How often should risk assessments be reviewed?

How Often Should Risk Assessments Be Reviewed?

Many contractors think the law sets a fixed answer to how often risk assessments should be reviewed: every 12 months. It doesn't. The Management of Health and Safety at Work Regulations (MHSWR) 1999 simply say that risk assessments must be kept up to date and reviewed when appropriate. The law focuses on accuracy, not arbitrary dates.

The "12-month rule" is a common industry convention for document control, not a statutory requirement. It's a sensible prompt to check your documents, but the law is more concerned with whether the assessment still reflects the actual work. Principal contractors often ask for RAMS less than 12 months old. They want assurance the paperwork is fresh. But a 6-month-old RAMS for a completely different site is still invalid. You can read more about the basics in our risk assessment step-by-step guide.

HSE inspectors look at whether your documents match what's actually happening on site. If you're doing a task with new machinery but your risk assessment is 11 months old and mentions hand tools, it's invalid regardless of the date on the page. A set review period is a useful baseline. Treating it as a strict legal boundary is a mistake.

What Triggers a Risk Assessment Review?

You need to review a risk assessment when the situation changes. It's a reactive process, based on what's happening on the ground. A review is required whenever the original assessment no longer reflects the work. Common triggers include:

• Major changes to the work process or methods
• New equipment, machinery, or substances brought onto site
• An accident, near miss, or case of ill health
• Changes to the people doing the work, like new starters or vulnerable workers
• New information about hazards, like manufacturer updates or HSE alerts
• Workers spotting problems with the current controls

Think about a typical week on site. If you turn up to fit a kitchen and find the floor is rotten, conditions have changed. Your existing risk assessment for kitchen fitting probably doesn't cover structural repairs or the dust and noise of cutting out floorboards. That's a trigger to stop and review.

Another trigger is an accident. If a worker trips over trailing cables, your current controls aren't working. You must review the assessment to add better cable management. Changes in personnel matter too. If you take on an apprentice, the risks change. You might need more supervision or different controls to protect a vulnerable worker. New information is another big one. If the manufacturer of your favourite power tool issues a safety recall, or the HSE publishes a new alert about silica dust, you need to review your assessments and update your controls.

What Does Risk Assessment Validity Mean in Practice?

Under CDM 2015, principal contractors expect RAMS to be site-specific. A generic risk assessment might have been valid for your last job, but it loses its validity the moment site conditions change. Risk assessment validity is about whether the document still accurately describes the hazards and controls for the task in front of you.

Principal contractors have a legal duty under CDM 2015 to manage risks on their site. They do this by checking subcontractors have suitable RAMS. If your document says "site access via main gate" but you're actually working on a roof with restricted access, your RAMS are invalid for that job. The principal contractor will reject them.

Validity isn't a tick-box exercise. It's about making sure the document protects the people doing the work. A valid risk assessment gives your team clear instructions on how to work safely today, not how they worked safely last year. Principal contractors use the RAMS review process to judge your competence. If your RAMS are generic and out of date, they'll assume your work is sloppy. Keeping your documents valid protects your reputation and helps you win more contracts.

When you review a risk assessment, you need to show that you did it. Good document control means recording the version, the date you reviewed it, and who did it. This proves to clients and HSE inspectors that you're actively managing safety, not just filing paperwork away. You also need to think about dynamic risk assessment for the ongoing checks that happen on the fly.

A simple review doesn't mean rewriting the whole document. You just need to check it still works. If nothing has changed, you can confirm it's still valid. Update the review date and sign it off. If things have changed, update the relevant sections and issue a new version. Version control is vital here. If two workers have different versions of the same method statement, confusion sets in. Digital tools make this easier. Everyone gets the latest version.

If you don't review your risk assessments, they quickly become useless. Principal contractors will reject your RAMS if they don't match the site. Worse, if conditions have changed and your controls are outdated, someone could get hurt. Outdated documents may also give you little protection if the HSE investigates an incident. If you have an accident and your risk assessment doesn't mention the hazard that caused it, you could struggle to show you identified and managed the risk.

Your insurance company may take a similar view. If you make a claim after an incident and your risk assessment is out of date or irrelevant to the task, your public liability insurer might question your cover. Fail to review your documents and you put your business and livelihood at risk.