Do I need a health and safety risk assessment?
Yes, every employer does, and it is the one assessment the law positively expects you to do yourself. When it has to be written down (the five-employee rule still applies here, unlike fire), what it covers, what a consultant should and should not cost, and what you should not be sold.
This is the starting point for UK workplace compliance. If you're not sure where to begin, start here. Every specific assessment on this site, fire, legionella, asbestos, electrical, hangs off the general duty explained on this page.
Looking for the technical detail? Read the version for professionals → MHSWR 1999, Regulation 3, hierarchy of control, and integration with other regulatory regimes.
Do I need one? Yes. If you employ anyone, or your work could put anyone else at risk, the law requires you to assess the risks.
Do I have to write it down? Once you have five or more employees, yes: the significant findings, by law. Below five, no, but do it anyway, because an assessment you can't produce is an assessment you can't prove.
Do I have to pay someone? For most small businesses, no. This is the assessment the regulator expects you to do yourself, and says so. Where the money should go is in the specific assessments that need specialist knowledge, not here.
What the law actually requires
The Health and Safety at Work etc. Act 1974 places the duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare of employees (section 2) and of anyone else affected by the business (section 3).
The Management of Health and Safety at Work Regulations 1999, regulation 3, turn that into a specific task: every employer and self-employed person must make a suitable and sufficient assessment of the risks to employees and to others arising from the work. Since 2015, self-employed people whose work creates no risk to anyone else are outside the Act.
Regulation 3(6): where you employ five or more people you must record the significant findings of the assessment, and any group of employees identified as being especially at risk.
Below five employees the assessment is still mandatory. Recording it is not. Record it anyway.
Don't confuse this with fire. Since 1 October 2023 a fire risk assessment must be recorded in full whatever your headcount. The five-employee threshold survives for the general health and safety assessment. Two different laws, two different rules, and plenty of websites have muddled them.
- A written health and safety policy (Act, section 2(3)).
- Recorded arrangements for planning, organising, controlling, monitoring and reviewing your preventive measures (Regulations, regulation 5).
- A consultant, for an ordinary low-risk workplace.
- A particular format, template or software.
- A fixed review interval.
- A certificate, badge or "compliance pack".
Employers' liability insurers can ask to see your assessments after a claim, and increasingly ask for them at renewal. Larger clients and public-sector tenders ask for them as a pre-qualification condition, usually with a policy and evidence of training. Those are contractual conditions with their own wording; meet the wording, not the sales pitch that grows up around it.
Northern Ireland: the same duties apply under the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, with the same five-employee threshold.
What this means for your premises
HSE's own position is that risk assessment is about sensible measures to control real risks, not paperwork, and that for most small, low-risk businesses the person who runs the business is the right person to do it. That's the regulator telling you not to buy this.
Where it changes is the nature of the work:
Ordinary workplaces (offices, shops, cafés, salons, small warehouses): general hazards, slips, manual handling, electricity, fire, screen work. Do it yourself.
Higher-risk work (construction, manufacturing, chemicals, working at height, lone working with the public, care): the general assessment is still yours, but the specific assessments need someone who knows the hazard, and the consequences of getting it wrong are serious enough to pay for that.
Specialist assessments (fire, legionella, asbestos, COSHH, noise, vibration): each has its own page on this site and its own rules on who should do it. This page is about the general one that sits above them.
Your options
Option A: do it yourself
Use HSE's free risk assessment template and worked examples for your type of business. Walk the workplace with the people who do the work. Identify the hazards, who could be harmed and how, what you already do about it, what more you should do, who will do it and by when. Write it down, sign it, date it. Review it when something changes and once a year regardless.
Who it fits: the great majority of businesses with fewer than 50 employees in ordinary premises.
Cost: half a day, once, then an hour a year.
Make it real: the most common failure isn't a missing assessment, it's a generic one downloaded from somewhere that doesn't describe your actual workplace. If a fire officer or an inspector reads it and can't recognise your premises, it isn't suitable and sufficient.
Option B: a consultant for the general assessment
A competent consultant visits, assesses, and writes it up with an action plan. Sensible where the work is higher-risk, where you've had an incident or an enforcement visit, where a client or tender demands third-party input, or where nobody in the business is willing to own it.
What to look for: relevant qualifications (NEBOSH General Certificate as a minimum for general work; chartered IOSH membership or OSHCR registration for higher-risk or specialist work), evidence of experience in your sector, and a report that describes your workplace rather than a template with your name typed in.
Cost: £200 to £500 for a small ordinary premises, £500 to £2,000 or more for larger or higher-risk sites.
What most small businesses should actually do
Option A for the general assessment. Spend the money you save on the specific assessments that need expertise: fire, and depending on the building, legionella and asbestos.
How often
Review when there's a significant change: new equipment, new process, new premises, more people, an accident or near miss, or a change in the law. Otherwise once a year, by you, taking about an hour. There is no legal requirement for an annual paid re-assessment, and being sold one for a low-risk workplace is the oldest trick in this market.
What it should cost
Nothing, for most small businesses, beyond your time. Where a consultant is justified, £200 to £500 for small ordinary premises and £500 to £2,000 or more for larger or higher-risk work. A retained "competent person" or advice-line contract is a separate product with a separate price and is not required by law, however it's described on the call.
What you shouldn’t be sold
- "You need a consultant to do your risk assessment." For an ordinary workplace you don't, and the regulator says so.
- The "competent person" service as a legal necessity. The law requires access to competent help. For a low-risk business that can be you or a trained manager. A retained consultancy is a choice, not a requirement.
- A pack of generic template assessments. Forty documents that don't describe your workplace are worth less than one that does.
- Annual paid re-assessment. The annual job is your own review. A paid re-assessment is for when something significant has changed.
- An advice line on a three- or five-year term. Work out how many times you'll actually call it, then price the contract per call. Then read the notice clause.
- A "certificate of compliance". There is no such document. The assessment and the policy are the documents.
Check what else your business needs
This general assessment tells you which specific assessments you need. The ones almost every premises needs are fire risk assessment and, where there's a water system, legionella. Run the Compliance Check to see the full list for your kind of business.
Sources
- Health and Safety at Work etc. Act 1974, sections 2 and 3 — legislation.gov.uk
- Management of Health and Safety at Work Regulations 1999, regulations 3, 5 and 7 — legislation.gov.uk
- HSE, Risk assessment: steps needed to manage risk — hse.gov.uk
- HSE, Risk assessment template and examples — hse.gov.uk
- HSE, Health and safety policy — hse.gov.uk
- Deregulation Act 2015, section 1 (self-employed exemption)
- Management of Health and Safety at Work Regulations (Northern Ireland) 2000
Quick answers
- Is a health and safety risk assessment a legal requirement in the UK?
- Yes. The Management of Health and Safety at Work Regulations 1999 require every employer, and most self-employed people, to assess the risks to their workers and to anyone else affected by their work.
- Do I need to write down my risk assessment?
- By law, once you have five or more employees you must record the significant findings and any group of employees identified as especially at risk. Below five it is not a legal requirement to write it down, but you still have to do the assessment, and writing it down is the only way to prove you did. This is different from a fire risk assessment, which must now be recorded in full whatever your size.
- Can I do a risk assessment myself?
- Yes. HSE says so directly and provides free templates for it. For a low-risk business such as an office, a shop or a café, the owner or a sensible manager is usually the right person, because they know the work. You need a consultant for higher-risk or specialist work, not for the general assessment of an ordinary workplace.
- What are the different types of risk assessment?
- The general health and safety risk assessment is the starting point. Specific assessments then cover particular hazards: fire, legionella, asbestos, COSHH for chemicals, DSE for screen work, manual handling, noise and vibration. Most workplaces need the general one plus two or three specific ones.
- How often should a risk assessment be reviewed?
- The law says review it when there is reason to think it is no longer valid or when there has been a significant change. There is no statutory interval. An annual review is sensible practice and costs you an hour. A paid annual re-assessment is not required.
- How much does a risk assessment cost?
- Doing it yourself costs your time. A consultant for a small, ordinary premises typically charges £200 to £500. Higher-risk or larger sites, £500 to £2,000 or more. If you are being quoted for a general risk assessment of a low-risk office, ask why you are not doing it yourself.
- Do I need a health and safety policy as well?
- If you have five or more employees you must have a written health and safety policy. Below five you must still have a policy but it does not have to be written. The risk assessment and the policy are different documents that reference each other.
- What happens if I do not do a risk assessment?
- It is a breach of the Regulations and, if someone is hurt, it is the first thing an HSE inspector, an insurer or a claimant solicitor will ask for. Fines are unlimited. Not having one also makes any other compliance you have bought much harder to defend.
- What is a competent person and do I have to appoint one?
- The law requires you to have access to competent help with health and safety. For a low-risk business that can be you, or a manager, with some basic training. You do not have to buy a retained consultancy service to satisfy it, whatever the sales call says.
- Do landlords need risk assessments?
- If a landlord employs people, or controls premises where others work, yes. A landlord of commercial premises typically holds the assessments for common parts and the building fabric; tenants hold them for their own activities.
This is general information about UK compliance, written for the person paying the bill. It isn’t legal advice. If your situation is unusual, get a professional to look at it.