To do a risk assessment, you need to understand what, in your business, might cause harm to people and decide whether you are doing enough to prevent that harm. Once you have decided that, you need to identify and prioritise putting in place, appropriate and sensible control measures.

Start by:

• identifying what can harm people in your workplace;
• identifying who might be harmed and how;
• evaluating the risks and deciding on the appropriate controls, taking into account the controls you already have in place;
• recording your risk assessment;
• reviewing and updating your assessment.

This is not the only way to do risk assessment as there are no fixed rules about how a risk assessment should be carried out. 

Principles of sensible risk management

1. Sensible risk management is about:
   • Ensuring that workers and the public are properly protected
   • Providing overall benefit to society by balancing benefits and risks, with a focus on reducing real risks – both those which arise more often and those with serious consequences
   • Enabling innovation and learning not stifling them
   • Ensuring that those who create risks manage them responsibly and understand that failure to manage real risks responsibly is likely to lead to robust action
   • Enabling individuals to understand that as well as the right to protection, they also have to exercise responsibility

1. Sensible risk management is not about:
   • Creating a totally risk free society
   • Generating useless paperwork mountains
   • Scaring people by exaggerating or publicising trivial risks
   • Stopping important recreational and learning activities for individuals where the risks are managed
   • Reducing protection of people from risks that cause real harm and suffering

The principles were launched by Bill Callaghan, Chair of the Health and Safety Commission in August 2006

This page contains public sector information published by the Health and Safety Executive and licensed under the Open Government Licence v1.0’.