Carrying out a health and safety risk assessment

Before you start you, and everyone in your team, need to be ‘risk assessment ready’. Use it as an opportunity to carefully examine anything in your workplace that could cause injury or ill health and what could be done to protect people. Risk assessments done like this are relevant and are successfully used to keep people safe and healthy.

Things to consider

• Who is responsible for carrying out risk assessments? Ensure they have the knowledge and appropriate training. This is usually the member of staff responsible for managing the work where there is significant risk. If you're unsure whether you need to carry out risk assessments, speak to your line manager or check your responsibilitiesyour responsibilitiesyour responsibilities.
• Who is responsible for making sure risk assessments are completed. The Health and Safety PolicyHealth and Safety PolicyHealth and Safety Policy can help you identify who this is.
• Managing health and safetyManaging health and safetyManaging health and safety, including risk assessments, is an integral part of good management and forms the basis of a positive safety culture. It is crucial to ensure everyone involved has the same values about good health and safety, knows what is going on and what their role is in the process.

Adequate resources make carrying out risk assessments manageable and achievable. If you are carrying out a major review of your risk assessments, it is recommended you plan the work and produce an action plan to track progress and help identify resourcing. If the assessment project is part of a major project, we recommend you include it in the overall project planning process.

There is a risk assessment checklist to help you review your current risk assessments and pinpoint where you're meeting the standard and areas where you could improve your assessments.

• Risk assessment action plan template (.dotx)
• Risk assessment review checklist (.dotx)

Allowing enough time ensures the assessment process will be carried out carefully and in full. This includes time to research legal and industry standards and best practice. Time should also be available for others to engage and support the assessor and in implementing the risk controls. Managers who recognise that it's part of the day to day work, and not an add on, will create an environment in which quality assessments can be produced.

We run bespoke risk assessment coursesrisk assessment coursesrisk assessment courses for those who carry out risk assessments. If there are sufficient delegates, the course can be delivered in your workplace and focused on the work you do.

There are three courses available:

• Risk Assessment Essentials: for those new to risk assessments
• IOSH Managing Safely: an occupational health and safety management course which includes risk assessments
• Research risk assessment: for those required to carry out risk assessment as part of a research project

Before you carry out the risk assessment you need to first identify the work tasks you manage and who can be harmed. This is easy if you are the responsible manager. However, if you're an assessor doing it on behalf of a manager you will need to work together in identifying the work tasks and the associated hazards.

Consider the following questions. They are a systematic way of gathering information you need and can help identify the hazards.

• What are the locationslocationslocations where the activities are taking place?
• What substancessubstancessubstances could people be exposed to? You’ll need to gather information about the concentration, amount, frequency and duration of exposure to inform your COSHH assessment.
• What equipmentequipmentequipment is being used?  You may also need to gather information about noise and vibrationnoise and vibrationnoise and vibration to inform whether you may need health surveillance.
• What physical agentsphysical agentsphysical agents are people exposed to? This covers noise and vibrationnoise and vibrationnoise and vibration, ionising radiationionising radiationionising radiation, non-ionising radiationnon-ionising radiationnon-ionising radiation and electromagnetic fieldselectromagnetic fieldselectromagnetic fields. You’ll need to gather information about the amount, frequency and duration of exposure.
• What are the activitiesactivitiesactivities being performed?
• Who are the people involved in, or affected by, these activities? Make sure you have sufficient detail on them, for example job titles, undergraduates or postgraduates, contractors and the numbers that could be affected.
• Do you have people at increased riskincreased riskincreased risk? Is there anyone especially at risk due to medical conditions, disabilities, pregnancy and new motherhood?

Here are some suggestions to get you started:

• observe the physical layout at each location. Take photos, make videos and sketches
• speak to people, workers and Union-appointed safety representativesUnion-appointed safety representativesUnion-appointed safety representatives to find out if they consider anything in the workplace a hazard
• refer to inspection checklists, inspections records, incident reports, and manufactures instructions or data sheets
• Consider all the processes associated with the work activities such as storage, transport, setting up, cleaning, maintenance and foreseeable emergencies
• Use our hazards list for further suggestions
• Check out the HSE information or your industry guidance for common hazards associated with your work

Work task list template

• Work task list template (.docx)

A risk assessment should identify hazards, hazardous events and consequences:

• hazards: things with the potential to cause harm
• hazardous event: takes place when someone or something interacts with the hazard, allowing it to cause harm. With physical agentsphysical agentsphysical agents and substancessubstancessubstances you’ll need to make an informed decision about the nature of the hazard, amount, frequency and duration of exposure. This information will need to be recorded on the assessment form.
• consequence: the likely nature of the most probable harm that could arise

For example, a wet floor (the hazard) in the washing up area could cause kitchen staff to slip (hazardous event) leading to concussion, serious sprains or minor fractures (consequences).

Understanding the differences between these and how they connect to each other will help you work through the process logically and efficiently. It will also help the end users understand what could hurt them and how. It will help you to correctly assign the risk controls by breaking down the risk into its component parts of likelihood of the hazardous event and the severity of the consequence.

Tips on getting it right

• Hazard descriptions should be adequate to inform the end user. Remember, the end user may be new to the job or not aware of abbreviations, local arrangements and terms.
• Deal with one hazard at a time. Grouping hazards can muddle the hazardous events and consequences.
• Make the hazards obvious within your risk assessment. Clearly identifiable hazards will help the end user quickly understand what can cause them harm.
• Some hazards may have more than one hazardous event. You'll need to consider these multiple events separately with their consequences to successfully manage the risks arising from that one hazard.
• Different groups of people can be affected by different hazards. Identifying who is at risk from your hazards will make it relevant to them and help you target your risk controls.
• Hazards can present either health or safety consequences, or both. Sometimes the harm is immediate and obvious, or may not be apparent and only realised years after exposure. Think short and long term consequences.

You will need up to date information to do this stage well and the sources can be many and varied. Things change over time and get updated. To ensure you’re up to date, use common knowledge, industry or sector knowledge and expert knowledge to help identify reasonably foreseeable hazards. You should know where to find this and know when to seek expert knowledge.

Here are some links to get you started:

• See 'Health, safety and wellbeing' section of the Staff/Student DirectoryStaff/Student DirectoryStaff/Student Directory for general health and safety advice at Essex
• Specialist safety help and advice at EssexSpecialist safety help and advice at EssexSpecialist safety help and advice at Essex.
• University and Sector Policies and StandardsUniversity and Sector Policies and StandardsUniversity and Sector Policies and Standards.
• HSE: Information about health and safety at work

With physical agentsphysical agentsphysical agents and substancessubstancessubstances you’ll need to make an informed decision about the amount, frequency and duration of exposure to determine whether health surveillance is required. Here’s our quick guide to which hazards may need health surveillance (.pdf) and when that is the case.

The next step is to estimate and evaluate the risk from a hazard. Risk is the product of two factors:

• the likelihood of the hazardous event occurring (likelihood)
• the expected consequence of the hazardous event (consequence)

Once you've assigned the risk, you need to take appropriate action to adequately manage it. You can use our simple risk matrix to help you do this:

Tips on getting it right

• Remember to take into account existing risk control measures when you determine the risk.
• Record how you got your risk rating and the residual risk. This is important information about the scale of likelihood and consequence, as well as helping to highlight if there is a dominant risk factor. In doing so you’ll be able to target risk controls to bring risk down.
• Check you have assigned the correct values to the risk factors. The likelihood and consequence factors need to have realistic values assigned to make the risk representative for the hazard.
• Make sure you are correct in your calculation of risk. Remember: risk = likelihood x consequence.
• The risk rating is applied to each hazard, hazardous event and consequence sequence rather than to the overall assessment.
• The residual risk should always be lower than the original risk after the additional risk control measures have been put in place.

Risk control measures are put in place to control the risk from a hazard by eliminating it or reducing either the likelihood or consequence or both. They should be a combination of protective and preventative controls and you should apply the hierarchy of controls, starting at the top to ensure, so far as is reasonably practicable, the most effective controls are used to reduce the risk.

• Hierarchy of control (.doc)

Tips on getting it right

• Implement risk controls from the high end of the hierarchy of control first. They offer more effective control than those at the lower end that rely on people (eg training, or provision of personal protective equipment).
• Descriptions of risk controls should be detailed and give information on the specific requirements needed to keep people safe and healthy. For example, recording ‘PPE’ or 'gloves' in your risk assessment is not enough. Instead, record the specific type of personal protective equipment and the required standard of protection (eg FFP2 for protection against hazardous dusts). This is a good habit to get into because it provides future assessors with the information and leaves no doubt on what should be in place to control the risk adequately.
• Whilst remembering your immediate controls, don’t forget to include the control measures that are needed to keep those immediate controls working and in good condition.
• Be clear on what risk controls apply to which hazard. Our risk assessment template helps you do this. (This can be found under 'Record and review your findings'.)
• Ensure there is a way to ensure further action or risk control implementation is recorded and followed up. Managers are responsible for ensuring risk controls are implemented within the timescale recorded on the risk assessment.
• Also include control measures for emergencies (eg spillages) or maintenance activities.

Recording

Now that you have assessed all the risks, you’ll need to record the significant findings using our risk assessment template. It's available in two formats to provide flexibility. It can be updated easily and previous versions can be archived.

• Risk assessment template (.dotx)

The administrative details at the top of the risk assessment template must be completed in full with names, signatures and dates. Using assessment references is good practice to help you cross reference between documents and keep track of your assessments.

Tips on recording the assessment:

• Give it a sensible file name that will help other people identify the assessment. This should be recorded on the top right-hand side of the form. (Highlight it and right click or press F9 to update it).
• Include the assessment date (or last assessment review date) in the filename. This will help you to identify the current version and those requiring review quickly.
• As well as giving the assessment a title, it is also helpful to describe what the assessment covers.
• Don’t repeat information already covered by other risk assessments (eg the office or driving risk assessment). You only need to cross reference them and record any variations.
• Assume that someone who is not familiar with the activity being assessed may read it, will they understand what you have recorded? Are you using terminology they won’t understand?
• Make sure you keep a hard copy with actual signatures, or an email trail to show that the manager responsible has approved the assessment.

Reviewing and health surveillance monitoring

The last step is to review your findings and is an important part of the process even if the risk ratings are low. You need to do this in order to ensure the assessment stays relevant and valid. There is no standard review period, only that it should be carried out regularly. This is because things change over time. For example new procedures, legislation, equipment and the people at risk change. Reviews are also triggered when new information comes to light, such as information about a substance or outcomes of an incident investigationincident investigationincident investigation or HSE prosecution.

Health surveillance might be necessary to monitor how effective your risk controls are for noise and vibrationnoise and vibrationnoise and vibration, ionising radiationionising radiationionising radiation, non-ionising radiationnon-ionising radiationnon-ionising radiation, outdoor work (sunlight) and electromagnetic fieldselectromagnetic fieldselectromagnetic fields hazards and associated risk assessments. It allows for early identification of ill health and helps identify any corrective action needed. Health surveillance results should be taken into account as part of your risk assessment review for these risk assessments.

You should archive your old risk assessments and the Health and Safety Advisory Service Retention Schedule will tell you how for how long.