A risk assessment is a record of a decision, not a form
It is the written record of you looking at a job, working out what could hurt somebody, and deciding what you are going to do about it. That is the whole of it. The grid, the numbers and the colours are a way of presenting that decision so somebody else can check it, and they are not the thing itself.
That matters because the commonest failure is not a badly scored assessment. It is a beautifully scored one about a job nobody actually looked at, which is what a downloaded template produces every time. An assessment that lists working at height, manual handling and slips for a job that involves none of them has recorded no decision at all.
The five steps, which are simpler than the paperwork suggests
- Identify the hazards. Walk the job. What could realistically hurt somebody here, as opposed to what appears on every template.
- Decide who might be harmed, and how. Not only your own people. The trades working near you, the delivery driver, the visitor, the public if you are anywhere near a boundary.
- Evaluate the risks and decide on controls. How likely, how bad, and what you will do to make it less likely.
- Record your significant findings. The hazards that matter and what you are doing about them, in a form somebody else can follow.
- Review it. When something changes, rather than on an anniversary.
Three scoring boxes, and the missing fourth is the point
Almost every assessment scores likelihood multiplied by severity, each from one to five, giving a number out of twenty five that gets banded into low, medium and high. What varies between a good form and a bad one is how many boxes there are.
A form with a severity after column is asking you to record something that cannot happen. Controls change how likely harm is. They do not change how badly somebody is hurt if it occurs anyway, and a form that lets you reduce severity invites exactly the fiction a reviewer is looking for: a fall from height quietly downgraded from fatal to minor because a harness appeared in the controls column.
So when you are looking at any template, count the boxes. Four is a tell.
Where the hazards come from decides whether it is any good
The hard part of an assessment is never the arithmetic, it is knowing what belongs on it. That is why a blank grid is close to useless: it asks the person with the least experience of writing these to supply the one thing experience provides.
A useful builder carries the hazards that genuinely recur, grouped the way a site is organised, with controls already written against each. Pick silica dust and the respiratory controls arrive with it. Pick excavation collapse and the support and inspection controls arrive with it. The work becomes reading and editing, which is a job somebody can actually do well, rather than recall, which is a job they cannot.
The same logic runs into the protective equipment: a list that fills itself from the hazards you picked is never short by accident, and a short PPE list is the second thing a reviewer notices after a generic hazard list.
Writing one now
The risk assessment builder on this site does everything described above: the hazard library, controls written against each hazard, the three scoring boxes, and a paginated PDF at the end with your own branding on it. It runs entirely in your browser, there is no account, and nothing you type reaches a server.
If a principal contractor has asked you for RAMS, you need a method statement alongside it, and the RAMS builder produces both as one document. If you are working outside Britain, the equivalent document has a different name and different required contents, which the four-market comparisonsets out.
Nobody checks the numbers, they check the hazards
The last thing worth knowing is what actually gets an assessment rejected, because it is almost never the scoring. It is a hazard list that could have been written without visiting the site, a persons-at-risk field naming only your own operatives, controls written as intentions rather than actions, and nobody named as having reviewed it.
All four are fixable in ten minutes and none of them is about the maths. If you spend your effort anywhere, spend it on the first step.
Common questions
Is a risk assessment the same as a method statement?
No, and they answer different questions. A risk assessment asks what could go wrong and what you are doing about it. A method statement describes how the work will actually be carried out, step by step, in order. Britain routinely bundles the two and calls the result RAMS, which is why people assume they are one document. They are not, and a principal contractor asking for RAMS is asking for both.
Who is legally required to have one?
Every employer, and every self-employed person whose work could affect other people. There is no size threshold on the duty to ASSESS. The threshold, five or more employees in Britain, is only about whether you have to write the significant findings down. In practice almost everybody writes one anyway, because a principal contractor will ask for it long before the law does.
What does "significant findings" actually mean?
The hazards that matter, who could be harmed, and what you are doing about them. It is deliberately not a transcript of your thinking: nobody wants a record of every risk you considered and dismissed. What it must contain is enough for somebody else to see that the real hazards were identified and that the controls are proportionate to them.
Does a risk assessment expire?
It has no expiry date and that surprises people. What ends its validity is a change rather than a birthday: new plant, a new substance, a different sequence of work, a near miss, an injury, or new people on the job. A yearly look is a sensible habit rather than a legal requirement, and a document reviewed on schedule every January on a job that changed in March is out of date with a recent date on it.
Can I download one that is already filled in?
Yes, and that is what the risk assessment builder on this site does. It carries a library of the hazards that actually recur on site, with controls already written against each one, so the work becomes editing rather than staring at an empty grid. It runs in your browser, produces a paginated PDF, and nothing you type is sent anywhere.
What is the difference between a hazard and a risk?
A hazard is the thing with the potential to cause harm: the open edge, the substance, the moving plant. A risk is how likely that harm is and how serious it would be. The distinction is not pedantry, because controls act on one and not the other, which is the whole reason the scoring on any decent assessment has one severity column rather than two.