The 5 Steps of Risk Assessment

The five steps as they are usually taught

This is the version on the laminated poster in the site cabin. It comes from an HSE leaflet that has since been withdrawn, and it is still the way most trainers, most toolbox talks and most revision material set the subject out.

1. Identify the hazards.
2. Decide who might be harmed and how.
3. Evaluate the risks and decide on precautions.
4. Record your findings and implement them.
5. Review the assessment and update it if anything has changed.

Learn it if it helps you remember the order. Just do not go into the test believing you are reciting HSE's current words, because you are not.

The two versions side by side

Read down either column and the sequence is the same: find the hazard, work out who it could hurt, do something about it, write down what matters, then check the controls are still working.

What an assessment has to decide

HSE's assessment step and its risk assessment template ask for the same five things, which makes them the most reliable thing to memorise on this whole page:

• who might be harmed and how
• what you are already doing to control the risks
• what further action you need to take to control the risks
• who needs to carry out the action
• when the action is needed by

The last two are the ones people forget. An action with no name against it and no date on it is not a control, it is a wish.

Controlling the risk, in HSE's order

Once the risks are assessed, HSE asks two questions in order: can the hazard be got rid of altogether, and if not, how can the risk be controlled so that harm is unlikely? Where further controls are needed it suggests redesigning the job, replacing the materials, machinery or process, organising work to reduce exposure, putting practical measures in place, and providing PPE and making sure it is worn.

Note where PPE comes in that list. Last, exactly as it does in the hierarchy of control and in the reasoning behind types of PPE. An exam answer that removes the hazard beats one that protects a single person from it. You are not expected to eliminate every risk: HSE's test is what is reasonably practicable, which it describes as balancing the level of risk against the money, time or trouble needed to control it.

Writing it down, and when to review it

HSE states that an employer with 5 or more employees must record the significant findings: the hazards, who might be harmed and how, and what is being done to control the risks. That threshold comes straight from regulation 3(6) of the 1999 Regulations, which also requires the record to name any group of employees the assessment identifies as being especially at risk. Regulation 3(1) is the source of the phrase supervisors quote at you, that the assessment must be suitable and sufficient. HSE adds a warning worth carrying into the test, that you should not rely purely on paperwork, because the priority is controlling the risks in practice.

Controls should be reviewed when:

• they may no longer be effective
• staff, a process, or the substances or equipment used have changed
• workers have spotted problems
• there has been an accident or a near miss

That last trigger is where risk assessment meets RIDDOR: reporting an incident is a legal duty, but reviewing the assessment that failed to prevent it is the part that stops it happening twice.

Where this comes up, and how to practise it

Risk assessment runs right through the Operatives paper rather than sitting in one section. It turns up in CDM regulations, where the duty holders each carry a slice of it, and behind topics that look like something else entirely, such as reading COSHH symbols on a drum before deciding how to handle it. Three habits beat the labels: hazard is the thing that could cause harm and risk is the chance of it doing so, control beats recording, and an assessment nobody ever reviews has stopped being an assessment.

Work through the general responsibilities questions with explanations, browse the full set of practice topics, or sit a free CSCS practice test to see whether this is costing you marks.

Verified August 2026 against hse.gov.uk. The current guide structure, the assessment bullets, the control options, the reasonably practicable wording, the 5 or more employees record rule and the review triggers were read from Managing risks and risk assessment at work at hse.gov.uk/simple-health-safety/risk/ and its printable version. The withdrawal of the five steps leaflet was confirmed by requesting hse.gov.uk/pubns/indg163.htm, which returns a 404. Legislation cited: the Management of Health and Safety at Work Regulations 1999, SI 1999/3242. No risk scoring matrix is quoted here because HSE publishes none in this guide.