How to Complete an IOSH Risk Assessment Form Correctly

The IOSH risk assessment form comes up in two very different situations.

The first is as part of the IOSH Managing Safely qualification, where candidates complete a practical risk assessment project to pass the course. The second is in the real world — where managers who have been through the training need to apply what they learned in the classroom to actual workplaces.

Both groups often make the same mistakes. This guide covers both.

What Is the IOSH Risk Assessment Form?

IOSH — the Institution of Occupational Safety and Health — is the professional body for health and safety practitioners in the UK. Their Managing Safely course is one of the most widely taken H&S qualifications in the country. It's designed for managers and supervisors who need a working understanding of safety, rather than full-time H&S professionals.

The practical assessment element of the course requires candidates to complete a risk assessment project using the official IOSH form. The form follows the HSE's five steps of risk assessment:

1. Identify the hazards
2. Decide who might be harmed and how
3. Evaluate the risks and decide on control measures
4. Record your findings
5. Review and update

Candidates submit the completed form to their training provider within 14 days of finishing the course. It is marked out of 38, and a score of 23 is required to pass.

What Each Section of the Form Covers

Assessor and organisation details

Your name, job title, company, and the date. For the Managing Safely project specifically, describe the area being assessed clearly — the assessor marking your work doesn't know your workplace.

Hazard identification

This is where you list each hazard. The Managing Safely course groups hazards into categories: biological, chemical, ergonomic, physical, and psychological. For the project, you need to identify four hazards from different categories. In practice — in a real workplace — you should work through the actual task or area and record what you observe, not what you expect to find.

Who might be harmed and how

Be specific. "Employees" is too broad. A roofer working at six metres has a different risk profile from a site manager carrying out a walkround. Define who, in what circumstance, and in what way they could be harmed.

Current controls and initial risk rating

Before identifying what else needs doing, record what controls are already in place. Then rate the risk using a likelihood x severity matrix — the IOSH form uses a 1–5 scale for each. The resulting score tells you the significance of the risk before any new measures are added.

Additional control measures

What further action is required to bring the risk to an acceptable level? This is where the hierarchy of controls applies:

• Eliminate the hazard entirely where possible
• Substitute with something less hazardous
• Engineering controls (guarding, extraction, isolation)
• Administrative controls (safe systems of work, training, supervision)
• PPE — always the last resort, not the first answer

Residual risk rating

After your controls are applied, re-rate the risk. If your controls are effective, the rating should drop. If it doesn't, your controls are not sufficient.

Action owners and deadlines

Who is responsible for implementing each control measure, and by when? An assessment without named owners and specific dates is not an action plan.

A Worked Example

Take a plumber carrying out hot works with a blowtorch in a domestic property.

• Hazard: Fire — ignition of timber joists or insulation behind pipework
• Who might be harmed: Plumber; occupants if the property is not vacated
• Current controls: Fire extinguisher present, combustibles cleared from working area
• Initial risk: Likelihood 3 (possible) x Severity 4 (serious) = 12 (high)
• Additional controls: Fire blanket used to shield exposed timber during works; 30-minute fire watch after completion; smoke alarms confirmed operational before starting
• Residual risk: Likelihood 2 x Severity 4 = 8 (medium)
• Owner: Plumber | Deadline: Before works commence on each visit

This is specific, realistic, and shows genuine thinking about the task. Compare that to: "Fire risk — wear PPE." One of those gets a pass. The other demonstrates that safety documentation is being done to tick a box.

Common Mistakes When Filling In a Risk Assessment Form

1. Listing hazards without meaningful controls

A hazard with "wear PPE" as the only control measure suggests the assessment was completed in five minutes. The hierarchy of controls exists for a reason: PPE is the last line of defence, not the plan.

2. Being too generic

"Manual handling" is a hazard category, not a hazard. "Lifting and moving 25kg rolls of felt roofing material at height" is a hazard. The more specific the assessment, the more useful it becomes.

3. Copying someone else's assessment

Whether it's a free template or a document from another company, a risk assessment that doesn't reflect your specific workplace is useless in practice and a liability in an investigation.

4. Not involving the people doing the work

Workers who carry out a task daily know more about the real hazards than anyone writing from an office. The best risk assessments are developed with input from the people on the ground.

5. Never reviewing them

A risk assessment is a living document. If the task changes, the environment changes, or new people join — the assessment should be updated. Annual reviews are a minimum. Pre-job reviews on every significant task are better.

The Difference Between Completing a Form and Controlling Risk

Here's something I see regularly: businesses with neatly completed risk assessment forms in a folder on a shelf. The folder stays in the office. The workers on site have never read them. The controls listed haven't been implemented.

That folder is not a safety management system. It's paperwork.

A risk assessment form is only useful if the controls are real, the people doing the work know what they are, and someone is checking they're being followed. The form records the thinking. The safety lives on site.

When I work with businesses on their risk assessment processes, the first question is always: does this document reflect what actually happens out there? If the answer is no, the paperwork provides no protection — and in an investigation, it can make things worse.

Getting Risk Assessment Documentation That Works

If you need risk assessment documentation written specifically for your trade, SafeCompli's trade safety packs include pre-populated risk assessments covering the real hazards your trade faces — not generic lists that could apply to any business.

Each pack includes 16–23 documents in editable DOCX and PDF format, available for instant download at £34.80. Written in plain language, structured for real-world use, and specific to your trade.

Find out more at www.safecompli.co.uk or browse the full range at etsy.com/uk/shop/SafeCompli.