What is the difference between a risk and a hazard?

A hazard is anything with the potential to cause harm — a wet floor, a sharp object, a chemical substance. A risk is the likelihood that the hazard will actually cause harm, combined with the severity of that harm. For example, a trailing cable is a hazard; the risk is that someone will trip over it and be injured.

What is the legal definition of risk in the UK?

There is no single statutory definition of risk in UK health and safety law, but the concept is central to the Management of Health and Safety at Work Regulations 1999. Risk is generally understood as the combination of the likelihood of harm occurring and the severity of that harm. Employers must assess risks under Regulation 3(1) of MHSWR 1999.

How is risk assessed in a workplace?

Risk is assessed using a systematic process: identify the hazards, decide who might be harmed and how, evaluate the level of risk (considering both likelihood and severity), decide what control measures are needed, record the findings, and review the assessment when circumstances change. This process is required under MHSWR 1999 Regulation 3.

What are examples of common workplace risks?

Common workplace risks include slips, trips and falls (the most frequent cause of injury in UK workplaces), manual handling injuries, falls from height, exposure to hazardous substances under COSHH, fire and explosion, vehicle movements, noise and vibration, work-related stress, and violence and aggression. Each of these risks must be assessed and controlled.

What is a high risk vs a low risk?

A high risk is one where the likelihood of harm is high and the severity is serious — for example, working at height without edge protection. A low risk is one where the likelihood is low and the severity is minor — for example, a papercut in an office. The combination of likelihood and severity determines whether urgent action is required or whether existing controls are sufficient.

Can a risk ever be completely eliminated?

Some risks can be completely eliminated by removing the hazard — for example, deciding not to use a hazardous chemical, or redesigning a process so that work at height is no longer necessary. However, many risks cannot be eliminated entirely and must be reduced to an acceptable level through the hierarchy of controls — substitution, engineering controls, administrative controls, and as a last resort, personal protective equipment.

Who is responsible for assessing risk in a UK business?

The employer is legally responsible for assessing risks under the Health and Safety at Work Act 1974 and the Management of Health and Safety at Work Regulations 1999. The employer may appoint a competent person to carry out the assessment on their behalf, but the legal duty remains with the employer. Employees have a duty to cooperate and to report hazards they identify.

What happens if you do not assess risks correctly?

Failing to carry out a suitable and sufficient risk assessment is a criminal offence under MHSWR 1999 Regulation 3. Penalties can include unlimited fines and up to two years imprisonment for individuals. If an accident occurs and the risk was not properly assessed or controlled, the employer may face prosecution under the Health and Safety at Work Act 1974 and civil claims from injured workers.

What is a Risk? | Risk vs Hazard Definition & Examples for UK Businesses

What is a risk?

A risk is the combination of the likelihood that a hazard will cause harm and the severity of that harm. In UK health and safety law, understanding risk is essential because every employer has a legal duty under the Health and Safety at Work Act 1974 and the Management of Health and Safety at Work Regulations 1999 to assess and control risks in their workplace. A hazard is something with the potential to cause harm — a wet floor, a sharp blade, a chemical, a moving vehicle. The risk is whether that hazard will actually hurt someone, how badly, and how often.

For example, a sharp knife is a hazard. The risk depends on how the knife is used, stored, and maintained. A chef using a sharp knife with proper training, a secure grip, and a stable chopping board faces a low risk. An untrained kitchen porter using the same knife on a wet, unstable surface while distracted faces a high risk. The hazard is identical — the risk is vastly different.

Risk assessment is the process of systematically identifying hazards, evaluating the risks they present, and putting controls in place to eliminate or reduce those risks to an acceptable level. This process is not optional — it is required by law for virtually every UK employer and self-employed person.

Risk vs hazard: the critical distinction

Many business owners and managers use the terms "risk" and "hazard" interchangeably, but they mean different things in UK health and safety law. Understanding the distinction is essential for writing a compliant risk assessment and demonstrating to an HSE inspector that you understand your legal duties.

A hazard is anything with the potential to cause harm. It could be a physical object (a trailing cable, an unguarded machine), a substance (cleaning chemicals, asbestos dust), a process (working at height, lone working), or an environmental condition (poor lighting, excessive noise). A hazard exists whether or not anyone is exposed to it.

A risk is the chance, high or low, that someone will be harmed by the hazard, together with an indication of how serious the harm could be. Risk is a function of two variables: likelihood (how often the harm might occur) and severity (how bad the harm could be). A high-severity, low-likelihood risk — such as a catastrophic equipment failure that could kill someone but is extremely rare — is still a risk that must be assessed and controlled.

Here is a worked example. A construction site has an open excavation 2 metres deep. The hazard is the open excavation. The risk is that a site worker, delivery driver, or member of the public could fall into it, suffering serious injury or death. The level of risk depends on several factors: is the excavation edge protected by barriers? Is there adequate signage? Is the site secured against unauthorised access? Is there a safe route marked for site traffic? Each of these controls reduces the risk without removing the hazard itself.

How risk is assessed in the UK

Under Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 (MHSWR 1999), every employer must make a suitable and sufficient assessment of the risks to the health and safety of employees and anyone else affected by their work activities. Self-employed persons have the same duty under Regulation 3(2).

A suitable and sufficient risk assessment does not require complex mathematics or specialist software. What it does require is a systematic approach: identify the hazards, decide who might be harmed and how, evaluate the level of risk, decide what precautions are needed, record the findings, and review the assessment when circumstances change.

Risk is typically evaluated using a simple matrix that considers likelihood and severity. Likelihood might be categorised as rare, unlikely, possible, likely, or almost certain. Severity might be categorised as negligible, minor, moderate, major, or catastrophic. The combination of the two produces a risk rating — low, medium, high, or very high — which determines the urgency and nature of the action required.

For example, a risk of a papercut in an office environment might be rated as "likely" (it happens regularly) but "negligible" severity (minor injury, no lost time). The overall risk is low, and the existing controls (providing plasters in the first aid kit) are sufficient. By contrast, a risk of a fall from height on a construction site might be rated as "possible" but "catastrophic" severity (potential fatality). The overall risk is high, and the law requires specific control measures under the Work at Height Regulations 2005 — edge protection, guardrails, safety nets, or as a last resort, a fall arrest system.

Examples of common workplace risks

Physical risks

Slips, trips and falls — the most common cause of workplace injuries in the UK. HSE statistics for 2023/24 recorded 32,000 non-fatal injuries to employees caused by slips, trips or falls on the same level. The hazards include wet or contaminated floors, uneven surfaces, trailing cables, poor lighting, and obstructions in walkways. The risk depends on the type of flooring, the standard of housekeeping, the footwear worn by workers, and the presence of vulnerable groups such as elderly visitors or pregnant employees.

Manual handling — lifting, carrying, pushing, or pulling loads. The hazard is the load itself and the task of moving it. The risk depends on the weight, shape, and stability of the load, the distance and height it must be moved, the posture and technique of the worker, and the frequency of the task. Under the Manual Handling Operations Regulations 1992, employers must avoid hazardous manual handling so far as is reasonably practicable, assess any manual handling that cannot be avoided, and reduce the risk of injury.

Working at height — any work where a person could fall a distance liable to cause personal injury. The hazard is the height itself and the surface or structure being worked on. The risk depends on the height, the duration of the work, the edge protection in place, the condition of the working surface, weather conditions, and the competence of the worker. The Work at Height Regulations 2005 require all work at height to be properly planned, supervised, and carried out by competent persons using the right type of equipment.

Chemical risks

Exposure to hazardous substances — the Control of Substances Hazardous to Health Regulations 2002 (COSHH) require employers to prevent or adequately control exposure to substances hazardous to health. The hazard is the substance itself — it could be a solvent, a cleaning chemical, welding fume, wood dust, or a biological agent. The risk depends on the concentration, the duration and frequency of exposure, the route of entry (inhalation, skin contact, ingestion), and the susceptibility of the individual (pregnant workers, those with respiratory conditions). A COSHH assessment must be carried out before the substance is used.

Biological risks

Legionella — a bacterium found in water systems that can cause Legionnaires' disease, a potentially fatal form of pneumonia. The hazard is the presence of Legionella bacteria in water systems such as cooling towers, spa pools, or hot and cold water systems in buildings. The risk is the creation of water droplets or aerosols that can be inhaled. Under the Health and Safety at Work Act 1974 and the Control of Substances Hazardous to Health Regulations 2002, building owners and employers (known as the "dutyholder") must assess the risk, implement a control regime (temperature control, flushing, disinfection), and keep records. The Approved Code of Practice L8 sets out the legal requirements.

Fire risks

Fire and explosion — under the Regulatory Reform (Fire Safety) Order 2005, the responsible person for any non-domestic premises must carry out a fire risk assessment. The hazards include ignition sources (electrical equipment, hot work, smoking materials), fuel sources (flammable liquids, waste, furnishings), and oxygen (the atmosphere, or oxygen-enriched environments). The risk depends on the likelihood of ignition, the fire load, the speed of fire spread, the adequacy of detection and alarm systems, the means of escape, and the presence of vulnerable occupants.

Ergonomic and psychosocial risks

Repetitive strain injury (RSI) and musculoskeletal disorders — caused by repetitive tasks, poor posture, forceful exertion, or prolonged static positions. The hazard is the task design or workstation layout. The risk depends on the frequency, intensity, and duration of the task, and the individual's physical condition. The Health and Safety (Display Screen Equipment) Regulations 1992 require employers to assess workstations used by employees for display screen work and reduce risks.

Work-related stress — the Management of Health and Safety at Work Regulations 1999 apply to psychosocial risks just as they do to physical risks. The hazards include excessive workload, lack of control, unsupportive management, bullying or harassment, and job insecurity. The risk depends on the individual's resilience, the support available, and the organisational culture. The HSE Management Standards for work-related stress provide a framework for assessing and controlling these risks.

The hierarchy of controls: how risks are reduced

Once a risk has been identified and evaluated, the law requires employers to take action to eliminate or reduce it. The method for doing so is set out in Schedule 1 of the Management of Health and Safety at Work Regulations 1999, commonly known as the hierarchy of controls. Employers must work through the hierarchy in order — higher-order controls are always preferred over lower-order ones.

1. Elimination — remove the hazard entirely. This is the most effective control because the risk no longer exists. Example: a building owner decides not to install a water feature in a reception area, eliminating the Legionella risk entirely. Example: a manufacturing process is redesigned so that a hazardous chemical is no longer needed.
2. Substitution — replace the hazard with something less dangerous. Example: replace a solvent-based paint with a water-based equivalent. Example: use a vacuum cleaner with a HEPA filter instead of sweeping, reducing dust exposure.
3. Engineering controls — physical changes to the workplace or equipment. Example: install machine guarding, edge protection on a flat roof, local exhaust ventilation for welding fume. Engineering controls are reliable because they do not depend on human behaviour.
4. Administrative controls — changes to how work is organised. Example: job rotation to reduce exposure to repetitive tasks, permit-to-work systems for high-risk activities, training, safe systems of work, supervision. Administrative controls depend on people following procedures consistently.
5. Personal protective equipment (PPE) — the last resort. PPE such as gloves, hard hats, safety glasses, hearing protection, and respirators only protects the individual wearing it, and only when worn correctly and fitted properly. Under the Personal Protective Equipment at Work Regulations 1992, PPE must be provided free of charge, must be appropriate for the risk, and must be maintained. Employers must also provide information, instruction and training on its use.

A common failing in risk assessments is to rely on PPE as the primary control without demonstrating why higher-order controls are not reasonably practicable. HSE inspectors will challenge this approach, and it will not satisfy the legal standard of a suitable and sufficient risk assessment.

Who is responsible for managing risk?

Under the Health and Safety at Work Act 1974 Section 2, the legal duty to ensure health and safety rests with the employer. This duty cannot be delegated or outsourced. The employer can appoint a competent person to assist them — this could be an in-house health and safety officer, an external consultant, or a combination of both — but the ultimate legal responsibility remains with the employer.

A "competent person" is defined in MHSWR 1999 Regulation 7 as someone with sufficient training, experience, knowledge, and other qualities to enable them to assist the employer in meeting their health and safety obligations. Competence does not require formal qualifications, but it does require an understanding of the hazards and risks in the specific workplace, the ability to identify when specialist advice is needed, and the authority to implement the findings of the risk assessment.

Employees also have duties under Section 7 of the Health and Safety at Work Act 1974. Every employee must take reasonable care for their own health and safety and that of others who may be affected by their acts or omissions. Employees must cooperate with their employer on health and safety matters and must not interfere with or misuse anything provided in the interests of health and safety. An employee who fails to follow a safe system of work identified in a risk assessment — for example, by removing machine guarding or not wearing required PPE — may face disciplinary action and in extreme cases, prosecution.

Risk assessment in specific industries

Construction

Construction is one of the highest-risk industries in the UK. In 2023/24, 45 workers were killed in construction accidents, and the industry accounted for 20% of all fatal injuries despite representing only 5% of the workforce. The hazards are numerous: working at height, excavations, vehicle movements, manual handling, noise, vibration, dust, and contact with live electrical equipment.

Under the Construction (Design and Management) Regulations 2015 (CDM 2015), every construction project must have a written construction phase plan before work begins. This plan must identify the site-specific hazards and the measures needed to control the risks. The principal contractor is responsible for ensuring the plan is prepared, implemented, and kept up to date. Specific risk assessments are required for high-risk activities such as work at height, excavations near services, and lifting operations.

Healthcare

Healthcare workers face a wide range of risks: manual handling of patients, exposure to infectious diseases, sharps injuries, violence and aggression from patients, and work-related stress. The hazards are inherent to the work — patients must be moved, and clinical procedures require the use of needles and other sharp instruments.

Risk assessments in healthcare settings must consider the vulnerability of the workforce (many healthcare workers are women of childbearing age, and patient handling places significant strain on the musculoskeletal system) and the unpredictable nature of the work (emergency admissions, infectious outbreaks, aggressive patients). The risk assessment must evaluate the risk to individual employees — a pregnant midwife, a healthcare assistant with a back injury, a lone community nurse visiting a patient with a history of violence — and put in place person-specific controls.

Retail and hospitality

Retail and hospitality businesses often assume that their risks are low because they do not operate heavy machinery or work with hazardous chemicals. This is a dangerous assumption. Slips, trips and falls are the most common cause of major injuries in these sectors. Manual handling injuries are common (lifting stock, moving furniture, handling kegs in pubs). Violence and aggression from customers is an increasing risk, particularly in late-night venues and shops selling age-restricted products. Fire risk is significant in any premises open to the public.

Under the Regulatory Reform (Fire Safety) Order 2005, every retail and hospitality business must carry out a fire risk assessment and implement a fire safety management plan. Under the Management of Health and Safety at Work Regulations 1999, a general risk assessment covering all other workplace hazards is also required.

When must a risk assessment be reviewed?

MHSWR 1999 Regulation 3(3) requires employers to review their risk assessment whenever they have reason to suspect it is no longer valid, or there has been a significant change in the matters to which it relates. Specific events that trigger a review include a workplace accident or near-miss, a change in work processes or equipment, the introduction of new substances or materials, a change in the workforce (new young workers, pregnant employees, workers with disabilities), new information about a hazard (a revised safety data sheet, an HSE safety alert), or an HSE enforcement notice.

There is no fixed legal requirement to review risk assessments at a set interval, but best practice is to review them at least annually. Many businesses choose to review all risk assessments at the start of the financial year or after the annual health and safety audit. A risk assessment that has not been reviewed for five years is unlikely to reflect current workplace conditions and will not satisfy the legal standard of being suitable and sufficient.

Common mistakes in understanding risk

Confusing hazard and risk — writing a risk assessment that lists hazards without evaluating the actual level of risk or the controls needed. An assessment that states "there is a risk of slips and trips" without describing the specific surfaces, the standard of housekeeping, or the footwear policy is not suitable and sufficient.
Ignoring low-likelihood, high-severity risks — focusing only on common, minor injuries and failing to assess rare but catastrophic events. A risk assessment for a commercial kitchen that does not consider the risk of a deep fat fryer fire is inadequate, even if such fires are statistically rare.
Failing to consider vulnerable groups — young workers, new and expectant mothers, workers with disabilities, and contractors unfamiliar with the site all face different levels of risk from the same hazard. A suitable and sufficient risk assessment must identify these groups and assess their specific risks.
Using generic, copied risk assessments — a risk assessment downloaded from the internet or copied from another site will not reflect the specific hazards and risks in your workplace. HSE inspectors recognise generic assessments immediately and will challenge them.
Treating risk assessment as a paperwork exercise — the purpose of a risk assessment is not to produce a document, but to identify and control risks. If the findings of the risk assessment are not implemented — if the control measures identified are not put in place, if workers are not trained, if PPE is not provided — the risk assessment is worthless.

How to assess risk if you have no experience

Many small business owners and sole traders have no formal health and safety training and do not know where to start with risk assessment. The good news is that the law does not require you to be an expert — it requires you to be competent, which means understanding the hazards in your workplace and knowing when to seek help.

Start by walking through your workplace or thinking through your work activities step by step. What could go wrong? Who could be hurt, and how? Write it down. Then think about what you are already doing to control the risk. Is it enough? If not, what more could you do?

The HSE publishes free guidance for most common work activities and industries. If your work is straightforward and the risks are well understood, you can use an online risk assessment generator to produce a compliant document in minutes. If your work involves complex or unusual hazards — asbestos removal, work in confined spaces, diving operations — you must seek specialist advice from a competent health and safety consultant.

The key point is this: you are not expected to know everything, but you are expected to take reasonable steps to identify and control risks. Doing nothing because you do not know what to do is not a defence.

Why understanding risk matters for compliance and protection

Understanding what a risk is and how it differs from a hazard is not an academic exercise — it is the foundation of UK health and safety law. Every legal duty placed on employers flows from the principle that risks must be assessed and controlled.

If you cannot correctly identify the risks in your workplace, you cannot comply with MHSWR 1999 Regulation 3. If you confuse hazards with risks, your risk assessment will not meet the suitable and sufficient standard. If you fail to evaluate the likelihood and severity of harm, you cannot apply the hierarchy of controls correctly. And if you do not understand risk, you cannot make informed decisions about where to allocate time, money, and resources to keep your workers and your business safe.

A clear understanding of risk also protects you in the event of an accident. If an employee is injured and brings a civil claim, or if the HSE investigates and considers prosecution, the first question they will ask is: did you carry out a suitable and sufficient risk assessment? If the answer is no, or if the assessment is generic and evidently not based on a genuine evaluation of your specific workplace, you will struggle to defend yourself.

Also see: The Ultimate Guide to Risk Assessment · Do I Need a Risk Assessment? · Risk Assessment Legal Requirements · Risk Assessment Generator

What is a Risk? Risk vs Hazard Explained for UK Businesses