Carrying out a health and safety risk assessment

Risk assessments help you identify what may cause harm, who is it risk, how likely something will happen and how serious the consequences might be. Once you have this information you can make decisions on how to get rid of the risk or adequately manage it.

It's a legal requirement to carry out health and safety risk assessments where significant risk has been identified. You must also communicate the findings, implement the risk controls and review it regularly.

Please follow the step-by-step guide below to carry out risk assessments using the University’s standard risk assessment template and methodology.

If you're a student planning a project that has potential risks to the researchers or participants in the project, you'll be asked to carry out a risk assessment. If you don’t know where to start your academic supervisor will help you. Read the guidance below about risk assessment and you'll find tools to help you.


If you would like training on risk assessment, please book onto one of our courses:

  • Risk Assessment Essentials (bookable via HR Organiser)
  • Research Risk Assessment (on demand, if interested please email

Preparing to carry out a risk assessment

If you would like further advice please contact your WSHW lead adviserWSHW lead adviserWSHW lead adviser

Get ready

Before you start you, and everyone in your team, need to be ‘risk assessment ready’. Use it as an opportunity to carefully examine anything in your workplace that could cause injury or ill health and what could be done to protect people. Risk assessments done like this are relevant and are successfully used to keep people safe and healthy.

Things to consider


Adequate resources make carrying out risk assessments manageable and achievable. If you are carrying out a major review of your risk assessments, it is recommended you plan the work and produce an action plan to track progress and help identify resourcing. If the assessment project is part of a major project, we recommend you include it in the overall project planning process.

There is a risk assessment checklist to help you review your current risk assessments and pinpoint where you're meeting the standard and areas where you could improve your assessments.

Allowing enough time ensures the assessment process will be carried out carefully and in full. This includes time to research legal and industry standards and best practice. Time should also be available for others to engage and support the assessor and in implementing the risk controls. Managers who recognise that it's part of the day to day work, and not an add on, will create an environment in which quality assessments can be produced.


We run bespoke risk assessment coursesrisk assessment coursesrisk assessment courses for those who carry out risk assessments. If there are sufficient delegates, the course can be delivered in your workplace and focused on the work you do.

There are three courses available:

  • Risk Assessment Essentials: for those new to risk assessments
  • IOSH Managing Safely: an occupational health and safety management course which includes risk assessments
  • Research risk assessment: for those required to carry out risk assessment as part of a research project

Carrying out a risk assessment

Risk assessment is a simple and straightforward process. Use the guidance, templates and resources here to make it easy.

We strongly recommend you to use the University standard risk assessment template. It aligns with our risk assessment training and safety management training, as well as helping to standardise the risk assessment process throughout the University. If you have good reason to believe that it won't meet your needs and want to use an alternative assessment process, please contact your WHSW lead adviserWHSW lead adviserWHSW lead adviser

Risk assessments already available

There are risk assessment forms and templates for specific health and safety topics. Information and forms are located in the relevant subject areas under 'Health, safety and wellbeing' in the Staff/Student Directory. You can download and change them to suit your situation or local set up.

All risk assessments need to be signed off and communicated to the people at risk.

The 5-step risk assessment process

Identify your work tasks and the people at risk

Before you carry out the risk assessment you need to first identify the work tasks you manage and who can be harmed. This is easy if you are the responsible manager. However, if you're an assessor doing it on behalf of a manager you will need to work together in identifying the work tasks and the associated hazards.

Consider the following questions. They are a systematic way of gathering information you need and can help identify the hazards.

Here are some suggestions to get you started:

  • observe the physical layout at each location. Take photos, make videos and sketches
  • speak to people, workers and Union-appointed safety representativesUnion-appointed safety representativesUnion-appointed safety representatives to find out if they consider anything in the workplace a hazard
  • refer to inspection checklists, inspections records, incident reports, and manufactures instructions or data sheets
  • Consider all the processes associated with the work activities such as storage, transport, setting up, cleaning, maintenance and foreseeable emergencies
  • Use our hazards list for further suggestions
  • Check out the HSE information or your industry guidance for common hazards associated with your work

Work task list template

Identify the hazards, hazardous events and consequences

A risk assessment should identify hazards, hazardous events and consequences:

  • hazards: things with the potential to cause harm
  • hazardous event: takes place when someone or something interacts with the hazard, allowing it to cause harm. With physical agentsphysical agentsphysical agents and substancessubstancessubstances you’ll need to make an informed decision about the nature of the hazard, amount, frequency and duration of exposure. This information will need to be recorded on the assessment form.
  • consequence: the likely nature of the most probable harm that could arise

For example, a wet floor (the hazard) in the washing up area could cause kitchen staff to slip (hazardous event) leading to concussion, serious sprains or minor fractures (consequences).

Understanding the differences between these and how they connect to each other will help you work through the process logically and efficiently. It will also help the end users understand what could hurt them and how. It will help you to correctly assign the risk controls by breaking down the risk into its component parts of likelihood of the hazardous event and the severity of the consequence.

Tips on getting it right

  • Hazard descriptions should be adequate to inform the end user. Remember, the end user may be new to the job or not aware of abbreviations, local arrangements and terms.
  • Deal with one hazard at a time. Grouping hazards can muddle the hazardous events and consequences.
  • Make the hazards obvious within your risk assessment. Clearly identifiable hazards will help the end user quickly understand what can cause them harm.
  • Some hazards may have more than one hazardous event. You'll need to consider these multiple events separately with their consequences to successfully manage the risks arising from that one hazard.
  • Different groups of people can be affected by different hazards. Identifying who is at risk from your hazards will make it relevant to them and help you target your risk controls.
  • Hazards can present either health or safety consequences, or both. Sometimes the harm is immediate and obvious, or may not be apparent and only realised years after exposure. Think short and long term consequences.

You will need up to date information to do this stage well and the sources can be many and varied. Things change over time and get updated. To ensure you’re up to date, use common knowledge, industry or sector knowledge and expert knowledge to help identify reasonably foreseeable hazards. You should know where to find this and know when to seek expert knowledge.

Here are some links to get you started:

With physical agentsphysical agentsphysical agents and substancessubstancessubstances you’ll need to make an informed decision about the amount, frequency and duration of exposure to determine whether health surveillance is required. Here’s our quick guide to which hazards may need health surveillance (.pdf) and when that is the case.

Estimate and evaluate the risk

The next step is to estimate and evaluate the risk from a hazard. Risk is the product of two factors:

  • the likelihood of the hazardous event occurring (likelihood)
  • the expected consequence of the hazardous event (consequence)

Once you've assigned the risk, you need to take appropriate action to adequately manage it. You can use our simple risk matrix to help you do this:

Tips on getting it right

  • Remember to take into account existing risk control measures when you determine the risk.
  • Record how you got your risk rating and the residual risk. This is important information about the scale of likelihood and consequence, as well as helping to highlight if there is a dominant risk factor. In doing so you’ll be able to target risk controls to bring risk down.
  • Check you have assigned the correct values to the risk factors. The likelihood and consequence factors need to have realistic values assigned to make the risk representative for the hazard.
  • Make sure you are correct in your calculation of risk. Remember: risk = likelihood x consequence.
  • The risk rating is applied to each hazard, hazardous event and consequence sequence rather than to the overall assessment.
  • The residual risk should always be lower than the original risk after the additional risk control measures have been put in place.

Risk control measures

Risk control measures are put in place to control the risk from a hazard by eliminating it or reducing either the likelihood or consequence or both. They should be a combination of protective and preventative controls and you should apply the hierarchy of controls, starting at the top to ensure, so far as is reasonably practicable, the most effective controls are used to reduce the risk.

Tips on getting it right

  • Implement risk controls from the high end of the hierarchy of control first. They offer more effective control than those at the lower end that rely on people (eg training, or provision of personal protective equipment).
  • Descriptions of risk controls should be detailed and give information on the specific requirements needed to keep people safe and healthy. For example, recording ‘PPE’ or 'gloves' in your risk assessment is not enough. Instead, record the specific type of personal protective equipment and the required standard of protection (eg FFP2 for protection against hazardous dusts). This is a good habit to get into because it provides future assessors with the information and leaves no doubt on what should be in place to control the risk adequately.
  • Whilst remembering your immediate controls, don’t forget to include the control measures that are needed to keep those immediate controls working and in good condition.
  • Be clear on what risk controls apply to which hazard. Our risk assessment template helps you do this. (This can be found under 'Record and review your findings'.)
  • Ensure there is a way to ensure further action or risk control implementation is recorded and followed up. Managers are responsible for ensuring risk controls are implemented within the timescale recorded on the risk assessment.
  • Also include control measures for emergencies (eg spillages) or maintenance activities.

Record and review your findings


Now that you have assessed all the risks, you’ll need to record the significant findings using our risk assessment template. It's available in two formats to provide flexibility. It can be updated easily and previous versions can be archived.

The administrative details at the top of the risk assessment template must be completed in full with names, signatures and dates. Using assessment references is good practice to help you cross reference between documents and keep track of your assessments.

Tips on recording the assessment:

  • Give it a sensible file name that will help other people identify the assessment. This should be recorded on the top right-hand side of the form. (Highlight it and right click or press F9 to update it).
  • Include the assessment date (or last assessment review date) in the filename. This will help you to identify the current version and those requiring review quickly.
  • As well as giving the assessment a title, it is also helpful to describe what the assessment covers.
  • Don’t repeat information already covered by other risk assessments (eg the office or driving risk assessment). You only need to cross reference them and record any variations.
  • Assume that someone who is not familiar with the activity being assessed may read it, will they understand what you have recorded? Are you using terminology they won’t understand?
  • Make sure you keep a hard copy with actual signatures, or an email trail to show that the manager responsible has approved the assessment.

Reviewing and health surveillance monitoring

The last step is to review your findings and is an important part of the process even if the risk ratings are low. You need to do this in order to ensure the assessment stays relevant and valid. There is no standard review period, only that it should be carried out regularly. This is because things change over time. For example new procedures, legislation, equipment and the people at risk change. Reviews are also triggered when new information comes to light, such as information about a substance or outcomes of an incident investigationincident investigationincident investigation or HSE prosecution.

Health surveillance might be necessary to monitor how effective your risk controls are for noise and vibrationnoise and vibrationnoise and vibration, ionising radiationionising radiationionising radiation, non-ionising radiationnon-ionising radiationnon-ionising radiation, outdoor work (sunlight) and electromagnetic fieldselectromagnetic fieldselectromagnetic fields hazards and associated risk assessments. It allows for early identification of ill health and helps identify any corrective action needed. Health surveillance results should be taken into account as part of your risk assessment review for these risk assessments.

You should archive your old risk assessments and the Health and Safety Advisory Service Retention Schedule will tell you how for how long.

Arrow symbol
Get in touch
Health and Safety Room 4S.6.2
Telephone: 01206 872944
Fire safety
Telephone: 01206 874847