Does every employer have to carry out a risk assessment?

Yes. MHSWR 1999 reg 3 applies to every employer and self-employed person, regardless of size. The duty is not limited to high-risk industries. A sole trader employing one person must still assess the significant risks arising from their work activity. The difference for smaller employers is that the assessment can be proportionately simpler.

Does the risk assessment have to be in writing?

In GB, the significant findings must be recorded in writing if five or more people are employed (MHSWR reg 3(5)). In Ireland, the written assessment is required as the basis for the Safety Statement (SHWWA s20) regardless of company size. Even where not legally required to write it down, a written record is strongly recommended as evidence that the assessment was carried out.

How often should a risk assessment be reviewed?

There is no fixed statutory interval. The duty is to review when the assessment "is no longer valid" or after a significant change (MHSWR reg 3(3)). In practice: review annually for most activities; immediately after an accident, near miss or significant change; and whenever new information or guidance becomes available.

Who can carry out a risk assessment?

There is no requirement for a specific qualification. The person must have sufficient knowledge of the work activity, the hazards involved, and the relevant legislation and guidance. For straightforward activities, a trained supervisor or safety-responsible manager is sufficient. For complex hazards (asbestos, major chemical hazards, complex machinery), a competent specialist should be involved (MHSWR reg 7 competent assistance).

Is a risk assessment the same as a method statement?

No, but the two are often produced together (RAMS). The risk assessment identifies hazards, assesses risks and specifies controls. The method statement describes how the work will be done and who will do it, incorporating the controls identified in the risk assessment. On construction sites both are usually required; the risk assessment must come first.

Can I use a template risk assessment?

A template can provide a starting point and a consistent format. However, the completed assessment must reflect the specific hazards in your workplace. A template completed with generic text, without a site-specific walkthrough, is not a suitable and sufficient risk assessment and will not withstand scrutiny.

Risk AssessmentBeginner🇬🇧🇮🇪

How to Conduct a Workplace Risk Assessment

A step-by-step guide for UK and Irish employers and safety managers

10 min read Updated 4 October 2026 MHSWR 1999 reg 3 MHSWR 1999 reg 16 HSWA 1974 s2 SHWWA 2005 s19 GAR 2007 reg 8

Key takeaways

·MHSWR 1999 reg 3 requires every employer to carry out a suitable and sufficient risk assessment of work-related risks — written if you employ five or more.
·A risk assessment has five steps: identify hazards, decide who is at risk, evaluate the risk and apply controls, record the findings, and review.
·The assessment must be proportionate to the complexity of the hazard — a simple office risk assessment can be brief; a chemical handling operation requires depth.
·Reviewing the assessment after incidents, near misses or significant changes is a legal requirement, not optional housekeeping.
·In Ireland, the written Safety Statement (SHWWA s20) must be based on the risk assessment — the two documents are legally linked.

What is a workplace risk assessment?

A risk assessment is the formal process of identifying hazards in the workplace, evaluating the likelihood and severity of harm, and deciding what controls are necessary to manage the risk to an acceptable level. It is the central mechanism through which employers discharge their duty to protect workers and others affected by work activities.

In Great Britain, MHSWR 1999 reg 3 requires every employer and self-employed person to carry out a "suitable and sufficient" risk assessment. If five or more persons are employed, the significant findings must be recorded in writing. In Ireland, SHWWA 2005 s19 and GAR 2007 reg 8 impose an equivalent duty. The written risk assessment is the foundation on which the Safety Statement (SHWWA s20) is built — the two are legally inseparable.

A risk assessment does not have to be complex. The HSE's own guidance states that a small builder with a handful of workers faces different risks from a major chemical plant, and the assessment must be proportionate. What it must not be is generic — it must reflect the actual hazards in your specific workplace.

Legal requirements in Great Britain and Ireland

🇬🇧Great Britain

MHSWR 1999 reg 3

Requires a suitable and sufficient risk assessment of all work-related risks to employees and others. Must be recorded in writing where five or more employees are employed. Must be reviewed when no longer valid or after a significant change.

HSWA 1974 s2(1)

Imposes a general duty on employers to ensure, so far as is reasonably practicable, the health, safety and welfare of employees. The risk assessment is the primary means of identifying what is required to discharge this duty.

🇮🇪Ireland

SHWWA 2005 s19

Requires employers to identify hazards, assess the risks, and put controls in place. The written assessment must be available to employees and their safety representatives on request.

GAR 2007 reg 8

Requires the employer to carry out an assessment of risks to workers arising from the work activity. The assessment must be reviewed when there is reason to believe it is no longer valid or there has been a significant change.

How to conduct a workplace risk assessment

Identify the hazards

Walk around the workplace and look at what could reasonably cause harm. Think about: physical hazards (machinery, vehicles, working at height, slips and trips), chemical and biological hazards (substances, fumes, biological agents), ergonomic hazards (manual handling, DSE, repetitive tasks), and psychosocial hazards (stress, lone working, violence).

Consult your workers — they often know where hazards exist that are not visible in a walkthrough. Review accident, near-miss and ill-health records; these reveal where controls have already failed. Check manufacturers' instructions, safety data sheets and relevant legislation and guidance for the activities you carry out. Do not overlook non-routine activities such as maintenance, cleaning, and visitor access.

Only consider hazards that could realistically cause harm in your circumstances. You are not required to eliminate every conceivable risk — only those that are reasonably foreseeable (HSWA 1974 s2; MHSWR 1999 reg 3).

Decide who might be harmed and how

For each hazard, identify who could be harmed and in what way. Consider: employees working directly with the hazard; maintenance and cleaning staff who may be exposed less frequently but to higher concentrations or during unguarded states; young workers and new starters who may be less aware of risks; new and expectant mothers (special consideration is required under MHSWR 1999 reg 16); contractors, visitors and members of the public; and lone workers who cannot call for immediate help.

Group workers by the nature of their exposure — you do not need to name individuals, but you should identify categories clearly. Where workers with disabilities, health conditions or other characteristics may face additional risk from a hazard, record this and ensure the controls address their specific situation.

Evaluate the risks and decide on controls

For each hazard, consider the likelihood of harm occurring and the severity of that harm if it does. This gives you a sense of the risk level — not a precise number, but a judgement about whether existing controls are adequate.

Apply the hierarchy of controls (MHSWR 1999 Schedule 1 / GAR 2007 Schedule 3): first, try to eliminate the hazard completely; if you cannot, substitute it with something less hazardous; then engineer controls (guarding, ventilation, isolation); then administrative controls (procedures, training, reduced exposure time); and finally personal protective equipment (PPE) as a last resort. PPE protects only the wearer and only while worn correctly — it must never be the primary control where a higher-level control is reasonably practicable.

Decide whether the risk is adequately controlled with existing measures, and if not, identify the additional controls needed. Record who is responsible for implementing each control and by when. Apply the controls before the assessment is complete, or at minimum before work resumes.

Record your findings

If you employ five or more people (GB) or carry out any significant work activity (Ireland), you must record the significant findings of the risk assessment in writing. The record does not need to be in a specific format — it can be paper or electronic — but it must show: the hazards identified, who is at risk, the existing controls, the residual risk level, any additional controls required, who is responsible, and the target completion date.

Keep the record in an accessible format and make it available to employees and their representatives on request (MHSWR 1999 reg 10; SHWWA 2005 s26). A complex written narrative is not required for straightforward workplaces — a structured form or table is sufficient. The test is whether the record would allow someone unfamiliar with the workplace to understand the hazards and controls.

Review and update the assessment

A risk assessment is not a one-off exercise. Review it whenever: there is reason to believe it is no longer valid (MHSWR reg 3(3)); there has been a significant change in the workplace, work activity, or workforce; an accident, near miss or dangerous occurrence has occurred; new information becomes available (new guidance, changed exposure limits, new equipment); or after any period of more than 12 months for higher-risk activities.

In practice, build a review schedule into your safety management system — annually for routine operations, more frequently for higher-risk activities or rapidly changing environments. Date-stamp each review. When a review confirms the assessment remains valid, record that finding too — it demonstrates active management of risk, not neglect.

Pro tip: Take photographs of hazard locations during your walkthrough and embed them in the risk assessment record. A photograph of the loading bay threshold, the unguarded shelf edge, or the poorly lit fire escape stairwell is worth more than a paragraph of description — and makes it much harder for anyone to argue the hazard was not identified.

Workplace risk assessment checklist

Physical walkthrough of all areas completed
Workers consulted and their knowledge captured
Accident, near-miss and ill-health records reviewed
All hazard types considered (physical, chemical, biological, ergonomic, psychosocial)
All groups at risk identified (employees, contractors, visitors, vulnerable groups)
Hierarchy of controls applied — PPE is last resort only
Existing controls evaluated for adequacy
Additional controls identified with owner and deadline
Significant findings recorded in writing
Assessment made available to employees and representatives
Review date set and scheduled
Assessment linked to Safety Statement (Ireland) or safety policy (GB)

Common mistakes to avoid

Copying a generic risk assessment from the internet

MHSWR reg 3 requires the assessment to be "suitable and sufficient" — meaning specific to your workplace and work activity. A generic document does not demonstrate that you have actually assessed your risks.

Failing to record the assessment in writing

For employers of five or more, the written record is a legal requirement. Without it, you have no evidence that an assessment was carried out if a claim or inspection arises.

Never reviewing the assessment

A risk assessment that has not been reviewed after a change or incident is no longer suitable and sufficient. The duty to review is ongoing, not discharged once.

Listing PPE as the primary control

PPE protects only while worn correctly and only the wearer. The hierarchy requires higher-level controls first. Defaulting to PPE without considering engineering or administrative controls is a compliance failure.

Excluding contractors and visitors

MHSWR reg 3 and HSWA s3 extend the duty to persons not employed by the organisation. Contractors and visitors must be included in the assessment of who might be harmed.

GB, Ireland and OSHA: key differences

🇬🇧Great Britain

MHSWR 1999 reg 3 is the primary duty. The written record is required for five or more employees. HSE guidance INDG163 provides practical help for smaller businesses. Fee for Intervention (FFI) may apply where a material breach of the risk assessment duty is found on inspection.

🇮🇪Ireland

SHWWA 2005 s19 and GAR 2007 reg 8 are the primary duties. The written assessment must be incorporated into the Safety Statement (SHWWA s20). Employees must be consulted through a safety representative (SHWWA s26). The HSA publishes sector-specific guidance for many industries.

🇺🇸United States

There is no single general-duty risk assessment regulation equivalent to MHSWR reg 3. Risk assessment obligations arise under individual OSHA standards (e.g. 29 CFR 1910.132(d) for PPE, 29 CFR 1910.119 for PSM). The General Duty Clause (OSH Act s5(a)) acts as a backstop for unaddressed hazards.