A simple risk assessment is a straightforward document that identifies hazards in your workplace or activity, works out who might be harmed and how, and sets out what you are doing to prevent that harm. Under the Management of Health and Safety at Work Regulations 1999 Regulation 3(1), every UK employer must carry out a suitable and sufficient risk assessment — but the law does not require it to be complicated. For most small businesses and low-risk activities, a simple one-page assessment is entirely appropriate.
What makes a risk assessment simple?
A simple risk assessment is one that is proportionate to the level of risk. The Health and Safety Executive is clear that risk assessments do not need to be lengthy or over-engineered. For many routine, low-risk activities — such as using a stepladder to change a lightbulb in an office, or serving food in a small café — a brief, one-page assessment covering the key hazards is legally sufficient.
What makes an assessment simple is focus. You identify the hazards that could actually cause harm, you write down who is at risk and what you are doing about it, and you keep the language plain. You do not need to cover every conceivable hazard — only the significant ones. HSE guidance states that trivial risks can usually be ignored.
A simple risk assessment is not a tick-box exercise. It must be based on genuine thought about the actual workplace and the actual people doing the work. The difference between a compliant simple risk assessment and an inadequate one is specificity: does it name the real hazards in your workplace, or does it use generic language that could apply to any business?
The 5-step process for a simple risk assessment
Step 1: Identify the hazards
Walk around your workplace or think through the activity from start to finish. Look for anything that could cause harm. Common hazards include slippery or uneven floors, heavy items that need lifting, equipment with moving parts, hot surfaces or liquids, chemicals or cleaning products, working at height (even a stepladder), electricity, and lone working. Ask your staff — they often know about hazards that managers miss.
Do not try to list every possible hazard. Focus on the ones that could realistically cause harm in your specific workplace. If you run an office, you do not need to assess the risk of a forklift truck accident. If you operate a warehouse, you do.
Step 2: Decide who might be harmed and how
Think about all the groups of people who could be affected by each hazard. This includes employees (full-time, part-time, temporary staff, and new starters who may be unfamiliar with the workplace), contractors and delivery drivers, visitors and members of the public, and vulnerable groups such as young workers, pregnant workers, or people with disabilities.
For each hazard, write down how someone could be harmed. For example: "Kitchen staff could suffer burns from hot oil when frying" or "Warehouse operatives could suffer crush injuries from reversing vehicles if pedestrian routes are not clearly marked."
Step 3: Evaluate the risks and decide on controls
For each hazard, decide whether the existing precautions are adequate or whether you need to do more. Ask yourself: How likely is it that someone will be harmed? How serious would that harm be? Can I eliminate the hazard completely, or can I reduce the risk?
The law requires you to apply the hierarchy of controls under Schedule 1 of the Management of Health and Safety at Work Regulations 1999. This means you must consider controls in this order: elimination (remove the hazard), substitution (replace it with something less dangerous), engineering controls (physical changes like machine guards or ventilation), administrative controls (safe systems of work, training, supervision), and personal protective equipment (PPE) as a last resort.
For a simple risk assessment, you do not need to write out the full hierarchy for every hazard — but you do need to show that you have thought about the most effective controls first. For example, if you are assessing the risk of a fall from a stepladder, the controls might be: use a podium step instead of a ladder where possible (substitution), ensure the ladder has a handrail and non-slip feet (engineering control), train staff in safe use and never allow lone working at height (administrative control), and ensure hard hats are worn in areas where overhead work is routine (PPE).
Step 4: Record your findings and implement them
Write down what you found. Under Regulation 3(6) of MHSWR 1999, if you have five or more employees you must record the significant findings of your risk assessment. Best practice is to record all assessments regardless of headcount. A simple written record demonstrates to the HSE that you have thought about the risks and taken action.
Your record should include the activity or area being assessed, the date, the hazards identified, who is at risk, the controls you have put in place, any further action needed, who is responsible for that action, and the target completion date. This can all fit on one page for a simple activity.
Most importantly, you must actually implement the controls you have identified. A risk assessment is useless if it sits in a drawer and no one follows it. Make sure your staff know about the assessment and understand what they need to do.
Step 5: Review and update the assessment
A risk assessment is not a one-off task. Under Regulation 3(3) of MHSWR 1999, you must review it if you suspect it is no longer valid or if there has been a significant change. Common triggers for a review include a workplace accident or near-miss, a change in the work process or equipment, new staff or changes to staffing levels, or new information about a hazard (for example, a supplier updates a safety data sheet for a chemical you use).
Even if nothing has changed, it is good practice to review your risk assessments at least once a year. This ensures they remain relevant and that new staff are aware of them.
Simple risk assessment template
A simple risk assessment template typically includes the following headings:
- Activity/Area — what work or location you are assessing
- Date of Assessment — when the assessment was carried out
- Assessed By — the name of the person who did the assessment
- Hazard — what could cause harm
- Who Might Be Harmed — which groups of people are at risk
- Existing Controls — what you are already doing to manage the risk
- Risk Rating — low, medium or high (optional but helpful for prioritisation)
- Further Action Required — anything additional you need to do
- Action By (Person) — who is responsible for implementing further action
- Target Date — when the action will be completed
- Review Date — when you will next review the assessment
This format is widely used and meets the legal requirement for a recorded risk assessment. You can adapt it to suit your business — for example, you might add columns for the likelihood and severity of harm if you want a more detailed risk rating system.
Worked example: Simple risk assessment for a small office
Activity: General office work — hot-desking environment, 8 employees
Date: 15 January 2025 | Assessed by: J. Smith, Office Manager | Review date: 15 January 2026
| Hazard | Who at Risk | Existing Controls | Risk Rating | Further Action |
|---|---|---|---|---|
| Trailing cables from desk equipment | All staff, visitors | Cable management trays installed at all desks. Staff briefed to tidy cables daily. | Low | None |
| Display screen equipment (DSE) — eye strain, posture | Office staff using screens for more than 1 hour daily | Adjustable chairs and monitors provided. DSE self-assessment completed by all users. Eye tests available on request. | Low | Remind staff of eye test entitlement in next all-staff email (J. Smith, 30 Jan 2025) |
| Manual handling — lifting boxes of printer paper | Office staff | Printer paper stored on lower shelves. Staff instructed to ask for help with heavy or awkward loads. | Low | None |
| Fire | All staff, visitors | Fire risk assessment completed 10 Dec 2024. Smoke alarms tested weekly. Fire drill every 6 months (last: 5 Dec 2024). Assembly point clearly marked. | Low | Next fire drill scheduled 5 Jun 2025 (J. Smith) |
This example demonstrates a simple, proportionate approach. The hazards are real and specific to the workplace. The controls are practical and implemented. The risk rating reflects the actual level of risk after controls are in place. Further action is minimal because the office is low-risk and the existing controls are adequate.
Worked example: Simple risk assessment for a small café
Activity: Food preparation and service — café with 3 staff, table service only
Date: 20 January 2025 | Assessed by: A. Jones, Owner | Review date: 20 January 2026
| Hazard | Who at Risk | Existing Controls | Risk Rating | Further Action |
|---|---|---|---|---|
| Hot liquids and surfaces — burns from coffee machine, oven, hot plates | Kitchen and front-of-house staff | Staff trained in safe handling. Oven gloves provided and used. Coffee machine positioned away from customer area. Warning signs on hot surfaces. | Medium | Replace worn oven gloves (A. Jones, 1 Feb 2025) |
| Slips on wet kitchen floor during cleaning | All staff | Non-slip floor tiles installed. Spillages cleaned immediately. Wet floor sign used during mopping. Cleaning scheduled outside peak service hours. | Low | None |
| Cuts from knives during food preparation | Kitchen staff | Sharp knives stored in knife block. Staff trained in safe knife use. Cut-resistant gloves available (used when preparing large volumes). First aid kit in kitchen. | Low | None |
| Manual handling — lifting flour sacks, deliveries | All staff | Deliveries unpacked by two people where loads exceed 10 kg. Trolley used to move heavy items. Staff instructed to ask for help. | Low | None |
| Cleaning chemicals — skin irritation, eye damage | All staff | All cleaning products stored in locked cupboard. Safety data sheets filed and available. Gloves provided for all cleaning tasks. Staff trained not to mix chemicals. | Low | None |
This example is still simple, but reflects the higher level of hazard typical in a food service environment. The controls are proportionate. The assessment identifies specific equipment (coffee machine, oven) and specific products (cleaning chemicals, flour sacks) rather than generic references.
When is a simple risk assessment not enough?
A simple risk assessment is appropriate for most low-risk workplaces and routine activities. It is not appropriate for high-risk work. If your work involves significant risk of serious harm or death — such as working at height above 2 metres, working in confined spaces, hot work (welding, cutting, grinding) near flammable materials, work with asbestos, or work with hazardous substances requiring detailed COSHH assessments — then you need a more detailed, task-specific assessment.
Certain activities are governed by specific regulations that require more than a simple generic assessment. The Regulatory Reform (Fire Safety) Order 2005 requires a fire risk assessment that follows a prescribed structure. The Construction (Design and Management) Regulations 2015 require detailed risk assessments and method statements for construction work. The Work at Height Regulations 2005 require you to avoid work at height where possible and to assess and plan it properly where it is unavoidable.
If you are unsure whether a simple risk assessment is sufficient, the HSE website provides sector-specific guidance. You can also use a tool like Anyrisks to generate a proportionate, regulation-referenced assessment based on the specific activity you describe.
Common mistakes in simple risk assessments
The most common mistake is using a generic template without adapting it to your actual workplace. A risk assessment that says "slips, trips and falls may occur" without specifying what surfaces are involved, what type of footwear staff wear, or what cleaning regime is in place is not a suitable and sufficient assessment. It is box-ticking.
Another common mistake is listing PPE as the main control measure without considering whether the hazard could be eliminated or reduced in a more effective way. For example, if your assessment says "staff must wear gloves when handling chemicals," you should first ask: can we use a less hazardous chemical? Can we automate the process? Can we provide mechanical handling equipment? PPE is the last line of defence, not the first.
Failing to involve staff is another frequent error. The people doing the work often know about hazards that managers overlook. A risk assessment written in isolation, without consulting the workforce, routinely misses real-world risks.
Finally, many businesses treat risk assessments as a one-off compliance exercise. They complete the assessment, file it, and never look at it again. A risk assessment is a living document. If your workplace changes, your assessment must change with it. If you have an accident, you must review the relevant assessment and update it.
Do I need to be competent to carry out a risk assessment?
Yes. Regulation 7 of the Management of Health and Safety at Work Regulations 1999 requires every employer to appoint one or more competent persons to assist them in meeting their health and safety duties. A competent person is someone with the necessary skills, knowledge and experience to carry out the task safely.
For a simple risk assessment in a low-risk workplace, competence does not mean you need a formal qualification. It means you understand the work being done, you know what hazards to look for, and you know how to identify effective controls. For many small businesses, the owner or manager is competent to carry out their own risk assessments, particularly if they have worked in the industry for some time and have received basic health and safety training.
For higher-risk work, you may need external help. If you are assessing work involving hazardous substances, complex machinery, or construction activities, and you do not have the technical knowledge to evaluate the risks properly, you should seek advice from a competent health and safety professional.
How AI is making simple risk assessments even simpler
AI-powered tools like Anyrisks are changing how UK businesses approach risk assessment. Rather than starting from a blank template or a generic document, you describe the activity in plain English — the location, the task, the people involved, any hazards you are already aware of — and receive a fully written risk assessment in under 2 minutes. The assessment includes the specific hazards relevant to your activity, the correct legal references for your industry, and practical control measures ranked in the correct order under the hierarchy of controls.
The key advantage is specificity without complexity. A well-configured AI system can produce a simple, one-page assessment that is tailored to your workplace, written in plain English, and based on real regulatory guidance. You still need to review the assessment and confirm it reflects your actual workplace conditions — the legal duty to assess risk cannot be outsourced — but the time required to produce a compliant document is reduced from hours to minutes.
This is particularly valuable for small businesses and sole traders who need to produce risk assessments regularly but do not have in-house health and safety expertise. An AI-generated simple risk assessment can be adapted, implemented, and reviewed far more quickly than a hand-written one, without sacrificing legal compliance or quality.
Also see: The Ultimate Guide to Risk Assessment · Do I Need a Risk Assessment? · Risk Assessment Legal Requirements · Risk Assessment Generator