A risk assessment is one of the most important health and safety requirements for any UK business. Whether you run a small construction firm, a security company, or a busy office, understanding what a risk assessment is and how to do one properly protects your people, keeps you legally compliant, and helps your business avoid serious consequences. This complete guide covers everything you need to know about risk assessments in the UK in 2026.
What Is a Risk Assessment?
A risk assessment is a careful, structured examination of your workplace and work activities to identify anything that could cause harm to people. The Health and Safety Executive defines it simply as looking at what in your work could cause harm and deciding whether you have done enough to prevent it.
There are two key terms you need to understand before anything else:
- Hazard: anything that has the potential to cause harm, such as a wet floor, a heavy load, or a piece of machinery
- Risk: the likelihood that the hazard will actually cause harm and how serious that harm could be
A risk assessment does not try to eliminate every possible hazard. That is rarely realistic. Instead, it identifies the significant risks and makes sure the right controls are in place to reduce them to an acceptable level.
Purpose of Risk Assessment
The main purpose of a risk assessment is to prevent accidents and ill health before they happen. It is a proactive tool, not a reactive one, rather than waiting for something to go wrong and then trying to fix it. A risk assessment encourages businesses to think ahead, identify problems early, and put the right measures in place in advance.
Beyond safety, risk assessments serve several important purposes:
- They demonstrate that your business takes legal health and safety duties seriously
- They protect employees, contractors, visitors, and members of the public
- They provide documented evidence of due diligence if an incident ever occurs
- They help businesses meet the requirements of ISO 45001, CHAS, SafeContractor, and other accreditations
- They reduce the financial impact of workplace accidents, including insurance claims and lost productivity
- They give employees confidence that their employer values their safety
In 2026, HSE inspectors will be increasingly focused on whether risk assessments are not just present. But actually suitable, sufficient, and actively used in day-to-day operations. A document that sits in a folder and is never reviewed or followed is treated very differently from one that reflects how the business actually works on the ground.
Who Needs a Risk Assessment in the UK?
Almost every UK business needs to carry out a risk assessment. The legal requirement comes from the Management of Health and Safety at Work Regulations 1999, which states that every employer must make a suitable and sufficient assessment of the risks to the health and safety of employees and anyone else who could be affected by their work activities.
This applies to:
- All employers, regardless of business size or sector
- Self-employed individuals whose work could pose a risk to others
- Businesses with five or more employees must also record their findings in writing
- Businesses operating in high-risk sectors such as construction, security, manufacturing, and healthcare
Businesses with fewer than five employees are not legally required to write their risk assessment down, but documenting it is strongly recommended. If an incident occurs, proving that you carried out an adequate assessment without any written record is extremely difficult.
Even home workers and remote employees may need risk assessments in certain circumstances, particularly. If they use company equipment or work in environments the employer has some control over.
Types of Risk Assessment
Different work activities and environments require different types of risk assessment. Choosing the right type for your situation is an important first step.
Common types include:
- General workplace risk assessment: the standard assessment required under the Management Regulations 1999, covering all general workplace hazards such as slips, trips, falls, manual handling, workstation setup, and electrical safety
- COSHH assessment: required when workers are exposed to hazardous substances such as chemicals, fumes, dust, or biological agents, covered under the Control of Substances Hazardous to Health Regulations 2002
- Fire risk assessment: required under the Regulatory Reform (Fire Safety) Order 2005 for all non-domestic premises, covering fire hazards, escape routes, and emergency procedures
- Manual handling assessment: required when workers regularly lift, carry, push, or pull loads, covered under the Manual Handling Operations Regulations 1992
- Display screen equipment (DSE) assessment: required for workers who regularly use computers or screens as a significant part of their work
- Dynamic risk assessment: a real-time, on-the-spot assessment used by security guards, emergency services, and other roles where hazards change rapidly and cannot always be planned for in advance
- Construction-specific assessments: including CDM-related assessments, working at height assessments, and task-specific RAMS required under the Construction (Design and Management) Regulations 2015
Principles of Risk Assessment
Good risk assessments follow a set of core principles that keep them practical, proportionate, and legally defensible. Understanding these principles helps businesses produce assessments that actually work rather than just look good on paper.
The key principles are:
- Proportionality: the level of detail and effort put into a risk assessment should match the level of risk involved. A low-risk office environment does not need the same depth of assessment as a high-risk construction site.
- Suitability: the assessment must be appropriate to the specific work actually being done, by the people actually doing it, using the equipment they actually use. A generic template downloaded from the internet and never adapted to your business is unlikely to be suitable
- Sufficiency: the assessment must cover all significant risks, consider everyone who could be harmed, including non-employees, and reflect current legislation and good practice
- Worker involvement: employees who carry out the work should be consulted when producing the assessment. They often know the hazards better than anyone, and their involvement improves both the quality and the ownership of the document
- Regular review: a risk assessment is not a one-off exercise. It must be reviewed regularly and updated whenever there are significant changes to processes, equipment, staff, or the workplace
5 Steps of Risk Assessment
The HSE’s five-step method has been the recognised UK framework for carrying out risk assessments since 1998. Following these steps in order gives businesses a structured, reliable approach that meets legal requirements.
Step 1: Identify the Hazards
Walk through the workplace and observe the work being done. Talk to the people who actually carry out the tasks, since they often know the hazards best. Review incident and near-miss records for patterns. Check the manufacturer’s instructions for equipment and substances used.
Look beyond obvious physical hazards. Consider ergonomic risks, psychosocial hazards such as stress and lone working, biological hazards, and chemical exposures. Do not forget non-routine activities such as maintenance, emergency procedures, and contractor visits, since these are often where the most serious incidents occur.
Step 2: Decide Who Might Be Harmed and How
For each hazard identified, consider everyone who could be affected. This includes not just your own employees but also contractors, agency workers, visitors, members of the public, lone workers, young workers, new starters, and pregnant employees.
Think carefully about how each group could be harmed. The route to harm matters as much as identifying the hazard itself, since understanding how harm could occur helps you design controls that actually prevent it.
Step 3: Evaluate the Risks and Decide on Controls
For each hazard, assess both the likelihood of harm occurring and the potential severity of that harm. This evaluation helps you prioritise which risks need the most urgent attention and what level of control is needed.
Use the hierarchy of controls to decide how to manage each risk:
- Eliminate the hazard where possible
- Substitute it with something less dangerous
- Isolate people from the hazard through physical barriers or enclosures
- Engineer controls such as guards, extraction systems, or mechanical aids
- Administrative controls such as safe systems of work, training, and signage
- Personal protective equipment as a last resort when other controls are not sufficient
The hierarchy exists because higher-level controls are more reliable than lower-level ones. A warning sign on a wet floor is far less effective than stopping the floor from getting wet in the first place.
Step 4: Record Your Findings
If you employ five or more people, you must record the significant findings of your risk assessment in writing. This record should include the hazards identified, who could be harmed and how, the controls already in place, any further action needed, who is responsible for that action, and the target completion date.
The record does not need to be complex or lengthy. It needs to be clear, accurate, and genuinely reflective of how your business operates. A short, honest, business-specific document is far more valuable than a long, impressive-looking template that has never been adapted to your actual work.
Step 5: Review and Update Your Assessment
Risk assessments must be reviewed regularly to remain useful and legally defensible. The HSE recommends reviewing at least annually and immediately after any of the following:
- A workplace accident or near miss
- Significant changes to processes, equipment, or materials
- New staff joining, particularly in higher-risk roles
- Changes to legislation or HSE guidance
- Feedback from employees identifying hazards not previously considered
In 2026, HSE inspectors will specifically look for evidence that risk assessments have been reviewed and updated. An assessment last reviewed in 2021, still sitting on file in 2026 with no update record, is one of the most common findings during enforcement visits.
Risk Assessment for Small Businesses
Many small business owners assume that risk assessments are only for large companies with dedicated health and safety teams. This is a common and potentially costly misconception.
Health and safety law applies to all UK businesses regardless of size. The only difference for smaller businesses is that the approach should be proportionate to the risks involved and the scale of operations.
For most small, low-risk businesses, carrying out a risk assessment is straightforward. The HSE is clear that you do not need to be a health and safety expert to do it. If you understand your workplace and can identify the obvious hazards, you can carry out a basic assessment yourself.
However, for small businesses in higher-risk sectors such as construction, security, or manufacturing, professional support is strongly recommended. A specialist health and safety consultant can identify hazards that you might overlook, ensure the assessment meets current legal standards, and produce documentation that holds up during an HSE inspection or in the event of a legal claim.
Key tips for small businesses:
- Keep your risk assessments simple, specific, and honest
- Involve your employees in the process
- Review them whenever anything significant changes
- Do not use generic downloaded templates without adapting them fully to your business
- Store them somewhere accessible so they are actually used rather than filed away
Common Risk Assessment Mistakes UK Businesses Make
Even well-intentioned businesses make avoidable mistakes with their risk assessments. Knowing these in advance helps you avoid them.
The most common mistakes include:
- Using generic templates that have never been adapted to the specific business
- Completing the assessment without involving the people who actually do the work
- Identifying actions but never implementing them, leaving the same issues open for months or years
- Missing psychosocial hazards such as stress, lone working, and workplace violence
- Failing to consider non-employees such as contractors, visitors, and members of the public
- Treating the risk assessment as a one-off paperwork exercise rather than a living document
- Not reviewing the assessment after incidents, changes, or on an annual basis
In 2026, the HSE issued 2,323 improvement notices in a single year, many of which were linked to inadequate or outdated risk assessments. These are avoidable with the right approach and the right support.
How BizGrow Holdings Supports UK Businesses with Risk Assessments
BizGrow Holdings supports UK businesses across construction, security, facilities management, and professional services with practical, thorough risk assessment preparation as part of their wider SHEQ and compliance consultancy service.
The BizGrow Holdings team helps businesses identify the right types of risk assessments needed for their specific activities, prepare documentation that is genuine, business-specific, and audit-ready, and build the wider health and safety management system needed to achieve accreditations like CHAS, SafeContractor, ISO 45001, and Constructionline.
Risk assessments are a central part of almost every compliance standard BizGrow Holdings supports. Rather than treating them as isolated documents, the team builds them into a complete, joined-up health and safety framework that works in practice and stands up to external scrutiny.
With a 99% pass rate across over 100 successful audits, BizGrow Holdings has the experience and the track record to help UK businesses get their risk assessments right the first time, without confusion, generic templates, or costly mistakes.
Conclusion
Understanding what a risk assessment is and how to do one properly is one of the most fundamental responsibilities any UK business owner or manager carries. Done well, a risk assessment protects people, satisfies legal requirements, supports accreditation applications, and demonstrates the kind of professionalism that serious clients and buyers expect to see.
With expert support from BizGrow Holdings, UK businesses can build risk assessments that are not just compliant but genuinely useful, creating a safer workplace and a stronger compliance foundation for long-term growth.
Frequently Asked Questions
Are your risk assessments suitable and sufficient?
A suitable risk assessment is tailored to your specific work activities and the people doing them, not a generic template. A sufficient one covers all significant risks and considers everyone who could be harmed, including non-employees. If your assessment has not been reviewed recently or has not been adapted to your actual business, it may not meet either standard.
How often should a risk assessment be reviewed in the UK?
Risk assessments should be reviewed at least once a year as a minimum. They must also be reviewed immediately after any workplace accident, significant change to processes or equipment, or introduction of new staff. Keeping review records up to date is essential for demonstrating ongoing compliance with the HSE.
Do self-employed people need a risk assessment?
Yes, if your work could pose a risk to the health and safety of others, including clients, the public, or subcontractors. The Management of Health and Safety at Work Regulations 1999 apply to self-employed individuals in most cases. If you work on client sites, you may also be asked to provide evidence of your assessment before starting work.
What happens if a business does not have a risk assessment?
The HSE can issue improvement notices, prohibition notices, or pursue prosecution for failure to carry out a suitable risk assessment. In serious cases, this can result in unlimited fines and up to two years’ imprisonment. Beyond legal consequences, an inadequate or missing risk assessment leaves your business exposed to civil claims following any workplace injury.
Can a consultant help write a risk assessment for my business?
Yes, a health and safety consultant can carry out a workplace assessment, identify hazards specific to your business, and produce documentation that meets current legal standards. This is particularly valuable for higher-risk sectors or businesses pursuing CHAS, SafeContractor, or ISO 45001 accreditation. BizGrow Holdings provides risk assessment support as part of its wider compliance consultancy service for UK businesses