Creating and reviewing risk assessments

During my time at the Health and Safety Executive (HSE), it was often straightforward to identify shortcomings in an organisation’s risk assessment. Missing hazards, insufficient control measures, or risk ratings that appeared inconsistent were all relatively easy to spot. However, when I later joined Transport for London and was tasked with developing a new risk assessment for an emerging risk, I quickly realised that creating an effective assessment from a blank page is far more challenging than reviewing one that already exists.

For anyone faced with this task, the first step is to understand the purpose of a risk assessment, and the distinction between a hazard and a risk.

• Hazard – Something with the potential to cause harm. This is typically the starting point of any risk assessment.
• Risk – The likelihood that a hazard will cause harm to people, property, or the environment, combined with the severity of that harm. This is often captured in the risk score within a risk assessment.
  

Starting a risk assessment

1. Begin by identifying all hazards relevant to the activity or issue being assessed. Historical accident reports, near misses and records of work-related ill health can provide valuable insight into hazards that may not be immediately obvious.
   
   
2. Once the hazards have been identified, assess the likelihood and severity of the hazard and who may be harmed by that hazard.
   
   
3. The next and most important stage is to identify the control measures that are already in place to eliminate or reduce those risks. From there, consider whether any additional controls that are reasonably practicable could further reduce the level of risk. Where additional actions are required, the assessment should clearly identify who is responsible for implementing them and the expected timescale for completion.
   
   
4. Finally, record the findings using a format that is appropriate for your organisation, whether that is a standard risk assessment template or another recognised method.

There is no single “correct” approach to recording risk. Some organisations prefer a qualitative assessment that describes hazards, controls and required actions, while others use quantitative methods based on numerical risk scoring. The most appropriate approach is the one that best supports informed decision-making within your organisation.

Involving the right people

A suitable risk assessment should never be completed in isolation. Engage with those who undertake the work or are directly exposed to the hazards, such as stewards, catering staff and other operational colleagues. Their practical experience can help identify hazards that may otherwise be overlooked and provide valuable insight into which control measures are realistic, effective and proportionate.

Risk assessment review

Completing a risk assessment is not the end of the process. It should become a living document that forms part of your organisation’s wider safety management system.

Risk assessments should be reviewed whenever there is a significant change to activities, equipment, legislation or the operating environment, or at the very least at regular intervals (for example every 12 months) to ensure they remain accurate and effective.

While risk assessments are a legal requirement, they should not be viewed simply as an administrative exercise. When completed thoughtfully, they provide a structured approach to managing health and safety risks, supporting informed decision-making and helping organisations prioritise improvements that will have the greatest impact on keeping people safe.

Further guidance

Guidance on how to conduct a risk assessment (with templates included) can be found on the HSE and SGSA website:

• Managing risks and risk assessment at work: Overview – HSE
• Risk assessments – SGSA
• Supplementary Guidance 03: Event Safety Management – Chapter 5 provides stadium specific guidance

Author:
Guy Widdowson – SGSA Inspector