Assessing risks
The five steps
A risk assessment follows a simple sequence: 1) identify the hazards; 2) decide who might be harmed and how; 3) evaluate the risks and decide on precautions; 4) record the significant findings and implement them; 5) review and update. Step 4 is where assessments usually fail - a document that sits in a folder but is not implemented is worthless.
Risk is normally scored as likelihood x severity, giving a number on a simple matrix (commonly 5 x 5). The score is not the point; the decisions it drives are. Risk assessments must be suitable and sufficient - proportionate to the risk, covering the significant hazards, identifying the controls and the people exposed. They do not need to be perfect or exhaustive.
Who might be harmed must include people who are not your long-serving employees: young and inexperienced workers, new and expectant mothers, people with disabilities, lone workers, contractors, visitors, the public, and people who clean or maintain equipment out of hours.
Record who is responsible for each action and by when. Review when something changes: new equipment or process, new chemicals, new staff or premises, an incident or near miss, or a change in legislation. A generic 'company-wide' assessment is not sufficient for a task with its own specific hazards.
Traps: writing the assessment but not acting on it; forgetting review triggers; ignoring non-employees; judging risk behind a desk rather than in the workplace; assuming a high score can simply be accepted without further controls.
Rule of thumb: if you cannot point to the control on the shop floor, it is not in place.