3.2 Five Steps of Risk Assessment

3.2 Five Steps of Risk Assessment

Quick Answer: Managing Safely teaches a practical five-step risk assessment: (1) identify hazards, (2) decide who might be harmed and how, (3) evaluate the risks and decide on precautions, (4) record significant findings, (5) review and update. Do this for workers and others affected (contractors, visitors, public), keep it suitable and sufficient, and reassess when work or knowledge changes.

A risk assessment is not a bureaucratic essay. It is a structured way for a manager to look at real work, judge whether people are protected well enough, and put improvements in place. The five steps give you a repeatable method that matches what the Health and Safety Executive (HSE) expects when organisations manage risks at work.

The five steps at a glance

Modern HSE web guidance sometimes groups language as identify → assess → control → record → review. Managing Safely still trains managers on the classic five-step wording above; both point to the same practical process. Learn the five-step list in order — sequencing questions appear in assessments.

Step 1 — Identify the hazards

Look for anything with the potential to cause harm. Do not wait for an accident file to tell you.

How managers identify hazards well:

• Walk the job at normal operating times and during awkward periods (shift change, night work, peak throughput).
• Watch how work is really done, not only how procedures say it is done.
• Talk to workers and supervisors — they know shortcuts, near misses, and awkward loads.
• Review incident, near-miss, and ill-health records for patterns.
• Check non-routine work: maintenance, cleaning, breakdowns, sampling, deliveries.
• Read supplier information (safety data sheets, manuals) and previous assessments.
• Consider health hazards as well as safety: noise, dust, chemicals, manual handling, stress drivers.

Avoid two extremes: listing every trivial possibility until the assessment is unusable, or only listing hazards that have already injured someone. Aim for significant, reasonably foreseeable hazards.

Step 2 — Decide who might be harmed and how

For each hazard, name who could be affected and how the harm would occur (the hazardous event and pathway).

Groups to consider include:

• Employees doing the task
• Other employees nearby (shared spaces, multi-trade work)
• Contractors and agency workers
• Visitors, customers, and members of the public
• Cleaners and maintenance staff
• Vulnerable workers: young workers, new starters, migrant workers, new or expectant mothers, people with disabilities or health conditions, lone workers

"How" means a concrete scenario: "Warehouse operative may be struck by a reversing forklift when walking to the canteen because pedestrian routes cross vehicle routes without barriers."

Different groups often need different controls even for the same hazard. A visitor may need escorting; a contractor may need induction and a permit; a new mother may need adjusted lifting tasks.

Step 3 — Evaluate the risks and decide on precautions

Now judge how likely harm is and how severe it could be, given what you already do. Then decide whether existing precautions are enough or further action is required.

Questions for the manager:

1. What are we already doing to control this risk?
2. Can we eliminate the hazard or reduce it at source?
3. If not, how do we control exposure so harm is unlikely?
4. What further action is needed, who owns it, and by when?
5. How will we check the control works?

Managing Safely later deepens control choice with ERICPD (Eliminate, Reduce, Isolate, Control, PPE, Discipline) and the idea of what is reasonably practicable. At this step you at least:

• Compare current controls with good practice for the industry
• Prioritise the highest risks first
• Prefer collective, reliable controls over relying only on people "being careful"
• Use PPE as support, not as the first and only answer

You will quantify many of these judgements with the 5×5 likelihood × consequence matrix in the next section. Even without numbers, step 3 is where you decide action.

Step 4 — Record significant findings

Recording turns judgement into something the organisation can share, implement, and audit.

What to record (significant findings):

• The hazards
• Who might be harmed and how
• What you are doing to control the risks
• Further action required, owners, and timescales
• (In project work) risk ratings before and after additional controls

Under the UK Management of Health and Safety at Work Regulations principle taught on this course, if you employ five or more people you must record significant findings. Smaller organisations still benefit from simple records, and clients/insurers often expect them regardless of headcount.

Good records are:

• Proportionate — longer and more detailed where risk is higher
• Usable — supervisors can understand and follow them
• Alive — linked to real controls on the floor, not filed and forgotten

HSE is clear: do not rely on paperwork alone; controlling risk in practice is the priority. The record supports that control.

Step 5 — Review and update

Risk assessments go stale. Review when:

• There is an accident, ill health case, or near miss
• Work changes (new kit, chemicals, layout, process, shift pattern)
• People change in ways that matter (new vulnerable workers, new contractors, loss of experienced staff)
• Workers report that controls are impractical or failing
• New information appears (updated SDS, manufacturer alert, enforcement guidance)
• A set review date arrives (often annually for stable low-risk activities; sooner for higher risk)

Update the written assessment when findings change, and communicate what workers need to know.

Suitable and sufficient assessments

"Suitable and sufficient" is legal and course language for a quality bar. An assessment is suitable and sufficient when it:

• Is proportionate to the risk and complexity of the work
• Identifies significant hazards and foreseeable risks
• Considers everyone who might be affected, including vulnerable groups
• Enables valid decisions about precautions
• Remains valid until circumstances change
• Is recorded appropriately (significant findings)

It does not require zero residual risk, encyclopaedic listing of trivial issues, or that only an external consultant can sign it. Competence matters, but managers are expected to assess risks in their area — bringing in specialists for complex hazards (for example asbestos, major process safety) where needed.

When to assess (and reassess)

Manager action table — five steps

Common failures (exam and real workplaces)

1. Copy-paste assessments that do not match the actual site
2. Ignoring contractors and the public
3. Listing hazards without saying who is at risk and how
4. Recording controls that are not actually in place
5. Never reviewing after change or incidents
6. Treating the form as the goal instead of safer work

If you run the five steps honestly, with worker involvement and clear ownership of actions, you meet the spirit of both Managing Safely and HSE risk-management guidance — and you build the exact habits the practical project marks.