IOSH Risk Assessment Example: What One Actually Looks Like in Practice

People search for "IOSH risk assessment example" for different reasons. Some are working through the IOSH Managing Safely practical project and need to understand the expected format. Others are safety managers trying to benchmark whether their existing assessments meet a recognised professional standard. And some are business owners who have been told their documentation needs to be "more IOSH standard" and are not sure what that means.

This post covers all three: what IOSH says about risk assessment, how the IOSH approach maps to the HSE's five-step framework, and a worked example for a trade business.

What IOSH Says About Risk Assessment

IOSH (the Institution of Occupational Safety and Health) is the world's largest professional body for health and safety. It does not publish a separate legal framework for risk assessment. It operates within UK law, which sets the requirement through Regulation 3 of the Management of Health and Safety at Work Regulations 1999. The standard remains "suitable and sufficient."

What IOSH provides is structured professional training. IOSH Managing Safely, the most widely taken health and safety qualification for managers and supervisors in the UK, requires delegates to complete a practical risk assessment project as part of their final assessment. That project tests whether the learner can correctly identify hazards, evaluate risk, select appropriate controls, and document findings in a way that reflects genuine thinking — not just a completed template.

The IOSH approach therefore maps closely onto HSE guidance, but places a higher emphasis on the quality of reasoning at each step.

How the IOSH Approach Aligns with the HSE 5-Step Model

There is a common misconception that IOSH has its own distinct risk assessment methodology. It does not. The five steps remain exactly as HSE guidance sets them out:

1. Identify hazards — what could cause harm in the specific task or environment
2. Decide who might be harmed and how — employees, contractors, visitors, members of the public
3. Evaluate the risks — assess likelihood and severity; consider what controls are already in place
4. Record your findings — document the assessment in a usable, accessible format
5. Review — update when circumstances change, after incidents, and at scheduled intervals

What IOSH's training adds is depth at each stage. A Managing Safely assessor is not expected to list a hazard and move on. They are expected to describe the specific condition that creates the hazard, identify the specific people at risk, explain the reasoning behind chosen controls using the hierarchy of control, and set a residual risk rating that reflects real conditions after those controls are applied.

The Hierarchy of Control

The hierarchy of control is central to the IOSH approach, and it is one of the clearest ways to identify whether an assessment has been properly thought through:

1. Eliminate the hazard entirely where possible
2. Substitute with a less hazardous alternative
3. Engineer controls — guarding, extraction, barriers, isolation
4. Administrative controls — safe systems of work, training, supervision, permits
5. Personal Protective Equipment — the last resort, not the first

If your assessments jump to PPE for every significant hazard without working through the steps above, they will not meet IOSH standards. They will not meet HSE standards either. Both frameworks point to the same place.

A Worked Example: Heating Engineer Completing a Boiler Replacement

Here is what an IOSH-standard risk assessment looks like for a practical trade activity.

Task: Removal of existing boiler and installation of new condensing boiler, including gas pipework modifications, in a domestic property.

Hazard 1: Manual handling — lifting the old boiler

Who is at risk: Engineer/operative

Likelihood before controls: High — awkward shape, wall-mounted unit, confined working space

Severity: High — back injury, muscular strain, crush injury if dropped

Existing controls: None specific to this task

Additional controls required:

• Assess weight and dimensions before attempting to move
• Use mechanical aid (trolley or pipe rollers) where unit exceeds 20kg
• Two-person lift for heavy or awkward units
• Clear route to exit point before disconnection begins
• Brief all operatives on lifting technique before work starts

Residual risk: Low-Medium

Action owner: Site supervisor

Review date: 6 months or after any manual handling incident

Hazard 2: Gas leak — pipework modification

Who is at risk: Engineer, building occupants, neighbours

Likelihood before controls: Low (Gas Safe registered operative working to procedure)

Severity: Very High — fire, explosion, carbon monoxide poisoning

Initial risk: High

Existing controls: Gas Safe registration; trained operative

Additional controls required:

• Confirm Gas Safe registration is current before work begins
• Isolate supply at meter and verify isolation with appropriate pressure gauge
• Carry out soundness and tightness test before re-commissioning
• Fit and test CO alarm before handover
• Inform building occupant of testing process and expected duration

Residual risk: Low

Action owner: Responsible engineer

Review date: Annually or after any near-miss involving gas

Hazard 3: Electrical isolation — removal of boiler supply

Who is at risk: Engineer

Likelihood before controls: Medium — multiple circuits, consumer unit access required

Severity: High — electric shock, cardiac arrest, fatal in worst case

Initial risk: High

Existing controls: Operative competence in electrical isolation

Additional controls required:

• Isolate boiler electrical supply at consumer unit
• Apply lock-off device where accessible
• Test with approved voltage indicator before touching any terminals
• Do not rely on visual inspection or switch position alone

Residual risk: Low

Action owner: Operative

Review date: Task-specific, reviewed at each new property

This is the level of specificity that both IOSH and HSE expect. The difference between this and a generic template entry is that it describes the actual conditions, the real people involved, and controls that are genuinely achievable in the working environment.

What Makes a Risk Assessment "IOSH Standard" in Practice

Based on the above, an IOSH-standard assessment:

• Describes each hazard specifically — not "manual handling" but what type, in what context, doing what
• Names real roles or categories of people at risk, rather than just "workers"
• Works through the hierarchy of control and documents why controls were selected
• Sets residual risk ratings that reflect conditions after controls are in place, not before
• Assigns actions to named individuals with realistic completion dates
• Is accessible to the people doing the work — not filed away after completion

Length is not a measure of quality. A well-constructed task-specific assessment might run to two pages. The test is whether it accurately reflects real working conditions and was written by someone who understands the work.

Get the Right Templates for Your Trade

If you are trying to get your risk assessments to a professional standard, the starting point is having the right template for your specific trade, not a generic document that fits no-one in particular.

Our trade-specific safety packs include pre-populated risk assessments, COSHH assessments, toolbox talks, and policies tailored to individual trades. Available for heating engineers, plumbers, electrical contractors, roofers, painters and decorators, scaffolders, tilers, and commercial cleaners. Each pack is £34.80, instantly downloadable and editable. Visit etsy.com/uk/shop/SafeCompli to see what is included for your trade.

For consultancy support or a review of your existing risk assessment documentation, visit www.safecompli.co.uk.