Health and Safety Risk Assessments: Do I Need One?
It's one of the most common questions I hear from smaller organisations:
"Do I actually need a health and safety risk assessment?"
The short answer is yes.
Under the Management of Health and Safety at Work Regulations 1999, employers are required to assess the risks to the health and safety of employees and others who may be affected by their activities.
If you employ five or more people, the significant findings of that assessment must be recorded.
But what if you employ fewer than five?
You still need to assess the risks.
You just aren't legally required to record the significant findings in writing.
However, there is a practical problem with that.
If it isn't written down, where is the evidence?
Imagine something goes wrong.
Someone is injured. An employee raises a concern. An enforcing authority investigates an incident.
One of the obvious questions is going to be:
"What risk assessment did you carry out?"
Saying "I considered it in my head" isn't particularly helpful when you're trying to demonstrate what hazards you identified, what risks you considered and what precautions you decided were necessary.
That's why I would generally recommend documenting your risk assessments even where the law doesn't specifically require you to.
It doesn't need to become an enormous administrative exercise.
In fact, good risk assessment shouldn't.
What does a risk assessment actually need to do?
At its heart, risk assessment is relatively simple.
You need to consider:
What could cause harm?
These are your hazards.
Who could be harmed and how?
Employees are an obvious consideration, but depending on your activities this could also include contractors, visitors, residents, service users, customers or members of the public.
How significant is the risk?
Consider how likely it is that harm could occur and how serious the consequences might be.
What are you going to do about it?
Identify the controls already in place and whether anything further is reasonably required to eliminate the hazard or reduce the risk.
Then keep the assessment under review.
That's the basic principle.
But there is another important requirement.
Your risk assessment must be "suitable and sufficient"
Having a document with RISK ASSESSMENT written across the top doesn't necessarily mean you have adequately assessed the risk.
The assessment needs to reflect what actually happens within your organisation.
It should identify the significant hazards and risks and the people who could genuinely be affected.
And this is where risk assessments sometimes go wrong.
People can become so determined to identify every conceivable hazard that the assessment starts considering scenarios which bear little relationship to the activity being assessed.
Risk assessment isn't an exercise in imagination.
It's about identifying real, foreseeable risks and controlling them proportionately.
Who should carry out the risk assessment?
The person carrying out the assessment needs to be competent to do so.
That doesn't automatically mean bringing in somebody with "Risk Assessor" in their job title.
In many cases, the person who understands the activity best can make an important contribution to the assessment.
Think about a cleaning team in a care home.
Who understands the chemicals being used?
Who knows how they're stored, diluted and applied?
Who knows whether staff use stepladders, move equipment or regularly lift and carry supplies?
Often, the people actually doing the work have invaluable knowledge of the hazards involved.
Competence is about having the appropriate combination of knowledge, skills and experience to understand the activity, recognise the hazards and determine appropriate controls.
For more complex or specialist risks, additional competent advice may be needed.
What should you risk assess?
There isn't one universal risk assessment that covers every workplace.
The assessments you need should reflect what your organisation actually does.
Depending on your activities, that might include:
manual handling;
moving and handling people;
hazardous substances and COSHH;
work at height and use of stepladders;
work equipment;
personal protective equipment;
display screen equipment;
workplace and premises risks;
vehicle movements;
lone working; and
particular activities undertaken by your employees.
A care provider will have a very different risk profile from an office, warehouse or property management company.
That's exactly why simply downloading somebody else's risk assessment from the internet and changing the company name is unlikely to produce a particularly useful assessment.
Risk assessment should drive your controls
This is perhaps the part of risk assessment that matters most.
The document isn't the end product.
The controls that come from it are.
A properly completed risk assessment might identify the need for:
different equipment;
additional guarding or physical controls;
personal protective equipment;
changes to working practices;
staff information;
supervision;
maintenance or inspection arrangements; or
training.'
What should you risk assess?
And even the level of training should reflect the level of risk.
A low-risk activity may require relatively straightforward instruction.
A higher-risk activity may require practical, face-to-face training, supervision or evidence
that somebody can actually perform the task safely.
The risk assessment should help you make those decisions.
Don't forget the legislation behind the risk
Some workplace activities are also subject to more specific health and safety legislation.
If employees use hazardous substances, for example, the Control of Substances Hazardous to Health Regulations may apply.
If they regularly work at height, the Work at Height Regulations need to be considered.
If they use work equipment, other requirements may apply.
A suitable and sufficient risk assessment therefore shouldn't exist in isolation from the legislation and recognised guidance relevant to the activity.
The objective isn't to fill the assessment with legal references.
It's to make sure the controls you identify actually meet the standards required to manage the risk.
And then review it
A risk assessment shouldn't be written, filed away and forgotten.
Workplaces change.
People change.
Equipment changes.
Activities change.
New hazards emerge and sometimes existing controls stop working as intended.
Risk assessments should therefore be reviewed when there is reason to believe they are no longer valid or following significant change.
They should be working documents, not paperwork produced purely to demonstrate compliance.
So, do you need a health and safety risk assessment?
Yes.
Whether you're running a large organisation, a small business or working for yourself, you need to think properly about the risks created by your work and how those risks will be controlled.
Whether you're legally required to write the significant findings down depends, amongst other things, on the number of people you employ.
But my advice is straightforward:
Write it down.
Keep it proportionate.
Make it specific to what you actually do.
Make sure it reflects the relevant legislation and guidance.
And, most importantly, make sure the controls identified in it actually happen.
Because a risk assessment shouldn't simply prove that you've completed a form.
It should help prevent somebody getting hurt.
And ultimately, that's what it's there for.
Comments