This guide is maintained as a current resource for September 2026 and covers only the laws of England and Wales. Information is for general guidance, not legal advice. Consult a qualified solicitor for advice specific to your situation.
Workplace risk assessments are a legal requirement under UK health and safety law. This guide explains employer duties, compliance standards, enforcement action, and practical steps for carrying out and reviewing risk assessments in England and Wales.
Legal framework for workplace risk assessments
Workplace risk assessments are a core legal requirement for employers and many self-employed individuals in England and Wales. The obligation arises primarily under the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999. These laws require employers to identify workplace hazards, evaluate risks, and implement measures to prevent harm to employees and others affected by business activities.
Risk assessment is not optional paperwork. It is a structured legal process intended to reduce workplace injuries, occupational illness, and fatalities. The Health and Safety Executive (HSE) provides statutory guidance on how compliance should be achieved in practice, including the expectation that risks are controlled so far as is reasonably practicable.
Failure to comply can lead to regulatory enforcement action, civil compensation claims, and criminal prosecution.
Legal duties governing workplace risk assessments
Health and Safety at Work etc. Act 1974
This Act establishes the general duty on employers to ensure, so far as reasonably practicable, the health, safety, and welfare of employees and non-employees affected by their operations. This includes customers, contractors, and members of the public.
Management of Health and Safety at Work Regulations 1999
These regulations set out the specific requirement to carry out “suitable and sufficient” risk assessments. Employers must:
- Identify hazards in the workplace
- Assess the likelihood and severity of harm
- Implement preventative or protective measures
- Review and update assessments when necessary
Where five or more employees are employed, significant findings must be recorded in writing.
What a workplace risk assessment involves
A risk assessment is a systematic review of workplace activities to determine what could cause harm and how that harm can be prevented or reduced.
The process is typically structured as follows:
1. Identifying hazards
A hazard is anything with the potential to cause harm, including:
- Machinery and moving equipment
- Electricity and gas installations
- Chemicals and hazardous substances
- Manual handling tasks
- Slips, trips, and falls
- Work-related stress and fatigue
Hazards may arise from routine work, maintenance activities, or changes in processes.
2. Identifying who may be harmed
Employers must consider:
- Employees (full-time, part-time, agency, trainees)
- Contractors and visitors
- Members of the public
- Vulnerable groups such as young workers or pregnant employees
The assessment must include how harm could occur and the potential severity.
3. Evaluating risk level
Risk is assessed by considering:
- Likelihood of harm occurring
- Severity of potential injury or illness
- Existing control measures already in place
This step determines whether further controls are required.
4. Implementing control measures
Controls must follow the hierarchy of risk control:
- Elimination of the hazard where possible
- Substitution with a safer alternative
- Engineering controls (guards, barriers, ventilation)
- Administrative controls (training, procedures, supervision)
- Personal protective equipment (PPE) as a last line of defence
The goal is to reduce risk to a level that is reasonably practicable.
5. Recording and reviewing
Employers must:
- Record findings where legally required
- Communicate controls to workers
- Monitor effectiveness
- Review assessments after changes or incidents
Risk assessments must be treated as living documents, not static records.
Legal compliance standards and enforcement
“Suitable and sufficient” standard
A risk assessment must be appropriate to the nature of the work and must:
- Cover all significant hazards
- Be proportionate to risk level
- Be based on real working conditions
- Be regularly updated
Inadequate or generic assessments are not compliant.
Role of the Health and Safety Executive (HSE)
The HSE enforces compliance through:
- Improvement notices (requiring corrective action)
- Prohibition notices (stopping unsafe activity)
- Criminal prosecution in serious breaches
Serious breaches may result in significant fines or imprisonment for responsible individuals in extreme cases.
Risk assessments and workplace liability
Criminal liability
Failure to carry out adequate risk assessments can constitute a breach of statutory duty. Employers may face prosecution under:
Cases are typically heard in Magistrates' Court or Crown Court depending on severity.
Civil liability and compensation claims
If a worker suffers injury due to inadequate risk assessment or unsafe systems of work, they may bring a personal injury claim. Compensation may cover:
- Medical costs
- Loss of earnings
- Pain and suffering
- Long-term disability impacts
Risk assessments are frequently central evidence in such claims.
Common compliance failures
Typical issues identified in enforcement action include:
- No written risk assessments where required
- Outdated assessments not reflecting current work practices
- Generic templates not adapted to specific workplaces
- Failure to consult employees
- Inadequate review after incidents or changes
- Poor implementation of control measures
Time limits and documentation requirements
While there is no fixed expiry date for a risk assessment, employers must review it:
- When there is reason to suspect it is no longer valid
- After workplace changes (equipment, staff, processes)
- Following accidents or near misses
- At regular intervals (commonly annually as best practice)
Employers with five or more employees must retain written records of significant findings.
Practical compliance steps for employers
A structured compliance approach typically includes:
- Assigning a competent person to conduct assessments
- Maintaining a hazard register
- Training staff to identify and report risks
- Implementing documented control measures
- Scheduling formal reviews
- Keeping records accessible for inspection
Frequently asked questions
Is a risk assessment legally required for every workplace?
Yes. All employers must assess workplace risks, regardless of business size. Written documentation is required when five or more employees are present.
Can a risk assessment remove all risk?
No. The legal standard is reduction of risk so far as is reasonably practicable, not complete elimination.
Who is responsible for carrying out risk assessments?
The employer holds ultimate responsibility, but assessments may be delegated to a competent person with appropriate training and experience.
What happens if risk assessments are not carried out?
Possible consequences include enforcement notices, prosecution, fines, and increased exposure to civil compensation claims.
Key Takeaways
Workplace risk assessments are a statutory requirement under UK health and safety law. Employers must identify hazards, evaluate risks, implement controls, and review outcomes regularly. Compliance is assessed against a “reasonably practicable” standard enforced by the HSE. Failure to comply can result in regulatory action and civil liability, particularly where workplace injury occurs.
