risk hazards during assessment?
High-risk hazards require immediate attention and control measures before work continues. You should implement temporary controls if possible, seek specialist advice for complex hazards, and ensure all affected employees are informed of the risks and protective measures.
How detailed should risk assessment records be?
Records should be detailed enough to show you’ve properly considered the hazards and control measures, but proportionate to the level of risk. Simple risks may need only brief documentation, whilst complex hazards require comprehensive analysis and control strategies.
Who can help me understand my risk assessment obligations?
The Health and Safety Executive provides free guidance and templates, whilst professional bodies like IOSH offer training and resources. You can also consult qualified health and safety advisers or refer to the Risk Assessment Wikipedia page for additional background information.
What control measures should I consider after identifying risks?
Follow the hierarchy of controls: eliminate the hazard if possible, substitute with something safer, use engineering controls, implement administrative controls, and provide personal protective equipment as a last resort. The most effective control measures address risks at their source.
Can employees refuse to work if no risk assessment has been conducted?
Employees have the right to refuse work they reasonably believe presents serious and imminent danger, which could include situations where obvious hazards haven’t been assessed. However, they should raise concerns through proper channels before taking such action.
How do I ensure my risk assessments remain legally compliant?
Keep assessments current through regular reviews, ensure they’re conducted by competent persons, document findings appropriately, implement identified control measures, and provide relevant training to employees. Consider professional advice for complex or high-risk situations.