By Summit Safety Solutions | Health and Safety Consultancy | Updated 2026
A risk assessment is one of the most important things an employer does. Get it right and you protect your people, meet your legal obligations, and run a business that holds up under scrutiny. Get it wrong and you face HSE enforcement, civil claims, and in serious cases, prosecution.
In 2026, we use the 2023/24 analysis, where the dust has had time to settle. This shows 1.7 million workers in the UK suffered from work-related ill health and 138 workers were killed in workplace accidents. The HSE’s own analysis shows the vast majority of those incidents were preventable. Most trace back to hazards that nobody identified, controlled, or reviewed when circumstances changed.
This guide covers the legal requirements, the HSE five-step process, and the points where most employers usually run into trouble. It also explains when carrying out a risk assessment yourself is reasonable and when bringing in a professional is the smarter call.
What is a risk assessment and why does it matter legally?
Health and Safety at Work Regulations 1999, every employer must identify what could cause injury or illness in the business, decide how likely someone could be harmed and how seriously, and take action to eliminate the hazard or, where elimination is not possible, control the risk.
That is your requirement.
A risk assessment is the tried and tested gold standard to do all of that. It is not a form to fill in and file away, It is a working, living document that should shape how your business operates day to day. It should primarily ‘live’ in the heads of all your staff.
Legally speaking, this needs to be documented (if you have 5 or more employees). An employer without a documented risk assessment is breaking the law. The HSE is reasonable, they will start by issuing improvement notices and prohibition notices; but they are well within their rights to prosecute, with unlimited fines and up to two years’ imprisonment for serious breaches.
What makes a risk assessment “suitable and sufficient”?
By law, a risk assessment must be deemed “suitable and sufficient”. In practice, the HSE looks for evidence that you have had a proper check, considered all the people who could be affected by a risk, identified and addressed all obvious hazards, reduced hazards that can’t be eliminated to as low as reasonably practicable, and involved workers in the process (or their representatives, such as a union rep).
As you might imagine, a risk assessment that ticks boxes on paper but does not reflect your actual workplace will therefore not satisfy this standard. This is one of the most common problems we see at Summit Safety Solutions. Business owners complete a risk assessment once, often using a generic template, and treat it as done. Years later the business has changed but the document has not.
Call us on 02393 112573 for a conversation if you are not sure whether your current assessments are still fit for purpose. It takes ten minutes and could save you tens of thousands.
Who needs to carry out a risk assessment?
Every employer has a legal duty to assess the risks their workers face.
Businesses with five or more employees must record the significant findings in writing. Smaller businesses still carry the same legal duty to assess the risks, even though they do not have to write it down. In practice, written records are always advisable regardless of team size.
Beyond your own employees, your duty also covers contractors, visitors, and any member of the public who could be affected by your work activities. You must consider all of them.
The HSE five-step process
What the five steps cover
The HSE recommends five steps: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on precautions, record your findings and implement them, and review your assessment and update it when necessary. Together, these steps give you a structured way to work through your workplace risks without missing anything significant.
Here is what each step involves in practice.
Step 1: Identify the hazards
Walk around your workplace and look at what could reasonably cause harm. Do not limit this to obvious physical dangers. You need to systematically check for physical, mental, chemical, and biological hazards.
Useful sources include accident and incident records, manufacturers’ instructions and safety data sheets, industry guidance and HSE publications, and non-routine activities such as maintenance, cleaning, and emergency procedures.
Involve your employees at this stage. The people doing the work day to day often spot hazards that management cannot see, simply because they are closer to them.
Businesses operating across multiple sites, using specialist processes, or working with hazardous substances will find this step harder than it looks. Many employers unknowingly leave gaps here. A site walkthrough with a Summit Safety Solutions consultant can identify hazards you may have missed and give you confidence the assessment is complete.
Book a free Compliance Gap Review to get started.
Step 2: Decide who might be harmed and how
For each hazard, think through who could realistically be affected. Some workers face greater exposure than others because of their role, health, or circumstances. Of course, all staff require consideration, but pregnant workers, young workers, those with disabilities, nightworkers, and shiftworkers; or anyone else with specific needs, may need specific consideration.
Do not overlook less visible hazards either. Work-related stress, lone working arrangements, and fatigue all need to be considered where they are relevant to your business. Consequently, a thorough assessment covers the full picture of who is present in your workplace and what they are exposed to.
Step 3: Evaluate the risks and decide on controls
You are not expected to eliminate every risk. However, you do need to do everything reasonably practicable to protect people from harm. This means balancing the level of risk against the time, cost, and effort needed to control it.
The hierarchy of control gives you a framework for deciding what measures to put in place. In order of preference: eliminate the hazard entirely, substitute it for something less harmful, introduce engineering controls to reduce exposure, put administrative controls in place, and as a last resort, provide personal protective equipment.
PPE is frequently the default in smaller businesses because it is visible and low cost. As a result, it is also the most over-relied upon measure on the hierarchy, and the least effective. When your current assessments treat PPE as the primary solution for significant hazards, that approach needs revisiting.
Step 4: Record your findings and act on them
In practice, recording findings is the easy part. Acting on them is where many businesses tend to fall short.
Businesses with five or more employees must write down their significant findings, including the hazards they identified, who is at risk, and what controls they put in place. The record should be clear enough that someone unfamiliar with the workplace could read it and understand the risks.
You can imagine, then, if HSE attend, find you have written down a significant finding and not acted to remove the risk, there may be some complaint.
Step 5: Review and update regularly
A risk assessment is not a one-off exercise. Review it whenever there are significant changes, including new equipment, new processes, new staff, an accident, or a near-miss. If there are now changes to the business, you should still review at least annually.
Check the controls you put in place are still working too. Deciding on a measure and assuming staff follow it is not enough. Regular review confirms the controls are in place and effective. Prompt your staff to ensure they have the knowledge in their heads.
If your last review was more than twelve months ago, or your business has changed in any meaningful way since a RA was written, Summit Safety Solutions can carry out an independent review and update it for you.
Call us on 02393 112573 or email us and we will talk you through what is involved.
Where employers most commonly go wrong
Working with businesses across the south of England, these are the risk assessment failures we encounter most regularly.
Errors that undermine legal compliance
Using a generic template without adapting it
A template can be a starting point; but it is not a finished risk assessment. Any document that references hazards irrelevant to your business, or that misses hazards that are genuinely present, will not satisfy the suitable and sufficient standard. Should it ever be examined, it will not protect you.
Completing the assessment once and never revisiting it
Business changes constantly. New staff join, processes change, equipment gets updated, and premises move. Each of these is a trigger to review your risk assessments. Many businesses we visit are still working from assessments written years ago that bear little resemblance to current operations.
Not involving employees
Consulting employees is not optional. It is a legal requirement and a practical necessity. The people closest to the work understand the hazards in ways that are not always visible from a management perspective. As a result, assessments completed in an office without input from the people doing the work are almost always incomplete.
Errors that leave people at risk
Treating documentation as the goal
The purpose of a risk assessment is to control risk, not to produce paperwork. Businesses that focus on having a file of completed forms, without checking whether the controls are working, leave themselves exposed both legally and practically.
Underestimating higher-risk activities
Routine tasks feel familiar, and familiarity leads to complacency. Working at height, manual handling, and use of hazardous substances are among the most frequently cited causes of workplace injury in the UK. Nevertheless, these are also the areas where risk assessments most often lack sufficient detail. When any of these activities apply to your business, the depth of your assessment needs to reflect the level of risk involved.
Can you do a risk assessment yourself?
When doing it yourself is reasonable
Running a small, low-risk business with well-understood hazards, a thorough and informed business owner can produce a suitable and sufficient risk assessment without professional support. The HSE is clear that the process does not need to be complicated or technical in straightforward workplaces.
But even in this scenario, a Health and Safety Consultant will help your business scale safely and likely pay for themselves in the admin time you’ll get back and piece of mind alone
Higher-risk activities that need professional input
If you have any high-risk activities within your workplace. bring in a Health and Safety Consultant
- Work at height
- Use of hazardous substances covered by COSHH
- Construction or site-based work
- Manual handling at scale
- Lone working arrangements
- High-risk machinery or plant
- Public-facing environments with high footfall
The consequences of missing something in these environments are severe. A qualified consultant brings sector knowledge, independence, and the ability to spot hazards that familiarity makes invisible. They also produce documentation that stands up to scrutiny.
Not sure whether your business falls into the category where professional support makes sense? One of our consultants will give you a straight answer, with no obligation to go further.
When to bring in professional support
No rule requires you to use an external consultant. There is, however, a principle that the person conducting a risk assessment must be competent to do so. Competence means having the knowledge, training, and experience to identify the relevant hazards and judge what controls are appropriate.
When the person doing the assessment lacks that competence, the assessment is legally and practically flawed, regardless of how thorough it looks on paper.
At Summit Safety Solutions, we work with employers across the south of England to produce risk assessments that are accurate, legally compliant, and genuinely useful. We visit the workplace, understand how the work actually happens, and produce assessments that reflect real conditions.
Alongside this we can act as the competent person under the Management of Health and Safety at Work Regulations 1999 for businesses that do not have the internal expertise to fill that role. Furthermore, we keep our clients updated when legislation changes, so their assessments stay current without them having to monitor it themselves.
Get in touch:
In summary
A risk assessment is a legal requirement for every UK employer. To meet the suitable and sufficient standard, you must identify the real hazards in your specific workplace, account for everyone who could be harmed, put appropriate controls in place, record findings in writing for businesses with five or more staff, and review everything regularly.
The five steps are straightforward in principle. In practice, the most common failures are not in understanding the process but in applying it thoroughly, keeping it current, and making sure the controls actually work.
Any questions about your current risk assessments, whether they are complete, up to date, or appropriate for your business, get in touch with the Summit Safety Solutions team. Call us on 02393 112573 or book a free Compliance Gap Review
FAQ’s
What is a risk assessment?
A risk assessment is a structured process for identifying hazards in your workplace, evaluating how likely they are to cause harm and how seriously, and deciding what controls to put in place. All UK employers must carry one out under the Management of Health and Safety at Work Regulations 1999.
Who is responsible for carrying out a risk assessment?
The employer carries legal responsibility for ensuring risk assessments happen.
Do I need to write my risk assessment down?
Businesses with five or more employees must record the significant findings of their risk assessment in writing.
How often should a risk assessment be reviewed?
At least annually as a minimum, and whenever there is a significant change to the business. This includes new equipment, new processes, new premises, changes to staffing, or following any incident or near-miss.
What happens if I do not have a risk assessment?
The HSE can issue improvement notices, prohibition notices stopping work immediately, or refer the matter for prosecution. Fines are unlimited. For serious breaches, custodial sentences of up to two years are possible. The absence of a risk assessment also significantly worsens your legal position if an employee is injured.
Summit Safety Solutions is a health and safety consultancy based in the south of England. We help employers conduct risk assessments that are legally compliant, accurate, and built around how their business actually works.
Related reading:
- [What Is a Health and Safety Policy and Does My Business Legally Need One?]
- [Health and Safety Requirements for Managing Directors]
© 2026 Summit Safety Solutions. This article is for general information only and does not constitute legal advice. For advice specific to your business, contact us directly.
