How to Write a Risk Assessment That Actually Protects People

Risk assessment is the legal and practical cornerstone of workplace safety in almost every jurisdiction on earth — and it is also one of the most commonly wasted exercises in industry. Done well, it prevents incidents before anyone gets near them. Done badly, it produces a folder of paperwork that protects nobody, written once to satisfy an auditor and never opened again. The difference between those two outcomes is not the form you use. It is the thinking behind it.

The five steps, properly understood

Nearly every framework in the world settles on the same five steps: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on controls, record your findings, and review when things change. The steps are simple; the discipline is in doing them honestly.

Step 1 — Identify the hazards by walking the job

Hazards are not found at a desk. Walk the task, watch it being done by the people who actually do it, and ask them what nearly went wrong last month — near-misses are the richest hazard data any workplace has. Look beyond the obvious injuries to health hazards too: dust, noise, vibration, repetitive strain, and heat cause far more harm over a working life than falls and cuts, precisely because they are easy to leave off the form.

Step 2 — Who might be harmed, and how

Name groups, not just "workers": the maintenance fitter who opens the machine, the cleaner who comes at night, the delivery driver who has never seen your site rules, the new starter in their first week. Different groups meet the same hazard in different ways, and controls that protect one group can miss another entirely.

Step 3 — Evaluate the risk and choose controls in the right order

This is where most assessments fail. The temptation is to jump straight to gloves, signage, and "take care" — the bottom of the hierarchy of controls. A suitable and sufficient assessment forces the question in order: can we eliminate this hazard? Substitute it? Isolate it with an engineering control? Only after those are honestly considered should administrative controls and PPE fill the remaining gap. If your assessment's control column is mostly PPE, it is telling you the thinking stopped early.

Step 4 — Record it so someone can actually use it

An assessment is a working document, not a legal shield. Write controls as specific, checkable actions — "guard interlock tested weekly by shift supervisor" rather than "ensure machine is safe." If a control cannot be verified by someone reading the line, it is a wish, not a control.

Step 5 — Review when reality changes

Assessments go stale the moment the job changes: new equipment, new substances, a new shift pattern, an incident, or a near-miss are all triggers for review — not just the annual date in the footer. The most valuable reviews happen within days of a near-miss, while the lesson is still sharp.

The three failures that make assessments worthless

First, copy-paste: an assessment recycled from another site or downloaded generically describes someone else's workplace, not yours. Second, vagueness: hazards like "manual handling" with controls like "training" say nothing anyone can act on. Third, exclusion: assessments written without the people who do the work miss what only they know. Involve the crew, be specific, and write about the job in front of you — that is most of what "suitable and sufficient" means.