Posted on November 4th, 2024 | Last updated: 10th, June 2026 | Reading time: 7 minutes

Dr. Chizaram Dagogo Nwankwo | Chartered Ergonomist (C.ErgHF, CIEHF) | Published author in human factors and process safety | 10+ years across oil & gas, healthcare, and high-risk UK operations

Every UK employer with at least one member of staff is legally required to carry out a risk assessment. For small businesses, this is where health and safety compliance either starts properly or gets put off indefinitely. It's also where the HSE finds some of its most common enforcement gaps.

This guide covers what the law actually requires, how to carry out a risk assessment using the HSE's five-step framework, what makes an assessment legally adequate, and the mistakes that get small businesses into trouble.

Quick Answer
UK employers must carry out a risk assessment under Regulation 3 of the Management of Health and Safety at Work Regulations 1999. The HSE recommends five steps: identify hazards, decide who might be harmed and how, evaluate risks and decide on precautions, record your findings, then review and update. Businesses with five or more employees must record significant findings in writing.

What the law requires

Regulation 3 of the Management of Health and Safety at Work Regulations 1999 places a duty on every employer to carry out a "suitable and sufficient" risk assessment. Those three words carry legal weight.

Suitable means the assessment addresses the actual hazards in your specific workplace, not a generic set of hazards that could apply to any business. Sufficient means it goes far enough to identify the significant risks and the controls needed to address them. A two-page template downloaded from a generic website rarely meets either test.

If your business employs five or more people, you must record the significant findings in writing. That record needs to be accessible; it needs to name the hazards identified, who is at risk, and what controls are in place. An assessment buried in a folder nobody opens doesn't satisfy the duty.

The HSE is clear that the purpose of risk assessment isn't paperwork. It's understanding the real risks in your workplace well enough to control them. The documentation is evidence that you've done that thinking, not a substitute for it.

The HSE 5 steps to risk assessment

The five-step framework is set out in HSE guidance INDG163 and published in 1998. It's been the UK reference standard for nearly three decades because it works at any scale, from a 3-person bakery to a 500-person manufacturing site.

Step 1: Identify the hazards

Walk the workplace. Look at what could reasonably cause harm: machinery, chemicals, manual handling tasks, working at height, electrical equipment, the physical environment. Talk to workers; they tend to spot hazards that managers walk past daily without noticing.

Also look beyond the obvious. Non-routine tasks, maintenance activities, and cleaning often carry higher risk than day-to-day operations because they happen less frequently, workers are less practised at them, and the usual controls may not apply.

Hazard categories to check in any small business: physical (slips, trips, falls, manual handling, machinery), chemical (COSHH-regulated substances including cleaning products, dusts, fumes), biological (particularly relevant in healthcare, food preparation, and waste handling), ergonomic (display screen equipment, repetitive tasks, workstation layout), and psychosocial (workload, working hours, lone working, workplace conflict).

Step 2: Decide who might be harmed and how

For each hazard, identify who is realistically at risk and how that harm could occur. The who isn't just permanent employees: it includes part-time staff, contractors, visitors, members of the public, young workers, and pregnant workers, each of whom may face different levels of risk from the same hazard.

Being specific here matters. "Employees" is too vague. "Warehouse operatives carrying out manual handling tasks on the loading bay between 6am and 2pm" gives you something to work with.

Step 3: Evaluate the risks and decide on precautions

For each hazard, assess how likely harm is and how severe it would be. Then check what controls are already in place and whether they're sufficient. The HSE uses a hierarchy of control: eliminate the hazard if possible; if not, substitute it with something less dangerous; then use engineering controls; then administrative controls; and finally personal protective equipment as a last resort.

PPE is listed last because it's the weakest control. If your risk assessment concludes that PPE is the primary control for a significant hazard, that's usually a sign the hierarchy hasn't been properly applied.

Step 4: Record your findings and put them into practice

Write down what you found: the hazards, who's at risk, what controls are in place, and what further action is needed. For businesses with five or more employees, this is a legal requirement. For smaller businesses, it's still strongly advisable.

The record should be specific enough that someone unfamiliar with your workplace could read it and understand what the hazards are and what's been done about them. Then the controls need to actually be implemented; a risk assessment that identifies a hazard and takes no action is evidence of a known risk that was ignored.

Step 5: Review and update

A risk assessment isn't a fixed document. It should be reviewed when anything significant changes: new equipment or processes, changes to the workforce (new staff, young workers, pregnant workers), after any incident or near miss, and at minimum annually even if nothing appears to have changed.

Workplaces drift. Tasks change gradually. What was true when the assessment was written may no longer reflect how work is actually done. Regular review catches that drift before the HSE does.

What makes a risk assessment "suitable and sufficient"

Two types of assessment consistently fail the legal test.

The first is the generic template. Downloaded from the internet, filled in with tick boxes, never tailored to the specific workplace. HSE inspectors recognise these on sight. They're not suitable because they don't reflect your business.

The second is the outdated assessment. Written when the business launched, not reviewed since. The business has moved, grown, or changed its processes, but the assessment still describes the original premises. It's not sufficient because the risks it describes may no longer be the risks that actually exist.

A legally adequate assessment describes real hazards in your actual workplace, names the people at risk with enough specificity to be useful, records controls that are genuinely in place, and carries a review date that has been acted on.

Where small businesses most commonly get it wrong

The most common gap isn't failing to do a risk assessment at all. It's doing one that looks complete on paper but doesn't connect to how work actually happens.

Controls listed but not in use. Training recorded but not delivered. Procedures documented but not followed by anyone who works on the floor. This disconnect between the written assessment and the working reality is what post-incident investigations find most often. It's also the gap that the HFACS-OGI research into accident causation highlights consistently: the conditions enabling serious incidents are usually present in the documentation long before they manifest as an event.

An external Chartered advisor reviewing your assessments provides the independent check on this gap that internal review can't. The person who wrote the assessment and works in the building every day is rarely the best person to spot where the document has drifted from reality.

Frequently asked questions

Does a small business legally need a risk assessment?

Yes. The Management of Health and Safety at Work Regulations 1999 apply to every employer regardless of size. There is no exemption for businesses below a certain employee count. The level of detail required is proportionate to the level of risk; a small office has simpler requirements than a manufacturing site, but both are subject to the same legal duty.

How often should a risk assessment be reviewed?

At minimum annually, and whenever there's a significant change: new equipment, new processes, a change in workforce composition, an incident or near miss, or a change in legislation relevant to your activities. The HSE's position is that risk assessments should be living documents, not static paperwork.

Does a risk assessment need to cover COSHH?

Yes. If your workplace uses hazardous substances, a COSHH risk assessment is required under the Control of Substances Hazardous to Health Regulations 2002. This is a separate assessment to the general workplace risk assessment. Common substances in small businesses that trigger COSHH requirements include cleaning products, adhesives, dusts, and fumes from welding or painting.

Can a small business owner carry out their own risk assessment?

Yes, if they have the knowledge and understanding to identify the relevant hazards and assess the controls needed. The HSE's INDG163 guidance is written specifically for small businesses and is a practical starting point. For higher-risk activities, or where the business owner isn't confident about specific hazards, bringing in a Chartered advisor for at least the initial assessment makes sense.

What happens if a business doesn't have a risk assessment?

An employer without a documented risk assessment is already in breach of the law. The HSE can issue improvement notices, prohibition notices, or prosecute. Fines for health and safety offences in the UK are unlimited in the Crown Court. In serious cases, individuals can be imprisoned. In any workplace injury claim, the absence of a risk assessment substantially weakens the employer's legal position.

Book a risk assessment with Nancheez

If your business needs a risk assessment written from scratch or an existing one reviewed by a Chartered advisor, our risk assessment service is for UK SMBs that need legally sound documentation without a full-time safety hire.

Once the assessment is in place, regular workplace inspections are the mechanism that keeps it current.

Book a free 30-minute call. We'll tell you exactly what your business needs.

For common questions about H&S compliance, our FAQ page covers the most common queries we receive from UK SMBs.