Risk Assessment Forms: What UK Employers Must Record, and What Inspectors Look For

The duty, and the bit about five employees

Every UK employer must carry out a suitable and sufficient risk assessment under the Management of Health and Safety at Work Regulations 1999, and where five or more people are employed, the significant findings must be recorded in writing. There is no minimum business size exemption from the duty itself — only from the requirement to write it down.

That distinction is where confusion starts. Below five employees you must still assess. You are simply not compelled to record it — and an unrecorded assessment is very difficult to evidence when something goes wrong.

The five steps, and where each one goes wrong

1. Identify the hazards. Walk the workplace, but also talk to the people doing the job — they know about the shortcut nobody documented. Your accident book and near-miss records are a hazard list written by experience.

2. Decide who might be harmed and how. Not just "staff". Cleaners working alone after hours. Delivery drivers who never enter the induction process. New and expectant mothers. Young workers. Visitors, contractors, the public. Office-based employees including hybrid and home-working staff, for work activities under your control.

3. Evaluate the risks and decide on precautions. The test is what is reasonably practicable. Work down the hierarchy of control rather than reaching for PPE first: eliminate, substitute, engineer, administrate, then protect. An assessment whose every control is "wear gloves and take care" will not survive scrutiny.

4. Record your significant findings. Show that a proper check was made, that you consulted those affected, that you dealt with the obvious significant hazards, and that remaining risk is low.

5. Review and update. When anything material changes, and after any accident or near miss. Date every version and keep the old ones.

Template to start from: the Risk Assessment Form, laid out step by step with hazard / who is harmed / existing controls / further action, and a built-in review date.

Why generic templates fail

This is the most common criticism from inspectors, and it applies to any template used carelessly.

An assessment listing "slips, trips and falls" and "fire" has identified categories, not risks. The HSE's published guidance is explicit that the assessment must be specific to the workplace, not a template tick-box exercise. The useful version names the trailing cable in the second-floor meeting room, the unmarked step into the stockroom, the entrance mats nobody replaces when saturated.

Specific office hazards worth naming include trailing cables, uneven flooring, wet floors after cleaning, items in walkways, poor stairwell lighting, and inadequate maintenance of mats and floor finishes.

A template's job is to make sure you ask the right questions in the right order. It is not to supply the answers. And note that fire requires a separate fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005.

Assessments that need their own form

COSHH assessments are legally required of every employer, but only have to be recorded in writing where you employ five or more people — and must be reviewed regularly and whenever substances, exposure or personnel change.

Manual handling, display screen equipment, work at height, and specific assessments for new and expectant mothers and young workers each carry their own duties.

Templates: COSHH Assessment Record, Manual Handling Assessment, DSE Workstation Assessment. The DSE form works far better as a digital self-assessment sent to each user than a PDF nobody returns.

The link to accidents: recording versus reporting

Two separate duties, and conflating them is expensive.

The accident book, typically Form BI 510, is a record-keeping duty under the Social Security (Claims and Payments) Regulations 1979 that applies to any employer with ten or more employees. It can serve as your RIDDOR record for injuries but not for diseases or dangerous occurrences — and logging an incident in the book does not satisfy the duty to report it to the HSE.

RIDDOR is the duty to report. It requires employers and those responsible for workplaces to report certain serious incidents to the HSE or the relevant local authority. Reportable categories include deaths, specified injuries, injuries causing more than seven days' incapacitation, certain occupational diseases, and defined dangerous occurrences.

Not every near miss is reportable. Regulation 7 and Schedule 2 list 27 dangerous occurrences — lifting equipment collapse, pressure system failures, overhead power line contact, scaffolding collapse above five metres. General near misses outside that list are not RIDDOR-reportable, though they should still be investigated and recorded internally.

One forward-looking note: the HSE consulted on a substantial overhaul of RIDDOR 2013, with the consultation closing on 30 June 2026. Build your reporting workflow so the triggers can be edited.

Templates: the Workplace Incident Report Form is structured to capture everything the HSE's online report asks for, so a reportable incident is transcribed rather than reconstructed. The Near Miss Report Form is deliberately short with a photo upload, because near-miss reporting dies the moment it becomes admin. The Incident Investigation Form supports root cause work — systematic investigation using 5 Whys, fault tree or bow-tie methodology is expected by the HSE as evidence of a learning culture.

Making the form work on site

Risk assessment forms are used in cold car parks on cracked phone screens by people with one free hand.

• Mobile first, genuinely. Large tap targets, no pinch-zooming, no side-scrolling tables.
• Photo capture on every hazard row.
• Offline tolerance. A form that discards a half-completed assessment when signal drops will not be used twice.
• Conditional logic. Ask about ladder inspection only if work at height was selected.
• Named assessor and date, mandatory.
• Automatic review reminders. The usual failure isn't a bad assessment — it's a good one nobody revisited.

Safety forms you can publish today

Frequently asked questions

Do I legally have to write down a risk assessment?

Only at five or more employees. The duty to assess applies to every employer regardless of size, and an unrecorded assessment is hard to evidence later.

How often should a risk assessment be reviewed?

Whenever something changes materially, and after any accident or near miss. Annual review is a common backstop but not a statutory interval.

What's the difference between a hazard and a risk?

A hazard has the potential to cause harm. A risk is the likelihood it will, combined with severity. Bleach is a hazard; the risk depends on whether it's decanted into an unlabelled bottle next to the kettle.

Does an accident book entry count as a RIDDOR report?

No. Failing to report a qualifying incident can lead to significant fines and legal action, and employers can face up to two years in prison in serious cases.

Are near misses reportable?

Only the 27 defined dangerous occurrences. Record and investigate the rest anyway — they are the cheapest safety data you will ever get.