why risk assessments matter more than most tradespeople think
If you've been turned away from a site because your RAMS weren't up to scratch, you know how frustrating it is. A risk assessment isn't just paperwork to get you on site. It's the law.
Under the Management of Health and Safety at Work Regulations 1999 (Regulation 3), every employer and self-employed person must carry out a suitable and sufficient assessment of the risks their work creates. That means you, even if you work alone.
On construction projects with more than one contractor, CDM 2015 (Regulation 15) reinforces this. Contractors must plan, manage and monitor their work to ensure it is carried out without risks to health or safety. The principal contractor coordinates all of this under Regulation 13.
It's not optional. It's the law. And more importantly, it's how you stop someone from getting hurt on your job. This guide walks through the process step by step.
step 1: identify the work and scope
Before you look at hazards, be clear about what you're actually doing. Generic risk assessments get rejected because they describe "construction work" instead of the specific task on the specific job.
What you should write down:
Don't copy someone else's risk assessment and put your company name on it. HSE's own guidance is explicit: copying a generic example and signing it does not satisfy the law and does not protect your employees. You have to think about the specific hazards and controls for your work.
The scope matters because it determines everything downstream. A risk assessment for installing kitchen sockets in a domestic property is very different from a full rewire in a commercial building, even though both involve electrical work.
step 2: identify the hazards
Walk the site before you start work. Not after. Before. Look at the environment, the equipment you'll use, the materials you'll handle, and the people around you. Ask one simple question: what could go wrong here?
Common hazard categories for construction work:
For each hazard, think about who could be harmed. Not just your own workers. Other tradespeople on site, the public, visitors, delivery drivers. Anyone who might be affected by your work.
Reference specific regulations where relevant. Working with power tools? Reference the Provision and Use of Work Equipment Regulations 1998 (PUWER). Working at height? Reference the Work at Height Regulations 2005 (WAHR 2005).
step 3: assess the risk using a risk matrix
Score your hazards. The 5x5 risk matrix multiplies likelihood by severity.
Likelihood scale:
Severity scale:
Multiply likelihood by severity to get your risk rating:
Be specific when scoring. "Possible" (3) that someone might get a minor electric shock (2) gives a rating of 6, medium risk. That needs controls. "Very likely" (5) that someone might fall from height (5) gives 25, very high risk. That needs serious controls before anyone goes up there.
step 4: identify the controls
Use the hierarchy of controls. It's not a suggestions list. Work through it from the top down. Only move to the next level if the level above isn't reasonably practicable.
1. eliminate the hazard
The best option is to remove the hazard entirely. Can the work be done without the risk? If you can eliminate it, do it. No other control measure is as reliable.
2. substitute with something safer
If you can't eliminate, can you substitute with something less hazardous? Using a manual tool instead of a power tool removes the electrical hazard. Using a lighter material reduces manual handling strain. Substitution isn't always possible, but it's worth considering.
3. engineering controls
Isolate the hazard physically or redesign the work. Install machine guards, use mechanical lifting aids, put up barriers and guardrails. Engineering controls are more reliable than administrative controls or PPE because they don't depend on people behaving correctly every time.
4. administrative controls
If engineering controls aren't reasonably practicable, use procedures and rules. Safe systems of work, training, signage, permit-to-work systems, toolbox talks. Administrative controls work, but they depend on people following the rules, so they're less reliable than engineering controls.
5. personal protective equipment (ppe)
PPE is the last line of defence. It should be the last thing you consider, not the first. PPE is covered by the Personal Protective Equipment at Work Regulations 1992 as amended by the Personal Protective Equipment at Work (Amendment) Regulations 2022. PUWER 1998 covers work equipment itself. Make sure PPE is used in the right situations, kept in good condition, and stored properly.
In your risk assessment, be specific about what controls you have in place for each hazard. Don't just write "wear PPE." Write "hard hat, safety boots, high-visibility vest, gloves" and say why each one is needed.
step 5: document it properly
Everything so far has been thinking work. Now you need to write it down. A risk assessment that only exists in your head isn't worth much. It needs to be recorded in a format you can share, your workers can read, and a principal contractor or HSE inspector can review.
A good risk assessment document includes:
HSE's risk assessment template (available free from hse.gov.uk) provides a simple structure. You can use it as a starting point, but you must adapt it for your specific work. A document written for a different job and not adapted for this one is a liability, not a protection.
Use plain language. It needs to make sense to someone who wasn't on site when you wrote it.
step 6: review and update
A risk assessment isn't a one-time document. It needs to stay current. A risk assessment written three months ago might be out of date if the site conditions have changed, the scope has changed, or something happened that revealed a hazard you hadn't considered.
When must you review and update a risk assessment?
CDM 2015 Regulation 15 makes clear that on a single-contractor project, the contractor is responsible for keeping the construction phase plan and risk assessments up to date. Where a principal contractor has been appointed, Regulation 13 puts that duty on them instead. If the work changes, the assessment must change with it.