Risk Assessment

Risk Assessment
Contents
Introduction to Risk Assessment
What is Risk Assessment?

Definitions
Hazard
Harm
Risk
Control Measure

Suitable and Sufficient Risk Assessment

Competent Risk Assessors

Sources of Information

Risk Assessment - Five Steps

1. Identify Hazards
2. Identify People at Risk
3. Evaluate Risk and Decide on Precautions Common Hazards and Controls
4. Record Significant Findings
5. Review and Update

Summary

© RRC Training

All rights reserved.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form, or by
any means, electronic, electrostatic, mechanical, photocopied or otherwise, without the express permission in
writing from RRC Training.

© RRC Traiining
 Risk Assessment
Introduction to Risk Assessment
What is Risk Assessment?
Risk assessment sounds complicated but you
do it every day. Much of the time, you do it
automatically, such as when you cross a familiar
road or drive your car to work. If you are not very
good at this process then you will not live long.

There are occasions in normal life, however,

when you might assess risks in a more deliberate,
conscious way. For example, if you look after very
young children you will think about the things in
your home that present particular risks to a child,
seeking to make the home safe for them. If you
take part in activities such as rock climbing or scuba
diving, you will recognise a similar process.

Risk Assessment at Work

A workplace risk assessment is simply an extension
of this self-preservation mechanism. The UK HSE
describe risk assessment as:

“a careful examination of what, in your work,

could cause harm to people, so that you can
weigh up whether you have taken enough
precautions or should do more to prevent
harm.”
The aim of a workplace risk assessment is simply to
create a safe place of work through the prevention
of accidents and ill-health.

© RRC Training
 Risk Assessment
Definitions Harm
Harm is caused by an uncontrolled hazard. It can
The following terminology is crucial in
come in the form of death or injury to people but
understanding risk assessment.
the term also includes damage/loss to property
such as equipment or buildings. Clearly, the severity
Hazard of harm can range from the minor to the very
A hazard is something (an object, activity or serious (as we shall see later).
situation) with the potential to cause harm.

The key word in this definition is potential – the

Risk
hazard may always exist but the potential for that Risk is the likelihood that a hazard will cause a
hazard to cause harm may never materialise. There specific harm. The degree of risk can be judged
are numerous hazards which you encounter every based on the likelihood of harm occurring in
day which are well controlled and so do not cause combination with the severity of the injury, damage
harm, a problem only arises where there is an or loss that might occur.
absence of control.
Risk can be described qualitatively using words
such as “high”, “medium” or “low”. This qualitative
Example description can be very subjective, but is quite
adequate for simple risks.
If an office worker receives an electric shock
from an item of electrical equipment that has Risk can also be defined quantitatively using
a damaged flex, then electricity is the hazard, probabilities and/or frequencies that have been
not the damaged flex. It is the electricity that derived from hard data (such as machinery
causes harm; the damaged flex is a failure in component failure rates). This type of quantified
the controls or preventive measures. If the flex risk assessment is far more rigorous and is used
were not damaged then the hazard would still for complex risks in high hazard industries (such as
be present (electricity is still running through nuclear and chemical).
the equipment) but it would be properly
controlled and the electric shock would not There are also a range of methodologies which fall
occur. in between those two extremes. These tend to
use scoring or rating systems to describe the risk.
We will stick to the simpler methods in this short
There are two major hazard categories:
course.
• Safety hazards – capable of causing immediate
physical injury. These are commonly broken Control Measure
down into sub-categories such as: A control measure, as the name suggests, is
–– Slips, trips and falls. something which prevents or reduces risk, in other
words, precautions. We’ll consider different types
–– Electricity.
of control measures, and the hazards they are best
–– Fire. suited to, later.
• Health hazards – can cause occupational
disease or ill-health conditions. These are often
broken down into sub-categories such as:

–– Physical, e.g. vibration, noise, etc.

–– Chemical, e.g. lead, sulphuric acid, cement
dust, etc.
–– Biological, e.g. hepatitis B virus (HBV),
legionella bacteria, etc.
–– Ergonomic, e.g. repetitive movement, manual
handling, etc.
–– Psychological, e.g. stress and trauma.

© RRC Training
 Risk Assessment
Suitable and Sufficient Competent Risk Assessors
Risk Assessment To ensure a risk assessment is suitable and
sufficient, it is important to have competent
In order to be considered good, a risk assessment persons to oversee the process.
must be “suitable and sufficient”. It should prevent These risk assessors should have good knowledge
any reasonably foreseeable, significant injuries and of general occupational health and safety and
ill-health from happening. In particular it should: may also require specialist knowledge and training
• Identify the significant risks arising out of work; relating to specific work activities and hazards,
i.e. those which are most likely to occur and depending on the workplace and work activities
result in harm being caused, with any remaining concerned.
risks being at an acceptable, low level.

• Enable the employer to identify and prioritise

Sources of Information
the measures that must be taken to protect There are various sources which can provide useful
people from harm; including complying with information when completing a risk assessment,
any relevant local legal provisions. these are usually divided into:
• Consider all people potentially at risk, including • Internal sources - available from within the
visitors and contractors. organisation:
• Seek specialist advice; an expert opinion or –– Health and safety policy.
assessment may be required (particularly
–– Risk assessment records.
important where hazards present risk of serious
harm, e.g. hazardous chemicals). –– Records of accidents/incidents/sickness.
–– Training records.
• Be appropriate to the nature of the work and –– Health and safety representatives.
remain valid for a reasonable period of time -
it should be proportionate to the risks in the • External sources - available from publications
workplace. and organisations, e.g.:

–– A low risk workplace with a few –– Local legislation and guidance.

straightforward, often predictable, hazards –– Websites/publications.
(e.g. a retail shop) requires a relatively simple –– Trade associations and trade unions.
risk assessment carried out by a competent –– Manufacturers guidance.
person (perhaps the manager) with reference
–– Accident and incident data.
to some basic guidance documents.
–– A high risk workplace (e.g. a chemical works)
requires a more complex risk assessment,
carried out by competent persons (industrial
chemists, etc.), using detailed reference
material.

© RRC Training
 Risk Assessment
Risk Assessment - Five Steps
The aim of a risk assessment is to ensure that a place
of work is safe.

This is achieved by systematically identifying the

hazards which exist, considering the potential harm
they could cause and assessing the risk presented by
the hazard and the precautions required to control
this risk. Once the initial assessment has taken
place, all required actions should be recorded and
implemented. They should then be reviewed at
regular intervals to ensure no further hazards have
arisen and that existing controls remain sufficient.

This sounds very complex, but the process can be

broken down in to five simple steps. Once you
understand what is required at each step it is easy to
complete a full risk assessment of a workplace.

Five Steps to Risk Assessment

1. Identify the hazards
2. Identify the people who might be harmed and how
3. Evaluate the risk and decide on precautions
4. Record the significant findings
5. Review and update as necessary

© RRC Training
 Risk Assessment
1. Identify the Hazards
The first step in the risk assessment process is to
identify all significant hazards associated with the
work and the area.

Remember, hazards are things with the potential

to cause harm. It is important to identify both the
safety hazards that might give rise to immediate
physical injury and the health hazards that might
cause disease or ill-health.

Hazard Identification Methods

There are various methods that might be used to
identify hazards in a workplace as part of a risk
assessment process:

• Workplace inspection – this often makes use

of checklists of commonly encountered hazards
as a prompt.

• Task analysis – this involves breaking a job

down into component steps and identifying
the hazards associated with each step. This can
even be done for planned jobs, so that potential
hazards can be identified and eliminated before
work starts. It is commonly used for developing
safe methods of working.
• Manufacturers’ information – when a new
item of plant, machinery or equipment is
SREDIM purchased it usually comes with an instruction
There is a useful mnemonic for the steps of book that contains information about all the
task analysis – SREDIM: related hazards and instructions for safe use,
cleaning and maintenance. Similarly, when a
–– Select task. new substance is purchased it comes with labels
–– Record steps or stages of the task. and a Safety Data Sheet that clearly identify the
–– Evaluate risks associated with each step. hazards of the substance.
–– Develop safe working method. • Accident/incident data – analysing the
–– Implement safe working method. causes of past accidents may help you identify
–– Monitor to ensure it is effective. potential causes of future accidents. The
main limitation here is that a very significant
hazard may not have caused harm in the
• Legislation and guidance – some legislation
organisation to date, and may therefore go
addresses specific risks. As a result, it can flag
unnoticed. External data, such as national
up particular issues (or requirements) that you
statistics published by the authorities can be
might not otherwise have thought about. For
more useful; they can identify a wider range
example, knowledge of the law relating to work
of potential hazards and risks because they are
at height will allow a competent assessor to
based on a much larger sample size.
identify what work might fall within its scope.
Legislation is often accompanied by guidance Once all hazards have been identified we can assess
documents. For example, in the UK, guidance who is at risk and consider whether any controls in
documents exist to spell out all the hazards place are sufficient to protect them.
that exist in engineering workshops. The HSE
website and Infoline are also useful tools.

© RRC Training
 Risk Assessment
2. Identify People at Risk Members of the Public
When identifying people at risk, it’s important to Members of the public could be affected by certain
consider both the people carrying out activities types of hazard simply by being near to a workplace
AND the people who may be affected by those where hazardous activities take place. For example,
activities. a release of toxic chlorine gas from an industrial site
will affect passers-by and those who live near the
Employees site.

Employees may be directly involved with the In some instances, trespassers (uninvited visitors)
activity, working nearby or passing by. Some hazards may get on to the site. This is of particular concern
create risk mostly for the employee carrying out with regard to the possibility of children coming
the work (e.g. a worker up a ladder is at risk from onto the premises (e.g. playing on building sites or
falling) whilst others create general risk for all near railway lines).
employees (e.g. a busy vehicle traffic route that all
employees cross to reach a staff car park). Special Cases
In certain instances, identifying general groups
Maintenance Staff
of people who might be harmed by hazards is
Maintenance staff are often involved in the removal inadequate and a more specific focus has to be
of the usual safeguards present in the workplace applied to a particular person or type of person
because of the nature of maintenance work (e.g. who is more vulnerable for one reason or another.
an engineer who has to remove machine guards Young people, new and expectant mothers,
to repair a breakdown). If the normal safeguards disabled workers and lone workers are all examples
are being removed or bypassed, then risk to these of special cases.
workers increases and other methods have to be
found to control this risk.

Cleaners
Cleaners may be exposed to greater risk because
cleaning work may involve the removal of
safeguards or activities that create additional risk
(e.g. window cleaning from an access cradle). Many
cleaners also work alone, outside normal working
hours; if injured they may not be able to summon
help quickly, if at all, leading to more severe, or even
fatal, consequences.

Contractors
Contractors may be working independently or
alongside employees. The workplace may create
new risks for these contractors and the contractors
may introduce additional risks to the workplace.

Visitors
Visitors may be very unfamiliar with the risks
inherent in the workplace and may therefore need
special consideration.

© RRC Training
 Risk Assessment
3. Evaluate Risk and Decide on Whilst there is a degree of judgment involved in
assigning the values, this type of risk rating system
Precautions can be useful for several reasons:
Having identified a hazard and the people who
• Clarity of thinking – people tend to think more
might be harmed by it, the next step in the risk
carefully about the likelihood and severity
assessment process is to answer a simple question:
of foreseeable injury when they are asked to
is the risk generated by the hazard acceptable or
use this type of scoring system, giving a more
does it need to be reduced?
accurate end result.
There are lots of ways to do this, but you shouldn’t
• Consistency of approach – different people can
make it overly complicated. One popular method
use this system and will get similar results.
is to firstly identify the level of the risk using a ‘risk
rating’, as outlined below. • Prioritisation – since risk is now represented
by a number, and the higher the number the
Risk Rating greater the risk, it is possible to easily separate
out the various risks presented by several
On some risk rating systems, risk is defined as the hazards and rank them in order of priority.
product of likelihood (of harm occurring) and
severity (of that harm): • Timescale – it is even possible to allocate
particular timescales to the risk ratings that are
Risk = Likelihood x Severity calculated using this type of system.

Likelihood Severity We can develop a chart to aid risk rating and

ensure the selection of appropriate precautions.
1 = extremely unlikely 1 = very minor injury The following is an example of what this
could look like. It allocates a risk rating of
2 = unlikely 2 = first aid injury ‘Low’ (green), ‘Medium’ (yellow) or ‘High’
3 = possible 3 = lost time injury (red) according to the outcome of the risk
calculation.
4 = likely 4 = major injury
5 = very probable 5 = fatality

Each of these is assigned a value on a scale from 1

to 5 (as in the table above).

Using this system, the risk generated by a trailing

electrical flex positioned across a busy corridor
might be calculated as 5 x 4 = 20 (very probable x
major injury).

The same electrical flex trailing on the floor close

to the rear wall of a rarely visited plant room might
be rated as 1 x 4 = 4 (extremely unlikely x major
injury).

The higher the number, the higher the risk.

Note that in both cases the severity of injury is

the same, only the likelihood varies. (This will not So, using the example discussed, the electrical
always be the case; e.g. put the trailing flex in an flex positioned across a busy corridor (5 x 4
old persons’ care home and the foreseeable injury = 20) is red, and therefore poses a high risk,
becomes more severe simply because the elderly whereas the cable at the back of the plant room
have brittle bones and suffer severe injuries when (1 x 4 = 4) is green, and therefore a much lower
they fall over.) risk.

© RRC Training
 Risk Assessment
Residual, Acceptable and Tolerable Risk • A low risk level might be low priority, but
it might also have a very simple, low cost
A risk assessment should take into account all remedy. In this case it should be implemented
current controls and precautions that exist in immediately because it can be done
the workplace. What is being assessed is the real immediately.
situation, with existing controls in place.
• A medium risk might demand a medium
For example; an assessment considering electrical priority, but that does not necessarily mean that
safety in an office environment should take into an intermediate timescale would be acceptable.
account whether there is a system in place for the The level of risk to workers should always be
routine inspection and testing of portable electrical acceptable – not just acceptable after 24 hours
appliances. If there is, that may indicate that the of working.
risk is being controlled to an acceptable standard; if
there is not, then that may indicate that you need This may mean that some interim precautions are
to do more to control the risk to an acceptable put in place, which temporarily control risk to an
standard. acceptable level, but do not present an ideal long-
term solution to the problem.
When existing controls are taken into account, the
current risk level can be estimated as discussed: Risk One way in which the risk rating can be practically
= Likelihood x Severity. The risk that remains once applied in the workplace is to create a chart similar
all existing controls have been taken into account is to the following:
called the ‘residual risk’.
Risk rating Action and timescale
If the residual risk is low then it might be considered
acceptable; the existing controls are adequate and 15 + Unacceptable – work may not
nothing more need be done. start. Additional controls must be
If the residual risk is high, a decision has to be made introduced to reduce risk below 9.
about whether this residual risk is tolerable or
9 to 14 Tolerable – additional controls must
unacceptable:
be introduced as soon as possible
• Tolerable implies that it is not acceptable but it and no later than 24 hours after
can be tolerated for a short time while interim assessment.
controls are put into place.
5 to 8 Tolerable – must be reduced to
• Unacceptable implies that the risk level is too below 5 within one week.
high for work to be allowed.
4 or below Acceptable – if simple action can
In the case of both tolerable and unacceptable risk reduce further then must be done
additional controls will need to be put in place to within one week.
reduce the risk down to an acceptable level. Once
these controls have been implemented a new Although this will vary according to the workplace,
residual risk level is created. the principle remains the same.

Priorities and Timescales General Control Hierarchy

A straightforward link can be made between the Once a hazard has been identified, and the level
level of risk associated with a particular hazard and of risk it presents has been decided, it is then
the prioritisation of that hazard; the higher the risk, necessary to select the precautions necessary to
the higher the priority for action. control it to an acceptable level. This is the most
You might therefore assume that a high risk important part of the risk assessment – identifying
demands a short timescale for corrective action the further action that is needed and taking that
and a low risk can be allowed to persist for a longer action.
period of time. There are two problems with this When trying to identify further precautions that
assumption: might be appropriate to a particular situation,

© RRC Training
 Risk Assessment
a useful approach can be to use a risk control
hierarchy. The following hierarchy shows the order Common Hazards and Controls
of preference of possible courses of action:
The following is an outline of some of the
most commonly experienced workplace
hazards and the range of available controls.

Slips, Trips and Falls

• Good housekeeping; e.g. tidy, clean, well
maintained workplace.

• Avoid uneven surfaces and changes in

level, e.g. steps.

• Ensure surfaces have good grip.

• Provide appropriate footwear (PPE).

Manual Handling
• Reduce the load.

• Mark weight clearly.

• Reduce the frequency of movement and

stooping/twisting movements.

• Choose appropriate staff and train them.

• Use mechanical aids, e.g. sack trolley.

• Automate the process.

It is clear that eliminating a hazard is the most
effective control measure, since the risk associated Fire
with a hazard is then also eliminated (avoiding
risk). Unfortunately, this is not always possible or • Good housekeeping to remove potential
practical. sources of fuel.

The next best option is to build safety into the • Choose and train staff to act as fire
workplace. This can be achieved through a range wardens.
of measures; limiting exposure, using engineering
• Remove sources of ignition (where
controls or creating safe systems of work.
possible), e.g. naked flames.
The least effective type of control is known as the
• Install and maintain a fire detection system.
‘safe person’ approach. This is the least effective
type of control because, unfortunately, workers do • Install and maintain fire doors and fire
not behave in an ideal way in the workplace – they alarms.
break rules knowingly and are subject to human
error. (Note: despite the disadvantages, these are • Create and maintain emergency routes
often the most appropriate controls for low risk from workplace to appropriate fire
activities.) assembly point.

In practice, a combination of methods should often • Provide fire fighting equipment, e.g. fire
be used to reduce the risk sufficiently. extinguishers.

© RRC Training
 Risk Assessment
4. Record Significant Findings
The significant findings of a risk assessment should
be recorded to provide a statement of the hazards
in the workplace, the extent of the risks that they
present and the action taken to control those risks.

There is no standard format for risk assessments so

different organisations can adopt a format that suits
them. The most important thing to remember is to
keep it simple.

Typical content would include:

• Identification of the activity/area assessed and

of the significant hazards.

• Identification of groups at risk and those

especially at risk.

• Evaluation of the risks and the adequacy of

existing control measures.

• Action plans for implementing further

precautions needed.

• Date of assessment and name of the competent

person carrying out the assessment.

• Review date.

© RRC Training
 Risk Assessment
5. Review and Update
There are a number of situations that might trigger
a review of a risk assessment, for example:

• If there is a significant change to anything that

the risk assessment relates to:

–– Processes.
–– Substances.
–– Equipment.
–– Workplace environment.
–– Personnel.
–– Legal standards.
• There is reason to suspect that the assessment
is inadequate, as indicated for example by:

–– Accident.
–– Near miss.
–– Ill-health.
It is also good practice to review risk assessments on
a regular basis. This is often done by determining
a frequency of review based on the level of risk
associated with the activity in question. An annual
review of risk assessments is common practice in
many workplaces.

© RRC Training
 Risk Assessment
Summary
• A risk assessment must be “suitable and sufficient”. It should be carried out by a competent person and
should prevent reasonably foreseeable, significant injuries and ill-health from occurring.

• Internal and external sources of information can be useful in carrying out a risk assessment.

• Risk assessment can be split into Five Steps:

1. Identify the hazards:

–– Workplace inspection, task analysis (SREDIM ), legislation and guidance, manufacturers’ information,
accident/incident data.
2. Identify the people who might be harmed and how:

–– Employees, contractors, visitors and members of the public must all be considered.
–– Special cases - vulnerable persons or groups of workers such as young persons, expectant and nursing
mothers, disabled workers and lone workers.
3. Evaluate the risk and decide on precautions:

–– Risk can be scored or rated using a simple Risk = Likelihood x Severity calculation where likelihood and
severity are allocated numbers on a scale.
–– If the risk is unacceptable, existing control measures may not be adequate, then further controls must
be introduced to either eliminate hazards or create a safe place or a safe person. Any residual risk must
be acceptable.
4. Record the significant findings.

5. Review and update as necessary.

© RRC Training