How to perform a risk assessment

What is a risk assessment?

A risk assessment is a process for finding workplace hazards, judging how likely they are to cause harm and deciding what controls to put in place.

The result is a ranked list of risks, so you know what to fix first.

Why is risk assessment important?

A risk assessment shows you where workers could get hurt before it happens. It also reflects good practice: OSHA's recommended practices for safety and health programs tell employers to find hazards and prioritize them for control.

A risk assessment is also one part of risk analysis, the wider process of weighing everything that could harm your people, operations or business. At larger scale, it supports enterprise risk assessment and enterprise risk management.

Risk Analysis Framework

When Do You Perform a Risk Assessment?

Beyond complying with legislative requirements, the purpose of risk assessments is to eliminate operational and security risks and improve the overall safety of the workplace. It is the employer’s responsibility to perform risk assessments when:

• new processes or steps are introduced in the workflow;

• managing contracts with third parties

• changes are made to the existing processes,

• assets, machines, and tools; or new hazards arise.

Risk assessments, including supplier risk assessment, are also performed by auditors when planning an audit procedure for a company.

When do you need to perform a risk assessment?

Beyond legal duties, a risk assessment helps you cut operational and security risks and make the workplace safer. As an employer, you're responsible for carrying one out when:

• new processes or steps enter the workflow

• you start

  contracts

  with third parties

• existing processes change

• assets

  ,

  machines

  or tools change

• new hazards appear

Auditors also run risk assessments, including supplier risk assessments, when they plan an audit procedure .

What are the three types of risk assessment?

HSE distinguishes three general types.

Large-scale assessments

These cover complex hazard sites such as nuclear, and oil and gas. They call for an advanced technique called quantitative risk assessment (QRA).

Required specific assessments

Specific laws require these, such as handling hazardous substances under the UK's COSHH regulations and manual handling under the Manual Handling Operations Regulations 1992.

General assessments

These manage everyday workplace risks. Health and safety authorities such as OSHA and HSE require them.

Risk assessment example

Here's a completed risk assessment. See more risk assessment examples from different industries.

Dynamic Risk Assessment Template | Mitti (by SafetyCulture)

On a construction site, run the assessment for each task and work area, then track the controls in construction risk management software.

How to perform a risk assessment in five steps

These five steps follow HSE's guidance on managing risk. Here's how to perform risk assessments efficiently. Work through them with the people who do the job on site, because they know where the near misses happen.

1. Identify hazards

Survey the workplace with the people who work there, and look for anything that could reasonably cause harm. Include non-routine work like maintenance and cleaning. Check common workplace hazards, manufacturer instructions and data sheets. Then review past accident and near-miss reports.

2. Evaluate the risks

Rate how likely each hazard is to cause harm and how serious that harm could be. Think about how, where, how often and for how long people are exposed. Then give each hazard a risk rating using a risk matrix.

3. Decide on control measures to implement

Once a hazard has a rating, decide how to protect workers, property, the public and the environment. The right controls often depend on the risk management frameworks your organization follows. For business continuity risks, an ISO 22301 checklist can guide your controls.

The gap between inherent risk and the risk level you're aiming for decides which controls come first. Rank them using the hierarchy of controls below.

4. Document your findings

Keep a formal record of risk assessments. Note how you assessed each risk, what you found and why you reached each conclusion. If you employ five or more people, HSE says you must record your significant findings. For construction projects, a construction risk register gives you one place to capture and track every risk on site. For other formats, browse these risk register examples.

5. Review your assessment and update if necessary

Check that your controls are in place and working. If conditions change significantly, decide whether you need a new risk assessment. Reviewing is a core part of risk mitigation, and a risk mitigation plan keeps your follow-ups in one place.

When updates are needed, a risk treatment plan for ISO 31000 or ISO 27001 helps you record revised actions and reassign owners.

What is the hierarchy of controls?

The hierarchy of controls ranks ways to reduce a hazard from most to least effective. NIOSH lists five levels, and you should work from the top down:

1. Elimination: remove the hazard completely.

2. Substitution: replace it with something safer.

3. Engineering controls: isolate people from the hazard.

4. Administrative controls: change the way people work.

5. Personal protective equipment (PPE): protect the worker with the right gear.

The top three levels work best because they don't depend on people remembering to do something. Ask your frontline team what's practical before you settle on a control.

How do you do a risk assessment for a small business?

Keep it simple. Walk your workplace, list what could hurt someone and note who's at risk. Rate each hazard high, medium or low, then deal with the high ones first.

Write your findings down, even if the law doesn't require it. A short risk assessment checklist keeps the process quick and consistent.

What tools and techniques are used in risk assessment?

The four most common risk assessment tools are the risk matrix, decision tree, failure modes and effects analysis (FMEA) and bowtie model. Other techniques include what-if analysis, fault tree analysis, layer of protection analysis (LOPA) and hazard and operability (HAZOP) analysis.

Digital tools help too. EHS risk assessment software lets teams run assessments on a phone, log hazards with photos and track actions to completion instead of chasing paper forms.

How do you use a risk matrix?

A risk matrix is often used to measure the level of risk by considering the consequence/ severity and likelihood of injury to a worker after being exposed to a hazard. Two key questions to ask when using a risk matrix should be:

1. Consequences: How bad would the most severe injury be if exposed to the hazard?

2. Likelihood: How likely is the person to be injured if exposed to the hazard?

The most common types are the 3×3 risk matrix, 4×4 risk matrix, and 5×5 risk matrix. If you want a ready-made template to apply this scoring system, a risk assessment matrix can help you log, score, and track risks consistently across your team.

How do you assess consequences?

Group injury severity into four categories:

• Fatality: leads to death.

• Major injury: serious damage to health that may be irreversible and needs ongoing treatment.

• Minor injury: reversible harm that may need medical attention but little ongoing treatment. It rarely means significant time off work.

• Negligible injury: first aid only, with little or no lost time.

How do you assess likelihood?

Group the likelihood of a hazard injuring a worker into four categories:

• Very likely: exposure to the hazard is continuous.

• Likely: exposure is occasional.

• Unlikely: it could happen, but only rarely.

• Highly unlikely: it could happen, but probably never will.

OSHA's hazard identification and assessment guidance explains how to characterize hazards and prioritize them for control.

How do digital tools help frontline teams with risk assessments?

Paper forms slow down the people closest to the risk. A worker spots a hazard, writes it down, and the note sits in a folder until someone types it up.

A mobile tool changes that. Teams can run the assessment on site, attach photos, assign a fix to an owner on the spot and give managers a live view of open risks. Platforms like Mitti keep a digital audit trail too, so your records are ready when an auditor asks.

Platforms like Mitti also support lone worker safety, with check-ins and panic alerts from any phone and automatic escalation to supervisors.

Risk assessment training

“Safety has to be everyone’s responsibility… everyone needs to know that they are empowered to speak up if there’s an issue.” – Captain Scott Kelly, at the Mitti (by SafetyCulture) Virtual Summit.

Good hazard identification and risk assessment training shows new and existing workers which hazards they may face and walks them through safety protocols. Platforms like Mitti let you build and send training based on what your workers actually face.