What makes a risk assessment "suitable and sufficient" under UK law?
Every UK employer has a duty under the Health and Safety at Work etc. Act 1974 to protect employees so far as reasonably practicable, and the Management of Health and Safety at Work Regulations 1999 (MHSWR) turns that into a specific requirement: a "suitable and sufficient" risk assessment of any activity that could cause harm. It must identify the hazard, evaluate who's exposed and how, and detail the control measures needed to protect those who could be harmed. The risk assessment must also be proportionate to the level of risk, with higher risk tasks needing a more in depth review.
When does a risk assessment have to be written down?
If you employ five or more people, the significant findings must be recorded in writing. Below that threshold there's no strict recording duty, though in practice most businesses record findings anyway, since an unrecorded assessment is difficult to demonstrate if something goes wrong. On construction sites, CDM 2015 and task-specific regulations like COSHH 2002 add further requirements on top of this, which is where general workplace risk assessments and site-specific risk assessments start to diverge.
What actually has to happen during the assessment?
Walking the site or workplace, consulting the people doing the work, and reviewing incident and near-miss records identifies the hazards. From there, risk is evaluated by who's exposed and how severely, and controls are chosen by working down the hierarchy of control, eliminating the hazard first where possible, then substitution, engineering controls, administrative controls, and PPE last. We see this hierarchy skipped over regularly on smaller fit-out projects across Surrey and Hampshire, where PPE gets reached for first because it's the quickest fix, not because it's the most effective one.
When does an assessment need reviewing?
Whenever circumstances change: new equipment, a different process, a near miss, or simply enough time passing that conditions on site have moved on from what the original assessment described. An assessment that hasn't been revisited since a project started is a common gap we flag on London and Surrey sites during inspections, particularly where the scope of works has shifted since the original risk assessments were issued.
What's commonly missed?
Mental health and workload-related risks are increasingly treated as a genuine assessable hazard under MHSWR, not just a wellbeing add-on, and employers who only assess physical hazards are leaving a real gap. Near misses being logged but never fed back into the assessment is another common pattern, along with assessments that technically exist but were never actually communicated to the people doing the work they cover.
Frequently asked questions
Do I need a risk assessment if I only have a few employees?
Yes. The legal duty to assess risk applies to every employer regardless of size. The formal recording requirement only kicks in at five or more employees, but the duty to assess exists either way.
Who can carry out a risk assessment?
Someone with sufficient competence, meaning the knowledge, training and experience to accurately identify hazards specific to that work. Many employers can assess routine risks themselves; specialist or high-risk activities usually warrant external support.
How is a risk assessment different from a method statement?
A risk assessment identifies hazards and evaluates risk. A method statement sets out the safe system of work for carrying out the task. On construction sites the two are typically combined into a single risk assessment and method statement (RAMS) document. You can find more information about method statements here.
PPT Health & Safety Consultants prepares risk assessments and full RAMS documentation for construction and fit-out clients across Surrey, Hampshire and London. If your current assessments aren't project specific or haven't been reviewed since the project scope changed, get in touch.
