HSE Risk Assessment Template: What You Actually Need to Comply

Most businesses have a risk assessment. Most of those risk assessments wouldn't survive an HSE inspection.

Not because the people who wrote them didn't care, but because nobody explained what "suitable and sufficient" actually means in practice. I've reviewed risk assessments across dozens of sectors over 25 years, and the same problems keep showing up: vague hazard descriptions, controls copied from a template someone found online, risk ratings with no rationale behind them, and signatures from people who weren't on site when the assessment was written.

Here is what the HSE actually requires, what your template needs to capture, and where most businesses fall down.

The Legal Standard: "Suitable and Sufficient"

The duty to carry out a risk assessment comes from Regulation 3 of the Management of Health and Safety at Work Regulations 1999 (MHSWR). Every employer must make a suitable and sufficient assessment of the risks to health and safety arising from their work activities.

That phrase does a lot of heavy lifting. It means two distinct things:

• Suitable: The assessment must be appropriate to the nature of the work and the level of risk involved. A sole trader plumber working in domestic properties needs a different assessment to a contractor managing multiple operatives on a large industrial site. Proportionality is built into the standard.
• Sufficient: It must be detailed enough to identify all significant risks and the control measures required. It does not need to be exhaustive, but it must be realistic about what can go wrong.

The HSE is also clear on documentation: if you employ five or more people, you must record the significant findings in writing. If you employ fewer than five, a written record is still best practice, especially if something goes wrong.

The HSE 5-Step Risk Assessment Process

The HSE sets out a five-step framework for completing a risk assessment. It has been the standard for decades and it has not changed because it works.

Step 1: Identify the Hazards

Walk the work area, observe the tasks, and think about what could realistically cause harm. Common hazards include manual handling, working at height, exposure to hazardous substances, slips and trips, use of tools and plant, and electrical risks. Be specific. "Working at height" is not a hazard description. "Use of an extension ladder on uneven ground in a domestic rear garden" is.

Step 2: Decide Who Might Be Harmed and How

Think beyond your own employees. Sub-contractors, visitors, members of the public, and people with specific vulnerabilities — new starters, pregnant workers, young workers — all need to be considered where relevant. The assessment should name actual categories of people, not just say "workers."

Step 3: Evaluate the Risks and Decide on Precautions

Assess likelihood and severity, then identify what control measures are needed. The hierarchy of control applies here: eliminate the hazard first, then substitute, then engineer out, then administrative controls, then PPE as a last resort. PPE is not a default answer.

Step 4: Record Your Findings and Implement Them

Write it down. Record the hazards, who is at risk, what controls are in place, and any further actions required. The record must reflect how work is actually done, not how a template assumes it is done.

Step 5: Review and Update

A risk assessment is not a one-off document. Review it when working conditions change, after any incident or near-miss, and at regular intervals. A document dated 2019 that has not been touched since is not a live risk assessment.

What a Compliant HSE Risk Assessment Template Must Include

Any template you use must capture the following:

• Business/site/task details: Company name, assessment date, person carrying out the assessment, location or task description
• Hazard identification: Specific hazards identified for the activity or environment
• Persons at risk: Who could be harmed and in what circumstances
• Existing controls: What is already in place
• Residual risk rating: Likelihood and severity after controls are applied — not before
• Further actions required: Additional controls needed, with a named responsible person and a target date
• Review date and authorisation: Who signed off the assessment and when it will next be reviewed

The HSE publishes a free downloadable template on its website covering these basics. But a blank template is only the starting point. The real work is in how accurately it reflects your specific activities.

Common Mistakes That Make Risk Assessments Non-Compliant

Here are the failures I see most often in practice.

Copying a generic template without adapting it

A risk assessment that could describe any business in any sector is not suitable and sufficient. "Slip hazard — wear appropriate footwear" tells an inspector nothing about your specific workplace or the controls you have actually implemented.

Listing controls that are not in place

Writing "all workers are trained" when no training records exist, or "PPE is provided" when the site tells a different story, creates far more legal exposure than having no risk assessment at all.

No review after incidents or changes in working method

If you have moved to a new site, changed your work process, or had a near-miss and the assessment has not been updated, it no longer reflects reality. That is when it fails.

Treating it as a filing exercise

Risk assessments need to be communicated to the people doing the work. A document locked in a van or a filing cabinet that workers have never seen does not manage risk. It generates paperwork.

Over-relying on PPE as the primary control measure

If every hazard in your assessment resolves to "wear gloves" or "use hi-vis," it will not hold up under scrutiny. The hierarchy of control must be evidenced, and PPE sits at the bottom of that hierarchy for a reason.

Rating initial risk rather than residual risk

The risk rating in your assessment should reflect the level of risk after controls are applied. Many assessments rate the initial, uncontrolled risk and leave it unchanged, which means the controls have not been factored in at all.

Practical Guidance for Smaller Businesses and Tradespeople

The HSE is explicit about proportionality. A sole trader or small employer does not need a 30-page document. What is needed is an accurate document that covers your specific activities.

For a heating engineer working in domestic properties, a set of task-specific risk assessments covering boiler installations, gas pipework, confined spaces, and manual handling — completed properly and reviewed regularly — will generally satisfy the standard.

For a small team, trade-specific risk assessments covering your core activities are far more useful than a single catch-all document that nobody reads and that does not reflect what anyone actually does on site.

The practical test is this: could you show an HSE inspector a document that accurately reflects how your business manages risk, written by someone who understands your actual work? If not, it is worth addressing that now.

Get Your Risk Assessments in Order

Our trade-specific safety packs at etsy.com/uk/shop/SafeCompli include pre-populated risk assessments, policies, and toolbox talks tailored to specific trades — roofers, plumbers, heating engineers, electrical contractors, scaffolders, tilers, painters and decorators, and commercial cleaners. Each pack is £34.80, instantly downloadable, and fully editable in Word and PDF format.

For more tailored support with risk assessment compliance and health and safety documentation, visit www.safecompli.co.uk.