All templates
Health & SafetySOPKey · UK

Risk Assessment Procedure template

A risk assessment procedure is the written method your organisation uses to identify workplace hazards, work out who could be harmed and how, and decide the controls that reduce the risk to an acceptable level. It turns risk assessment from a one-off form-filling exercise into a repeatable process anyone competent can run.

Free to use
UK-focused
Updated 11 July 2026

Risk assessment is the engine of UK health and safety law — nearly every other duty, from fire arrangements to manual handling controls, flows from what your assessments find. A consistent procedure means two different managers assess the same task the same way, and the paperwork stands up when an inspector or insurer asks for it.

This template gives you the full procedure: when an assessment is triggered, who does it, the five-step method, the hierarchy of controls, and the records that prove your controls existed on the day it mattered.

The template

Full text, ready to adapt.

Highlighted fields are placeholders — replace them with your organisation's specifics. A starting point, not legal advice.

Risk Assessment Procedure

SOP · Health & Safety

1. Purpose and scope

This procedure sets out how {{org.name}} identifies, assesses and controls workplace risks. It applies to every activity, site and person working for us, including [contractors, agency staff, home workers], and supports the commitments in our health and safety policy.

2. When to carry out or revisit an assessment

  • Before a new task, machine, substance or work area is introduced.
  • When a process, layout, staffing level or shift pattern changes materially.
  • After any accident, near miss or work-related ill-health report connected to the task.
  • When an assessment's review date falls due.
  • When someone who needs specific consideration joins the task: [young workers, new and expectant mothers, disabled staff, lone workers].

3. Roles and responsibilities

  • Assessment owner ([name/role]): maintains the risk assessment register, sets review dates, and signs off assessments for higher-risk activities.
  • Assessors ([names/roles]): competent people trained in this procedure who carry out and write up assessments.
  • Managers and supervisors: implement the controls, brief their teams, and confirm the controls are being followed in practice.
  • All staff: follow the controls, and report to [role] when a control fails, is unworkable, or a hazard has been missed.

4. Before you start

  1. 1Gather what already exists: previous assessments, manufacturer instructions, safety data sheets, and accident or near-miss records for the task.
  2. 2Walk the task where it actually happens — assess in the room, not from a desk.
  3. 3Talk to the people who do the job; they know the shortcuts and failure points no manager sees.
  4. 4Check whether anyone doing the task needs specific consideration: [young workers, new and expectant mothers, disabled staff, lone workers].

5. Step-by-step: carrying out the assessment

  1. 1Identify the hazards — anything with the potential to cause harm: equipment, substances, the environment, and the way the work is organised.
  2. 2Decide who could be harmed and how: staff doing the task, others nearby, contractors, visitors, and members of the public.
  3. 3Evaluate the risk — how likely is the harm and how serious would it be, taking account of the controls already in place.
  4. 4Decide what further controls are needed using the hierarchy in the next section, and give each one an owner and a deadline.
  5. 5Record the significant findings on [form/system]: the hazards, who is at risk, existing and new controls, the owner, and the review date.
  6. 6Brief everyone who does the task on the findings and controls before the assessment is filed.

6. Choosing controls

Work down this hierarchy and only settle for a lower level where the higher ones are not reasonably practicable:

  • Eliminate the hazard entirely — change the process, buy pre-cut stock, stop doing the task.
  • Substitute something less hazardous — a safer chemical, a lighter container.
  • Engineer the risk away — guards, local ventilation, barriers, mechanical aids.
  • Administrative controls — safe systems of work, training, signage, job rotation, supervision.
  • Personal protective equipment — the last layer, never the first answer.

7. Records and proof of completion

Completed assessments are stored in [system/location] and indexed in a register showing owner and review date. Team briefings on new or changed assessments are recorded with names and dates in [system].

Superseded versions are kept for [period] so we can show exactly which controls applied on any given date — that history is what an investigation asks for.

8. If something goes wrong

If an accident or near miss happens on an assessed task, treat it as evidence the assessment failed somewhere: review the assessment as part of the investigation and update it before the task resumes.

If a control proves unworkable in practice, staff report it to [role] rather than quietly working around it. A control nobody follows is a paper control, and paper controls fail audits and people in the same week.

9. Review

Every assessment carries its own review date set by the assessor: [frequency, e.g. annually] is our default, shorter for higher-risk tasks. This procedure itself is reviewed [frequency] by [name/role]. Next review due: [date].

Make it yours

How to adapt this template.

1

Build your task list first — you can't assess what you haven't listed. Start with the activities most likely to cause serious harm.

2

Replace the [form/system] references with whatever you will genuinely use; a simple shared table beats sophisticated software nobody opens.

3

Name your competent assessors in section 3 and get them trained on this procedure before you publish it.

4

Set the default review frequency to match your risk profile — a quiet office can run longer between reviews than a kitchen or workshop.

5

Pilot the procedure end to end on one real task, fix what jarred, then roll it out.

6

Book the first batch of reviews into the diary on day one, or the review dates will silently pass.

A document is not a system

Turn this template into trained, proven behaviour

A policy in a drawer proves nothing. In TrainedTeam this template becomes assigned training with knowledge checks, e-signature acknowledgments, version history, and an audit-ready record of who completed what, when.

Risk Assessment Procedure template FAQs

Is a risk assessment a legal requirement in the UK?

Yes. The Management of Health and Safety at Work Regulations 1999 require every employer to assess the risks their work creates for employees and anyone else affected. If you employ five or more people, the significant findings must be written down.

Who can carry out a risk assessment?

Anyone competent to do so — meaning they understand the task, can recognise its hazards, and know when to ask for help. For most everyday business risks that is a trained manager or experienced staff member, not an external consultant. Specialist risks (complex machinery, hazardous substances at scale) may need specialist input.

What does "suitable and sufficient" mean?

It is the legal standard from the 1999 Regulations, and it means proportionate: the assessment must identify the significant hazards, consider everyone who could be harmed, and produce controls that reflect the level of risk. It does not demand that every trivial hazard be documented or that paperwork be lengthy.

How often should risk assessments be reviewed?

The law sets no fixed interval — the duty is to keep assessments valid. Review whenever the task, equipment, people or environment change materially, after any related accident or near miss, and otherwise at a sensible default; many organisations use annually.

What's the difference between a risk assessment and a method statement?

The risk assessment is the analysis: hazards, who could be harmed, and controls. A method statement is a step-by-step description of how a specific job will be done with those controls built in. Construction and contractor work often pairs the two as RAMS; most everyday workplace tasks only need the assessment.