The 5 Steps to Risk Assessment: HSE Framework Explained (UK 2026)

Risk assessment is the foundation of UK workplace health and safety. Almost every safety failure that causes serious harm — and there are around 135 work-related fatalities and 600,000 non-fatal injuries reported in the UK each year — could have been prevented or reduced by a properly conducted risk assessment.

The HSE's 5-step framework is the standard approach. It's used by safety officers, line managers, and anyone responsible for workplace safety in the UK. This guide walks through each step in detail, with worked examples, common mistakes to avoid, and how the framework fits into UK law.

What is a risk assessment?

A risk assessment is a careful, structured examination of what could harm people in a workplace, and what reasonable steps you can take to prevent that harm. Two important distinctions:

• A hazard is anything with the potential to cause harm — a chemical, a piece of machinery, working at height, a wet floor, a stressful situation
• A risk is the chance, high or low, that someone will actually be harmed by that hazard, combined with how serious the harm could be

Risk assessment is the process of identifying hazards, evaluating the risks they pose, and deciding what to do about them. It's not a paperwork exercise — though it does need to be documented — it's a tool for making workplaces genuinely safer.

Why the 5 steps?

The HSE published the 5-step framework in their guidance document INDG163 (originally in 1996, updated several times since). It's deliberately simple. The framework was designed to be usable by small employers without specialist safety knowledge — but it's the same framework professional safety officers use, just applied with more depth.

The 5 steps work because they map onto the underlying logic of risk management: find the problem, work out who's affected, decide what to do, do it, then check it's working. Anything more complicated tends to confuse rather than help.

Step 1: Identify the hazards

The first step is finding everything in the workplace that could cause harm. There's no shortcut to this — it requires actually looking at the workplace, observing how the work is done, and asking the people who do it.

How to identify hazards

• Walk the workplace. Slowly, deliberately, with someone who knows the operation. Look for what could go wrong, not just what is going wrong.
• Talk to workers. The people doing the job often know about hazards their managers don't see — near-misses they've had, things they've worked around, problems they've raised but never been resolved.
• Check accident and near-miss records. What's gone wrong before is the strongest predictor of what could go wrong again.
• Read manufacturers' instructions. Equipment, chemicals, machinery — the supplier's documentation tells you what hazards the product creates.
• Consider non-routine activities. Maintenance, cleaning, breakdowns, changes in production. Most workplace incidents happen during non-routine work, not normal operations.
• Think about long-term hazards too. Not just things that cause immediate injury — but exposures that cause harm over time (chemicals, noise, vibration, repetitive strain, mental health impact).

Common hazard categories

It helps to think systematically. Common hazard categories in UK workplaces:

Step 2: Decide who might be harmed and how

For each hazard you've identified, work out which groups of people could be affected, and how. This isn't always obvious.

Groups to consider

• Employees doing the work directly
• Other employees nearby, even if not doing the task themselves
• Contractors and visitors who may not be familiar with workplace risks
• Members of the public who could be affected (delivery drivers, customers, neighbours)
• Vulnerable groups with specific protections — young workers, new and expectant mothers, lone workers, people with disabilities, workers with limited English
• Cleaners and maintenance workers who often work outside normal hours

How they might be harmed

Be specific. "Workers might be harmed" is too vague. "A forklift driver could collide with a pedestrian in the warehouse aisle, causing crush injuries" is the level of detail that drives effective control measures.

Step 3: Evaluate the risks and decide on precautions

This is where the assessment turns from observation into action. For each hazard, you need to:

1. Assess the level of risk — how likely is harm, and how serious would it be?
2. Decide whether existing controls are adequate
3. If not, decide what additional controls are needed

Evaluating risk

Most UK workplaces use a simple matrix to evaluate risk: likelihood (how probable is harm?) multiplied by severity (how bad would the harm be?). A typical 5x5 matrix:

The matrix is a tool for prioritisation, not a magic answer. Two reasonable assessors looking at the same hazard may rate the likelihood differently — and that's fine, as long as the reasoning is documented.

The hierarchy of control

When you decide what precautions to put in place, UK law requires you to follow the hierarchy of control — also called the hierarchy of risk control measures. The principle is to prefer the most effective controls over the least effective:

1. Eliminate — remove the hazard entirely (don't use the hazardous substance at all)
2. Substitute — replace with something less hazardous (use a less harmful chemical)
3. Engineering controls — change the workplace to reduce exposure (extraction, machinery guarding)
4. Administrative controls — change how people work (procedures, training, signage)
5. Personal Protective Equipment (PPE) — protect the individual (gloves, masks, hard hats)

PPE is at the bottom because it relies on people wearing it correctly, doesn't reduce the hazard itself, and fails when people forget or take shortcuts. It's a backstop, not a primary control.

Reasonably practicable

UK law uses the phrase "so far as is reasonably practicable" — meaning the cost and effort of a control should be balanced against the risk it reduces. You're not required to eliminate every conceivable risk; you're required to take measures that are reasonable in proportion to the risk. The greater the risk, the more cost and effort can reasonably be expected.

Step 4: Record your findings and implement them

UK law (specifically the Management of Health and Safety at Work Regulations 1999) requires employers with five or more employees to record their significant findings in writing. Smaller employers don't have to — but it's still good practice and provides evidence of due diligence if anything goes wrong.

What to record

A written risk assessment should typically include:

• What the assessment covers (workplace, activity, date)
• Who carried it out and who they consulted
• Significant hazards identified
• Who could be harmed and how
• Existing control measures
• Risk evaluation
• Additional control measures needed
• Who is responsible for implementing each control
• Target dates for completion
• Date of next review

Writing a risk assessment that's actually useful — clear, specific, action-oriented — is a discipline in itself. The pattern most untrained writers fall into is recording what's nominally in place rather than what's actually controlling the risk, and producing documents nobody reads after the day they're filed. For people responsible for writing assessments across an organisation, our Risk Assessment Writers Workshop covers the practical writing skills — phrasing controls so they're verifiable, structuring assessments so they survive review, and avoiding the generic-template trap that makes documents legally weak.

Implementation

The risk assessment is only valuable if the controls actually get implemented. This is where many assessments fail — controls are listed in the document but never put into practice. Real implementation usually requires:

• Someone specific made responsible for each action
• A timeline with realistic dates
• Budget allocated where needed
• A check that the action was completed
• Communication to the workers affected

Step 5: Review your assessment and update if necessary

Risk assessments aren't done once. The HSE expects them to be reviewed regularly and updated whenever circumstances change.

When to review

• After an incident — including near-misses where harm was averted
• When work changes — new equipment, new processes, different working hours, different materials
• When the workforce changes — new starters, particularly in safety-sensitive roles
• When laws or guidance change — HSE updates, new ACOPs, regulatory changes
• On a regular schedule — annual review is typical for stable workplaces; more frequently for higher-risk or rapidly changing environments

What to look for in review

The review isn't a paperwork exercise — it's a real check on whether the controls are working. Are workers using the PPE? Has the engineering control been maintained? Have new hazards emerged? Are there incidents or near-misses suggesting the assessment underestimated something?

Dynamic risk assessment — for changing conditions

The five-step framework works well for stable, predictable workplaces. For work where conditions change in real time — emergency response, security, healthcare, lone working in unfamiliar environments — a static assessment written in advance can't keep up. Dynamic risk assessment is the discipline of continuously re-assessing while work is in progress: noticing what's changed, reassessing the risk on the spot, and adjusting the response. It complements rather than replaces the standard five-step process. Our Dynamic Risk Assessment Workshop covers this skill specifically and is the right level for staff in roles where conditions can shift faster than paperwork can follow.

A worked example

To make the framework concrete, here's a worked example for a small bakery's risk assessment of "operating the bread oven":

Common mistakes that fail risk assessments

1. Treating it as paperwork

The most common failure. The assessment is written, filed, and never looked at again until something goes wrong. A risk assessment that doesn't change behaviour isn't a risk assessment — it's a record of past thinking.

2. Generic assessments

Copying a template without genuinely thinking about the specific workplace. Generic assessments miss the hazards unique to the actual operation. The strongest assessments are workplace-specific.

3. Not consulting the workforce

Managers writing the assessment without talking to workers. The people doing the job have insights no one else has. Skipping that conversation is the single quickest way to write a weak assessment.

4. Focusing only on PPE

Defaulting to "we'll issue gloves" without considering whether the hazard could be eliminated, substituted or engineered out. PPE is the last line of defence, not the first.

5. Never reviewing

Risk assessments dated five years ago, with a workforce that's changed twice and equipment that's been replaced. A risk assessment is a living document or it's nothing.

When you need professional help

For most everyday workplace risks, a competent line manager or safety officer trained in risk assessment can produce a good assessment. For complex or specialist hazards, professional input is appropriate:

• Fire risk assessment — legally required to be carried out by a "competent person" under the Regulatory Reform (Fire Safety) Order 2005. For low and medium-risk environments, our Fire Risk Assessment for Low to Medium Risk Environments course covers the assessor competence the order expects
• COSHH assessments — chemical risk assessments may need specialist occupational hygiene input for complex exposures. Our COSHH Assessors Training covers in-house competence for routine and moderately complex chemical assessments, with COSHH Awareness as the wider workforce baseline
• Major hazard sites (COMAH) — process safety assessments require qualified specialists
• Asbestos surveys — must be carried out by a competent surveyor. Asbestos Awareness is the worker-level baseline; for duty-holders, our Managing Asbestos course covers the broader management framework

KeyOstas's Risk Assessment & Management consultancy supports UK businesses with both routine and specialist risk assessment, drawing on 41 years of practical safety experience.

Frequently asked questions

What are the 5 steps of risk assessment?

The five steps are: (1) identify the hazards, (2) decide who might be harmed and how, (3) evaluate the risks and decide on precautions, (4) record your findings and implement them, and (5) review your assessment and update if necessary.

Is risk assessment a legal requirement in the UK?

Yes. Under the Management of Health and Safety at Work Regulations 1999, employers have a legal duty to carry out a risk assessment of workplace activities. Employers with five or more employees must record significant findings in writing.

How often should a risk assessment be reviewed?

Risk assessments should be reviewed regularly — annually as a minimum for most workplaces — and additionally whenever circumstances change.

Who can carry out a risk assessment?

Any "competent person" — meaning someone with sufficient knowledge, training and experience to identify hazards, evaluate risks and recommend appropriate controls.

What's the difference between risk assessment and method statement?

A risk assessment identifies hazards and recommends controls. A method statement is the practical step-by-step plan that puts those controls into action for a specific task. For high-risk work, both are typically required.

What is the hierarchy of control in risk assessment?

The hierarchy of control is the principle of preferring more effective control measures over less effective ones. The order is: (1) eliminate, (2) substitute, (3) engineering controls, (4) administrative controls, (5) personal protective equipment.

Do I need risk assessment training?

Anyone responsible for carrying out risk assessments at work should have training appropriate to the level of risk they're assessing. Higher-risk environments typically need NEBOSH-level training.

Where to learn more

If you need to carry out risk assessments as part of your role, formal training pays back quickly. KeyOstas offers options at every level, broadly mapped to who in the organisation needs the training:

• IOSH Working Safely — entry-level qualification for any employee, covering risk awareness and personal responsibility
• Risk Assessment Training — practical 1-day course for managers and supervisors who carry out assessments themselves
• Risk Assessment Writers Workshop — for staff responsible for writing assessments across an organisation
• Dynamic Risk Assessment Workshop — for staff in roles where conditions change in real time
• IOSH Managing Safely — 3-day course covering risk assessment alongside broader safety management
• NEBOSH National General Certificate — Level 3 qualification with risk assessment as a core component

For consultancy support on specific risk assessments, see our Risk Assessment & Management consultancy service. Or call us on +44 (0) 3300 569534 for tailored advice.