What are the steps involved in a risk assessment?
There are five basic steps to a risk assessment, we want your assessment to be the very best it can be therefore we have added in extra considerations and detail.
A basic assessment comprises the following steps:
- Identify the hazards.
- Establish who might be harmed and how.
- Evaluate the risks and decide on precautions.
- Record findings and implement them.
- Review assessment and update if necessary.
What’s the difference between a risk and a hazard?
Often confused or thought to be the same thing – there is a difference between the two. Generally, when talking about health and safety, a Hazard is something with potential to cause harm, injury or illness. We often cite things in the workplace that have potential, such as fire, slips and trips, electricity, equipment and tools, hazardous substances, manual handling and working from height to name but a few. However, just because something has potential, it doesn’t necessarily mean that it will cause harm, that depends on many factors.
The Risk refers to the likelihood or chances of harm being caused by the hazard, so for example we talk about things or situations being high risk, low risk and everything in between. In other words how likely would it be that something could happen.
When we talk about risk we also throw a couple of other factors into the equation such as, how severe would the harm be? It could be something trivial like a paper cut or a bruise or more severe such as losing a limb, life changing injuries or even being killed! As you can imagine, there are all sorts of levels of severity when it comes to harm, injury or illness.
Also it is worth noting the fact that we tend to concentrate quite often on short term risks i.e. from accidents and incidents but don’t always consider long term health effects for example from exposure to hazardous substances or long term spinal damage from poor manual handling technique or poor ergonomics in the office environment.
Another factor to throw into the equation when considering risk, is to ask how many people would be harmed, perhaps one person or perhaps many and who would these people be? Could they be general staff and customers or could they be persons who would be more vulnerable to be being harmed such as persons with low immunity to infection, persons with learning difficulties, persons working on their own or perhaps young persons with less life experience and more likely to put themselves at risk than persons with more life experience, greater skills and knowledge.
A risk assessment is simply about identifying all relevant hazards in your workplace which have the potential to do harm then, as part of the same exercise you should consider what level of risk these hazards present. Thinking about who might be harmed, how many might be harmed and the severity of harm caused.
Once you’ve put this all together you can think which control measures can be implemented that will either remove the hazard or reduce the risk to a level which is reasonably practicable.
‘Suitable and sufficient’ risk assessments
It’s important that your risk assessments are relevant and specific so that they can do the job of reducing risk. Ensure that you consider the following when putting your risk assessments together:
- a thorough check was made and you consulted all resources available
- you asked and found out who might be affected by certain hazards and the subsequent risks
- you dealt with all the obvious significant risks
- you took into account the numbers of people you who could be affected
- the precautions are reasonable and the remaining risk is acceptably low
- you involved your workers or their representatives in the process
What to include in a risk assessment
The level of detail in a risk assessment should be proportionate to the risk and appropriate to the nature of the work. Insignificant risks can usually be ignored as can risks arising from routine activities associated with life in general (unless the work activity compounds or significantly alters those risks).
Your risk assessment should only include what you could reasonably be expected to know – you are not expected to anticipate unforeseeable risks.
1.Scope of a risk assessment
So, what can be risk assessed? Many things, however, generally the types of things that are risk assessed are:
- a person (normally only if especially vulnerable for example, a young person, an expectant mother, a person with a medical condition that makes them particularly vulnerable, a lone worker, temporary workers etc),
- an area,
- a task,
- a process,
- equipment, tools and machinery,
- an event or one-off activity
Some types of hazards require their own risk assessments such as fire risk assessments and some risk assessments are very specific, for example COSHH assessments, Display Screen Equipment (DSE) assessments and Manual Handling assessments.
It is important to define the scope of the risk assessment, in other words what is included and what isn’t, otherwise risk assessments become either vague or too generic and risk assessments should be as specific as possible.
In order to define the scope of the each risk assessment, make a purposeful effort to think about the limitations of each one. So for example when completing a risk assessment on an area, make a very clear distinction where the area starts and stops. You may decide to assess the ‘kitchen area’ and use the entrance as the limit of the area.
Or if you are assessing a task, be very specific about the task and try not to stray in other areas of the working day (unless they are affected by the task).
When you first consider this approach it can seem like the slow way of doing things but it will actually save you time in the long run. By clearly splitting up your risk assessments it means that you don’t have to re-assess the whole business too frequently. If a small area of your business changes, such as a work area or a person change, then you can re-assess that small part of your business independently.
This works particularly well in areas of your business which see frequent change such as events, staff changes or areas which undergo regular building change.
2. Identifying hazards in a risk assessment
In this step you need to think about what hazards are present. So firstly you will need to understand what is meant by the term ‘hazard`.
A ‘hazard` is something, a situation or set of circumstances with potential to cause harm, injury or illness. So for example ‘working at height` has potential to cause harm, however this does not necessarily mean that harm will occur, it just simply has potential. The same goes for slipping and tripping, hazardous substances, manual handling, electrical equipment, hot liquids, carbon monoxide, fire etc
Identifying the hazard is not always obvious, we could probably identify the ones above relatively easily as they are easy to see, but what about the things that are not so obvious or as easy to quantify, such as stress or health hazards which could build up over a long period such as exposure to high levels of noise and poor lighting.
There are lots of resources we can turn to when we need to identify what are the significant hazards, such as –
- Using knowledge and experience, this can be your own, but it is advisable to consult with employees that do the job every day because they can give you invaluable insights into where hazards and risks lie.
- Speak to maintenance teams and cleaning staff.
- Go and physically have a walk around and see the area or task or process for yourself, look at the who, what, why, where, when and make judgements yourself on what you see for yourself, remember every site will be different.
- Think about risks at different times such as at night and through the day or at the weekend.
- Could there be risks when the weather is different or at different times of the year.
- Read instructions or data sheets provided by manufacturers or suppliers.
- The HSE (Health and Safety Executive) is the organisation who effectively police health and safety in the UK, instigate prosecutions and collate information and statistics that helps to shape future health and safety policy, laws and regulations. Their website is full of great information on risk assessments.
- Industry bodies and associations who represent various types of industry for example British Hospitality Association, Nationwide Caterers Association, UK Hospitality, The British Retail Consortium can provide invaluable help and advice.
- Consulting with union representatives who will have much experience in your particular industry including access to valuable information, experience, resources, statistics etc.
- Consult the accident book and see if any previous accidents and subsequent investigations have been carried out in the past, look not just at accidents and incidents but also near misses, these resources will give you lots of clues.
- Consider other situations – such as problems with equipment, machinery, maintenance or cleaning.
Lastly, remember to not just concentrate on safety which is primarily concerned with accidents but also consider health. For example, having your hearing damaged and becoming deaf generally happens over a number of years and doesn’t normally happen as the result of a one-off incident but more likely by exposure to damaging levels of noise over a period of time.
3. Who could be harmed by the hazards?
So here you are looking at who could be harmed, this is obviously employees but can also be other parties such as:
- contractors working on site (they will also have to provide their own risk assessments),
- delivery staff – people delivering to you and your own delivery staff if applicable,
- visitors of any other description,
- vulnerable groups such as young people, inexperienced people, pregnant women, children, those with disabilities.
In terms of working out how people could be harmed your findings should be sensible, foreseeable and reasonably likely. Looking closely at the person, the task, equipment/tools used, the environment, levels of exposure, PPE requirements etc should give you a reasonable clue as to what could lead to an accident, incident or more chronic health problems.
One way to go about making this list is to think about who will interact with this task or area in a chronological order. For example if risk assessing a work area, such as a kitchen, then think about who uses the kitchen through the day.
Ask yourself questions about this timeline such as this:
- Who opens up?
- Who uses the kitchen during the first shift?
- What happens during the shift changeover?
- Will any contractors, suppliers or other visitors be using the kitchen?
- Who uses the kitchen during the second shift?
- Who closes the kitchen down?
- Does anybody have access to the kitchen while closed?
- Do cleaners or unsupervised people have access?
- Is there anything in the kitchen which could affect people in the nearby area at any point?
How could they be harmed by the hazards?
Once you’ve made your list of people who could possibly be harmed, you need to think about the possible ways in which they could be harmed. This is a little a more challenging and often takes a little bit of imagination and creative thinking to do.
Again, we find the best way to do this is to think in a chronological fashion. So as you’re thinking about the working day and identyfing people who could be harmed, jot down the main activities and actions which each of them undertake – this is usually a good starting point when trying to identify the ways in which people could be harmed.
This is a good place to involve your employees in the risk assessment process. Nobody knows the job better than the people who are doing it, so ask them what is involved and where they see the risks in their role, environment or task.
It’s useful to think about the different types of hazards which are currently faced in work to consider which ones are applicable to your risk assessment.
These common hazards include:
- Biological. Biological hazards include viruses, bacteria, insects, animals, etc., that can cause adverse health impacts. For example, mould, blood and other bodily fluids, harmful plants, sewage, dust and vermin.
- Chemical. Chemical hazards are hazardous substances that can cause harm. These hazards can result in both health and physical impacts, such as skin irritation, respiratory system irritation, blindness, corrosion and explosions.
- Physical. Physical hazards are environmental factors that can harm an employee without necessarily touching them, including heights, noise, radiation and pressure.
- Safety. These are hazards that create unsafe working conditions. For example, exposed wires or a damaged carpet might result in a tripping hazard. These are sometimes included under the category of physical hazards.
- Ergonomic. Ergonomic hazards are a result of physical factors that can result in musculoskeletal injuries. For example, a poor workstation setup in an office, poor posture and manual handling.
- Psychosocial. Psychosocial hazards include those that can have an adverse effect on an employee’s mental health or wellbeing. For example, sexual harassment, victimisation, stress and workplace violence.
Risk assessment control measures – which are best?
The next step is to decide on your control measures, but before you do let’s take a look at different types of controls. There are probably lots of ideas that immediately jump into your mind and we might write them down quickly in no particular order however, you should take your time and think carefully about this section.
Control measures are categorised into different types which can be displayed as a ‘The Hierarchy of Control`. The hierarchy prioritises different types of controls based on their effectiveness.
The first thing to notice that may be a surprise to many people is that the wearing of PPE is the last thing on the list after all other options have firstly been actioned or utilised.
Secondly, notice how the items at the top of the inverted pyramid are the most effective and as we work down the list then the controls become less and less effective So, let’s go through each item with a little explanation as to what we mean.
Elimination of the hazard
This is exactly what it says on the tin i.e. eliminate or remove the hazard so that it ceases to present a risk anymore.
Hazard associated with an employee who is moving heavy boxes from one side of the warehouse to another. This is a manual handling hazard with high risk of injury due to size and weight of the boxes.
We could move boxes using a fork lift truck meaning that the manual handling hazard has now been eliminated.
Hazard associated with a cleaner who is diluting a concentrated chemical substance from a 5 litre tub into a trigger bottle manually. There is a high risk of chemical inhury as the chemical is classified as corrosive in its concentrated form.
The chemical is non hazardous in its diluted form so a solution could be to purchase ready to use a product directly from manufacturer, hence the hazard has been eliminated.
Substitution of the hazard
This means substituting something for a less hazardous option.
Using the hazardous cleaning chemicals example again, if for example we had a hard surface cleaner, which is classified as a corrosive substance, a concern would be that the chemical could burn the skin or eyes or prove fatal if swallowed.
A solution could be to change it for an alternative product that is formulated using less hazardous substances and perhaps is classified as an irritant or non hazardous at all.
Using the manual handling example again, if a fork lift truck isn’t available then a solution may be split the loads into more manageable (lighter) boxes. This means that staff will still be munually moving the boxes but the risk of unjury is reduced because the loads are lighter.
Isolation of the hazard
Isolation involves separating the hazard in time or space from the person or persons at risk. This can be achieved by isolating the hazard through containment or enclosure. These methods aim to, basically, keep the hazard “in” and the worker “out” (or vice versa). If you isolate a hazard you place it where it is not possible for a person to be exposed to it. This can be done in many ways such as making the hazard out of reach, enclosing it or placing barriers between it and the people it might hurt.
Using remote control systems to operate machinery rather by hand.
Separating staff from exposure to damaging high levels of noise by using sound proofing or enabling the work to be done in another room.
An engineering control is a control measure that is physical in nature including a mechanical device or process. Engineering controls are strategies designed to protect workers from hazardous conditions by placing a barrier between the worker and the hazard or by removing a hazardous substance through air ventilation. Engineering controls involve a physical change to the workplace itself, rather than relying on workers behaviour or requiring workers to wear protective clothing.
Engineered controls can also be built into a system or process or equipment at the design stage
Using guards on machinery so that users cannot make contact with dangerous parts.
Effective ventilation systems to remove fumes/smoke/particles etc
Administrative controls include training, safe working procedures, providing information, or shift designs that lessen the risk of harm to workers or others. Administrative controls typically change the behaviour of people rather than removing the actual hazard. The problem with administrative controls is that they are heavily reliant on human behaviour, such as the ability to understand and follow instructions, and are therefore less reliable.
Problems with administrative controls can also be hard to define and fix. They can range from lack of training, lack of experience, lack of competency, lack of management commitment, lack of leadership, lack of safe systems, lack of supervision, lack of information, workload pressures, peer pressure, laziness, tiredness, corner cutting, complacency, horseplay, bravado etc, the list goes on and on.
PPE (Personal Protective Equipment)
PPE should only be used once all other options for control have been exhausted. The term personal protective equipment, or simply PPE, refers to a large group of products designed to protect workers from workplace hazards. PPE is used in environments in which hazards have not been sufficiently controlled by other means. A risk assessment should always be carried out before PPE is chosen and work commences.
Personal Protective Equipment is defined in the Regulations as ‘all equipment (including clothing affording protection against the weather) which is intended to be worn or held by a person at work and which protects him against one or more risks to his health or safety’ e.g. safety helmets, gloves, eye protection, high-visibility clothing, safety footwear and safety harnesses. The Regulations referred to here cover personal protective equipment. However, hearing protection and respiratory protection are covered by specific health and safety regulations.
Collective versus individual controls
Some controls will protect more people at once than others. You should always prioritise controls that will protect and minimise risk to several people before those that protect just a single person.
The above example regarding a guard rail can also be applied to this principle of collective control over individual controls. Using a guard rail protects everyone from falls from height at once whereas a harness would only protect the wearer of the harness (and anybody at ground level in the landing area).
Passive versus active controls
A passive control requires none or very little human intervention to function properly once installed, usually it has no active mechanisms or moving parts.
For example, if you have a mezzanine level there is a risk of falling from height. A passive control measure would be the use of guard rails because the rail will stop a fall with no integration from the person involved. Active Systems are the opposite, as you would suspect. So, an active control measure against falling from would be the use of a harness. The person at risk needs to effectively use the harness in order for it to provide a level of safety.
Active controls have more scope for things going wrong because they rely on human interaction. Passive controls should always be considered first, then active controls added in afterwards to lower risk further.
4,5 and 6. Deciding on your control measures
Now you’ve learned about the different types of controls, it’s time to decide which controls you will use to protect the people you’ve identified in your risk assessment.
The most effective control measures will differ from venue to venue, task to task and even potentially day-to-day. A lot of the time there isn’t necessarily a definitive right or wrong control to use, many different types could be used individually or at once. When thinking about your controls consider the following.
What have you already got in place?
You may not have really thought about it before but you will already have some controls in place so sit down and think about what you already do or have in place and list these controls. Think about where they sit in the Hierarchy of Control and how effective they are in lowering risk. Some of the controls may be working really well and should be kept, but perhaps some of them are not working too well and should be removed.
Keep it simple and adapt to the individual
Just like physical limitations, people have limits when it comes to their ability to take in or carry out information. Try to keep the controls as simple as possible to avoid confusion and human error.
It’s also important to adapt the control measures to the person it affects. Some control measures will be more effective when used by certain people. You can involve your staff in the process here to consult with them on which controls might be better utilised.
Once you have decided on the controls, you should ask yourself honestly “am I doing everything that I can and have I lowered the risk level to as low as is reasonably practicable?”
The term ‘reasonably practicable` means that time, energy, effort and money spent to lower the risk is reasonable in relation to the level of initial risk.
For example, if a risk was high and a person could be killed, seriously injured or could cause serious health issues….did you do enough to eliminate the hazard or reduce/control risk? What you do should be proportionate.
What is deemed proportionate can be somewhat subjective from an untrained or inexperienced person compiling a risk assessment, if in any doubt about this please contact Foursquare Group for advice.
7. Monitoring control measures
Without monitoring and checking your control measures are being implemented, the risk assessment exercise is being done justice and may not be effective.
You should ask yourself “how do I know this is actually happening” then put things into place that will ensure that they do.
Because you are using a Foursquare compliance diary, you have the perfect tool to monitor these actions. Many of the controls you identify in your risk assessment will be monitored and recorded in this diary on an ongoing basis throughout your daily, weekly and monthly checks but some may need to be recorded directly on your risk assessment documents at the front of this diary.
7. Reviewing your risk assessment
The review of your risk assessment should be a periodic occurrence, this should be written onto your risk assessment document with a date for when you intend to review. The time scales in regard to when the next periodic review will take place is dependent on levels of risk, higher risk situations would require more frequent reviews and very low risk situations may only require a review every 12 months.
Sometimes circumstances will call for a risk assessment review to take place earlier than this, for example:
- if an accident, incident or near miss occurs,
- if new work processes or procedures are introduced,
- if new equipment is introduced,
- if there are changes to the building or the work environment,
- if new substances are introduced,
- changes in legislation including changes to ACOPS (approved codes of practice) or industry best practice requirements,
- increased levels of personnel,
- casual or temporary workers are introduced
Documentation, whether it be a risk assessment or a method statement provides a certain level of due diligence defence for you, as an employer if something goes wrong.
It is a legal requirement for every business to carry out risk regular assessments. If you employ five or more people, then it is a legal requirement to write those risk assessment exercises down and record them. However even if you employ less than five, we strongly recommend that you have written risk assessments in place as it is difficult to prove due diligence without written documentation and it’s also difficult to share the findings of your risk assessments with your team (they need to know what risks are present too).
However, you must always remember that a risk assessment or a method statement has little value in itself if other important factors are not also taken into consideration, such as:
Information – how do you communicate important information relative to health and safety to your staff including the content of the risk assessment and any safe methodology or operating practices.
Instruction – simply telling someone how to do something is not always enough, sometimes you need to show them, demonstrate, get them to have a go, practice, gain experience over time etc
Training – don’t forget that simply telling someone something does not necessarily mean they have processed it properly. Generally, different people learn in different ways. Some people are very practical and respond better by physically doing something, whereas others learn by being told something and building a mental picture as to how they would complete a task for example. Some respond better to visual methods for example watching a video or e-learning and others process information by a mixture of these learning methods.
Supervision – unless people are managed or supervised then mistakes and errors can creep in very easily. Everyone should know and fully understand their role and remit.
Monitoring – it is critical that if health and safety in the workplace is to be successful, then monitoring activity needs to take place, making checks is an important part of your health and safety process, it shows that you are constantly managing and controlling risk. This diary forms a large part of your ongoing monitoring but you should also be checking control measures identified in risk assessments which are not part of this diary. For example, when running a short event or off-site event.