How to Conduct Risk Assessment: UK Workplace Guide 2026
- 1 day ago
- 14 min read
You've been asked for a risk assessment. It might be for a new construction site, a refit of a hospitality kitchen, a gym floor with new equipment, or a simple request from a director who wants “everything covered by Friday”.
That's usually when people freeze. They either open a blank template and start guessing, or they download a generic form that looks official but says very little about the actual work being done.
Neither approach helps.
A useful risk assessment is practical. It reflects the place, the people, and the work as it happens on a Tuesday morning, not how it looks in a policy file. If you want to know how to conduct risk assessment properly in a UK workplace, start with that principle. The task is not to produce paperwork. The task is to identify what could cause harm, judge whether your current controls are enough, and decide what needs to change.
Table of Contents
Why Risk Assessments Are More Than Just Paperwork - What the request usually sounds like - What reasonably practicable really means
Laying the Groundwork for a Successful Assessment - Start with scope, not the template - Get the right people involved early - Check your local risks against the wider picture
From Hazard Spotting to Risk Scoring - Find hazards in the real job, not the imagined one - Who could be harmed and how - Use a matrix carefully, not mechanically - What good risk scoring looks like in practice
Choosing Controls That Actually Work - Why lower order controls fail so often - Apply the hierarchy in the right order - What this looks like across sectors
Documenting Findings and Dodging Common Pitfalls - What your written record must show - The mistakes inspectors spot quickly - Why psychosocial risk is often missed
From Assessment to Action Your Next Steps - Turn findings into an action plan - Make controls visible in daily work - Review before the document goes stale
Why Risk Assessments Are More Than Just Paperwork
A manager's first mistake is usually treating the assessment as a form-filling task. That happens in every sector. A site manager in construction wants to get groundworks moving. A restaurant owner needs to open the kitchen. A gym operator is trying to launch a new class area before the weekend. The pressure is operational, so safety paperwork gets rushed.
That's exactly when poor decisions slip in.
According to the latest 2024/25 Health and Safety Executive data, UK workplace incidents resulted in 33.7 million working days lost, which shows why risk assessment has to deal with real causes of injury and ill health rather than generic statements on a form (UK annual HSE statistics breakdown).
What the request usually sounds like
The request often sounds simple. “Can you do a full risk assessment for the new area?” The problem is that “full” means nothing unless you define the work.
A construction assessment might need to cover excavation edges, vehicle movements, temporary electrics, and contractor interfaces. In hospitality, the immediate hazards may be hot oil, knives, slips, cleaning chemicals, and lone closing shifts. In a gym, the issues are different again. Think manual handling of weight plates, member behaviour, equipment maintenance, cleaning products, and staff working alone early or late.
A document that tries to cover all of that at once usually becomes vague. Vague assessments don't drive action.
Practical rule: If the assessment could apply equally to ten other workplaces, it probably isn't specific enough to protect yours.
What reasonably practicable really means
In UK health and safety law, the key test is whether risk has been reduced so far as is reasonably practicable. That means you don't ignore a hazard because removing it is inconvenient, and you don't chase absurd controls for trivial risks. You make a balanced judgement based on the level of risk and the measures available to control it.
That matters in daily decisions. If a gym keeps a torn floor surface that creates a trip point because replacement is awkward, that's not a defensible position. If a construction team can prevent falls with proper edge protection but relies only on verbal warnings, that's weak control. If a hospitality business knows a cellar staircase becomes slippery during deliveries but leaves it to “staff being careful”, the assessment has failed its purpose.
Risk assessments matter because they protect people, but they also protect continuity. When an incident happens, work stops. Managers get pulled away. Confidence drops. The best assessments are the ones that stop that chain of disruption before it starts.
Laying the Groundwork for a Successful Assessment
Good assessments are built before anyone starts scoring risks. The preparation decides whether the final document will be sharp or superficial.
Start with scope, not the template
Define what you are assessing.
That sounds obvious, but many weak assessments mix task risk, area risk, and organisation-wide risk into one document. The result is confusion about what the controls apply to. A better approach is to choose one of these starting points:
A task assessment for a specific activity, such as changing a saw blade, using a meat slicer, cleaning shower areas, or setting up free weights before opening.
An area assessment for a place with mixed activities, such as a gym floor, kitchen, workshop, stage, plant room, or reception area.
An activity assessment for broader arrangements, such as lone working, contractor management, manual handling, or deliveries.
Once scope is fixed, boundaries become clearer. You know what's in and what's out. You also avoid the common trap of using one document to stand in for an entire safety system.
Get the right people involved early
A competent assessment doesn't come from one person guessing at everyone else's work. You need input from people who know the job as it is done, not just as it is described.
Use a small working group where possible:
Role | What they add |
|---|---|
Line manager or supervisor | Knows output pressures, staffing patterns, and work sequencing |
Front-line worker | Knows shortcuts, awkward steps, and non-routine problems |
Maintenance or technical lead | Knows equipment limits, servicing issues, and recurring faults |
Health and safety adviser | Tests whether controls are suitable and legally defensible |
In practice, the front-line voice is often the difference between a decent assessment and a useless one. Gym staff know where members leave bags. Chefs know which prep area gets crowded during service. Construction operatives know where materials are stored when space gets tight.
If you're not sure where your management system is weak, a structured health and safety gap analysis often shows whether the problem sits with documentation, supervision, training, or control implementation.
The best assessments usually come from a short site conversation before they come from a keyboard.
Check your local risks against the wider picture
Your assessment should reflect your own workplace, but it shouldn't be developed in isolation from the UK risk framework. The National Risk Register 2025 says organisational assessments should focus on domestic impacts and align with its framework for judging likelihood and potential impact (National Risk Register 2025 PDF).
That matters because it pushes organisations to think properly about consequence and relevance. A multi-site hospitality group, for example, may face supply disruption or severe weather issues that affect staffing, deliveries, and public access across UK locations. A construction business may need to think about domestic impacts from energy interruption, transport disruption, or contractor availability. A gym chain may focus on localised operational risk at site level, but still needs a method that matches wider resilience planning.
Before you start the assessment itself, pin down these points:
What work is being assessed
Which people may be affected
Which locations are covered
Who needs to be consulted
What documents, incident records, and manuals need reviewing
That groundwork saves hours later. Of greater significance, it prevents the false confidence that comes from a neat-looking document built on poor assumptions.
From Hazard Spotting to Risk Scoring
Many presume they know how to conduct risk assessment: walk around, list a few hazards, score them red-amber-green, and move on.
That isn't enough.
The Health and Safety Executive's required method is clear. Identify hazards, assess risks, control risks, record findings, and review controls so risks are kept as low as is reasonably practicable (HSE five steps to manage risk).
Find hazards in the real job, not the imagined one
A walk-through is useful, but it won't catch everything. People clean differently from how they serve customers. Maintenance happens outside normal hours. Deliveries arrive when spaces are busy. Contractors improvise if materials are late.
Look in several places before you list hazards:
The work area itself. Check layout, access, lighting, surfaces, storage, housekeeping, and equipment condition.
Accident and near-miss records. They often reveal repeated issues that staff have normalised.
Manufacturer information. Manuals and instructions for treadmills, slicers, mixers, extraction systems, and access equipment often identify limits and cleaning risks that managers overlook.
Conversations with workers. Ask what goes wrong when the site is busy, short-staffed, or under time pressure.
Non-routine tasks. Cleaning, maintenance, waste handling, stock delivery, opening up, locking up, and contractor work often carry different hazards from routine operations.
Construction gives easy examples because the hazards are visible. Unguarded openings, rebar, unstable materials, reversing vehicles, dust, noise, temporary works, and work at height all need close attention. In hospitality, hazards can look ordinary and still hurt people. Wet floors near pot wash areas, overloaded storage, poor separation of allergens, damaged knife handles, and hot holding equipment all sit in plain view. In gyms, some of the biggest issues come from interaction. Members moving unpredictably, staff trying to clean around active users, and improvised lifting or spotting all change the exposure.
Who could be harmed and how
This step is often rushed. People write “staff and visitors” and move on.
That misses the point. You need to identify groups with different exposures. A kitchen porter, a head chef, a delivery driver, and a customer all encounter the same kitchen differently. A contractor on a building site may not know local routes or emergency arrangements. A new gym instructor opening alone before daylight faces different risks from a daytime duty manager.
Consider:
Employees
Agency and temporary workers
Contractors
Members of the public or customers
Young or inexperienced workers
Lone workers
People with health conditions or other vulnerabilities
Then describe the likely harm. Slips can cause bruising, fractures, or head injury. Poor manual handling can cause strains and longer-term musculoskeletal issues. Chemical contact may cause burns, irritation, or respiratory effects. Poorly controlled violence and aggression risks can harm both physical and mental health.
If you can't explain who gets hurt and how, you haven't finished assessing the risk.
A hazard list without exposed groups is just an inventory.
Here's a short explainer if your team needs a visual refresher before scoring:
Use a matrix carefully, not mechanically
A risk matrix helps you rank priorities. It does not do the thinking for you.
Most organisations use a 5 x 5 matrix based on likelihood and consequence. That's perfectly workable if the scoring criteria are clear and applied consistently. The key is to score the risk that exists with the current controls in place, not the risk you hope to achieve after improvement.
Common scoring mistakes include:
Confusing hazard with risk. A dumbbell is not a risk by itself. The risk comes from manual handling, poor storage, dropped loads, or user behaviour.
Ignoring frequency of exposure. A hazard encountered ten times a shift is not judged the same way as one encountered once a month.
Over-scoring everything. If every item is “high risk”, the document gives no useful priority.
Under-scoring familiar problems. People downgrade hazards they've learned to live with, such as slippery back-of-house flooring or repeated overcrowding around a squat rack.
What good risk scoring looks like in practice
A simple example helps.
Workplace example | Likelihood | Consequence | Practical note |
|---|---|---|---|
Unsecured trailing cable in office reception | Depends on footfall and visibility | Usually lower consequence but can still injure | Often fixed quickly through housekeeping or rerouting |
Wet tiled floor in hospitality kitchen during service | Higher if contamination is frequent | Can be serious if staff are carrying hot items | Needs more than a warning sign |
Member deadlifting in a congested gym free-weights zone | Depends on layout, supervision, and behaviour | Can cause acute injury to user or bystander | Space design and storage matter |
Missing edge protection on raised construction area | Exposure can be immediate | Consequence can be severe | Demands urgent control |
Good scorers explain their reasoning in plain language. They don't just write numbers. If your matrix says a risk is high, the reader should understand why. If it says a risk is moderate despite an obvious hazard, the control measures should justify that judgement.
That's the difference between a live assessment and a decorative spreadsheet.
Choosing Controls That Actually Work
This is the point where many assessments collapse into weak wording. “Staff to take care.” “Use caution.” “PPE to be worn.”
Those are not strong controls on their own. They rely too heavily on people getting everything right every time.
Why lower order controls fail so often
Administrative rules and PPE have a place, but they are fragile. They depend on attention, training, supervision, supply, and behaviour. When the workplace gets busy, people forget steps, improvise, or prioritise output.
That's why the hierarchy of controls matters. It forces you to ask whether the hazard can be removed, reduced by design, or isolated before you fall back on procedures and kit.
A kitchen example is useful. If a delivery route repeatedly creates collisions between staff carrying hot pans and staff bringing stock in, telling people to “be careful” is weak. Changing the route, rescheduling the delivery window, or separating the pathway is stronger. In a gym, reminding members to re-rack weights is helpful, but layout changes, storage design, and staff positioning may control the hazard more reliably. On a construction site, a harness may be necessary, but preventing the need to work at height in the first place is better.
Apply the hierarchy in the right order
A good control discussion usually runs like this:
Elimination. Can the hazard be removed entirely?
Substitution. Can you replace the material, process, or equipment with something safer?
Engineering controls. Can you separate people from the hazard through guards, barriers, extraction, layout, or fixed protection?
Administrative controls. Can you improve systems of work, supervision, signage, training, sequencing, permits, or access rules?
PPE. What personal equipment is still needed after the stronger controls are in place?
For a clearer breakdown of how these options work in practice, this guide on control measures is useful.
The strongest control is the one that still works when someone is tired, rushed, or new to the job.
What this looks like across sectors
Here's where the hierarchy becomes practical rather than theoretical.
Construction
Elimination might mean designing out a need for work at height during installation. Engineering controls could include edge protection, trench support, machine guarding, or segregated vehicle routes. Administrative controls still matter, but they should not be carrying the full load.
Hospitality
Substitution may involve using a less hazardous cleaning product where suitable. Engineering controls could include better extraction, slip-resistant flooring, or safer storage heights. Administrative controls include cleaning schedules, allergen procedures, and supervision during busy service periods.
Gyms and fitness
Elimination is rare but still possible. Remove damaged kit from service immediately rather than “keeping an eye on it”. Engineering controls may include spacing changes, mirrors for visibility, cable management, secure storage, and panic arrangements for lone workers. Administrative controls include induction rules, cleaning routines, staff patrol patterns, and member conduct standards.
One of the most common consultant observations is this: businesses often choose the easiest control to write down, not the one most likely to prevent harm. That's how you end up with detailed PPE requirements sitting on top of unresolved layout, maintenance, and supervision failures.
Documenting Findings and Dodging Common Pitfalls
Once you've assessed the risks and chosen controls, the findings need to be written clearly enough for someone else to use. If your business has five or more employees, recording significant findings is a legal requirement. Even where a written record is not strictly required, it is still the sensible standard.
What your written record must show
A workable risk assessment record should show, at minimum:
The hazard. State what could cause harm.
Who may be harmed. Be specific where groups differ.
Existing controls. Record what is already in place.
Further action needed. State what must change.
Responsibility. Name who will do it.
Review trigger or date. Make sure the document won't sit untouched.
The best records are short enough to use and detailed enough to direct action. If a supervisor can't read it and know what to do next, the document is too vague.
A simple risk register often works better than long prose because it forces clarity. It also makes follow-up easier when actions are overdue.
The mistakes inspectors spot quickly
Some faults appear again and again.
Common pitfall | Why it fails |
|---|---|
Generic template copied from elsewhere | It doesn't reflect the actual site, task, or workforce |
Long hazard lists with no prioritisation | Managers can't tell what needs urgent action |
Controls written as “take care” or “follow training” | Too weak to stand alone |
No named owner for actions | Improvements drift and nobody closes them out |
No evidence of review after change or incident | The assessment becomes historical, not current |
Another problem is pencil-whipping. That's the assessment that gets signed off because someone needed a document for a file, not because anyone tested the risks on site. You can usually spot it quickly. It describes perfect housekeeping in a workplace with obvious clutter, or it claims staff are trained without checking whether agency workers, new starters, and contractors received the same information.
A clean template doesn't prove a safe workplace. It only proves someone completed a template.
Why psychosocial risk is often missed
Many organisations still treat risk assessment as a purely physical exercise. That's outdated.
Psychosocial risk matters in UK workplaces because work pressure, poor support, unclear roles, conflict, and inadequate staffing can all lead to harm. Best practice is to assess these issues using mixed methods, not just one headline survey, and to analyse them at team level rather than relying only on organisation-wide averages. The source material provided states that 78% of UK employers reported reduced psychosocial incidents after implementing targeted team-level insight protocols (risk assessment best practices for optimal results).
That point matters because broad averages hide local trouble. One hospitality venue may have a well-run kitchen and a struggling front-of-house team. One gym may have stable daytime cover and repeated lone-working strain on early shifts. One construction project may be technically compliant on paper while a particular crew is overloaded, under-supported, and rushing.
Poor psychosocial assessment usually fails in one of three ways:
It stays too broad. Organisation-wide data conceals team hotspots.
It mistakes exposure for risk. Busy work is not the whole picture. High demand combined with low resource is where strain often escalates.
It excludes consultation. If staff don't trust the process, the findings will be shallow.
A risk assessment that ignores stressors, workload pressure, fatigue, and poor communication is incomplete, even if the physical hazard section looks polished.
From Assessment to Action Your Next Steps
A completed assessment is not the end product. The useful output is the action that follows.
Turn findings into an action plan
Every significant action needs three things: an owner, a timescale, and a status. Without those, control measures remain good intentions.
Not every action needs the same urgency. Missing guarding, unstable storage, uncontrolled work at height, or serious lone-working gaps need rapid attention. Lower-order improvements, such as signage updates or minor layout refinements, can be planned in a more staged way. What matters is that the priority reflects the level of risk, not the convenience of the budget cycle.
A short action tracker often works better than burying tasks inside the assessment itself.
Make controls visible in daily work
Controls only work if the people doing the job know what has changed.
That means supervisors need to brief teams. Inductions need updating. Contractors need to receive relevant information. Shift managers need to know what must be checked. In hospitality, a revised cleaning method needs to appear in the kitchen routine, not just in the office file. In gyms, staff need to know the expected response to damaged kit, member misuse, and lone-working concerns. In construction, temporary changes to routes, exclusion zones, or lifting plans must be communicated before work starts.
Practical implementation usually includes:
Briefings for the teams affected
Updated safe systems of work where needed
Checks by supervisors to confirm controls are being used
Feedback routes so staff can report when a control is not working
Review before the document goes stale
Risk changes when work changes. New staff, new kit, new contractors, revised layouts, near misses, incidents, or process changes can all trigger a review.
If you need a practical guide to timing, this article on how often risk assessments should be reviewed is a good starting point.
The strongest organisations treat risk assessment as a cycle. They assess, act, check, and revise. Over time, that builds something more valuable than a compliant document. It builds a workplace where managers notice weak controls earlier, staff speak up faster, and safety becomes part of how decisions are made, not a form that appears when something has already gone wrong.
If you need practical support with risk assessments, compliance reviews, accredited training, or workplace wellbeing, KODOBI works with UK employers across construction, hospitality, fitness, offices, education, manufacturing, and events to build safety systems that are legally sound and workable in day-to-day operations.
Comments