A risk assessment should be carried out whenever workplace activities could expose employees, contractors, visitors or members of the public to harm. Under UK health and safety law, employers have a legal requirement to assess risks, introduce suitable control measures and protect workers from accidents, injury and ill health.
Whether you operate in construction, manufacturing, healthcare, logistics or office environments, a suitable and sufficient assessment helps businesses identify hazards early and reduce risks before incidents occur. Many organisations now use risk assessment software to streamline inspections, record their findings and maintain ongoing health and safety compliance across the workplace.
Understanding when a risk assessment should be carried out is essential for maintaining safety, controlling workplace hazards and complying with the Management of Health and Safety at Work Regulations 1999.
What is a risk assessment?
A risk assessment is a careful examination of workplace activities, tasks and processes to identify hazards that could cause harm. The assessment process allows an employer to evaluate risk levels, decide on the controls needed and implement reasonable control measures to protect employees and others affected by work activities.
A suitable and sufficient assessment should:
- Identify hazards
- Determine who might be harmed
- Evaluate the level of risk
- Introduce control measures
- Record significant findings
- Review the existing risk assessment regularly
The Health and Safety Executive (HSE) explains that employers are legally required to protect workers and others from harm. The HSE also states that reasonably practicable controls should balance the level of risk against the time, cost and resources needed to control risks effectively.
Risk assessments are important as they help businesses:
- Reduce risks
- Prevent accidents
- Protect employee health
- Control workplace hazards
- Prevent ill health
- Improve workplace safety
- Maintain compliance with health and safety law
Hazard identification should include all potential hazards, including physical hazards, hazardous substances, manual handling risks, fire hazards and psychological risks that may affect employees within the workplace.
When should a risk assessment be carried out?
A risk assessment should be carried out before work begins and whenever significant changes create new risks or alter existing control measures. The risk assessment procedure should never be treated as a one-off exercise. Instead, businesses should regularly review assessments to ensure they remain suitable and sufficient.
The risk assessment process should normally be reviewed:
- Before starting a new activity
- When introducing a new process
- After significant changes in the workplace
- Following accidents or near misses
- When using new technology
- When introducing new materials
- When employees or workers change
- During periods of high staff turnover
- In higher risk workplaces requiring regular reviews
Before starting a new activity or process
Conducting a risk assessment is essential before starting new activities or processes to identify potential hazards and implement safe practices from the outset.
Risk assessments should be carried out prior to any new activity to ensure compliance with the Management of Health and Safety at Work Regulations 1999. Identifying risks early allows organisations to establish controls needed before work begins and communicate safety procedures clearly to employees.
For example, if a business introduces:
- New machines
- New materials
- New processes
- Different working methods
- New workplace layouts
Then a new risk assessment should normally be carried out before employees begin the activity.
Changes in workplace activities can create new hazards that existing control measures may not address adequately. Updating risk assessments before work activity changes helps organisations manage new risks effectively while ensuring current safety procedures remain suitable and sufficient.
Construction businesses often combine risk assessments and method statements through RAMS software to improve safety management across changing projects and higher risk environments.
After significant changes in the workplace
An existing risk assessment may no longer remain valid if significant changes occur within the workplace. Businesses should review assessments immediately whenever workplace conditions, staffing levels or operational processes change substantially.
Examples of significant changes include:
- Moving to a new workplace
- Expanding operations
- Introducing new technology
- Installing new machines
- Using hazardous substances
- Changing workflows
- Increasing production levels
When introducing new technology or new materials, businesses should carry out a risk assessment to identify and manage any risk arising from those changes. New technology can create new challenges that existing control measures may not fully address.
For example, automated systems may introduce:
- New injury risks
- Electrical hazards
- Psychological stress
- Different training requirements
- Additional controls
A suitable and sufficient assessment helps identify whether existing controls remain effective or additional controls are necessary to protect employees from harm.
After accidents or near misses
Risk assessments are necessary after incidents, including accidents and near misses, to evaluate the effectiveness of existing control measures.
If an accident occurs within the workplace, businesses should immediately review the existing risk assessment to determine:
- What hazards were missed
- Whether controls failed
- If risk levels were underestimated
- What additional controls are required
- How to prevent future harm
Reviewing a risk assessment after an incident helps identify the root cause and supports proactive safety management moving forward.
Documenting near misses is equally important because they often identify potential hazards before serious accidents occur. Many businesses fail to assess near misses properly, despite these events providing valuable knowledge about weaknesses in current control measures.
In 2023/24, 138 workers lost their lives in work-related accidents across the UK. These figures highlight why ongoing health and safety reviews remain critical for protecting workers and reducing workplace risk.
A new risk assessment may also be required where repeated incidents suggest that existing control measures are no longer sufficient assessment standards for the workplace.
When employees or workers change
Changes in personnel can introduce new risks that require updated assessments. Employers should consider whether a new risk assessment or revised controls are necessary when:
- Recruiting new employees
- Hiring temporary workers
- Using contractors
- Managing returning employees
- Supporting vulnerable workers
Onboarding inexperienced workers often increases workplace risk levels, particularly within higher risk sectors such as construction, manufacturing and logistics.
A self employed person also has responsibilities under health and safety law where their work activity may affect others.
Employers should assess whether workers:
- Have adequate training
- Understand hazards
- Require supervision
- Need PPE
- May be harmed differently due to experience or health conditions
High staff turnover can also create additional safety concerns where workers lack knowledge of workplace procedures, hazards and emergency processes.
The person carrying out the assessment should evaluate whether current control measures remain suitable and sufficient for the employees involved.
In higher risk workplaces
Some industries require more frequent risk assessments due to elevated workplace dangers. Higher risk environments typically include:
- Construction
- Manufacturing
- Warehousing
- Chemical handling
- Fire safety operations
- Heavy engineering
Regular reviews of risk assessments are essential to keep safety measures effective in these sectors.
Higher risk workplaces often implement fire risk assessment software to manage inspections, identify hazards and maintain compliance records across multiple sites.
The frequency of reviews should align with workplace risk levels. In lower risk offices, an annual review may be sufficient. However, workplaces involving hazardous substances, heavy machinery or dangerous work regulations may require far more regular assessments.
Businesses working with chemicals may also use control of substances hazardous to health (COSHH) assessment software to monitor exposure risks and maintain digital control measures record systems.
How often should risk assessments be reviewed?
There is no single timeframe that applies to every business. However, regularly scheduled reviews are important to ensure assessments remain valid and sufficient.
A review once a year may be adequate within lower risk workplaces such as offices. However, significant changes should always trigger an immediate review.
Businesses should regularly assess:
- Existing controls
- Workplace hazards
- Employee safety
- Equipment safety
- Changes in processes
- Risk arising from operational changes
The Health and Safety Executive recommends reviewing assessments whenever circumstances change or evidence suggests current controls may no longer protect workers adequately.
Regular reviews also help employers:
- Identify hazards earlier
- Eliminate unnecessary risks
- Reduce accidents
- Improve health outcomes
- Protect workers
- Maintain legal compliance
Legal requirements for risk assessments
Under the Management of Health and Safety at Work Regulations 1999, employers are legally required to carry out a suitable and sufficient assessment of workplace risks.
Health and safety law applies to most businesses regardless of size or industry. Employers must take reasonable steps to protect employees and others affected by workplace activities.
The law requires businesses to:
- Assess workplace risks
- Implement control measures
- Reduce risks so far as reasonably practicable
- Record your findings where applicable
- Review assessments regularly
Employers with five or more employees must record significant findings from risk assessments in writing.
Failure to comply with health and safety at work regulations can lead to:
- Enforcement action
- Fines
- Legal claims
- Business disruption
- Serious injury
- Reputational damage
The Health and Safety Executive can investigate businesses where inadequate assessments contribute to accidents or workplace harm.
What should a suitable and sufficient assessment include?
A suitable and sufficient assessment should examine all workplace hazards and evaluate the likelihood of harm occurring.
The risk assessment procedure should normally include:
1. Identify hazards
Identify anything that could cause injury, ill health or harm within the workplace.
2. Decide who might be harmed
Assess employees, contractors, visitors, vulnerable workers and members of the public who may be affected.
3. Evaluate risks
Evaluate risk levels and determine whether existing control measures are adequate.
4. Implement controls
Control measures may include:
- Eliminating hazards
- Reducing risks
- Restricting access
- PPE
- Training
- Supervision
- Safe systems of work
5. Record your findings
Businesses with five or more employees should record your findings and maintain clear documentation.
6. Review the assessment
Risk assessments should be reviewed regularly to ensure controls remain effective and suitable and sufficient for current workplace conditions.
Common mistakes businesses make
Many organisations carry out a risk assessment once and fail to review it properly afterwards. This can leave businesses exposed to new risks, changing workplace hazards and outdated controls.
Common mistakes include:
- Failing to review after significant changes
- Ignoring near misses
- Poor hazard identification
- Inadequate employee training
- Not recording findings properly
- Failing to assess new technology
- Weak management oversight
- Ignoring psychological health risks
Risk assessments are important as workplace hazards constantly evolve as businesses grow, processes change and employees rotate.
An outdated assessment may fail to identify potential hazards or provide sufficient assessment standards for current workplace conditions.
Conclusion
A risk assessment should be carried out before work begins, after significant changes, following accidents and whenever new risks emerge within the workplace. Regular reviews help businesses maintain suitable and sufficient assessment standards while protecting employees from injury, ill health and harm.
By identifying hazards early, evaluating risks properly and introducing effective control measures, businesses can reduce accidents, improve health and safety performance and comply with UK law.
Whether reviewing an existing risk assessment or carrying out a new risk assessment, businesses should treat the process as an ongoing part of workplace safety management rather than a one-time exercise.
Frequently asked questions
When should a risk assessment be reviewed?
A risk assessment should be reviewed regularly to ensure it remains suitable and sufficient for the workplace. In lower risk environments, an annual review may be enough, but significant changes, accidents, near misses or new hazards should trigger an immediate reassessment.
Is a risk assessment a legal requirement?
Under the Management of Health and Safety at Work Regulations 1999, employers are legally required to carry out a suitable and sufficient assessment of workplace risks and introduce appropriate control measures to protect employees and others from harm.
Who is responsible for carrying out a risk assessment?
The employer is responsible for ensuring a risk assessment is carried out. In some businesses, the person carrying out the assessment may be a manager, health and safety officer or competent employee with suitable knowledge of the workplace and its hazards.
What happens if a workplace risk assessment is not updated?
Failing to review an existing risk assessment can leave businesses exposed to new risks, workplace accidents and legal issues. Outdated assessments may no longer reflect current work activity changes, new technology, staffing changes or additional hazards introduced over time.
Do small businesses need risk assessments?
Even small businesses and self employed person operations must assess risks where work activities could cause harm to employees, contractors, visitors or members of the public. Employers with five or more employees must also record significant findings in writing.
What should control measures include?
Control measures should aim to eliminate hazards where possible and reduce risks where elimination is not practical. This may include training, PPE, restricted access areas, supervision, equipment maintenance and safe working procedures designed to protect workers
