Risk assessment: the duty, the method HSE publishes now, and who must write it down

Most employers know they are supposed to have a risk assessment. Far fewer can name the regulation that requires it, say what "suitable and sufficient" is measured against, or answer whether their headcount triggers the duty to write anything down. Those three answers decide whether the document on your shared drive counts for anything.

This post covers the general duty in Great Britain: where it comes from, what the words attach to, who must record the findings, the method the Health and Safety Executive publishes today, who may do the work, and when a review is required. It is general information about the position in Great Britain and not legal advice.

An assessment is only worth having if someone owns it, the review lands on time and the actions get closed. See how New Dynamics workflows let you set the stages, participants, reminders and approvals for a recurring process, so a review date is not something one person has to remember.

The duty is regulation 3, and it reaches beyond your own staff

The general duty sits in regulation 3 of the Management of Health and Safety at Work Regulations 1999 (S.I. 1999/3242), in force since 29 December 1999. Regulation 3(1) requires every employer to "make a suitable and sufficient assessment of" two things:

• "the risks to the health and safety of his employees to which they are exposed whilst they are at work"
• "the risks to the health and safety of persons not in his employment arising out of or in connection with the conduct by him of his undertaking"

That second limb is the one people skip. Contractors on site, visitors, delivery drivers and the client whose home your engineer enters are all inside the duty. An assessment covering only employees is incomplete on the face of the regulation.

Regulation 3(2) puts the same duty on a "relevant self-employed person", which regulation 3(3A) has defined since 1 October 2015 by reference to section 3(2) of the Health and Safety at Work etc. Act 1974, so not every self-employed person is caught. Regulation 3 extends to England, Wales and Scotland. Northern Ireland has its own instrument, S.R. 2000/388, whose regulation 3 uses the same "suitable and sufficient" wording.

What "suitable and sufficient" attaches to

The phrase is not a quality rating floating free of anything. Regulation 3(1) ties it to a purpose, and the purpose is the test: the assessment is made "for the purpose of identifying the measures he needs to take to comply with the requirements and prohibitions imposed upon him by or under the relevant statutory provisions".

So the question is not whether the document looks thorough. It is whether it identified the measures you need to take. An assessment listing twenty hazards and producing no controls has not done what the regulation asks. One naming four real hazards and the controls that follow from them has.

HSE puts the proportionality point in its own words on the steps needed to manage risk page: "You're not expected to eliminate all risks but you need to do everything 'reasonably practicable' to protect people from harm. This means balancing the level of risk against the measures needed to control the real risk in terms of money, time or trouble." The same page is blunt about the point of the exercise: "Do not rely purely on paperwork as your main priority should be to control the risks in practice."

Who must record it, and the threshold that still stands here

Regulation 3(6) is narrower than most people assume. It applies "Where the employer employs five or more employees", and requires the employer to record two things: "the significant findings of the assessment" and "any group of his employees identified by it as being especially at risk".

Two consequences follow. An employer with four employees must still make a suitable and sufficient assessment, because regulation 3(1) has no threshold; it simply has no statutory duty to write the findings down. And what must be recorded is the significant findings, not a transcript of everything considered.

Employers conflate this with fire safety, and that is now a real trap, because the two have diverged. Article 9 of the Regulatory Reform (Fire Safety) Order 2005 once carried a five-employee threshold of its own. From 1 October 2023, section 156(3)(a) of the Building Safety Act 2022 substituted the recording words in article 9(6), which now requires the responsible person to "make a record of the assessment or review, which must in particular include the information prescribed by paragraph (7)", with no headcount condition at all. Section 156(3)(b) omitted the word "significant" from article 9(7)(a) the same day.

So in England and Wales a four-person business has no duty to record its general risk assessment, and does have a duty to record its fire risk assessment. Our post on fire safety duties covers that side.

The method HSE publishes now, and why the third step matters

If you came looking for "the five steps to risk assessment", HSE's old leaflet of that name is gone. The address that served it returns a 404, and hse.gov.uk/risk redirects to the current guide, "Managing risks and risk assessment at work". We have not reproduced the withdrawn list, because we could not open it.

What HSE publishes today, under the heading "Steps needed to manage risk", opens with a framing that matters: "Risk management is a step-by-step process for controlling health and safety risks caused by hazards in the workplace." The five steps are:

1. Identify hazards. "Look around your workplace and think about what may cause harm", including non-routine work such as maintenance, cleaning or changes in production cycles.
2. Assess the risks. Decide "how likely it is that someone could be harmed and how serious it could be", who might be harmed and how, what further action is needed, who carries it out and by when.
3. Control the risks. Ask "can I get rid of the hazard altogether?" and if not, "how can I control the risks so that harm is unlikely?" HSE's options run from redesigning the job and replacing materials or processes, through reorganising work to reduce exposure, to personal protective equipment last.
4. Record your findings. The significant findings, at five or more employees.
5. Review the controls. Covered below.

Note where the weight sits. Control is a step in its own right, and protective equipment is the last option rather than the first. An assessment whose only output is a box of gloves has skipped most of step three.

Be precise about scope as well. HSE's current guide contains no phrase like "every conceivable hazard", so we have not quoted one. What it publishes is the reasonably practicable balance above, the word "significant" in the recording step, and a prompt to read your own accident and ill health records, which "can help you identify less obvious hazards".

It also tells you not to stop at safety: "Think about hazards to health, such as manual handling, use of chemicals and causes of work-related stress." Its key figures for Great Britain 2024 to 2025 show why, reporting "1.9 million working people suffering from a work-related illness", of which "964,000 workers suffering work-related stress, depression or anxiety", and "40.1 million working days lost due to work-related illness and workplace injury". For the wider picture, see our HR statistics hub.

Who can do it, and the competent person you must appoint

There is no licence for this work. HSE's steps page says plainly: "You can do it yourself or appoint a competent person to help you." Nothing in regulation 3 requires an external assessor or a qualification.

Appointing someone is a separate duty, and it is not optional. Regulation 7(1) requires every employer to "appoint one or more competent persons to assist him in undertaking the measures he needs to take to comply with the requirements and prohibitions imposed upon him by or under the relevant statutory provisions". Regulation 7(5) sets the standard: competent means having "sufficient training and experience or knowledge and other qualities to enable him properly to assist". Regulation 7(8) prefers a competent person already in the employer's employment over one who is not, and regulation 7(6) disapplies the appointment for a self-employed employer not in partnership who can properly do the work personally.

HSE's competence guidance calls it "the combination of training, skills, experience and knowledge that a person has and their ability to apply them to perform a task safely", confirms that "As an employer, you must appoint a 'competent person' to help you meet your health and safety duties", and adds that it "only needs to be proportionate to their job and place of work."

Consulting employees about it

Be careful here, because the statutory words do not say "risk assessment". Section 2(6) of the Health and Safety at Work etc. Act 1974 requires every employer "to consult any such representatives with a view to the making and maintenance of arrangements" for cooperating on health and safety measures "and in checking the effectiveness of such measures".

The regulations then name the topics. Regulation 4A(1)(a) of the Safety Representatives and Safety Committees Regulations 1977 requires consultation with safety representatives "in good time" about "the introduction of any measure at the workplace which may substantially affect the health and safety of the employees the safety representatives concerned represent". Where employees are not represented under those Regulations, regulation 3 of the Health and Safety (Consultation with Employees) Regulations 1996 imposes the same obligation directly for them.

So the duty bites on the control measures your assessment produces rather than on the document, which is a thin distinction in practice: you cannot consult in good time about a control if the first anyone hears of it is when it appears. HSE's own hazard step tells you to "Involve your employees as they will usually have good ideas." Which regime applies is not the employer's choice, and our post on the safety representative sets out both.

When a review is required

Regulation 3(3) gives triggers, not a calendar. An assessment must be reviewed by the employer who made it if "there is reason to suspect that it is no longer valid" or "there has been a significant change in the matters to which it relates". The paragraph then closes the loop: where the review shows changes are required, the employer "shall make them". A review that finds a gap and changes nothing does not discharge the duty.

No statutory interval exists, so do not claim one. HSE adds practical triggers: review the controls if "they may no longer be effective", or after changes "to staff", "a process", or "the substances or equipment used". It also says to consider a review "if your workers have spotted any problems or there have been any accidents or near misses", and to "Update your risk assessment record with any changes you make". Anything reportable under RIDDOR is a trigger by definition, and our post on RIDDOR reporting covers what is reportable.

Templates and example assessments, and their limit

HSE publishes both. Its risk assessment template and examples page offers a template in Word and OpenDocument formats, plus example assessments for an office-based business, food preparation and service, factory maintenance work and a warehouse.

The same page sets the limit in HSE's own words: "Do not just copy an example and put your company name to it as that would not satisfy the law and would not protect your employees. You must think about the specific hazards and controls your business needs."

Read that against regulation 3(1). A template cannot be suitable and sufficient for your workplace, because the test is whether the assessment identified the measures you need to take, and a form that has never met your premises, equipment or people cannot have done that. Use the template for the shape of the record and do the looking yourself.

One boundary to keep in view. Regulation 3(4) bars employing a young person without an assessment taking particular account of the matters in regulation 3(5), and separate instruments require their own assessment for display screen work, hazardous substances, manual handling, fire and first aid needs. Those sit on top of the general assessment, not instead of it. The general one covers the work nobody wrote a specific regulation about, and it is the one an inspector asks for first. Our post on workplace safety tips covers the day to day end.

Frequently asked questions

Is a risk assessment a legal requirement in the UK?

Yes, in Great Britain. Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to employees at work and to people not in their employment arising from the undertaking. There is no headcount threshold on the duty to assess. Northern Ireland has an equivalent instrument, S.R. 2000/388.

Does a risk assessment have to be written down?

Only at five or more employees, for the general assessment. Regulation 3(6) requires a record of the significant findings and any group of employees identified as especially at risk where the employer employs five or more employees. Below that, the assessment must still be made. Fire safety law differs: the threshold was removed from article 9 of the Fire Safety Order on 1 October 2023.

What are the five steps to risk assessment?

HSE no longer publishes a leaflet by that name, and the old address returns a 404. Its current guide lists five steps under the heading "Steps needed to manage risk": identify hazards, assess the risks, control the risks, record your findings, and review the controls. The third step is what distinguishes managing risk from documenting it.

Who can carry out a risk assessment?

Anyone competent to do it, including you. HSE states that you can do it yourself or appoint a competent person to help, and no qualification is prescribed. Separately, regulation 7(1) requires every employer to appoint one or more competent persons to assist with health and safety duties, with a narrow exception in regulation 7(6).

How often should a risk assessment be reviewed?

No law sets an interval. Regulation 3(3) requires a review where there is reason to suspect the assessment is no longer valid, or where there has been a significant change in the matters to which it relates, and requires the resulting changes to be made. HSE adds changes to staff, a process or the substances and equipment used, plus problems workers have spotted and any accidents or near misses.

Can I use a risk assessment template?

Yes, for the shape of the record. HSE publishes a template and four example assessments, and also says not to copy an example and put your company name on it, because that "would not satisfy the law and would not protect your employees". The regulation asks whether your assessment identified the measures you need to take, and only looking at your own workplace answers that.

Your next step

Three checks, in this order. First, confirm the assessment covers people who are not your employees, because regulation 3(1)(b) is the limb most often missed. Second, decide whether regulation 3(6) applies to you, and if it does, check the record names the significant findings and the groups especially at risk rather than reciting every hazard considered. Third, give the review a trigger and an owner, because regulation 3(3) is written around events rather than dates, and events are easy to miss.

Then put the arrangements where people will read them. Our employee handbook guide covers writing the health and safety section so it says who does what. If the real problem is that reviews slip and actions sit open, book a New Dynamics demo and we will show you how a recurring process keeps its owners, dates and approvals in one place.