Risk assessment: what the law requires

In short

Regulation 3 of the Management of Health and Safety at Work Regulations 1999 says every employer must make a suitable and sufficient assessment of the risks to their workers and to anyone else affected by their work. If you employ five or more people, you must record the significant findings. The assessment should be proportionate to the risks, and what matters most is that the controls work in practice.

Example

the workshop walk-round

Priya runs a joinery workshop with three staff. She thought a risk assessment meant a thick file, so she kept putting it off. One quiet afternoon she walked round the workshop with her team instead. They listed what could hurt someone: the saws, wood dust, lifting sheet materials and deliveries. The team pointed out that the dust extraction on one machine had been weak for weeks, and Priya had it repaired. With three staff she need not write anything down, but she used HSE's template anyway. It came to two pages.

An illustrative example, not a real case.

What the law says

Regulation 3(1): every employer must make a suitable and sufficient assessment of the risks to employees and to others affected by the work.
Regulation 3(3): you must review it if it may no longer be valid, or if there has been a significant change.
Regulations 3(4) and 3(5): before employing anyone under 18, you must take particular account of their inexperience, lack of awareness of risks and immaturity.
Regulation 3(6): with five or more employees, you must record the significant findings and any group identified as especially at risk.
Regulation 4: your controls must be based on the principles of prevention, starting with avoiding risks.

HSE's five steps

1. Identify hazards
In practice
Look at how work is really done, including maintenance and one-off jobs. Ask your workers.
2. Assess the risks
In practice
Decide who might be harmed and how, what you already do and what more is needed.
3. Control the risks
In practice
Remove the hazard if you can. If not, control the risk, with protective equipment as the last resort.
4. Record your findings
In practice
Note the hazards, who might be harmed and your controls. This is a legal duty with five or more employees.
5. Review the controls
In practice
Check they work, and review them after changes, accidents or near misses.

Step	In practice
1. Identify hazards	Look at how work is really done, including maintenance and one-off jobs. Ask your workers.
2. Assess the risks	Decide who might be harmed and how, what you already do and what more is needed.
3. Control the risks	Remove the hazard if you can. If not, control the risk, with protective equipment as the last resort.
4. Record your findings	Note the hazards, who might be harmed and your controls. This is a legal duty with five or more employees.
5. Review the controls	Check they work, and review them after changes, accidents or near misses.

Note: HSE publishes a free template and examples, but warns that copying an example and adding your company name would not satisfy the law.

Common myths

Myth: it needs a consultant. HSE says you can do it yourself or appoint a competent person to help.
Myth: you must remove every risk. HSE says you are not expected to, but the law requires everything reasonably practicable.
Myth: more paperwork means more safety. HSE says your main priority should be controlling the risks in practice.
Myth: small firms are exempt. Every employer must assess risks; only the duty to record them depends on having five or more employees.

What the courts have said

Kennedy v Cordia (Services) LLP [2016] UKSC 6
A home carer slipped on ice while walking between clients' homes. The Supreme Court said a suitable and sufficient risk assessment is the starting point for judging what precautions a reasonable employer should take. A proper assessment would have found low-cost anti-slip attachments for footwear, and the employer was liable for not providing them.

Common questions

Is a risk assessment a legal requirement?

Yes. Regulation 3 of the Management Regulations requires every employer to assess the risks, and to record the significant findings if they employ five or more people.

Do I need a written risk assessment if I have fewer than five employees?

The law does not require one, but you still have to assess and control the risks. A short written record helps you brief your team and answer clients.

How often should a risk assessment be reviewed?

There is no fixed interval. Regulation 3(3) says you must review it if it may no longer be valid or there has been a significant change, and HSE suggests a review after accidents or near misses.

Who can carry out a risk assessment?

You can do it yourself if you understand the work and its hazards. HSE says to involve your workers and to get competent help where you need it.

How NXT-HSE can help

NXT-HSE can help you carry out or review risk assessments that fit your work, and write site-specific RAMS where clients ask for them. The duty to assess and control the risks stays with your business.

Sources

Sources checked 27 September 2026 against current Health and Safety Executive guidance and legislation. This guide is general information, not legal advice; your legal duties stay with your business.

Risk assessment: what the law requires, and what it does not.