Free tool

Do I need a risk assessment?

Answer three quick questions and get a clear, regulation-backed answer for your situation — in under 60 seconds.

Question 1 of 30%

How many people work at your organisation?

Include employees, workers, contractors and self-employed people who work under your control.

Why risk assessments matter

The duty to assess workplace risks sits primarily in Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 (MHSWR), which requires every employer — and most self-employed people — to make a “suitable and sufficient” assessment of the risks to which employees and others may be exposed. This is not optional guidance: it is a statutory requirement enforceable by the Health and Safety Executive (HSE) and local authority Environmental Health Officers.

The Health and Safety at Work etc. Act 1974 provides the broader framework, requiring employers to ensure, so far as is reasonably practicable, the health, safety and welfare of all employees (s.2) and of others affected by their work (s.3). Risk assessments are the primary mechanism through which organisations demonstrate compliance with this duty.

Sector-specific regulations add further layers. Construction projects above a certain threshold trigger duties under the Construction (Design and Management) Regulations 2015 (CDM 2015). Workplaces with hazardous substances must comply with the Control of Substances Hazardous to Health Regulations 2002 (COSHH). Settings involving children must follow the Early Years Foundation Stage Framework 2024. In each case, the specific assessment duty is additional to, not a replacement for, the general MHSWR duty.

Employers with five or more employees must also record the significant findings of their risk assessment in writing — a requirement that is regularly checked during HSE inspections.

Common questions

Are sole traders exempt from risk assessments?
Only if their work poses no potential risk to others. The Deregulation Act 2015 exempted self-employed people from MHSWR 1999 where their work activities pose no potential risk to the health and safety of other persons. However, this exemption is narrow: if you work at client premises, employ helpers, or your work could affect bystanders, the exemption does not apply.
Do I need to write it down?
If you employ five or more people, yes — recording the significant findings of your risk assessment in writing is a legal requirement under MHSWR 1999 Regulation 3(5). For smaller employers it is not strictly required by law, but a written record is strongly recommended as it helps demonstrate compliance and is often required by clients and insurers.
How often does a risk assessment need to be reviewed?
There is no fixed legal interval, but MHSWR 1999 Regulation 3(3) requires a review whenever there is reason to suspect it is no longer valid, or there has been a significant change in the matters to which it relates. In practice, HSE guidance recommends reviewing assessments at least annually and after any incident, near-miss, or change in work activities.
Can I use a generic or template risk assessment?
A template can be a useful starting point, but it cannot be used unmodified as your assessment. MHSWR 1999 requires a “suitable and sufficient” assessment: one that identifies the real hazards in your specific workplace, evaluates the actual risks to your workers and others, and records controls proportionate to those risks. The HSE has criticised the use of unmodified generic assessments as a failure to comply with the Regulations.
What happens if I don’t carry out a risk assessment?
Failure to carry out a risk assessment is a criminal offence under MHSWR 1999. The HSE can issue an Improvement Notice requiring compliance within a specified period, or a Prohibition Notice stopping work immediately. Prosecution can follow, with unlimited fines in the Crown Court and, for individuals, potential imprisonment. Civil liability for resulting injuries is also significantly increased where no assessment was in place.