How to write suitable and sufficient risk assessments

Writing suitable and sufficient risk assessments

A risk assessment should do more than tick a compliance box. Done properly, it helps you understand what could cause harm, who might be affected, and what controls you need to put in place to reduce risk to an acceptable level.

Under UK health and safety law, employers and those in control of workplaces are expected to carry out risk assessments that are suitable and sufficient. In practice, that means the assessment should be proportionate to the risks, relevant to the work being done, and detailed enough to support sensible decisions.

The Health and Safety Executive (HSE) sets out a clear five-step approach that remains the best starting point for most organisations. If you need to manage many assessments across different sites, teams or activities, software such as RiskThread can help keep the process organised, but the underlying principles stay the same.

What “suitable and sufficient” means

A suitable and sufficient risk assessment should:

• identify the significant hazards, not every trivial one
• identify who might be harmed and how
• evaluate the level of risk using a sensible method
• identify controls that are effective and proportionate
• record the key findings where required
• be reviewed when circumstances change or when the review date is reached

It should also reflect the reality of the workplace. A generic document copied from another site will rarely be enough unless it has been adapted to the actual tasks, people, equipment and environment involved.

The HSE five steps

1. Identify the hazards

Start by considering anything that could cause harm. A hazard is the source of potential injury or ill health. That may include:

• moving machinery
• manual handling
• slips, trips and falls
• hazardous substances
• electricity
• noise
• lone working
• stress and workload

Walk the workplace, talk to staff and supervisors, and review incident reports, near misses and maintenance issues. People carrying out the work often spot hazards that managers miss.

2. Decide who might be harmed and how

Think beyond employees. You may need to consider:

• contractors
• agency workers
• visitors
• members of the public
• cleaners, maintenance staff and delivery drivers
• workers with disabilities, pregnancy-related risks or other individual needs

The point is not to list every name, but to understand the groups exposed to the hazard and the nature of the harm they could suffer.

3. Evaluate the risks and decide on precautions

This is where you judge how likely harm is and how severe the consequences could be. You then decide what controls are needed.

A common tool is the 5x5 risk matrix, which scores likelihood and severity from 1 to 5. It is useful because it makes comparison easier and helps prioritise action. But it should support judgement, not replace it.

For example:

• a low-likelihood, low-severity risk may need simple controls and monitoring
• a higher-likelihood or higher-severity risk may need immediate action, stronger controls or changes to the task itself

When selecting controls, follow the hierarchy of control where possible:

1. eliminate the hazard
2. substitute with something safer
3. use engineering controls
4. introduce administrative controls
5. provide personal protective equipment as a last line of defence

A 5x5 matrix can be helpful, but be careful not to over-engineer it. The numbers are there to guide action, not to create false precision.

4. Record your findings and implement them

If you have five or more employees, you must record the significant findings. Even where formal recording is not strictly required, written records are still good practice.

A strong record should show:

• the hazard
• who is at risk
• the risk rating before controls
• the controls already in place
• the further actions needed
• who is responsible for each action
• target dates for completion

The record should be readable by the people who need to use it. A well-structured document is more valuable than a long one.

5. Review the assessment and update if necessary

Risk assessments are not one-off exercises. They should be reviewed regularly and whenever something significant changes.

Triggers for review include:

• changes to processes, equipment or materials
• new starters, vulnerable workers or changing work patterns
• incidents, near misses or complaints
• refurbishment, relocation or layout changes
• changes in legislation, guidance or standards
• the planned review date arriving

Reviews should not be left until something goes wrong. If a control is no longer effective, the assessment should be updated promptly.

Using a 5x5 matrix well

A 5x5 matrix is one of the most common ways to structure workplace risk scoring. It usually assesses:

• Likelihood: how probable the harm is
• Severity: how serious the harm would be

The matrix can help teams speak a common language about risk, but it has limits. Different organisations score differently, and a single score can hide important context.

To use it effectively:

• agree what each score means before using the matrix
• keep the definitions simple and consistent
• use it to prioritise, not to justify inaction
• review whether the chosen controls genuinely reduce risk
• avoid treating a low score as a guarantee of safety

A useful rule is this: if the risk would be unacceptable without the control, do not rely on the score alone. Make sure the control is practical, implemented and working.

Common mistakes to avoid

Many risk assessments fail because they are either too vague or too complicated.

Watch out for:

• generic wording that does not match the actual task
• listing obvious hazards but missing significant ones
• scoring everything the same way
• confusing controls with actions still waiting to happen
• failing to assign ownership and deadlines
• forgetting to review after changes

Another common mistake is treating the assessment as a paperwork exercise completed by one manager alone. Better assessments usually involve supervisors and the people doing the work.

Making reviews stay on time

A good review process depends on clear ownership and visible deadlines. Without that, assessments drift out of date and risk controls become unreliable.

Useful habits include:

• setting review dates when the assessment is first approved
• linking reviews to scheduled audits or inspections
• assigning a named owner for each assessment
• keeping a central register of live assessments
• flagging overdue reviews before the deadline passes
• recording changes, even where the overall risk level has not changed

In larger organisations, digital tracking can make this much easier by showing what is due, what is overdue and what has been updated after an incident or process change.

Practical takeaways

• Use the HSE five steps as the backbone of every risk assessment.
• Focus on significant hazards and the people most likely to be harmed.
• Use a 5x5 matrix to support judgement, not replace it.
• Prioritise the hierarchy of control before relying on PPE.
• Record the findings clearly, with owners and deadlines.
• Review assessments on time and after any meaningful change.

Official source to consult

For the most authoritative guidance, start with the HSE guidance on risk assessment at GOV.UK. That should be your first reference point when building or reviewing workplace assessments.

Final thought

A suitable and sufficient risk assessment is practical, specific and alive to change. If it helps people understand the risks, apply the right controls and keep reviews current, it is doing its job.