How to get Risk Assessments right

Risk assessments are a legal requirement under the Management of Health and Safety at Work Regulations—and they function as an organization’s first line of defense against both criminal and civil consequences. The core message is straightforward: businesses must identify hazards, assess who could be harmed and how, evaluate the likelihood and severity of harm based on existing controls, then record, communicate, and regularly review the assessment. Doing it well matters because weak or missing assessments can lead to enforcement action, prosecutions, civil claims, reputational damage, and financial penalties.

The legal landscape splits into two streams. Criminal law is typically driven by Acts of Parliament and regulations, with guidance and approved codes issued by bodies such as the Health and Safety Executive, Environment Agency, Fire Authority, and local authorities. The most commonly cited foundation is the 1974 Health and Safety at Work Act. Civil claims are more common in practice: an individual can bring a case alleging negligence (a tort of negligence), usually heard in the County or High Court. Civil cases tend to be easier to pursue because the burden of proof is lower than in criminal matters. In both settings, a strong risk assessment helps demonstrate that the organization followed sensible, consistent steps—preventing incidents where possible, and showing how risks were mitigated when problems arose.

A risk assessment must be “suitable and sufficient.” It should be conducted whenever considering a task, not merely when legislation explicitly demands written documentation. The process begins by identifying hazards—anything with the potential to cause harm—then deciding who might be harmed (employees, contractors, visitors, and vulnerable groups such as young or inexperienced workers, including those under 18, and pregnant workers whose exposures may change). Next comes evaluating risk: how likely the hazard is to cause harm, and how severe the harm could be, taking into account existing control measures.

The assessment should incorporate standard safe working practices and training requirements. For example, someone should not be put on a forklift truck until they can demonstrate competence for that specific vehicle, not just complete a generic awareness course. Precautions should be realistic and actually implemented; “ideal” controls that won’t be done don’t count. If residual risk remains high after controls, the assessment needs revision to drive risk down—ideally toward low risk.

Recording and communication are treated as non-negotiable. Verbal-only documentation is hard to defend, so organizations should keep documentary evidence and make it available to those doing the work and to impacted third parties. Communication can take the form of toolbox talks, short training sessions, and recorded acknowledgements (including signatures where possible). Finally, risk assessments must be reviewed and updated—typically at least annually, but also after incidents, accidents, or changes in circumstances. Near misses are highlighted as early warning signals that something is not quite right.

To make the method concrete, the talk uses an intentionally absurd example: a shark in a swimming pool. The hazard is the shark (and the potential for severe injury), controls include barriers/exclusion to prevent access, affected parties include family and any subcontractors involved (like pool cleaners), and the assessment is recorded, circulated, and reviewed—especially if circumstances change or the risk becomes redundant. The takeaway is that a risk assessment left “on the shelf” is useless; it must be actively understood and applied on the ground.