The 5 steps to risk assessment
The HSE’s five steps to risk assessment are: 1) identify the hazards, 2) decide who might be harmed and how, 3) evaluate the risks and decide on controls, 4) record your findings and put them into practice, 5) review and update. Employers with five or more employees must write down the significant findings.
The steps with a site example
Example job: replacing a run of guttering on a two-storey house.
| Step | What you do | Example |
|---|---|---|
| 1. Identify hazards | Walk the job and list what could cause harm | Falls from height, falling objects, manual handling of ladders, power lines |
| 2. Who might be harmed and how | Workers, other trades, the public, residents | Operatives falling; people below hit by dropped tools |
| 3. Evaluate and control | Use the hierarchy of control; score the risk before and after | Tower scaffold instead of ladders, exclusion zone below, tool lanyards |
| 4. Record and implement | Write the significant findings and brief the team | RAMS signed by the team before work starts |
| 5. Review | When something changes, after an incident, or at set intervals | Weather turns windy: stop and reassess |
When must it be written down?
If you employ five or more people, you must record the significant findings (Management of Health and Safety at Work Regulations 1999, regulation 3(6)). In construction, principal contractors and many clients will ask for written RAMS regardless of your size, so most contractors write them for every job.
Scoring the risk
Most site risk assessments score likelihood × severity on a 1–5 scale. A score of 15 or more is high and work should not start until it is reduced; 8–12 is medium and needs controls; below that is low. The numbers are a tool for comparing risks, not a legal requirement.
Common mistakes
- Copying a generic assessment without visiting the site.
- Listing PPE as the only control.
- Not briefing the people who do the work.
- Never reviewing it after the job changes. That is where a dynamic risk assessment comes in.
All five steps in one document. RAMS Maker lists the hazards for your trade, who is at risk, controls and the risk score before and after, then adds the method statement and sign-off sheet. Free to make and download.
Make RAMS See ProQuestions
What are the 5 steps to risk assessment?
Identify the hazards; decide who might be harmed and how; evaluate the risks and decide on precautions; record your findings and implement them; review and update.
Do self-employed contractors need a risk assessment?
Yes, if their work could put others at risk. On a construction site that is almost always the case.
How often should a risk assessment be reviewed?
Whenever there is a significant change, after an accident or near miss, and at regular intervals. Many firms review at least once a year.
Checked against HSE guidance “Managing risks and risk assessment at work” and the Management of Health and Safety at Work Regulations 1999, November 2026. Related: RAMS template.