The purpose of risk assessment and the "suitable and sufficient" standard

Risk assessments are an essential part of an OHS management system. They make a safer and healthier workplace possible, and in particular they help to:

• raise awareness of hazards and risk
• identify who may be at risk, such as employees, cleaners, visitors, contractors and the public
• decide whether a control programme is needed for a particular hazard
• decide whether existing controls are adequate or more should be done
• prevent injuries and illnesses, especially when done at the design or planning stage
• prioritise hazards and control measures
• meet legal requirements where they apply

A risk assessment must be suitable and sufficient. It should show that:

• a proper check was made
• everyone who might be affected was identified
• all the obvious significant risks were dealt with, taking account of how many people could be involved
• the precautions are reasonable and the remaining risk is low
• workers or their representatives took part

The detail should be proportionate to the risk and suited to the nature of the work. Insignificant risks can usually be ignored, as can risks from ordinary daily life, unless the work activity makes them worse or significantly changes them. The assessment should include only what you could reasonably be expected to know, since nobody is expected to foresee the unforeseeable.

A general approach: five steps

Step 1: identify hazards

Methods include:

• Area inspection. Walk around the workplace and observe. What about the activities, practices, processes, plant and equipment, substances or general state of the premises could injure employees or harm their health?
• Sources and forms of harm. Some hazards have a well-recognised risk of harm, such as working at height and electricity. Depending on the work there may be others relevant to the business. Remember long-term hazards to health, such as high noise levels or exposure to harmful substances.
• Sources of information. Information comes from two main places.

• Task analysis. Identify hazards for the different states of operation. Break the job into smaller steps and identify the hazards of each step. This finds more hazards than looking at the job as a whole, and complex activities should be broken into component parts.
• Legislation. Check applicable regulations, which may also describe the hazards.
• Manufacturers' instructions and data sheets. For chemicals and equipment these explain the hazards and put them in perspective.
• Incident data. This often reveals the less obvious hazards.
• Non-routine operations. Include maintenance, cleaning and changes in production cycle.
• Talk to workers. Involve employees in hazard identification and risk assessment, because they usually have good ideas.
• Guidance. More detailed guidance on identifying hazards and controlling the risks of specific hazards is available from sources such as the HSE website and Managing for health and safety (HSG65).

Step 2: identify people at risk

For each hazard, think about how employees (including operators, cleaners and maintenance staff), contractors, visitors or members of the public might be harmed.

Some workers are more vulnerable and have particular needs, for example young workers, migrant workers, new or expectant mothers, lone workers and people with disabilities.

Step 3: assess the risks, taking account of what you already do, and decide whether you need to do more

Once hazards are identified, decide how likely it is that someone could be harmed and how serious the harm could be. This is assessing the level of risk. Decide:

• who might be harmed and how
• what you are already doing to control the risk
• what further action is needed
• who needs to carry it out
• when it is needed by

Risk is the chance, high or low, that somebody could be harmed by the hazards found in Step 1, together with an indication of how serious the harm could be. A risk factor is something that can increase the chance of the hazard occurring. Judge both the likelihood of harm, such as an injury or illness, and its severity.

• Consider normal operations and also non-standard events such as maintenance, shutdowns, power cuts, emergencies and extreme weather.
• Review all available health and safety information on the hazard: the SDS, manufacturers' literature, reputable organisations, test results, inspection reports, and incident records (type and frequency of accidents, illnesses, injuries and near misses).
• Understand the minimum legal requirements where you work.

Each hazard should be studied to find its level of risk. Look at:

• product information and manufacturers' documents
• past experience, including knowledge held by workers
• legislative requirements and applicable standards
• industry codes of practice and best practice
• safety data sheets, research studies or other manufacturer information about the hazard
• information from reputable organisations
• test results, such as air sampling or biological swabs
• the expertise of an occupational health and safety professional
• information on previous injuries, illnesses, near misses and incident reports
• observation of the process or task

Also include the factors that contribute to the level of risk:

• the work environment, including layout and condition
• the systems of work in use
• the range of foreseeable conditions
• the way the source may cause harm (for example inhalation or ingestion) and the acute and chronic effects
• how often and how much a person will be exposed
• the interaction, capability, skill and experience of the workers doing the job

A common approach is to split risk into its two parts and rate each separately:

A matrix can help compare priorities, but its score does not determine legal compliance or give permission to continue unsafe work. The table below gives illustrative responses; apply hazard-specific guidance, mandatory controls and competent judgement regardless of the score. The summary notes group hazard/people identification together and risk assessment/control separately; this chapter groups the same actions differently within five steps.

The HSE website carries a lot of guidance on risk assessment.

Residual risk is the risk remaining after the controls being assessed are taken into account. It can still be unacceptable and require more action. Do not subtract risk-matrix scores as though they were precise physical quantities.

Tolerable risk does not mean acceptable. It describes an organisation's willingness to live with a risk in order to secure certain benefits, in the confidence that the risk is worth taking and is being properly controlled.

Look at what you already do and the controls already in place, and ask:

• Can I get rid of the hazard altogether?
• If not, how can I control the risks so that harm is unlikely?

Summary notes for Element 3 · Cheat sheet · Glossary. A study aid, not published or endorsed by NEBOSH.