How to Do a Risk Assessment

Before you start

A risk assessment should be carried out by a competent person — someone who understands the work, the equipment, and the environment well enough to spot what could realistically go wrong. That is often a supervisor or an experienced worker, not a distant safety manager. The best assessments are written *with* the people who do the job, not *for* them.

You do not need to assess every conceivable danger. The legal test in most countries is proportionate: the UK asks for a “suitable and sufficient” assessment, and controls only “so far as is reasonably practicable”; Australia, New Zealand, the US, and Canada use similar language. In plain terms — focus your effort on the significant risks that could cause real harm, and don't drown a simple job in paperwork.

Set aside a little time before work begins, gather any manufacturer instructions or safety data sheets, and if it helps, walk the actual location. The five steps below are the framework almost every regulator recognises.

The five steps to a risk assessment

This is the sequence popularised by the UK's HSE and mirrored by regulators worldwide. Work through them in order.

1. 1

   Identify the hazards

   Walk the task and note anything with the potential to cause harm — working at height, electricity, moving plant and vehicles, hazardous substances, manual handling, noise, and the environment itself. Look at routine and non-routine activities, and don't forget maintenance, cleaning, and breakdowns. Our guide to hazard identification covers what to look for and how to spot the hazards people walk past every day.

2. 2

   Decide who might be harmed and how

   For each hazard, name the people exposed and the way they could be hurt. Include your own workers, but also contractors, visitors, and members of the public. Pay particular attention to anyone at greater risk — new or young workers, expectant mothers, lone workers, and people unfamiliar with the site. Being specific here (“workers below the platform could be struck by dropped tools”) makes the next step far easier.

3. 3

   Evaluate the risk and decide on controls

   Judge how likely each hazard is to cause harm and how serious that harm would be. Many teams score this on a risk assessment matrix — likelihood multiplied by consequence — to rank the worst risks first. Then decide what to do, always working down the hierarchy of controls: eliminate the hazard if you can, then substitute, isolate, or engineer it out, use administrative controls, and treat PPE as the last line, not the first.

4. 4

   Record your findings and put controls in place

   Write down the significant hazards, who is at risk, the controls you have chosen, and who is responsible for them. The record is your evidence that the thinking happened — but the point is action: make sure each control is actually in place, understood, and briefed to the crew before work starts. Depending on where you work, this record becomes a JHA, a SWMS, a RAMS, or an SSSP.

5. 5

   Review and update

   A risk assessment is a living document. Revisit it whenever the method, site, equipment, or crew changes, and always after an incident or near-miss — those are the clearest signal that something was missed. Even without changes, review high-risk work periodically so the controls keep pace with reality on the ground.

How much detail is enough?

The most common question is also the hardest to answer: how far do you go? The honest rule is proportionate to the risk. A brief, low-hazard office task might warrant a few lines. High-risk construction, confined-space entry, or work near live electricity deserves a detailed, task-specific assessment — and in many jurisdictions the law *requires* one before work can begin.

Avoid the two classic failures. The first is the thin assessment — generic hazards copied from a template that no one on site recognises. The second is the bloated assessment — pages of boilerplate that bury the three controls that actually matter. A good assessment is specific enough that a new worker could read it and understand exactly what to watch for and what to do.

Turning your assessment into the right document

The five steps are universal, but the finished document has a different name and format depending on where you work — and getting the format wrong can mean the paperwork isn't accepted on site. In the US it's usually a Job Hazard Analysis; in Australia, high-risk construction needs a Safe Work Method Statement; in the UK, a RAMS pairs the assessment with the method of work; and in New Zealand a Safe System of Work Plan does the equivalent job.

This is where RiskForms helps: describe the task in plain language, choose your region, and it drafts the five steps in the correct format — with the right governing law and columns — ready for a competent person to review, adjust, and sign.