A risk assessment should be an integral part of any business. It must be regarded as a vital tool in protecting the business against potentially harmful consequences, which may be financial, reputational or both. Risk assessments should be tailored to each specific business. Whilst there is no ‘one size fits all’ policy, there are some general principles we can follow to develop good risk assessment practices.
A risk assessment should be an integral part of any business. It must be regarded as a vital tool in protecting the business against potentially harmful consequences, which may be financial, reputational or both. Risk assessments should be tailored to each specific business. Whilst there is no ‘one size fits all’ policy, there are some general principles we can follow to develop good risk assessment practices.
What is a risk assessment?
A risk assessment is very simply a thorough, systematic examination of the way a business operates and how its actions and processes could cause harm to people. It is about preventing that potential harm from happening by identifying possible hazards, establishing who might be affected by the hazard, assessing how big the risk of harm is, documenting these findings and carrying out regular reviews.
Why carry out a risk assessment?
As employers, we have a legal duty to protect the safety, health and welfare of our employees and anyone who may be affected by the business. There are a wide range of general and business specific health and safety regulations. You can find more information at the Health and Safety Executive website. However, the benefits of a good risk assessment are not confined to making sure a business complies with the law. In fact, an effective risk management strategy feeds into employee wellbeing. Moreover, it optimises staff performance as well as business efficiency and contributes to the sense of a well run organisation.
Five steps to carry out an effective risk assessment
Carrying out a risk assessment should be done carefully and across all aspects of the business. It should be a head to toe examination of all issues relating to the health and safety of persons affected by the business. There are lots of resources available on the Health and Safety Executive website around managing risks in your business. We’ve also summarised a simple step by step guide for you below on undertaking an effective risk assessment.
Step 1: Identify possible hazards
A hazard is anything done by a business that may cause harm to a person. This clearly covers a wide spectrum of health and safety risks. Identify anything that a person could be exposed to which might lead to physical, mental, biological or chemical harm. It extends beyond customers and employees to anyone who might be affected by the actions of a business, or by a visit to business premises.
‘Physical health hazards’ typically arise from work procedures. For example noise from machinery, repetitive type injury or posture issues from sitting.
‘Mental health hazards’ are associated with harm caused by workloads, working hours, exposure to potentially dangerous clients or bullying in the workplace.
‘Chemical hazards’ result from a person not being protected against the risks of harm from materials used in a business. For example, asbestos or toxic fluids.
‘Biological hazards’ apply to cases where a person comes into contact with infectious diseases, often an issue faced by healthcare professionals.
Each business is unique, and therefore will have unique risks that will depend on how the business functions, and operates. As part of your risk assessment, you will need to examine what risks are posed by your business’ actions and processes. For example, a noisy manufacturing business will present different risks to an office based service business. Similarly, a large business will present different health and safety challenges to a SME. What matters is that the risk profile is properly evaluated and steps taken to deal with potential harms.
Step 2. Find out ‘Who’ is at risk and ‘How’.
The best place to start in identifying ‘who’ is at risk is with your organisation’s own employees. There may be certain categories of employees who are at greater risk of greater harm and so the approach to be taken needs to reflect that. This duty to identify those at risk extends to temporary staff and contractors, visitors to the business, clients and other members of the public coming into contact with the business.
Review how the functions of the business are carried out. For example, this may include documenting work practices, which will help reveal ‘How’ potential harm can be exposed and then prevented. To give some examples, depending on the nature of the business policies might need to be developed for:
- lifting techniques,
- guidelines on the safe operation of equipment and machinery,
- the safe handling of hazardous materials,
- keeping workers safe when dealing with members of the public
- posture and eyesight protection for sedentary workers e.g. specifying breaks or identifying specific suitable equipment
In addition, as employers, we need to make special provision for the health and safety of more vulnerable employees such as young or inexperienced workers, disabled employees, night workers, shift workers, and pregnant or breastfeeding women.
Step 3: Assess the level of risk and mitigate it
Assessing the risk means objectively considering how likely it is that harm could result from the activities of the business. If the risk can be eliminated that is ideal. In many instances however, there will be an element of risk remaining. It would be sensible to categorise these remaining risks into Low, Medium or High. This in turn leads to identifying proportionate and reasonable precautions to minimise the risk of each level of harm occurring. Importantly, the greater the potential harm the more that should be done to mitigate the risk.
However, this is not an exact science. We need to take care that trivial risks are not over blown leading to a top heavy response. The needs of the business to function effectively need to be balanced against the nature of the risk, and what measures are needed to combat it.
Step 4. Document the results and processes
The proper documenting of the risk assessment is an essential element in making it effective. Employers with five or more staff are required to record in writing the main findings of the risk assessment. However, all businesses would benefit from this approach. The written record should identify the potential hazards, and any action taken to remove or reduce the risk.
A written record is visible proof that the employer has actually carried out the risk assessment. So, this record also provides evidence that the assessment was carried out properly. In addition, it can also be used as the basis for later reviews of working practices. The risk assessment record is a living document and should be a prominent and visible part of a best practice approach.
Step 5. Regularly review risks and processes
We should highlight that a risk assessment is not something to be undertaken once and then filed away. It needs to be kept under regular review to ensure it continues to be effective and reflects any changes in the business. Some occasions may trigger the need for a further review, in addition to planned periodic reviews. For example, additions to or reductions in employee numbers, changes to business practices, altering job specifications, acquiring new equipment or exposure to new clients. Depending on the nature of the business quarterly, half yearly or annual reviews may be sensible.
The review is needed to ensure that the safe working practices put in place to address hazards are being kept to and to identify any changes to the risk level of an activity, or highlight any that may have been overlooked. The written process also provides a template for future reviews because as in all aspects of business process, it should be capable of being picked up, understood and followed if key people change role.
Lessons can be learned from incidents of harm that take place that were either not anticipated or were not mitigated for effectively. Also, patterns can be identified and additional harm prevention steps put in place where necessary. Moreover, we want to ensure that if something does go wrong, it is remedied and preventative measures are identified to stop it happening again.
Important take aways
To sum up, employers can carry out their own risk assessments, either by themselves or in conjunction with staff (who may have a useful perspective on the risks they may face). Regardless, ensure that whoever undertakes the risk assessment is sufficiently qualified. This may involve specialised training for specific employees. Ultimately, the approach will vary according to the size and nature of the business.
Given the potential harm that poorly managed hazards can cause to a business, it may be wise to involve external experts to independently carry out a fully comprehensive risk assessment. An ineffective risk assessment may store up potential future harm to the business, so it is important that you make the right decision when choosing who to appoint.
Useful resources
For more guidance and information visit the Health and Safety Executive website:
