How to Conduct a Risk Assessment: A Step-by-Step Guide

Most workplace injuries happen during ordinary work, in places people walk through every day. Once workers grow familiar with a place, they stop noticing the things in it that could cause an accident.

A cord running across the floor, a shelf stacked too high, a fire door propped open with a box: all of it stops being noticeable after somebody's first week.

Employers are responsible for preventing that harm, and nobody can act on a hazard that has never been named. Telling people to be careful alone changes nothing because that instruction doesn’t help create repeatable preventive action.

A risk assessment closes that gap. It turns a general duty into a ranked list of specific fixes, each with a name and a date against it. Whoever holds it knows what to deal with first and what can safely wait.

In this guide, we will walk you through how to perform a risk assessment one step at a time, using a small warehouse as a worked example. It covers the formula behind the score, what a finished assessment should contain, and what is legally required in the US, UK, EU, Australia and Canada.

Key Takeaways

• A risk assessment involves recording what in a workplace could cause harm, who it could harm and how badly, what already protects them, and what else needs doing. Its purpose is to rank hazards so the most dangerous is addressed first.
• Hazards are identified by naming the actual object or condition instead of the category it belongs to. A cord across a walkway is a hazard, whereas "slips, trips and falls" is only a heading.
• Every hazard carries a named group of people and a named injury. "Staff could be harmed" cannot be scored, whereas "staff struck by a forklift where it crosses the aisle" can.
• Risk is scored as likelihood multiplied by severity, each rated 1 to 5, producing a score between 1 and 25. That score ranks hazards without deciding which to address first.
• Controls are ranked by effectiveness, from removing the hazard down to protective equipment, and protective equipment ranks last. Every recorded action carries a named owner and a deadline.
• An assessment is accurate only while the workplace stays unchanged, so it is reviewed whenever equipment, processes, people, or layout change, and on a set schedule regardless.

What Is a Risk Assessment?

A risk assessment is a written record of the hazards in one workplace, the people each hazard could hurt, and what is being done about it. Its purpose is to rank those hazards so the most dangerous gets dealt with first.

That record is only as good as the information behind it, and the information has to come from looking. So walk the workplace instead of filling in the form at a desk. A form filled in at a desk records what somebody already believed about the place, and the value of an assessment lies in finding what nobody had noticed.

An assessment has to describe the work as it is actually done, which is not always the work the written procedure sets out. A procedure might say two people lift each sack. The assessment still has to cover the day when only one person is available, and the sacks get moved anyway.

People use hazard and risk interchangeably in conversation. An assessment has to keep them apart. A hazard is something that can cause harm. A risk is the chance of that harm happening, and how bad it would be.

For example, an extension cord running across an office floor is a hazard. Somebody tripping on it and breaking a wrist is the risk.

Knowing the difference between a hazard and a risk helps you decide what to do next. Hazards get removed or guarded, and risks get scored so you know which hazard to tackle first.

There are various types of risk assessments, each covering a different amount of ground. A generic assessment covers an activity wherever it happens, such as working at a computer. A site-specific assessment covers one place and its actual conditions, and a dynamic assessment is the judgement somebody makes on the spot when conditions change mid-job.

Almost everyone asked to produce one needs the site-specific kind.

The employer or business owner carries the legal responsibility, not whoever fills in the form. Whoever carries it out has to understand the job and its hazards well enough to judge them.

That usually means the people doing the job rather than an outside expert, which is why both EU-OSHA and Safe Work Australia build worker consultation into the process. So if you know the job and somebody has handed you this, you are probably the right person for it.

What Are the Prerequisites of a Risk Assessment

Six things separate a useful assessment from a form that gets filled in and forgotten. Most workplaces already have five of them.

• A walk around the actual workplace: the single most useful input, and the one people skip in favor of working from a desk.
• Your accident and near-miss records: these show what has already gone wrong here, which is better evidence than a prediction.
• Equipment manuals: manufacturers list the hazards of their own machines, so that work is already done for you.
• Safety data sheets for any chemicals on site: section 2 of every sheet is the hazard identification, written by the supplier.
• What the workers tell you: they know the shortcuts taken when a shift is running late, and no written procedure records those.
• Your regulator's guidance for your industry: most publish hazard checklists for common sectors at no charge.

Any format that captures those columns works, and a spreadsheet is fine. A health and safety risk assessment template saves you building the columns yourself, and that time is better spent on the walk.

Downloading somebody's completed example and changing the company name does not work, because the example describes their workplace rather than yours.

How long it takes depends on the hazards rather than the paperwork. In a small office, it genuinely takes an hour or two, while a workshop with machinery takes days and gets revisited.

Match the detail to the size of the risk. That also settles when to stop: the assessment is finished when somebody who does the job could read it and recognize their own work.

How to Conduct a Risk Assessment in 5 Steps

A risk assessment has five steps: find the hazards, decide who could be harmed, judge how serious each risk is, record it and fix what needs fixing, then review it.

They run in that order because each one needs what the one before produced. You can't score a hazard you haven't found, and you can't choose a control before you know how bad the risk is.

Step 1: Identify the Hazards

Start with a walk around the workplace, notepad in hand, writing down anything that could hurt somebody. Record what is physically there on the day you look, not what might go wrong in theory and not what the written procedure says happens.

An hour in a small warehouse turns up four things: the forklift route crossing an aisle staff walk along, the most-ordered items stored down at floor level, pallets stacked in front of a fire exit, and a cabinet of cleaning chemicals with no lock on it.

Hazards are usually ordinary things nobody has examined closely in a long time. Walking the floor turns up more than working from memory at a desk.

Accident and near-miss records beat the walk as a starting point for hazard identification, because they show what has already gone wrong in this building, not what somebody guesses might. And the people doing the job know the shortcuts they take when they're behind, which no written procedure records.

Name specific objects and conditions rather than categories. "Slips, trips and falls" and "manual handling" describe the warehousing industry rather than this warehouse, so anything that vague needs naming properly before you move on.

Everything written down should be something you could walk over to and point at. If you cannot point at it, it is not specific enough yet.

Step 2: Decide Who Could Be Harmed and How

Against each hazard goes the group of people it could hurt and the injury they would actually get. Groups rather than individuals, and a named injury rather than the word "harm".

The forklift crossing puts anyone walking down that aisle at risk of being struck, which, at forklift weights, means a major or fatal injury. The items at floor level reach the same people, just slowly, because a back injury builds over months instead of arriving in one moment.

Leave the injury blank, as most people do, and nothing in the row points toward a control. "Staff could be harmed" gives nothing to act on, while "staff struck by a forklift where it crosses the aisle" more or less names its own fix.

Anyone who isn't on site every day is easy to miss:

• cleaners, who often work alone and outside normal hours
• contractors and maintenance engineers, who don't know the site
• delivery drivers, who may be on site briefly and have never had a safety briefing
• visitors, including anyone who brings a child onto the premises
• new starters, and anyone in their first week on a task
• night shift, where fewer people are around to notice a problem
• pregnant workers, young workers, and anyone whose circumstances change the risk for them

A delivery driver spends four minutes on site with no safety briefing, and nobody has told them where to stand while the pallet comes off the truck. Everyone who works there learned that months ago without noticing they had learned it, which is exactly why nobody thinks to say it.

Step 3: Evaluate the Risk and Decide What to Do About It

Each hazard now gets a number, so the hazards can be put in order. The number comes from two judgements: how likely harm is, and how bad it would be if it happened.

You are scoring the hazard as it stands today, with whatever already protects people. Because the forklift crossing has a painted walkway and licensed drivers, it scores better than the same crossing with nothing at all.

The risk assessment formula is Risk = Likelihood x Severity. Score each of the two from 1 to 5 and multiply them, which puts every hazard somewhere between 1 and 25.

The items at floor level score 4 for likelihood, because bending fifty times a shift is happening now, and 3 for severity, because a back injury needs treatment and time off but is rarely worse. That gives 12.

The chemical cabinet reaches 12 the other way round. Likelihood is 3, since somebody has already opened it who shouldn't have, and severity is 4, because a concentrated cleaning product in the eyes means a hospital visit.

Neither number means anything until you have settled what each point on the scale stands for.

Table: Likelihood and Severity, Scored 1 to 5

Those wordings are a working convention rather than a standard, and plenty of organizations phrase them differently or use a 1 to 3 scale instead. Unless everybody scoring in one workplace uses the same definitions, two people with different ideas of "likely" will rate one hazard differently, and neither of them will be wrong.

Both warehouse hazards came out at 12 and need different responses. Staff feel the floor-level items every month. The cabinet could put somebody in the hospital tomorrow and then not again for five years.

The score ranks hazards without deciding between them. Both deserve attention. Which one gets handled first is still your call.

A low number doesn't excuse skipping a cheap, obvious fix either. A lock on that cabinet costs almost nothing, so it goes on whatever the score said.

A risk assessment chart, also called a risk matrix, plots likelihood against severity so a long list of hazards sorts itself into an order. Find your likelihood on one axis and your severity on the other, then read the cell where they meet.

A 20 sits up in the top corner and needs something done this week, while a 2 sits in the bottom corner and needs recording and nothing else.

Most people start from a risk assessment matrix template and reword it until it matches how their own workplace talks about likelihood.

Step 4: Record What You Found and Put the Controls in Place

Until it is written up, the findings are of no use to you. Each hazard gets its own row, and each action gets a named owner and a deadline.

An assessment without owners and deadlines is not a plan. It is a description of a problem, filed.

Choosing what to do rests mostly on one principle: fix the hazard before protecting the person. That principle is called the hierarchy of controls, and it ranks the options from most effective to least.

The ranking runs: remove the hazard, substitute something safer, put a barrier between the hazard and people, change how and when the work is done, and only then reach for protective equipment. Protective equipment comes last because it guards one person at a time, only while it is actually worn, and it fails quietly.

Applied to the warehouse, that means a barrier at the forklift crossing rather than a high-visibility vest, and a lock on the cabinet rather than a sign asking people not to open it.

Score the hazard again once the control is in place. A score that has not moved means the control was the wrong one.

That gives four rows, one per hazard.

Table: An Example of Risk Assessment for a Small Warehouse

Despite being the most likely of the four, the most-ordered items score lowest, because a back injury is serious and rarely fatal. Read down the deadline column rather than the score column, and that is the order the work should happen in.

The forklift crossing shows what a control does to a score. A painted walkway and licensed drivers leave likelihood at 3 and severity at 5, so it sits at 15.

Adding a barrier and mirrors at the blind corner drops likelihood to 1, because a pedestrian now has to climb something to be in the forklift's path. Severity stays at 5, because the weight of the forklift has not changed.

That leaves 5, which is the residual risk. The risk hasn't disappeared, but it is now small enough to work next to. That is the point of a control.

Step 5: Review the Assessment and Update It

An assessment stays accurate only while the workplace stays the same, which is rarely long. Two things bring you back to it: something changes, or the review date you set arrives.

Eight months on, peak season doubles the orders going out of the warehouse and a second forklift is brought in. The crossing was scored for one truck on a quiet floor, so 15 no longer describes it.

These are the changes that should send you back:

• new equipment arrives, or an existing process changes
• the people change, whether somebody new starts or the mix of people on site shifts
• something happens, either an injury or a near miss that could easily have been one
• the layout changes, even temporarily, such as during building work
• a regulation or code of practice you relied on is updated
• a control you put in stops being used the way you intended

Walk the area again and compare what you find against what is written. If the two match, the assessment holds whatever date sits on it, and if they don't, the date is worth nothing.

Those five steps are the simplified version of a sequence the standards already set out. ISO/IEC 31010:2019 defines risk assessment as risk identification, then risk analysis, then risk evaluation, and the mapping is close to one-to-one.

Finding the hazards and naming who they could hurt is identification. Scoring likelihood against severity is analysis. Deciding whether that score is acceptable or needs a control is evaluation.

ISO 31000:2018 sits above it as the framework, and ISO/IEC 31010 is the part that catalogues the techniques.

For a site working toward or holding ISO 45001 certification, the requirement bites at clause 6.1.2, hazard identification and assessment of risks and opportunities. An auditor will look for a documented process, evidence that workers were consulted, and assessments that have been reviewed rather than filed.

What Should a Risk Assessment Include?

A risk assessment should include the hazard, who could be harmed and how, the controls already in place, a risk score, what else needs doing, who owns each action, a deadline, and a date to look at it again.

It covers 12 fields which include:

• the activity, area or site being assessed
• the date, and the name of the person who did it
• each hazard, named specifically
• who could be harmed, and the injury they would get
• controls already in place
• likelihood, severity and the score they produce
• further action needed
• the person who owns that action
• a deadline for it
• the score again once the action is done
• a review date
• who was consulted

If the assessment is ever challenged, three of the twelve carry most of the weight: the date, a named person against every action, and a record that the people doing the work were asked.

Twelve fields sound heavy. In a small workplace, all of it fits on one page, because the fields set out what has to be answered rather than how much has to be written.

Once there are more assessments than one person can hold in their head, keeping them together in a risk register beats scattering them across folders.

How To Do a Risk Assessment Report

Conducting a risk assessment isn’t the end of things. Converting it into a readable risk assessment report is the version other people read. The assessment is the thinking, and the report is how that thinking reaches whoever has to act on it.

Start with the technique that produced the findings, because a scoring can only make sense to the person reading it if they know how it was reached. ISO/IEC 31010 catalogues more than thirty techniques for assessing risk, and seven of them cover almost everything a general workplace needs.

Table: Risk Assessment Tools and Techniques

Name the technique you used in two lines and move on. A reader needs to know a risk matrix produced the numbers, not how a risk matrix works.

A readable report has six parts:

1. Cover details: the site or activity, who assessed it, the date, and the review date
2. Scope: what was assessed, and what was deliberately left out
3. Method: the scale used, in two lines
4. Findings: the assessment table itself
5. Actions: pulled out of the table into their own list, with owners and dates
6. Sign-off: who approved it, and who was consulted

Pull the actions into a list of their own, and they start getting done. A table is built for judging, and nobody works from a table. Five actions with names and dates against them is something a supervisor can run a Monday meeting on.

Since the people who most need to follow it are rarely the people who wrote it, plain language beats regulatory phrasing. One page per activity where possible, actions near the front, and no abbreviations the reader doesn't use daily.

The people doing the job get it first, then supervisors, then any contractor working in the same area. Keeping it where the work happens matters as much as who receives it, so it does not belong in a folder nobody opens.

Date every version and keep the previous one. Otherwise, "we changed that last year" is a claim with nothing behind it.

Who Should Conduct a Risk Assessment?

The employer or business owner carries the legal responsibility, not whoever fills in the form. That duty cannot be handed off by paying somebody else to write the document.

Whoever carries out the assessment has to be competent, which in most regulations means understanding the work and its hazards well enough to judge them rather than holding a particular certificate. That usually points to the people doing the job. A warehouse picker knows which aisle the forklift cuts through at speed, and a visiting consultant does not.

In practice, the work gets shared between three roles:

• somebody senior enough to authorize spending, who signs it off
• a supervisor or manager, who writes it up
• the people who do the task, who supply what actually happens on a normal shift

Both EU-OSHA and Safe Work Australia build worker consultation into the process rather than treating it as a courtesy.

Outside help earns its cost when the hazards need knowledge nobody on site has: structural loading, high-voltage work, confined spaces, complex chemical exposure, anything needing exposure monitoring or air sampling.

Even then, the consultant assesses and advises while the duty stays with the employer. So if you know the job and somebody has handed you this, you are probably the right person for it. What you may still need is somebody's authority to spend money on the fixes you find.

How Often Should Risk Assessments Be Performed

Risk assessment should be reviewed as soon as there are any changes, or according to a pre-determined schedule. Annual reviews are not legally required, though many organizations schedule one as policy.

Look at higher-hazard work more often, though how fast the work itself changes matters more than the calendar. A warehouse that reorganizes every quarter needs reviewing more often than an office that hasn't moved a desk in three years.

How often you must do this, and whether it has to be written down at all, depends on where you work. Advice written for one country routinely does not apply in another, and the differences are large enough to matter.

Table: What the Law Requires in Five Regions

Whether writing it down is compulsory comes down to a handful of triggers:

• how many people you employ
• whether the work is a specifically regulated activity, such as selecting protective equipment or working at height
• a licence or permit condition
• a client or contract requirement
• an insurer's requirement

Write it down regardless of which of those apply, because an assessment that exists only in somebody's head can't be reviewed, handed over, or shown to anyone.

Why Are Risk Assessments Necessary

A risk assessment is the only part of a safety program that asks what could go wrong here before it does. Everything else in the program responds to something that already happened.

Beyond the legal duty that applies in most countries, preventing harm is the reason that matters most. US private industry employers recorded 2.5 million nonfatal injuries and illnesses in 2024. Across 2023–24, the largest share of cases involving days away, restricted duty, or transfer (946,290) came from overexertion, repetitive motion, and bodily conditions.

Almost none of that comes from dramatic events. It comes from lifting, reaching, and walking.

Almost everything else gets built on top of it. Training content, permits to work, method statements, emergency planning, and the rules handed to contractors all start from an assessment of what could go wrong, so a weak assessment compromises everything built on it.

Somebody will ask for it sooner or later. Insurers, clients, auditors, and regulators all want the same document, so having it ready turns a scramble into a filing exercise.

Assessing also forces a proper look at how the work is really done, which is where the walk usually turns up something nobody had registered.

Common Mistakes to Avoid While Assessing Risks

The same handful of mistakes turn up in first assessments:

• copying a template and changing only the company name
• assessing the procedure instead of the work as it is really done
• filing it and never going back
• reaching for protective equipment first instead of last
• leaving actions without an owner or a deadline
• treating the score as a measurement rather than a judgement

Where to Get Templates and Help

The regulators publish the best free material, and it is usually better than the paid alternatives.

HSE publishes a blank risk assessment template with six worked examples covering an office, a shop, food preparation, a vehicle repair shop, factory maintenance and a warehouse. EU-OSHA does the same for member states, CCOHS keeps a plain reference page on hazard and risk, and Safe Work Australia issues a code of practice on managing work health and safety risks.

Because somebody has already thought about your hazards, a sector-specific checklist from an industry association beats a generic form. The same logic applies to the forms themselves, and pre-built risk management templates give you one that already lists the common hazards for a setting, so the starting point is a list rather than a blank page.

A consultant earns their fee when the hazards need expertise you do not have, such as structural, electrical, or complex chemical exposure. For ordinary hazards, you will do a better job, because you know how the work really happens and they will have to ask.

From an Assessment to a System

An assessment for one activity is more than most workplaces start with. Four actions take it further, and each is small enough to start on right away.

1. Start with whatever scored highest, not whatever is easiest to write up.
2. Put every deadline and the review date in a calendar, because the document will not remind you.
3. Tell the people who do the job what changed and why.
4. Do the next activity. Assessments accumulate, and nobody covers a whole site in one sitting.

A spreadsheet handles the first few without complaint. It starts to fail somewhere around the point where nobody can say which version is current, whose actions are overdue, or which assessments have gone past their review date.

Keeping assessments, actions, and review dates in risk management software means the overdue ones surface on their own instead of waiting for somebody to check.

Whichever way you track them, the assessment that matters is the one that gets reviewed.

Frequently Asked Questions

Is Risk Assessment and Risk Management the Same?

No. A risk assessment is one part of risk management, which is the whole cycle of finding hazards, assessing them, controlling them, reviewing the controls, and recording all of it. The assessment is the judging step in the middle.

Do You Need a Qualification to Conduct a Risk Assessment?

No qualification to conduct a risk assessment is needed in most countries. What is needed is competence, meaning you understand the work and its hazards well enough to judge them, and formal training helps without usually being a legal condition.

How Long Should a Risk Assessment Take?

A risk assessment should take an hour or two for a small, low-hazard workplace, and considerably longer where machinery or chemicals are involved. The time should be proportionate to the hazards rather than to the length of the form.

What Is the Difference Between a Risk Assessment and a Job Safety Analysis?

The difference between a risk assessment and a job safety analysis is: A risk assessment covers an area or an activity, while a job safety analysis breaks one specific job into its steps and assesses each step in turn.

Can You Copy a Risk Assessment Template You Found Online?

You can copy the structure of an online risk assessment but not its content. A completed example with your company name on it describes somebody else's workplace. Risk assessment templates that generally cover most average hazards can often be used without requiring much modification.

What Happens If You Do Not Do a Risk Assessment?

If you do not do a risk assessment, you may be exposed to enforcement action. More practically, you have no defence and no record of having thought about the risk when something does go wrong.

Can I Write My Own Risk Assessment?

Yes, you can write your own risk assessments, and for most workplaces you might do it better than an outsider, because you know how the work really happens. Bring in a specialist when the hazards fall outside your knowledge, such as structural loading, high-voltage work, or complex chemical exposure.