What is a risk assessment? The 5 steps, the law and UK penalties explained
Liam Jones
Founder of Pilla
Date Modified
14 October 2026
Date modified: 14th October 2026 | This article has been written by Pilla Founder, Liam Jones, click to email Liam directly, he reads every email.
A risk assessment is the legal check every employer must make of what could hurt people at work. Here are the steps, what to write down, when to review, the law in each UK nation and what happens if you skip it.
Article Content
What is a risk assessment? In UK workplace law, it's the check every employer has to make of what in their work could hurt someone, how likely that harm is and how bad it would be, so they can decide what to do to prevent it. The duty sits in regulation 3 of the Management of Health and Safety at Work Regulations 1999 in Great Britain and in the Northern Ireland version from 2000, and it applies to every employer, whatever the number of staff.
Risk assessment at a glance
- Every employer must make a "suitable and sufficient assessment" of the risks to staff and to anyone else their work affects, such as customers and contractors.
- Only employers with five or more employees have to write the significant findings down. Everyone else still has to do the assessment.
- HSE's current method in Great Britain is identify, assess, control, record, review. Northern Ireland's HSENI still publishes the older "five steps".
- There's no fixed review date in the law. You review when something changes or the assessment may no longer be valid.
- Breaking the duty is a criminal offence, and three real cases further down show what it costs.
What is a risk assessment, and what isn't it?
HSENI's risk assessment guidance gives the two words people mix up: "A hazard can be anything that has the potential to cause harm. A risk is the chance, high or low, that somebody may be harmed by the hazard." A fryer full of hot oil is a hazard. The chance of a burn, and how serious it would be, is the risk.
HSE's overview of managing risks puts the legal minimum in three parts: identify what could cause injury or illness, decide how likely it is that someone could be harmed and how seriously, and "take action to eliminate the hazard, or if this isn't possible, control the risk".
The law's test is that the assessment is "suitable and sufficient". It doesn't ask for a particular form or a score. HSE's step-by-step guide also warns: "Do not rely purely on paperwork as your main priority should be to control the risks in practice."
A few things share the name but aren't the same duty:
| Term | What it is | How it connects |
|---|---|---|
| General risk assessment | The regulation 3 duty, covering all work risks to people | This page |
| Fire risk assessment | A separate duty on the "responsible person" for premises | See fire risk assessment |
| HACCP | Food safety hazard analysis to keep food safe to eat | Protects customers from unsafe food. Staff hazards sit in the general assessment. See what HACCP means |
| Specific assessments (COSHH, manual handling, noise, screens) | Detailed assessments other regulations require for one hazard | Covered in the decision table below |
The phrase is also used in finance, security and insurance. This page is about the workplace health and safety duty.
Why does the law require risk assessments?
The Health and Safety at Work etc. Act 1974 set general duties on employers to protect staff "so far as is reasonably practicable". The general duty to assess every work risk arrived later, in the Management of Health and Safety at Work Regulations 1992, which came into force on 1 January 1993. Its European roots still show: Schedule 1 to today's Regulations lists "the general principles of prevention set out in Article 6(2) of Council Directive 89/391/EEC".
The 1999 Regulations replaced them, revoking the 1992 Regulations and their 1994 amendments, and came into force on 29 December 1999. Northern Ireland followed with the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, in operation from 1 February 2001. They revoked the NI 1992 Regulations and the Health and Safety (Young Persons) Regulations (Northern Ireland) 1997.
Fire was split off later. On 1 October 2006, words in regulation 3(1) were revoked by the Regulatory Reform (Fire Safety) Order 2005 in England and Wales and by an order under the Fire (Scotland) Act 2005 in Scotland, as fire risk assessment moved under those laws.
Which risk assessment law applies in each UK nation?
| Nation | General risk assessment duty | In force | Fire risk assessment (in force) |
|---|---|---|---|
| England | MHSWR 1999, regulation 3 | 29 December 1999 | Regulatory Reform (Fire Safety) Order 2005, article 9, from 1 October 2006 |
| Wales | MHSWR 1999, regulation 3 | 29 December 1999 | Regulatory Reform (Fire Safety) Order 2005, article 9, from 1 October 2006 |
| Scotland | MHSWR 1999, regulation 3 | 29 December 1999 | Fire (Scotland) Act 2005, section 53, with the Fire Safety (Scotland) Regulations 2006 from 1 October 2006 |
| Northern Ireland | MHSW (NI) Regulations 2000, regulation 3 | 1 February 2001 | Fire and Rescue Services (NI) Order 2006, article 25, with the Fire Safety Regulations (NI) 2010 from 15 November 2010 |
The 1999 Regulations extend to England, Wales and Scotland. The NI regulation 3 duty on employers uses the same words as the GB text, including the five-employee recording rule. The self-employed wording differs, as the next section explains.
Civil claims work differently in the two jurisdictions. In Great Britain, section 69 of the Enterprise and Regulatory Reform Act 2013 amended the 1974 Act so that, from 1 October 2013, breach of health and safety regulations "shall not be actionable" in a civil claim unless regulations say so. But in Northern Ireland, regulation 22 of the 2000 Regulations only blocks claims "in so far as that duty applies for the protection of persons not in his employment", so an injured employee there can still sue for breach of the risk assessment duty itself.
Who has to do a risk assessment, and who can carry it out?
Regulation 3(1) puts the duty on "every employer", covering:
- "the risks to the health and safety of his employees to which they are exposed whilst they are at work"
- "the risks to the health and safety of persons not in his employment arising out of or in connection with the conduct by him of his undertaking"
The second line is why customers, delivery drivers and contractors belong in your assessment.
Self-employed people are covered differently in each part of the UK. In Great Britain, regulation 3(2) has applied only to a "relevant self-employed person" since 1 October 2015. HSE's guide for the self-employed says the law applies if "you employ anyone", if your work "poses a potential risk to the health and safety of others", or if you do one of six listed high-risk activities, such as construction or work with gas. In Northern Ireland, regulation 3(2) still says "Every self-employed person".
You can do the assessment yourself. HSE says "You can do it yourself or appoint a competent person to help you", and regulation 7 requires an employer to appoint "one or more competent persons" to help them comply. HSE also says to "Involve your employees as they will usually have good ideas."
The five steps of a risk assessment
Search "5 steps to risk assessment" and you'll find two different lists. HSE in Great Britain now uses one set of steps on its web guide, and its old INDG163 leaflet address (hse.gov.uk/pubns/indg163.pdf) redirects to that guide. HSENI's Five steps to risk assessment leaflet, dated 16 March 2017, still uses the older list.
| Step | HSE, Great Britain (current web guide) | HSENI, Northern Ireland (2017 leaflet) | What it means in a kitchen |
|---|---|---|---|
| 1 | Identify hazards | Identify hazards and those at risk | Walk the kitchen, stores and front of house. Check the accident book |
| 2 | Assess the risks | Decide who might be harmed and how | Chefs near fryers, porters lifting stock, a pregnant server, customers on a wet floor |
| 3 | Control the risks | Evaluate the risks and decide on precautions | Remove the hazard if you can, otherwise reduce it |
| 4 | Record your findings | Record your findings and implement them | Write down hazards, who's at risk and controls if you have 5+ employees |
| 5 | Review the controls | Review your risk assessment and update if necessary | After a near miss, a new machine, a new starter or a menu change |
Both lists cover the same legal duty. The GB version separates "assess" from "control", and HSE's assessment step asks you to decide "what further action you need to take", "who needs to carry out the action" and "when the action is needed by".
How to choose controls
HSE's control step asks "can I get rid of the hazard altogether?" and then lists options in order: redesigning the job, replacing materials, machinery or process, organising work to reduce exposure, practical measures to work safely, and personal protective equipment. That order echoes the legal list in Schedule 1 to the 1999 Regulations, which starts with "avoiding risks" and "combating the risks at source", and includes "replacing the dangerous by the non-dangerous or the less dangerous". Regulation 4 requires you to follow those principles.
But you aren't expected to remove every risk. HSE says "You're not expected to eliminate all risks but you need to do everything 'reasonably practicable'", which means "balancing the level of risk against the measures needed to control the real risk in terms of money, time or trouble."
How do you rate a risk? The likelihood and severity grid
Most templates online score risks on a grid. HSE asks you to decide "how likely it is that someone could be harmed and how seriously", but we found no legal requirement to use a numbered matrix. A simple grid is one way to show your thinking:
| Likelihood ↓ / Severity → | Minor (first aid, a small cut) | Serious (burn needing treatment, time off) | Major (fracture, amputation, death) |
|---|---|---|---|
| Likely (happens most weeks) | Medium | High | High |
| Possible (has happened here or nearby) | Low | Medium | High |
| Unlikely (hard to see it happening) | Low | Low | Medium |
The grid is a sorting tool. A "low" rating doesn't excuse a cheap, obvious control. In this example grid, "high" means act before the next shift.
Worked example: a café risk assessment
HSE's example risk assessment for food preparation, cooking and service (published 11/19) is written for "restaurants, cafés, sandwich bars, pubs, takeaways or hotel kitchens". Its café has five permanent staff, a young person under 16 who helps on Saturdays, and one staff member who doesn't speak English well. The manager walked the kitchen and stockroom, talked to staff and checked the accident book.
| Hazard in HSE's example | One control HSE's example lists | One action HSE's example adds |
|---|---|---|
| Slips and trips | Spillages cleaned up immediately and the floor left dry | Repair damaged floor tiles by the dishwasher |
| Manual handling | Heavy stock stored on shelves at waist height | Team working for moving heavier items such as pots |
| Steam, hot water, hot oil and hot surfaces | Staff trained on emptying and cleaning fryers | Display "hot water" and "hot surface" signs |
| Knives | Knives suitably stored when not in use | Tell staff not to use knives to remove packaging, and provide cutters |
| Food handling and cleaning chemicals | Dishwasher used instead of washing up by hand | Remind staff to check for dry, red or itchy skin and tell the manager |
| Gas appliances | Daily check of gas appliance controls | Gas Safe registered engineer to fit a flame failure device on the oven |
| Electrical equipment | RCDs on supplies to hand-held and portable appliances | Get an electrician to advise how often equipment should be inspected and tested |
| Machinery | All dangerous parts suitably guarded, with daily guard checks | Remind staff to isolate machinery before maintenance or cleaning |
HSE's example ends: "Do not just copy this example and put your company name to it as that would not satisfy the law and would not protect your employees." Afterwards the manager told the young person's parents about the findings, explained the arrangements to the worker in a language she understood and made the assessment part of induction. For ready-made versions built around kitchens and restaurants, see the kitchen risk assessment and restaurant risk assessment templates.
Generic, specific and dynamic risk assessments
The law asks for one thing: a "suitable and sufficient" assessment. Generic, specific and dynamic are labels employers and councils use for how they get there. They aren't three legal duties.
- Generic. One assessment for a task that's done the same way in many places, such as opening up or a deep clean. Warwickshire County Council's risk assessment guide treats a generic assessment as "a model, for guidance only" that the assessor must adapt to "actual work situations and local circumstances". HSE says the same about its example risk assessments: "Do not just copy an example and put your company name to it".
- Specific. Written for one task, place or person, where the hazards "are only applicable to that particular activity/process or circumstance" (Warwickshire). In a restaurant that means a new piece of kit, an outside event, a pregnant chef or a 16-year-old's first shift.
- Dynamic. The judgement made on the spot when things change: a flood in the kitchen, a fight at the door, the walk-in breaking down mid-service. Warwickshire calls it "a continuous process of identifying the hazards during that activity". The Sports Grounds Safety Authority uses the same idea for conditions that change after the plan is written. A dynamic assessment sits on top of your written one. It doesn't replace it. Noting what you did afterwards is good practice, and it feeds the next review.
Which extra risk assessments do you need? A decision table
The general assessment often shows that another set of regulations applies. Each one has its own assessment duty:
| If your work involves... | Assessment required by | Northern Ireland equivalent | Pilla page |
|---|---|---|---|
| Cleaning chemicals, flour dust, fumes | COSHH 2002, regulation 6 | COSHH (NI) Regulations 2003, regulation 6 | COSHH risk assessment |
| Lifting stock, kegs, pots | Manual Handling Operations Regulations 1992, regulation 4 | Manual Handling Operations Regulations (NI) 1992, regulation 4 | Manual handling risk assessment |
| Staff working at screens daily | Display Screen Equipment Regulations 1992, regulation 2 | DSE Regulations (NI) 1992, regulation 4 | DSE workstation assessment |
| Loud music, extraction, glass crushers | Control of Noise at Work Regulations 2005, regulation 5 | Control of Noise at Work Regulations (NI) 2006, regulation 5 | Noise risk assessment |
| Employing anyone under 18 | MHSWR 1999, regulation 3(4) and (5) | MHSW (NI) 2000, regulation 3 | See the next section |
| Women of child-bearing age | MHSWR 1999, regulation 16 | MHSW (NI) 2000, regulation 16 | See the next section |
| Running the premises | The fire law for your nation, in the table above | Fire and Rescue Services (NI) Order 2006 | Fire risk assessment, linked above |
| Work-related stress | MHSWR 1999, regulation 3 | MHSW (NI) 2000, regulation 3 | Stress risk assessment |
Young workers and new or expectant mothers
Under-18s
Regulation 3(4) says an employer "shall not employ a young person unless he has, in relation to risks to the health and safety of young persons, made or reviewed an assessment". Regulation 3(5) lists what that assessment must take "particular account of", starting with "the inexperience, lack of awareness of risks and immaturity of young persons" and including "the form, range, and use of work equipment". For a child, meaning under school-leaving age, regulation 10(2) requires you to give a parent "comprehensible and relevant information" on the risks and controls before they start. Regulation 19 then limits the work a young person can do, with an exception for training under competent supervision.
New and expectant mothers
Regulation 16 says that where your staff "include women of child-bearing age" and the work could involve risk to a new or expectant mother or her baby, "the assessment required by regulation 3(1) shall also include an assessment of such risk". If the risk can't be avoided, you must alter her working conditions or hours. If that isn't reasonable, or wouldn't avoid the risk, you must suspend her "subject to section 67 of the 1996 Act". In Great Britain the Employment Rights Act 1996 says an employee suspended on maternity grounds "is entitled to be paid remuneration by her employer while she is so suspended". In Northern Ireland the Employment Rights (Northern Ireland) Order 1996 is the equivalent.
The individual duties start when she tells you. Regulation 18 says you don't have to act under regulation 16(2) or (3) "until she has notified the employer in writing". HSE's guidance on pregnant workers says you must also "carry out an individual risk assessment" once you've been told in writing that she is pregnant, breastfeeding or has given birth in the last six months.
Dismissal law for pregnant workers is also changing. Section 26 of the Employment Rights Act 2025, in force from 6 January 2026, amends the 1996 Act so the Secretary of State can make regulations on dismissal during or after pregnancy in Great Britain. The government's factsheet on enhanced dismissal protections gives the expected commencement as "2027". We found no regulations made under section 26 as of 14 October 2026, and we found no matching change announced for Northern Ireland.
What must you write down?
| Record | Who must keep it | Law |
|---|---|---|
| The significant findings of the assessment | Employers with five or more employees | Regulation 3(6)(a) |
| Any group of employees identified as "especially at risk" | Employers with five or more employees | Regulation 3(6)(b) |
| Arrangements for "planning, organisation, control, monitoring and review" of preventive measures | Employers with five or more employees | Regulation 5(2) |
| A written health and safety policy | Employers with five or more employees | Section 2(3) of the 1974 Act in Great Britain, and the matching article of the 1978 NI Order |
HSE's health and safety policy guidance says that with fewer than five employees "you do not have to write anything down, but it is useful to do so". HSE's risk assessment pages offer a free template with columns for who might be harmed, existing controls, further action, who and by when. We found no retention period for risk assessment records in the 1999 Regulations. Keeping old versions shows how your controls changed if an incident is investigated later.
How often should a risk assessment be reviewed?
Regulation 3(3) sets no interval. It says the assessment "shall be reviewed" if "there is reason to suspect that it is no longer valid" or "there has been a significant change in the matters to which it relates", and you must make the changes the review shows are needed. HSE adds triggers such as changes to "staff", "a process" or "the substances or equipment used", and says to consider a review if workers have spotted problems or "there have been any accidents or near misses".
Some providers recommend a fixed cycle. Citation's guide says "Ideally, this should be done at least once a year." That's a sensible diary habit, and it's Citation's own advice. The law works on triggers instead. A kitchen that adds a pizza oven in March can't wait for an annual review in December. It reviews in March.
Enforcement, penalties and real cases
Who enforces
In most restaurants, cafés, pubs and shops in Great Britain the council's environmental health team enforces health and safety (see what an environmental health officer does). In food factories it's HSE. In Northern Ireland, catering premises fall to the district council. Inspectors can serve an improvement notice giving a deadline to put things right, or a prohibition notice that stops an activity straight away.
Penalties in each nation
Breaching regulation 3 is an offence under section 33(1)(c) of the 1974 Act, triable either way, with maximum penalties in Schedule 3A:
| Nation | Summary (magistrates' or sheriff court) | On indictment |
|---|---|---|
| England and Wales | Up to 12 months' imprisonment, or an unlimited fine, or both. Schedule 3A says "the general limit in a magistrates' court", which is 12 months for an either-way offence under section 224(1A) of the Sentencing Act 2020, as amended from 18 November 2024 | Up to two years' imprisonment, or a fine, or both |
| Scotland | Up to 12 months' imprisonment, or a fine up to £20,000, or both | Up to two years' imprisonment, or a fine, or both |
| Northern Ireland | Under Schedule 3A to the Health and Safety at Work (NI) Order 1978: up to 6 months' imprisonment, or a fine up to £20,000, or both | Up to two years' imprisonment, or a fine, or both |
Prison applies to individuals. Under section 37, a director or manager whose "consent or connivance" or "neglect" led to the company's offence is guilty too. The Sentencing Council's guideline for organisations breaching health and safety regulations applies in England and Wales only, with an offence range of "£50 fine – £10 million fine" read against turnover. In Scotland and Northern Ireland we found no sentencing guideline for health and safety breaches.
Because the offence is triable either way, the six-month limit for summary prosecutions doesn't apply in any nation. Section 127(2) of the Magistrates' Courts Act 1980 disapplies it in England and Wales, in Northern Ireland article 19(1)(a) and (b) of the Magistrates' Courts (NI) Order 1981 applies the six-month limit only to summary offences that aren't "also triable upon indictment" and says an indictable offence "may be made to a justice of the peace and dealt with at any time", and in Scotland section 136 of the Criminal Procedure (Scotland) Act 1995 only covers offences "triable only summarily".
Three real cases
- A 16-year-old's first day at a pet food factory (2023). Food Manufacture (trade press, 20 October 2023) reported that a new starter at a Finer By Nature factory in Hereford had his middle finger sliced off on 15 July 2020. He had been told to stand on a ladder and put his hand into a dog food packaging machine to scrape the base, "despite the presence of dangerous moving parts". The firm pleaded guilty to breaching regulations 3(1) and 3(4) of the 1999 Regulations and regulation 11(1) of PUWER, and was fined £34,000 plus £4,564.15 costs. Director Gary Pitchford pleaded guilty under section 37 of the Health and Safety at Work etc. Act 1974 and got a six-month prison sentence, suspended for 12 months, at Kidderminster Magistrates' Court.
- A risk assessment that missed a known risk (2026). HSE's release on Syngenta Ltd says its "risk assessment documents in place failed to appreciate the increased risk involved in relying on a single method of isolation when there was known corrosion". A contractor escaped a high-pressure steam release on 6 November 2023. The company pleaded guilty to regulation 3(1) and a PUWER maintenance breach, and was fined £400,000 with £8,288 costs at Leeds Magistrates' Court on 28 January 2026.
- A restaurant's indoor charcoal grill (2026). Cornwall Council's release on The Pickled Plate Ltd says the Padstow restaurant used a grill indoors "without undertaking a suitable and sufficient assessment of the risks it created", for staff and for "persons other than employees", then ignored an improvement notice and a prohibition notice. It pleaded guilty to five offences under the 1974 Act and COSHH at Exeter Magistrates' Court on 18 June 2026 and was fined £8,000, with a £2,000 victim surcharge and £4,000 costs.
For scale, HSE's key figures for Great Britain count 126 workers killed in work-related accidents in 2025/26 and 59,219 injuries to employees reported under RIDDOR. See accident reporting for what has to be reported.
Myths and facts
| What people say | What the law says |
|---|---|
| "Any business with five or more employees is legally required to carry out and record risk assessments." (Citation guide) | Five or more is the threshold for recording. Carrying out the assessment applies to every employer under regulation 3(1). |
| "Legally a risk assessment should be done every trimester." (BabyCentre forum, 2025) | Regulation 3(3) sets triggers, not a schedule. Review when her condition or the job changes enough that the assessment may no longer be valid. |
| "We've always done it this way" (a software vendor's post on X, 2026, quoting the excuse) | Habit isn't an assessment. Syngenta's maintenance in the case above was routine, and its assessment still missed the risk. |
| We downloaded a template, so we're covered | HSE: copying an example "would not satisfy the law". |
How to check your risk assessment is doing its job
- It covers staff and non-employees: customers, contractors, delivery drivers
- It names who's especially at risk: under-18s, new or expectant mothers, staff with limited English
- Each hazard has an owner and a date for any further action
- The controls on paper match what you'd see on a walk round today
- Staff have been told the findings (regulation 10 requires "comprehensible and relevant information")
- It was reviewed after the last change, accident or near miss
- Specific assessments (fire, COSHH, manual handling) exist where the decision table says they should
- With five or more employees: findings, at-risk groups and arrangements are written down
Spot-checks between reviews help. A hazard spot check is one way to catch drift.
What has changed recently, and what's next?
legislation.gov.uk shows "no known outstanding effects" for both the 1999 Regulations and the NI 2000 Regulations as of 14 October 2026. We found no announced change to the general risk assessment duty in any UK nation. The change to watch is employment law: enhanced dismissal protection for pregnant women and new mothers under the Employment Rights Act 2025 is expected in 2027, as set out above. The rest of that Act's timetable, such as the unfair dismissal qualifying period, doesn't change any risk assessment duty.
If you'd rather keep assessments, reviews and actions in one place with reminders, Pilla's risk assessment templates do that.
Related pages
For customer-facing risks, see the violence risk assessment template.
Frequently asked questions
Does a sole trader need a risk assessment?
In Great Britain, only if health and safety law applies to your work. HSE says it does if you employ anyone, if your work could put others at risk, or if you do one of the six listed high-risk activities. A self-employed caterer cooking for the public is likely to create risks to others, so the duty is likely to apply. In Northern Ireland, regulation 3(2) applies to every self-employed person.
Who should sign a risk assessment?
The law doesn't require a signature. HSE's food preparation example records who carried out the assessment and the date, which makes it clear who did it and when it's due for review.
Can a risk assessment be done digitally?
Yes. The 1999 Regulations require you to "record" the findings and don't specify paper. What matters is that staff can see the findings and an inspector can see the current version.