This guide is maintained as a current resource for September 2026 and covers only the laws of England and Wales. Information is for general guidance, not legal advice. Consult a qualified solicitor for advice specific to your situation.
Learn how to conduct legal risk assessments in England and Wales, covering statutory requirements under health and safety law, the five‑step assessment process, documentation duties, worker involvement, and practical guidance for employers to meet their legal obligations and manage workplace risks effectively.
Conducting risk assessments is a legal requirement for employers in England and Wales. A risk assessment helps identify workplace hazards, evaluate the likelihood of harm, and decide on suitable control measures to protect employees and others affected by work activities. These assessments underpin an employer's duty of care under the Health and Safety at Work etc. Act 1974 and are detailed further in the Management of Health and Safety at Work Regulations 1999. This guide explains the legal context, the steps involved in conducting a compliant risk assessment, and practical guidance on documenting, reviewing, and acting on findings.
Legal Framework for Risk Assessments
Statutory Obligations
Under the Management of Health and Safety at Work Regulations 1999, employers must undertake a “suitable and sufficient” risk assessment of health and safety hazards associated with their business activities. This is in addition to the broader statutory duty to ensure the health, safety and welfare of employees under the Health and Safety at Work etc. Act 1974. These duties extend to contractors, visitors and members of the public who may be affected by work activities.
Writing Down Risk Assessments
If an organisation has five or more employees, employers are legally required to record the significant findings of their risk assessments in writing. There is no strict legal requirement to write down assessments in smaller organisations, but having written records is considered best practice and supports evidence of compliance.
What Is a “Suitable and Sufficient” Risk Assessment?
A risk assessment is considered “suitable and sufficient” if it:
- identifies the significant hazards associated with work activities
- evaluates the likelihood and severity of harm arising from those hazards
- identifies appropriate control measures to eliminate or reduce risks
- provides records (where required) that accurately reflect findings and decisions
- involves competent persons with appropriate knowledge, experience or training
- is kept under review and updated as workplace conditions change
These criteria help ensure the assessment is not merely a form‑filling exercise but genuinely protects people from harm.
Step‑by‑Step Process for Conducting a Risk Assessment
1. Identify Hazards
The first legal requirement is to recognise what in the workplace has the potential to cause harm. Hazards might include:
- physical dangers such as machinery, uneven flooring or exposure to chemicals
- ergonomic risks like repetitive tasks or poorly designed workstations
- environmental factors such as noise, temperature or poor lighting
- work‑related stressors and organisational risks
Observation, inspecting previous injury records, and consulting workers about their tasks can help identify less obvious hazards.
2. Determine Who Might Be Harmed and How
Once hazards are identified, employers must assess who might be affected and in what ways. This includes:
- employees working on or off site
- contractors, visitors and members of the public
- especially vulnerable groups such as young workers, pregnant employees or individuals with pre‑existing health conditions
Understanding both who and how harm might arise helps tailor effective control measures.
3. Evaluate the Risks and Decide on Control Measures
Assess the likelihood and severity of harm from each hazard. This evaluation informs whether existing control measures are adequate or if further action is needed. Risk control follows a hierarchy:
- Eliminate the hazard where reasonably practicable.
- Substitute with less hazardous processes, substances or equipment.
- Engineer controls such as guards or barriers.
- Administrative measures including training, supervision or safe work procedures.
- Personal Protective Equipment (PPE) as a last resort.
Appropriate precautions should be proportionate to the level of risk and must comply with relevant regulations and guidance.
4. Record Your Findings
For organisations with five or more employees, significant results must be documented. The written record should include:
- the hazards identified
- people at risk and how they might be harmed
- existing controls
- additional measures to be taken
- who is responsible for implementing each control
- deadlines or review dates
Recording findings demonstrates compliance and provides a foundation for training, policy development and future reviews.
5. Review and Update Regularly
Risk assessments are not static. Employers must revisit assessments:
- after an accident, near‑miss or incident
- when new equipment, tasks, substances or work practices are introduced
- when changes in legislation or guidance occur
- periodically, even if no obvious change has occurred
Regular review ensures the assessment remains relevant and effective in protecting health and safety.
Involving Workers in the Process
Law requires employers to involve employees or their representatives in risk assessment and health and safety planning. Consulting workers helps ensure that assessments reflect actual work practices and improves understanding and acceptance of control measures. Risk assessment templates and consultations also help communicate findings and responsibilities.
Individual Risk Assessments
Certain situations require individual risk assessments, such as when an employee is pregnant, breastfeeding, disabled or reports work‑related stress. Acas notes that employers must assess risks specific to individuals to address their unique circumstances and implement appropriate control measures.
Consequences of Non‑Compliance
Failing to conduct suitable and sufficient risk assessments can lead to enforcement action by the Health and Safety Executive (HSE) or local authority inspectors. Enforcement powers include improvement notices, prohibition notices and prosecution. Serious breaches may attract unlimited fines, disqualification of directors and, in extreme cases, imprisonment. Civil claims for personal injury or compensation can also result from inadequate risk management.
Common Questions
Do risk assessments apply to home and remote workers?
Yes. Risk assessments must cover all places where work is carried out, including home or remote working environments.
Can an employer delegate risk assessments?
Employers can appoint a competent person to carry out or assist with risk assessments, but the ultimate legal responsibility rests with the employer.
Is risk assessment the same as health and safety policy?
No. A risk assessment is part of health and safety management. Employers with five or more employees must also prepare and maintain a written health and safety policy.
Key Takeaways
Conducting risk assessments legally in England and Wales is a core component of an employer's health and safety duties. Legislation requires employers to assess workplace risks, implement appropriate control measures, record findings where necessary, and review assessments regularly. A structured five‑step process helps organisations identify hazards, evaluate risk, decide controls, document significant findings and keep assessments current. Effective risk assessment not only protects employees and others affected by work activities, but also demonstrates legal compliance and reduces the likelihood of enforcement action and compensation claims.
