Health & Safety Risk Assessment Checklist Template

Most workplace risk assessments are written once and filed. The hazards are listed, but the further action has no owner or date, nobody asked who was especially at risk, and the record is not opened again until after an accident.

Last reviewed: October 2026

Every employer in Great Britain must make a suitable and sufficient assessment of the risks to their employees, and to anyone else their work affects. This free health and safety risk assessment checklist is for managers, health and safety leads and small business owners who assess a workplace or an activity and then have to show the actions were done. One run is one assessment. It follows the HSE’s five steps: identify hazards, assess the risks, control the risks, record your findings and review the controls. Before them it plans the walk-round and gathers the records. Along the way it asks who might be harmed and how, including new and expectant mothers, young workers, lone workers, contractors and visitors. A phase to stop or restrict the work appears when a risk is still high once the planned controls are in place, and a legal recording task appears when the employer has five or more employees.

A Risk Assessment Decides What to Do. Inspections Check It Was Done.

Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to the health and safety of their employees at work, and of the people they do not employ who are affected by their work. The HSE puts the minimum plainly: identify what could cause injury or illness in your business, decide how likely it is that someone could be harmed and how seriously, and take action to eliminate the hazard or, if that is not possible, control the risk. Its guidance breaks the job into five steps: identify hazards, assess the risks, control the risks, record your findings and review the controls. This checklist follows them in that order.

The assessment decides what has to be done. Checking that the chosen controls are still in place is a different job: a safety audit or a manufacturing safety inspection does that, area by area. Fire has its own fire risk assessment, and an ISO 45001 management system runs all of them as an annual cycle. Use this checklist when a workplace or activity is new, when something significant changes, and on the review date you set.

Risk assessment

Decides what could harm people and what more to do

Asks: what could cause harm here, who to, how likely and how serious, and what further action is needed?

When: before new work starts, after a significant change, and at the review date.

Output: the significant findings, an action plan with owners and dates, and the manager’s sign-off.

Inspection or audit

Checks the controls are in place today

Asks: are the guards fitted, the aisles clear, the PPE worn and the records current?

When: daily to yearly, area by area.

Output: defects and corrective actions, which feed the next review of the risk assessment.

Fire risk assessment

Covers fire under its own law

Asks: what could start a fire, who is at risk, and would everyone get out?

When: reviewed regularly and after a significant change, by the responsible person for the premises.

Output: fire precautions, an emergency plan and its own action plan.

What the Health & Safety Risk Assessment Checklist Covers

Eight phases take one assessment from planning to review, in the order of the HSE’s five steps. Phase 6 appears only when a risk is still high once the planned controls are in place, and Phase 7 adds a legal recording task when the employer has five or more employees.

  1. Phase 1

    Phase 1: Plan the Assessment

    5 tasks

    Decide what the assessment covers and gather the records before the walk-round. A walk-round without the accident book and last year’s actions finds only what is visible on the day.

    • Record the workplace, the assessor and the manager who signs off — the site or activity assessed, the start date and how many people the employer employs
    • Define what the assessment covers — the areas, activities and shifts in scope, including night, weekend and off-site work, and the topics that have their own assessment, such as fire
    • Pull the previous assessment and its open actions — which actions were completed, which slipped and which were never started
    • Gather the records the walk-round needs — the accident book, ill-health and near-miss reports, manufacturers’ instructions, safety data sheets, and inspection and maintenance records
    • Arrange time with workers and their safety representatives — supervisors, the people who do each job and any safety representative, so the walk-round hears from the people who know the work
  2. Phase 2

    Phase 2: Identify Hazards

    7 tasks
    • Walk round the workplace — look at how people work, how plant and equipment are used, which chemicals and substances are used and the general state of the premises
    • Include non-routine work — maintenance, cleaning, breakdowns, changes in production cycles and work done only at night or at weekends
    • Talk to workers about the hazards they see — ask what feels unsafe, what causes aches and pains, and where the written procedure is not followed and why
    • Look back at accident and ill-health records — they show the less obvious hazards, such as repeated strains from the same task
    • Check manufacturers’ instructions and safety data sheets — for the hazards they spell out and the precautions they say to take
    • Think about hazards to health, not only to safety — manual handling, chemicals, noise, vibration and the causes of work-related stress
    • List every hazard found — one line each, with where it is found and how it was found, so the next phases can work through them in order
  3. Phase 3

    Phase 3: Decide Who Might Be Harmed and How

    7 tasks

    For each hazard, think about how employees, contractors, visitors or members of the public might be harmed. Some groups need particular thought, and the law names several of them.

    • Identify which employees each hazard could harm — by role, task and shift, and how: a crushed foot, a back injury, dermatitis or hearing loss
    • Consider contractors, visitors and members of the public — delivery drivers, cleaners, maintenance contractors, agency staff and people passing the site
    • Consider new and expectant mothers — where women of childbearing age work, the assessment must include risks to a new or expectant mother or her baby
    • Consider young workers under 18 — assess before they start, taking particular account of their inexperience, lack of awareness of risks and immaturity
    • Consider lone workers — anyone working without close or direct supervision: how they keep in touch, what happens if something goes wrong, and whether the work needs a second person
    • Consider workers with particular requirements — disabled workers, migrant workers whose first language is not English, and people new to the job
    • Record who might be harmed and how for each hazard — against the hazard references from Phase 2
  4. Phase 4

    Phase 4: Assess the Risks

    5 tasks
    • Record what you are already doing to control each risk — the controls you saw in place on the walk-round, not only the ones written in procedures
    • Check the existing controls actually work — guards fitted, PPE worn, training records current, inspections done and defects reported
    • Rate each risk on one scale — how likely harm is and how serious it could be, with the existing controls in place
    • Compare the ratings with your accident and near-miss history — a hazard rated low that keeps causing injuries has been rated too low
    • Agree the ratings with the people who do the work — a supervisor and a safety representative check that the ratings match real practice
  5. Phase 5

    Phase 5: Control the Risks

    6 tasks

    First ask whether the hazard can be removed altogether. If it cannot, control the risk so that harm is unlikely, working down the hierarchy of control with PPE as the last resort.

    • Ask whether each hazard can be removed altogether — stop the task, do it another way, or remove the substance or equipment that causes it
    • Work down the hierarchy of control for the rest — redesign the job, replace the materials, machinery or process, organise the work to reduce exposure, put practical measures in place, and provide PPE last
    • Decide what further action is reasonably practicable — balance the level of risk against the money, time or trouble needed to control it
    • Make the quick fixes straight away — a blocked aisle, a missing guard or a leaking container: fix it now and record it
    • Write the action plan — each further action with who needs to carry it out and when it is needed by, the most serious risks first
    • Rate the risk that remains once the actions are done — on the same scale, and record whether any risk is still high; this answer switches on Phase 6
  6. Phase 6 — If Needed

    Phase 6: Stop or Restrict High-Risk Work

    5 tasks

    Shown only when a risk is still high once the planned controls are in place. The work stops, or carries on only under restrictions, until a control brings the risk down.

    • Stop or restrict the work — decide which activities stop and which carry on only under restrictions, from when, and tell the people who do them
    • Put interim controls in place — extra supervision, an exclusion zone, trained staff only or fewer people exposed, until a lasting control is found
    • Find a control that brings the risk down — go back up the hierarchy: can the job, the equipment or the process change, and is specialist advice needed
    • Manager decides whether the work may restart — on the evidence that the risk is no longer high, recorded with any conditions
    • Brief the team before the work restarts — the new controls, any conditions, and who to tell if a control is not working
  7. Phase 7

    Phase 7: Record Your Findings

    5 tasks

    With five or more employees, the law requires the significant findings to be written down. Whatever the size of the business, the HSE warns against relying on paperwork alone: the priority is controlling the risks in practice.

    • Write up the significant findings — the hazards, who might be harmed and how, what you are already doing and the further action, with who and by when
    • Record any group of employees found to be especially at risk — shown only when the employer has five or more employees; for example young workers, new and expectant mothers or lone workers, with the controls for each
    • Manager signs off the assessment and action plan — before it is shared, with the decision and any conditions recorded
    • Share the findings with employees — the risks found and the measures that control them, in a form people understand, and with their safety representatives
    • Tell contractors and other employers on site about the risks to their people — the risks your work creates for them and the measures you have taken
  8. Phase 8

    Phase 8: Act on the Findings & Review the Controls

    5 tasks
    • Track each action to its due date — follow up each owner before the date, and escalate a slipped action rather than letting it drift
    • Close each action with evidence — a photo, a training record or a contractor’s certificate attached to this task
    • Check the new controls are working — watch the work and ask the people doing it, a few weeks after each control goes in
    • Update the risk assessment record — with every change made, so the written record matches the workplace
    • Set the review date and the triggers for an earlier review — a change of staff, process, substances or equipment, an accident or near miss, or a problem workers report

Who Might Be Harmed: The Groups the Law and the HSE Name

The second question on the HSE’s record is who might be harmed and how. Most assessments answer it for employees and stop. The Management of Health and Safety at Work Regulations 1999 name several groups that need particular thought, and the HSE adds others. Use the table as a prompt in Phase 3, so each group is either assessed or recorded as not present.

Who What the law or the HSE says What to check in the assessment
EmployeesThe assessment covers the risks to employees while they are at work (regulation 3(1)(a)).Every role, task and shift, including night, weekend, maintenance and cleaning work.
Contractors, visitors and the publicIt also covers people you do not employ, where the risks arise from or in connection with your work (regulation 3(1)(b)).Delivery drivers, cleaners, maintenance contractors, agency staff and anyone passing the site. Tell other employers sharing the site about the risks to their people (regulation 11).
New and expectant mothersWhere women of childbearing age work and the work could put a new or expectant mother or her baby at risk, the assessment must include that risk (regulation 16). Once an employee tells you in writing that she is pregnant, has given birth in the last six months or is breastfeeding, the HSE says you must complete an individual risk assessment.Long periods sitting or standing, heavy lifting, long hours, shift and night work, harmful substances and infections, and PPE that no longer fits. If a risk cannot be controlled: adjust her conditions or hours, then offer suitable alternative work, then suspend on paid leave.
Young workers under 18An employer must not employ a young person without first making or reviewing the assessment, taking particular account of their inexperience, lack of awareness of risks and immaturity (regulation 3(4) and (5)).The work they will do, the equipment they will use, the supervision and training planned, and work they must not do (regulation 19).
Lone workersThe HSE says you must manage the risks before people work alone, train, supervise and monitor them, and keep in touch and respond to any incident.How each lone worker keeps in touch, what happens if they are taken ill or hurt, and whether the work needs a second person.
Workers with particular requirementsThe HSE names young workers, migrant workers, new or expectant mothers and people with disabilities as workers who may have particular requirements.Instructions in a language people understand, help to evacuate, and adjustments to the job or workstation.

What has to be written down. Regulation 3(6) says an employer with five or more employees shall record the significant findings of the assessment and any group of employees it identifies as especially at risk. The HSE lists what the record includes: the hazards, who might be harmed and how, and what you are doing to control the risks. Its free template adds what further action is needed, who needs to carry it out and when it is needed by. Northern Ireland has its own Management of Health and Safety at Work Regulations (Northern Ireland) 2000, with the same five-employee recording rule.

When to look again. Regulation 3(3) requires a review when there is reason to suspect the assessment is no longer valid or there has been a significant change in the matters it relates to. The HSE adds changes to staff, a process, or the substances or equipment used, problems workers have spotted, and accidents or near misses.

Why Run Health and Safety Risk Assessments in CheckFlow?

1

Reviews start when they are due

A yearly recurring schedule starts the review on the same date for each site, assigned to the assessor. A significant change or an accident starts its own run from the same template the same day, and the last task records the next review date and the triggers for an earlier one.

2

The manager signs off before the findings go out

The manager is chosen on the first task. The sign-off is assigned to them alone, and nothing after the sign-off step can be completed until they record a decision. When a risk is still high, the decision to restart the work is theirs too, recorded with any conditions.

3

Actions are closed with evidence

Walk-round photos, data sheets, the action plan and the signed record sit on the tasks that produced them, with names and dates. Each action has an owner and a date, and the Reports Grid shows every assessment in progress and the tasks that are overdue.

CheckFlow does not decide whether a risk is acceptable. That judgement is yours, recorded in the tables on each task. It runs the assessment around it: who does what, by when, with what evidence, and who signed it off. CheckFlow’s compliance checklist software shows how the same approach handles recurring inspections and reviews.

Fire is assessed separately with the Fire Risk Assessment Checklist. Check that the controls stay in place with the Safety Audit Checklist, or on a factory floor the manufacturing safety inspection. The ISO 45001 Checklist runs the management system around your assessments, and the Operational Risk Assessment Checklist covers risks to the business rather than harm to people.

AI generator

Didn’t find what you need? Describe it.

Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.

Frequently Asked Questions

Is a risk assessment a legal requirement in the UK?

Yes. In Great Britain, regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make a suitable and sufficient assessment of the risks to their employees at work, and to people they do not employ who are affected by their work. Some self-employed people have the same duty. Northern Ireland has equivalent regulations from 2000. The HSE’s summary of the minimum is to identify what could cause injury or illness, decide how likely and how serious the harm could be, and eliminate the hazard or control the risk.

What are the HSE’s five steps to risk assessment?

The HSE words them as: identify hazards, assess the risks, control the risks, record your findings and review the controls. Identifying hazards means looking round the workplace, talking to workers and checking accident and ill-health records. Assessing the risks covers who might be harmed and how, what you already do and what more is needed. Controlling them starts with removing the hazard if you can. Recording is a legal requirement with five or more employees, and the review checks the controls are working.

Do I have to write my risk assessment down?

If you employ five or more people, yes. Regulation 3(6) requires you to record the significant findings and any group of employees identified as especially at risk. The HSE says the record includes the hazards, who might be harmed and how, and what you are doing to control the risks. With fewer than five employees there is no legal duty to write it down, but a record is still the easiest way to show what was decided. The HSE also warns against relying purely on paperwork: controlling the risks in practice comes first.

How often should a risk assessment be reviewed?

The regulations set no fixed interval. Regulation 3(3) requires a review when there is reason to suspect the assessment is no longer valid, or when there has been a significant change in the matters it relates to. The HSE adds changes to staff, a process, or the substances or equipment used, problems workers have spotted, and accidents or near misses. Many organisations also set a yearly review date so the assessment is looked at even when nothing seems to have changed. Update the record with every change you make.

Who should carry out a workplace risk assessment?

The duty is the employer’s, but the HSE says you can do it yourself or appoint a competent person to help. The HSE says the steps are straightforward for most small, low-risk businesses, and points larger or higher-risk businesses to its more detailed guidance. Whoever leads it should involve the people who do the work and any safety representatives because, as the HSE puts it, they will usually have good ideas. The checklist names an assessor and a separate manager who signs the assessment off.

What does “reasonably practicable” mean?

The HSE explains that you are not expected to eliminate every risk, but you must do everything reasonably practicable to protect people from harm. That means balancing the level of risk against the measures needed to control it, in terms of money, time or trouble. A serious risk justifies a lot of effort. A trivial one does not justify a costly control. Phase 5 records the further controls you considered and did not take, with the reason, so the judgement can be explained later.

Can I use one of the HSE’s example risk assessments?

Use them as a guide, not as your assessment. The HSE publishes examples for an office, a local shop, food preparation and service, a motor vehicle repair shop, factory maintenance work and a warehouse, and says not to copy an example and put your company name on it, because that would not satisfy the law or protect your employees. Think about the hazards and controls your own workplace needs. The examples are useful for spotting hazards you might have missed.

Is CheckFlow free for this template?

14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.

Assess Every Workplace Risk, Then Act On It and Review It

Free trial — no credit card required.

14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting