How to Conduct a Risk Assessment: 5 Steps, Example and Template

A workplace risk assessment is a structured check of what in your work could harm people, how likely and how serious that harm would be, and whether you are doing enough to prevent it. It follows five steps:

1. Identify the hazards.
2. Decide who might be harmed and how.
3. Evaluate the risks.
4. Control the risks.
5. Record and review.

In most countries it is a legal duty: under the UK Management of Health and Safety at Work Regulations, the EU Framework Directive, Turkey's Law No. 6331 and ISO 45001, the employer must carry one out. This guide walks through each step, shows a complete worked example, and gives you a template you can use today.

---

Hazard vs Risk: The Distinction That Drives Everything

A hazard is anything with the potential to cause harm: a rotating shaft, a solvent, a ladder, a night shift. A risk is the chance that the hazard actually causes harm, combined with how serious that harm would be.

The distinction matters because you do not assess hazards, you assess risks. The same hazard carries very different risk depending on the situation:

Hazard	Low-risk situation	High-risk situation
Solvent-based cleaner	Small quantity, used outdoors, gloves worn	Used daily in a confined, unventilated tank
Ladder	Short job, three points of contact, footed	Carrying materials, overreaching, on a slippery floor
Forklift	Segregated route, trained driver	Shared aisle with pickers, blind corners

A risk assessment asks, for each hazard, "given how the work is actually done here, is the risk adequately controlled?"

---

What the Law Requires

Risk assessment is a legal requirement almost everywhere. The details differ:

Jurisdiction	Requirement	Key detail
United Kingdom	Management of Health and Safety at Work Regulations 1999, Reg. 3	Must be "suitable and sufficient"; employers with five or more employees must record the significant findings
European Union	Framework Directive 89/391/EEC	Employers must evaluate risks and be in possession of an assessment of the risks
Turkey	Law No. 6331 (Art. 10) and the Risk Assessment Regulation	Done by a team (Art. 6); renewed at the latest every 2, 4 or 6 years for very hazardous, hazardous and less hazardous workplaces (Art. 12)
United States	No single general requirement	Specific standards require it, such as the written PPE hazard assessment in 29 CFR 1910.132(d) and process hazard analysis under PSM. The General Duty Clause covers recognized hazards
ISO 45001	Clause 6.1.2	Ongoing hazard identification and assessment of OH&S risks

"Suitable and sufficient" does not mean perfect. It means the assessment identifies the significant risks, is proportionate to the work, involves the people who do the work, and leads to real controls.

---

The 5 Steps of Risk Assessment

Step 1: Identify the Hazards

The goal is a complete list of what could cause harm, not just the obvious. Use several sources, because each one catches different hazards:

• Walk the workplace at different times and shifts. Watch the work as it is really done, not as the procedure describes it.
• Talk to the people doing the job. They know about the workarounds, the jammed guard, the job that only happens on Fridays.
• Review records: incident and near-miss reports, first-aid logs, sickness absence, maintenance history.
• Check manufacturer information: equipment manuals and safety data sheets for every chemical.
• Think beyond normal operation: start-up, cleaning, maintenance, breakdowns, and emergencies.

Group what you find so nothing is missed:

Category	Examples
Mechanical	Moving parts, nip points, falling objects, vehicles
Physical	Noise, vibration, heat, radiation, working at height, slips and trips
Electrical	Damaged cables, live work, overloaded sockets
Chemical	Solvents, dusts, fumes, gases (see chemical safety)
Biological	Bacteria, viruses, mold, bodily fluids
Ergonomic	Manual handling, repetitive tasks, poor posture (see ergonomics)
Psychosocial	Workload, lone working, violence, shift patterns

For tasks with several distinct steps, break the task down first with a job safety analysis.

Step 2: Decide Who Might Be Harmed and How

For each hazard, name the groups at risk and the way they could be hurt. "Staff" is not specific enough; "maintenance fitters clearing jams on line 2 could have fingers drawn into the conveyor" is.

Pay particular attention to:

• New and young workers, who lack experience of the hazards.
• Pregnant and breastfeeding workers, for chemical, physical and manual handling risks.
• Workers with disabilities or health conditions.
• Contractors, agency staff and visitors, who do not know your site (see contractor safety).
• Lone workers and night shifts.
• Members of the public near your operations.

Step 3: Evaluate the Risks

Now decide how big each risk is, taking into account the controls already in place. Two approaches dominate:

• A risk matrix (typically 5×5) multiplies likelihood by severity.
• The Fine-Kinney method multiplies Probability × Frequency × Consequence, which separates how often people are exposed from how likely harm is on each exposure.

Whichever you use, write down the scale definitions and use them consistently. Two assessors should give the same hazard roughly the same score. For a comparison of scoring methods, see quantitative vs qualitative risk assessment.

This guide's example uses Fine-Kinney, with these action bands:

Score (R)	Risk level	Required action
> 400	Very high	Stop work immediately
200–400	High	Urgent corrective action
70–200	Significant	Corrective action required
20–70	Possible	Attention needed
< 20	Acceptable	No immediate action

Step 4: Control the Risks

For every risk that is not acceptable, decide what more is needed. Work down the hierarchy of controls and do not jump straight to PPE:

1. Elimination: remove the hazard (do the task differently, at ground level, or not at all).
2. Substitution: replace it with something less hazardous (a water-based product, a lighter component).
3. Engineering controls: isolate people from the hazard (guards, interlocks, local exhaust ventilation, edge protection).
4. Administrative controls: change how people work (procedures, permits, training, rotation, signage).
5. Personal protective equipment: the last line of defense, used alongside higher controls.

The test is not "is there a control?" but "have we done everything reasonably practicable?" The ALARP principle explains how to judge that. Every new control needs an owner, a deadline and a way to check it works, managed as a corrective action.

Step 5: Record and Review

Record the significant findings: the hazards, who is at risk, the existing controls, the risk score, the further actions, their owners and deadlines. In the UK this is mandatory for employers with five or more employees. In practice, an unrecorded assessment cannot be checked, audited or improved.

Review the assessment:

• when the work, equipment, materials, layout or people change;
• after an incident, near miss or occupational illness;
• when monitoring shows controls are not working;
• when new information about a hazard appears;
• at the renewal interval set by your regulator. In Turkey this is at the latest every 2, 4 or 6 years depending on the hazard class; elsewhere, set your own interval proportionate to the risk.

---

Worked Example: Risk Assessment for a Metal Fabrication Workshop

The example below is illustrative: a 20-person workshop that cuts, bends and welds mild steel. It uses the Fine-Kinney scales from our method guide:

• P = probability (0.1–10)
• F = frequency of exposure (0.5–10)
• C = consequence (1 = first aid … 15 = one fatality … 100 = many fatalities)

#	Hazard	Who / how harmed	Existing controls	P × F × C = R (before)	Further controls	P × F × C = R (after)	Owner / due
1	Welding fume from MIG welding indoors	Welders and nearby staff; inhaling fume causes respiratory disease	General ventilation, disposable dust masks	6 × 10 × 7 = 420 Very high	On-torch fume extraction on all sets; fit-tested powered respirators; exposure monitoring	0.5 × 10 × 7 = 35 Possible	Production manager, 2 weeks
2	Damaged extension leads and trailing cables	All shop-floor staff; electric shock	Visual check "when noticed"	3 × 6 × 15 = 270 High	Fixed sockets at each bench; RCD protection; pre-use checks; periodic testing	0.5 × 6 × 15 = 45 Possible	Maintenance lead, 1 week
3	Loading the mezzanine storage area	Storemen; fall of about 3 m from an open edge	Painted edge line	3 × 3 × 15 = 135 Significant	Fixed edge protection and a pallet safety gate	0.2 × 3 × 15 = 9 Acceptable	Site manager, 3 weeks
4	Angle grinder disc burst or kickback	Operators and bystanders; eye and face injuries, cuts	Safety glasses	3 × 6 × 7 = 126 Significant	Guard condition in pre-use check; discs rated for the tool speed; face shields; screened grinding bay	0.5 × 6 × 7 = 21 Possible	Supervisor, 2 weeks
5	Manual handling of steel sheets	Fabricators; back injury	Two-person lift rule	6 × 6 × 3 = 108 Significant	Vacuum sheet lifter and sheet trolley; manual handling training	1 × 6 × 3 = 18 Acceptable	Production manager, 4 weeks
6	Noise from press brake and hammering	All shop-floor staff; noise-induced hearing loss	Ear plugs available	6 × 6 × 3 = 108 Significant	Noise survey; hearing protection zone with signage; quieter forming methods; health surveillance	1 × 6 × 3 = 18 Acceptable	HSE advisor, 4 weeks

Four things to notice:

• The order of action follows the score, not the order of discovery. Welding fume (420) is dealt with first even though it had "controls".
• Most of the reduction comes from engineering controls: extraction, edge protection, lifters, RCDs. PPE is added, not relied on.
• Residual risks in the "possible" band are accepted consciously. They stay on the register and are monitored, not forgotten.
• Each action has an owner and a date. Without that, the table is a description of risk, not a plan to reduce it.

For more scored examples across construction, warehousing and laboratories, see Fine-Kinney risk assessment examples.

---

Risk Assessment Template

Use these columns for your own register. They cover what regulators and ISO 45001 auditors expect to see:

Column	What to write
Ref. no.	A unique number for tracking
Area / task	Where and during which activity
Hazard	The source of harm, specifically
Who might be harmed and how	The groups at risk and the injury or illness
Existing controls	What is already in place and working
Risk before (P, F, C, R or L × S)	Scored with your written scale
Further controls needed	Following the hierarchy of controls
Risk after	The expected residual score
Action owner	A named person, not a department
Due date	A realistic deadline
Date completed / verified	When done, and how effectiveness was checked
Review date	The next scheduled review

Keep the assessment specific to your site. A generic assessment copied from another workplace fails the "suitable and sufficient" test, because it describes someone else's hazards.

---

Common Risk Assessment Mistakes

Copying a generic assessment. Downloaded templates list hazards that may not exist on your site and miss the ones that do.

Assessing the procedure instead of the practice. If the guard is propped open every afternoon, the risk is the one with the guard open.

Not involving the workers. The people doing the task know about the shortcuts, the equipment faults and the conditions that change on night shift.

Scoring without definitions. "Likelihood 3" means nothing unless everyone uses the same written scale.

Going straight to PPE. Gloves and glasses are the weakest controls. Look for elimination and engineering first.

Actions without owners. A list of "further controls" with no names or dates is rarely implemented.

Filing it and forgetting it. An assessment that is never reviewed describes a workplace that no longer exists.

---

How FindRisk Speeds Up Risk Assessment

FindRisk is built for the on-site part of the process. Describe the area or task and the AI generates a tailored hazard checklist, which you can edit and save as your own template. You then mark hazards directly on photos and use AI analysis to spot anything you might have missed. Each risk is scored with Fine-Kinney, and a professional PDF report with the findings, recommended controls and deadlines is ready before you leave the site.

---

Frequently Asked Questions

How often should a risk assessment be reviewed?

Whenever something significant changes: the work, equipment, materials, layout or people. Also after an incident or near miss, and when monitoring shows controls are not working. Some jurisdictions set a maximum interval; in Turkey the assessment must be renewed at least every two, four or six years for very hazardous, hazardous and less hazardous workplaces respectively. Where no interval is set, choose one proportionate to the risk.

Who should carry out a risk assessment?

A competent person: someone with enough training, knowledge and experience of the work and its hazards. The best assessments are done by a small team that includes the people who actually do the work. In Turkey the Risk Assessment Regulation requires a team that includes the employer or their representative, the occupational safety specialist, the workplace doctor, employee representatives, and employees who know the work.

Does a risk assessment have to be written down?

In the UK, employers with five or more employees must record the significant findings. Many other jurisdictions and ISO 45001 also expect documented information. Even where it is not strictly required, a written assessment is the only way to show what was considered, track actions and review it later.

What is the difference between a hazard and a risk?

A hazard is something with the potential to cause harm, such as a chemical, a moving machine or work at height. A risk is the likelihood that the hazard will actually cause harm, combined with how severe that harm could be. The same hazard can be low or high risk depending on how the work is done and what controls are in place.

Which risk assessment method should I use?

For most workplaces, a 5×5 risk matrix or the Fine-Kinney method is sufficient. Use a job safety analysis for multi-step tasks and a HAZOP study for complex process plant. Where a single number is not enough, use quantitative methods. The best method is the one your team applies consistently with written scale definitions.

What makes a risk assessment "suitable and sufficient"?

It identifies the significant hazards and risks, considers everyone who could be affected, reflects how the work is really done, and is proportionate to the level of risk. It also leads to control measures that are actually implemented. It does not need to cover trivial risks or be perfect, but it must be specific to your workplace.

---

Conclusion

A risk assessment is not a form to complete once and file. It is the way you decide, hazard by hazard, whether people are protected well enough, and what to do when they are not.

The five steps are simple: identify, decide who could be harmed, evaluate, control, record and review. What makes an assessment good is how honestly it reflects the real work, how consistently the risks are scored, and whether every action has an owner and a date.

Download FindRisk to carry out your next risk assessment on-site, from AI-generated hazard checklists and photo markup to Fine-Kinney scoring and a finished report.