What does avoid, assess, reduce, review mean?
Avoid, assess, reduce, review is a four-stage risk management principle used by UK employers and health and safety practitioners to control workplace hazards. It means: first try to avoid a hazard altogether; where that is not reasonably practicable, assess the risk it poses; reduce that risk using the hierarchy of controls; and then review the controls regularly to make sure they remain effective. It is a practical shorthand for the legal duties set out in the Management of Health and Safety at Work Regulations 1999.
Why this principle matters
Most UK businesses are familiar with the formal five-step risk assessment process (identify hazards, decide who might be harmed, evaluate risks, record findings, review). Avoid, assess, reduce, review sits alongside that process as a simpler mental model — it reminds you that the very first question should always be "can we avoid this risk entirely?" before you even start assessing it. This ordering matters because UK law does not treat risk management as a single flat exercise; it is a hierarchy, and avoidance sits above assessment and control.
According to HSE statistics, an estimated 604,000 workers sustained a non-fatal injury at work in 2022/23, and 1.8 million workers were suffering from a work-related illness. A large proportion of these incidents relate to risks that were foreseeable and, in many cases, avoidable through better planning rather than better paperwork.
Step 1: Avoid the risk
Avoidance is the most effective form of risk control because a risk that does not exist cannot cause harm. In practice, avoiding a risk might mean redesigning a task so that work at height is no longer necessary, choosing a non-hazardous cleaning product instead of a corrosive one, or scheduling deliveries so that vehicles and pedestrians are never in the same space at the same time. Avoidance is closely related to "elimination", the top tier of the hierarchy of controls under Schedule 1 of MHSWR 1999. Before assessing a risk in detail, it is always worth asking whether the activity creating it is actually necessary at all, or whether it can be removed, automated, or restructured.
Step 2: Assess the risk
Where a hazard cannot reasonably be avoided, the next step is to assess it. Under Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 (MHSWR 1999), every employer must make a suitable and sufficient assessment of the risks to the health and safety of employees, and of anyone else who may be affected by their work activities. This means identifying the hazard, working out who could be harmed and how, and judging how likely it is that harm will occur and how severe it could be. This stage is where most formal risk assessment documents are produced, including the risk matrices and scoring systems used to prioritise action. For a full walkthrough of this process, see our ultimate guide to risk assessment.
Step 3: Reduce the risk
Once a risk has been assessed, it must be reduced to the lowest level reasonably practicable. UK law does not permit employers to simply document a risk and move on — Regulation 4 of MHSWR 1999, read alongside Section 2 of the Health and Safety at Work Act 1974, requires action to actually control the risk. Reduction should follow the hierarchy of controls set out in Schedule 1 of MHSWR 1999, in order of preference: elimination, substitution, engineering controls, administrative controls, and personal protective equipment as a last resort. Reducing risk at a lower tier (for example, relying solely on PPE) without first considering higher tiers is a common reason that HSE inspectors reject risk assessments as not "suitable and sufficient".
Step 4: Review the risk
Risk management does not end once controls are put in place. Under Regulation 3(3) of MHSWR 1999, employers must review their risk assessment if they have reason to suspect it is no longer valid, or if there has been a significant change in the matters to which it relates. Common triggers for review include an accident or near-miss, new equipment or substances, a change in the workforce, or new guidance from the HSE. Reviewing is not a box-ticking exercise — it is the mechanism that keeps the avoid-assess-reduce cycle accurate as circumstances change. Many organisations build an annual review into their health and safety calendar as a minimum, in addition to reviewing immediately after any triggering event.
How this links to the 5-step risk assessment process
Avoid, assess, reduce, review is a simplified companion to the formal 5-step risk assessment process recommended by the HSE: identify hazards, decide who might be harmed, evaluate risks and decide on precautions, record findings, and review. The "avoid" stage sits conceptually before "identify hazards" — it asks whether the hazard needs to exist at all. "Assess" and "reduce" map onto evaluating risks and deciding on precautions. "Review" is identical in both frameworks. Understanding both models side by side helps businesses see that risk management is not simply about filling in a form — it is a continuous cycle of avoidance, judgement, control, and monitoring.
Who needs to follow this principle
This principle applies to every UK employer and self-employed person, regardless of size or sector. Our tool helps you check whether you need a formal risk assessment for your specific situation, but the underlying duty to avoid, assess, and reduce risk applies even to sole traders and very small businesses without a single employee, because the duty under MHSWR 1999 extends to anyone affected by the work — including members of the public, clients, and contractors.
Common mistakes with this approach
- Skipping avoidance entirely — jumping straight to control measures without first asking whether the hazard can be removed.
- Treating assessment as a one-off exercise — producing a document once and never revisiting it, even when the workplace changes significantly.
- Reducing risk with PPE first — defaulting to protective equipment before considering elimination, substitution, or engineering controls, which contradicts the Schedule 1 hierarchy in MHSWR 1999.
- No defined review trigger — failing to set a date or event that prompts a formal review, leaving risk assessments to become outdated without anyone noticing.
Turning this principle into a compliant document
Understanding avoid, assess, reduce, review is useful conceptually, but UK law requires employers with five or more employees to record the significant findings of their risk assessment in writing under Regulation 3(6) of MHSWR 1999. Anyrisks turns this four-stage principle into a fully written, regulation-referenced risk assessment document in minutes, covering the hazards specific to your business, the people at risk, and the control measures required at each stage of the hierarchy. See our AI risk assessment generator to produce a compliant PDF and Word document instantly.
Also see: The ultimate guide to risk assessment · Do I need a risk assessment · Risk assessment legal requirements · AI risk assessment generator