The Five Steps to Risk Assessment, Explained

Why five steps?

UK employers must assess risk under the Management of Health and Safety at Work Regulations 1999, which sit beneath the broader duty of care in the Health and Safety at Work etc. Act 1974. The law does not prescribe a single method, but the five-step framework popularised by the Health and Safety Executive (HSE) has become the common-sense standard because it is easy to follow and works in almost any setting, from an office to a building site.

The five steps are: identify the hazards; decide who might be harmed and how; evaluate the risks and decide on controls; record your significant findings; and review the assessment. Let us take each in turn.

Step 1 — Identify the hazards

A hazard is anything that could cause harm. Walk through the workplace as if seeing it for the first time, and look for the obvious and the easily missed alike: trailing cables, slippery floors, moving vehicles, noise, dust, working at height, lone working, repetitive tasks and stress. Talk to the people who do the job — they know where things go wrong. Check manufacturers' instructions and safety data sheets, and look back at any accident or near-miss records you already hold.

Step 2 — Decide who might be harmed and how

For each hazard, name the groups at risk and describe the harm. This is not about listing individuals but identifying who is exposed: employees, contractors, visitors, members of the public. Pay attention to people who may be at greater risk, such as new and young workers, expectant mothers, or those who work alone. Being specific about how harm could occur — "could strain their back lifting cases" rather than just "manual handling" — sharpens the controls you choose later.

You do not have to assess every conceivable hazard. The duty is to address the significant ones — the things that could genuinely cause real harm — in a way that is proportionate to the risk.

Step 3 — Evaluate the risks and decide on controls

Now weigh how likely harm is and how serious it could be, then ask whether your existing precautions are enough. Where they are not, work down the hierarchy of control: first try to remove the hazard altogether, then reduce it, then control exposure, then rely on personal protective equipment and safe systems of work as a last line of defence. The goal is to reduce risk so far as is reasonably practicable — balancing the level of risk against the time, cost and effort needed to control it.

If you are still finding your feet with the wider process, our guide to how to write a risk assessment shows the full document with a worked example.

Step 4 — Record your significant findings

If you employ five or more people, you must write down the significant findings of your assessment. Even smaller employers benefit from doing so. A good record shows the hazards you found, the controls in place, any further action needed, who is responsible and by when. Keep it simple and readable — it should be something you can hand to a new starter to explain how the job is done safely, not a document that gathers dust. When chemicals are involved, you will also need a COSHH risk assessment alongside your general findings.

Step 5 — Review and update

A risk assessment is not a one-off. Set a date to review it, and revisit it sooner if something changes — new equipment, a new process, a change in staff, or after an incident or near miss. Reviewing keeps the assessment "suitable and sufficient" over time rather than only on the day it was written.

Putting it into practice

The five steps work because they force a logical sequence: see the danger, name who it threatens, decide what to do, write it down, and keep it current. Followed honestly, they protect your people and demonstrate that you have met your legal duty. The method scales from a single hazard to a complex operation — the discipline stays the same.