What Is a Risk Assessment? What It Must Include and How It Should Work on Site

What is a risk assessment?

A risk assessment is a systematic examination of workplace hazards, the people who could be harmed, the likelihood and potential consequences of harm, and the measures needed to control those risks.

Put more simply, it should answer five questions:

1. What could go wrong?
2. Who could be harmed, and how?
3. How serious is the risk?
4. What needs to be done to prevent or control it?
5. How will we know those controls are working?

A risk assessment is primarily a planning and decision-making process.

It helps an employer decide whether existing precautions are adequate, whether further action is necessary and how work can be organised to protect employees and others who may be affected.

For example, consider a groundworks contractor preparing to excavate near an existing building.

The assessment must consider more than the activity of digging. Relevant hazards might include excavation collapse, underground services, moving plant, adjacent structures, groundwater, restricted access and the presence of other contractors.

The assessor must examine the actual work, location, conditions and people involved before identifying suitable controls.

The resulting document records the significant findings and decisions. But the real value lies in whether those decisions are implemented before work begins.

What does UK law require?

In Great Britain, the principal general requirement comes from the Management of Health and Safety at Work Regulations 1999, Regulation 3.

Employers must carry out a suitable and sufficient assessment of risks to their employees and to others who may be affected by their undertaking.

The Health and Safety at Work etc. Act 1974 establishes wider duties to protect health, safety and welfare, so far as is reasonably practicable.

For construction activities, the Construction (Design and Management) Regulations 2015 (CDM 2015) introduce further responsibilities for planning, managing, monitoring and coordinating construction work.

Specific regulations may also require more detailed assessments for particular hazards, including:

• Work at height
• Hazardous substances under COSHH
• Manual handling
• Noise and vibration
• Asbestos and other specialist risks

A general risk assessment does not replace these specific duties.

What does "suitable and sufficient" mean?

It means the assessment must be proportionate to the work and thorough enough to identify significant foreseeable risks and determine appropriate precautions.

A suitable and sufficient assessment should:

• Reflect the actual activity and working environment.
• Identify significant hazards and people who could be affected.
• Consider existing controls and whether further precautions are needed.
• Prioritise effective risk reduction.
• Account for relevant site conditions, equipment, competence and interactions with other activities.
• Be reviewed when it may no longer be valid or circumstances change significantly.

It does not have to be unnecessarily long or technically complicated.

A short, well-considered assessment can be more effective than a lengthy generic document that has little connection to the work.

The legal test is not how much has been written. It is whether the risks have been adequately assessed and controlled.

Must a risk assessment be written down?

Employers with five or more employees must record the significant findings of their risk assessments, including any groups of employees identified as being especially at risk.

Businesses with fewer than five employees are generally not required to record the significant findings under this particular provision, although carrying out an appropriate assessment remains necessary.

Keeping a written record is good practice, particularly in construction, where work often involves several contractors, changing environments and the need to demonstrate how risks are being managed.

Other legal requirements or contractual arrangements may impose additional documentation duties.

How to carry out a risk assessment: five practical steps

The HSE recommends five stages for managing workplace risks.

1. Step 1: Identify the hazards

   Examine the work as it will actually be carried out.

   Review the work area, planned activities, equipment, substances and relevant site information.

   Speak with the people doing the job. They often know where the practical difficulties lie.

2. Step 2: Assess the risks

   Identify who may be harmed and how.

   Consider the likelihood and potential consequences of the hazards, taking account of existing controls.

   Distinguish between risks already adequately controlled and those requiring further action.

3. Step 3: Control the risks

   Identify and implement reasonably practicable measures to eliminate or reduce the risks.

   Select effective controls before considering reliance on procedures, training and PPE alone.

   Agree responsibilities and ensure critical actions are completed before work begins.

4. Step 4: Record the significant findings

   Produce a clear record where required and whenever it helps people implement, coordinate or verify the controls.

   Avoid filling documents with irrelevant generic content.

   The reader should be able to identify the significant hazards, required precautions and outstanding actions without searching through unnecessary material.

5. Step 5: Review the controls and assessment

   Check whether the controls remain appropriate and are working in practice.

   Review the assessment when changes, incidents, new information or evidence of ineffective controls indicate that it may no longer be valid.

Risk assessment should be a continuing process, not an administrative exercise completed once at the start of a project.

Example: what should a construction risk assessment look like?

The free editable RAMS template uses external brickwork from a scaffold platform as its illustrative activity. Its first risk-register row considers a bricklayer falling from height.

Here are the ten columns from that row, shown vertically for easier reading. Each example must be replaced with findings from the actual task and site.

On smaller screens, scroll across to read the full table.

This is an illustration of how findings can be recorded, not a complete assessment or a ready-to-use safe system of work.

The example reduces likelihood while retaining the potential severity of a fatal fall. Its scores are illustrative, not recommended scores for every scaffold task. The ALARP entry is a prompt to complete the reasoning, not a finished justification or confirmation that the work is safe.

The assessor must examine the actual scaffold, activity, access, loading, people and site interfaces, and assess other foreseeable hazards. Any outstanding safeguards belong in the action record, with a responsible person, deadline and completion check.

Notice what makes the example useful: each control connects directly to a recognised hazard and a foreseeable form of harm.

Simply writing "take care", "be vigilant" or "wear appropriate PPE" would not provide the same level of risk control.

How does this guidance fit the DocRide RAMS template?

The download brings the risk assessment, safe working method and supporting arrangements into one editable Word document. The eight components discussed above describe what an assessment needs to address; the template organises that information into document details, seven numbered sections and supporting records.

Start with Document details: identify the activity, contractor, exact location, reference, version, status, dates, risk profile, jurisdiction, preparer and reviewer. Define the scope, people at risk and interfaces with other work.

1. 01 / RAMS table

   Use one row for each foreseeable risk. Record affected people and how harm could occur, its source, pre-control scores, specific controls, the residual explanation and post-control scores. The following Compliance obligations & risk criteria section records applicable requirements, how controls address them and the scoring framework.

2. 02 / Responsible roles

   List the roles involved and their task-specific PPE requirements. Assign work steps to roles in the method table, and give outstanding actions a named responsible person in the final record.

3. 03 / Safe working method

   Complete Step, Applicability and Safe working method step. Explain who carries out each stage, the sequence, pre-start checks, safeguards, stop-work conditions and how the area will be made safe and handed over.

4. 04 / Substances used

   Record each substance, its use, COSHH assessment reference and status, controls and any RPE or additional protection. The mortar example shows how to reference supporting information. This index does not replace a COSHH assessment.

5. 05 / Foreseeable emergencies

   Describe each credible scenario, its triggers, actions in order, who takes charge, who meets emergency services, contacts, access, evacuation or rescue arrangements, equipment and training. Duplicate the page where scenarios need separate arrangements.

6. 06 / Health surveillance triggered by this work

   Record the exposure trigger, reason, affected roles and frequency or arrangements. The wet-cement example prompts an occupational-health-informed skin surveillance programme; replace it with arrangements appropriate to the assessed exposure.

7. 07 / Tangible resources

   List equipment, linked asset references, risks, maintenance or inspection arrangements, status and the risk owner. Identify other supporting records, such as scaffold handover information and competence records.

Finish with Actions, review & briefing record. Assign outstanding controls, deadlines and verification; record review triggers, revisions and approval for the defined work. The worker briefing table includes a field for checking understanding and resolving questions, alongside the briefing date and signature or record.

Replace the light-grey examples, including names, dates and scores, with your own information. Add rows where needed and explain any section that does not apply. Have the completed RAMS checked by someone competent for the work, brief the team and verify critical controls before starting.

Use the template completion guide alongside this article when preparing your project copy.

Risk assessment vs method statement: what is the difference?

The construction industry frequently combines risk assessments and method statements under the term RAMS.

It is familiar shorthand, but a combined RAMS document is not a separate, universally required statutory document category.

Risk assessments and method statements serve related but distinct purposes.

Method statements are not generally required by law for every construction activity, although specific work, such as demolition or structural alteration, has particular requirements for written arrangements.

They can also be required under principal contractor procedures or contractual arrangements.

For complex activities involving several people, one coordinated method statement may be appropriate, provided the responsibilities and instructions for each role are clear.

The aim is not necessarily to create a separate method statement for every worker.

It is to make sure each person understands the parts of the safe system that apply to their work and how they interact with others.

A method statement should not simply repeat the risk assessment in a different layout.

It should make the safe working arrangements usable.

How should risk assessment findings be communicated to workers?

This is where many safety management systems fail.

A competent person completes the assessment. A document is uploaded to a folder. Workers are asked to sign a briefing sheet.

The paperwork looks complete.

But have the workers understood the risks and precautions?

Regulation 10 of the Management of Health and Safety at Work Regulations 1999 requires employers to provide employees with comprehensible and relevant information about the risks identified by the assessment and the preventive and protective measures.

Employers must also provide appropriate instruction, training and supervision.

That is more meaningful than simply handing someone a document.

Turn findings into clear working instructions

Communication should reflect the activity, the hazards and the people involved.

Useful approaches include:

• Task-specific briefings before work begins.
• Toolbox talks focused on important hazards.
• Clear method statements and visual instructions.
• Practical demonstrations where appropriate.
• Role-specific instructions and pre-start checks.
• Additional support for people with language, literacy or training needs.

Workers should be involved in discussions about how risks are controlled, not treated simply as recipients of information.

Check understanding, not just signatures

A signed briefing record may provide evidence that information was issued.

It does not, on its own, prove understanding or competence.

A supervisor might ask:

• What are the main hazards in today's work?
• What must be checked before you start?
• Which precautions are essential?
• What would make you stop the task?
• Who do you tell if conditions change?

The answers provide a better indication of whether important information has been understood.

For more complex or high-risk work, practical demonstrations, competence checks and appropriate supervision may also be necessary.

The goal is not to make people memorise documents. It is to make sure they understand and can safely carry out their work.

Why workers need practical pre-start checklists

Even experienced people can overlook something familiar.

A checklist is not a replacement for training, competence or supervision. It is a practical aid for verifying important conditions and precautions at the point of work.

Think about the difference between engineering analysis and operational checks.

An aircraft's structural analysis is essential to its design. But the crew also needs clear operating procedures and checklists.

The same principle applies to construction.

The assessment determines what is necessary to control risks. The safe system describes how the work should proceed. A practical checklist helps workers verify that critical requirements are satisfied before or during the task.

For example, an unloading-team checklist might prompt verification of the delivery location, exclusion arrangements, equipment suitability, load condition and site-specific changes.

These are prompts, not a complete unloading procedure.

The checklist should be completed where the work takes place and must lead to action when a required condition is not met.

In the downloadable RAMS, put required checks and stop-work conditions into the Safe working method. The template does not include a separate completed pre-start checklist; develop any task-specific checklist from the assessed controls and reference it in the method.

A ticked box is not a control measure unless the underlying check has actually been carried out.

Who is responsible for developing, implementing and monitoring a risk assessment?

Different people contribute at different stages, but responsibilities must not become disconnected.

The employer or contractor: accountable for managing the risk

The employer retains the legal responsibility for assessing and controlling risks arising from its undertaking.

Appointing an external consultant does not transfer that responsibility.

Under CDM 2015, contractors also have duties to plan, manage and monitor construction work under their control.

The competent assessor: responsible for informed assessment

The person undertaking or assisting with the assessment needs appropriate knowledge, skills and experience for the work and hazards involved.

They should identify hazards, evaluate risks, consult relevant people and recommend suitable controls.

They must understand the activity well enough to recognise where specialist input is needed.

The supervisor: responsible for checking implementation

Supervisors should understand the controls and make sure they are applied in the work they oversee.

They should verify that the necessary arrangements are in place, observe the work and respond when conditions change or controls fail.

Workers: responsible for participating and following safe arrangements

Workers have an important part to play.

They must cooperate with relevant safety arrangements, follow appropriate procedures and report dangers or shortcomings they identify.

They should also be consulted about matters affecting their health and safety.

The principal contractor: responsible for coordination

On construction projects involving more than one contractor, the principal contractor has wider duties to plan, manage, monitor and coordinate the construction phase.

This includes managing interfaces between different contractors and ensuring appropriate arrangements exist for communicating relevant risks.

The responsibilities are connected, but they are not interchangeable.

The assessor evaluates the risks. The employer ensures they are managed. The supervisor checks delivery. Workers help put controls into practice.

How should risk assessments be managed?

A completed assessment needs to remain usable throughout the work.

Good risk assessment management involves more than saving a PDF.

Keep assessments current and identifiable

Maintain a reliable record of the current approved assessment, its scope, revision status and supporting information.

Avoid situations where several different versions circulate without anyone knowing which one applies.

Connect assessments with the actual project

A company may have standard assessments for recurring activities.

These can provide useful starting points, but they must be checked and adapted for the specific site, task, equipment, people and conditions.

Copying the same assessment from project to project without reviewing its suitability can leave significant hazards uncontrolled.

Make information available to those who need it

Assessors, managers, supervisors, workers and other relevant dutyholders may need different levels of information.

The system should support appropriate access to the current documents, significant findings, safe working instructions and supporting records.

Paper or digital arrangements can work, provided they are reliable and suitable for the task.

Monitor whether controls work

Management should include workplace inspections, supervisor checks, worker feedback, incident investigations and other appropriate monitoring.

The purpose is to verify that precautions are actually being used and remain effective.

Maintain evidence of decisions and changes

Where appropriate, keep records of changes to assessments, outstanding actions, completed controls, relevant communication and significant reviews.

Good version control supports accountability and helps prevent outdated information being relied upon.

But document control must support operational safety rather than becoming an end in itself.

When should a risk assessment be reviewed?

A risk assessment is not valid forever simply because it has been approved and signed.

Under Regulation 3, an assessment must be reviewed when there is reason to suspect it is no longer valid or when there has been a significant change in the matters to which it relates.

Typical review triggers include:

• Changes to the work activity, sequence or method.
• New equipment, materials or substances.
• Changes in the site layout or working environment.
• New hazards created by other contractors.
• Accidents, incidents or near misses.
• Reports that existing controls are ineffective.
• New technical or safety information.
• Significant changes in the workforce or its capabilities.

Periodic review arrangements should also be proportionate to the nature of the work and the speed at which circumstances change.

Does a risk assessment have to be reviewed every 12 months?

There is no universal requirement under the general risk assessment duty for every assessment to be rewritten annually.

Businesses often set annual review dates as part of their management systems, but those dates do not replace the need to review assessments earlier when circumstances require it.

Some specialist regulations impose additional assessment and review requirements.

A review should establish whether the original assumptions, identified hazards and selected controls remain appropriate.

If nothing relevant has changed and the controls remain effective, a complete rewrite may not be necessary.

If the work changes significantly, the affected parts must be reassessed and any necessary revisions made.

An assessment should be reviewed because the risk requires it, not merely because a calendar notification has appeared.

How should risk assessments be audited?

An audit should distinguish between the quality of the assessment and the quality of implementation.

These are two different questions.

Check 1: Was the risk assessed properly?

Examine whether:

• The assessment reflects the actual activity.
• Significant hazards were identified.
• Relevant workers and affected people were considered.
• Controls were selected using appropriate prevention principles.
• Actions were assigned and completed.
• The assessment was prepared with suitable competence.
• Changes and new information have been addressed.

This tests the quality of the risk management decisions.

Check 2: Is the work being carried out safely?

Go to the workplace.

Observe the activity, examine the controls, speak to workers and compare what is happening with the planned arrangements.

Ask whether:

• Required safeguards are physically in place.
• Workers understand the important hazards.
• The agreed safe method is being followed.
• Supervisors are identifying changes and intervening appropriately.
• Pre-start checks and inspections are meaningful.
• Unsafe conditions are reported and corrected.

This tests implementation.

A missing document may be a legitimate finding where records or availability are required. It should be addressed accordingly.

But the finding "RAMS not on site" should not become a substitute for identifying whether the real problem is a defective assessment, missing information, inadequate training, absent controls or poor supervision.

Those failures need different corrective actions.

Common risk assessment mistakes

Several recurring problems reduce the usefulness of assessments.

1. Copying a generic assessment without adapting it. A familiar template cannot identify every significant site-specific hazard.
2. Assessing only the normal sequence of work. Changes, maintenance, unusual conditions and interactions with others must also be considered where foreseeable.
3. Relying on PPE for every risk. Stronger preventive or collective measures should be considered first.
4. Using scores without effective control measures. Risk matrices can assist decision-making but do not make a weak assessment suitable and sufficient.
5. Confusing communication with understanding. Signatures alone do not establish that workers understand what they must do.
6. Failing to assign actions. Identifying a necessary control achieves little if nobody implements it.
7. Failing to review changed circumstances. A previously suitable assessment may become inadequate when equipment, site conditions or work methods change.
8. Treating document approval as proof of safe working. Approved paperwork and safe implementation must both be verified.

From risk assessment to safe working: closing the gap

The real purpose of a risk assessment is not to create a document that satisfies an auditor.

It is to support safer decisions and safer work.

That requires a connected process:

1. Assess the risks
2. Select effective controls
3. Develop the safe system of work
4. Communicate it
5. Implement and supervise
6. Monitor
7. Review

Each stage depends on the one before it.

At DocRide, we believe construction safety documentation should support this process rather than overwhelm the people responsible for carrying it out.

The DocRide Site-Ready Passport helps subcontractors prepare editable RAMS and other site-document drafts, maintain relevant company and workforce records, access optional competent-person review and submit project packs to principal contractors.

The documents still need to be assessed, tailored and checked by competent people. Software does not replace those responsibilities.

Its role is to make the supporting information easier to prepare, manage, update and communicate.

And that brings us back to the question at the beginning.

When an auditor asks whether workers have their RAMS, the answer matters. But it should never be the end of the conversation.

Ask whether the risks were assessed properly.

Ask whether effective controls were put in place.

Ask whether workers know the safe method and can explain the critical precautions.

Then go and look at the work.

Because a risk assessment is not successful when the document is signed. It is successful when the risks are understood, the controls are implemented and the work is carried out safely.