Risk Assessment for Construction: A Step-by-Step Guide for Tradespeople

Why Risk Assessments Matter More Than Most Tradespeople Think

If you've been turned away from a site because your RAMS weren't up to scratch, you know how frustrating it is. A risk assessment isn't just paperwork to get you on site. It's the law.

Under the Management of Health and Safety at Work Regulations 1999 (Regulation 3), every employer and self-employed person must carry out a suitable and sufficient assessment of the risks their work creates. That means you, even if you work alone.

On construction projects with more than one contractor, CDM 2015 (Regulation 15) reinforces this. Contractors must plan, manage and monitor their work to ensure it is carried out without risks to health or safety. The principal contractor coordinates all of this under Regulation 13.

It's not optional. It's the law. And more importantly, it's how you stop someone from getting hurt on your job. This guide walks through the process step by step.

Step 1: Identify the Work and Scope

Before you look at hazards, be clear about what you're actually doing. Generic risk assessments get rejected because they describe "construction work" instead of the specific task on the specific job.

What you should write down:

• What work are you carrying out? (e.g. first-fix electrical installation in a domestic extension)
• Where is the work taking place? (site address, area within the site)
• Who else is working nearby or in the same space?
• What's the timeline? (start date, expected duration, key stages)
• Are there any special conditions? (confined space, live building, shared site)

Don't copy someone else's risk assessment and put your company name on it. HSE's own guidance is explicit: copying a generic example and signing it does not satisfy the law and does not protect your employees. You have to think about the specific hazards and controls for your work.

The scope matters because it determines everything downstream. A risk assessment for installing kitchen sockets in a domestic property is very different from a full rewire in a commercial building, even though both involve electrical work.

Step 2: Identify the Hazards

Walk the site before you start work. Not after. Before. Look at the environment, the equipment you'll use, the materials you'll handle, and the people around you. Ask one simple question: what could go wrong here?

Common hazard categories for construction work:

• Work at height (falling from ladders, scaffolds, platforms)
• Electrical work (shock, burns, arc flash)
• Manual handling (lifting heavy materials, awkward positions)
• Moving vehicles and plant (reversing vehicles, site traffic)
• Hazardous substances (dust, cement, solvents, asbestos)
• Noise and vibration (power tools, plant machinery)
• Excavations and trenches (collapse, underground services)
• Fire risk (hot work, flammable materials)
• Collapse of structures or temporary works
• Public and other workers sharing the space

For each hazard, think about who could be harmed. Not just your own workers. Other tradespeople on site, the public, visitors, delivery drivers. Anyone who might be affected by your work.

Reference specific regulations where relevant. Working with power tools? Reference the Provision and Use of Work Equipment Regulations 1998 (PUWER). Working at height? Reference the Work at Height Regulations 2005 (WAHR 2005).

Step 3: Assess the Risk Using a Risk Matrix

Score your hazards. The 5x5 risk matrix multiplies likelihood by severity.

Likelihood scale:

• 1 - Very unlikely (almost never happens)
• 2 - Unlikely (could happen occasionally)
• 3 - Possible (might happen sometimes)
• 4 - Likely (will probably happen)
• 5 - Very likely (happens often)

Severity scale:

• 1 - Negligible (minor cuts, no time off work)
• 2 - Minor (injury needing first aid, short time off)
• 3 - Moderate (injury needing hospital treatment, longer time off)
• 4 - Major (serious injury, permanent harm, extensive treatment)
• 5 - Catastrophic (death or life-changing injury)

Multiply likelihood by severity to get your risk rating:

• 1 to 4: Low risk (acceptable, monitor but no urgent action needed)
• 5 to 9: Medium risk (implement controls, review regularly)
• 10 to 16: High risk (implement controls before work starts, senior review needed)
• 17 to 25: Very high risk (stop work, implement immediate controls, seek advice)

Be specific when scoring. "Possible" (3) that someone might get a minor electric shock (2) gives a rating of 6, medium risk. That needs controls. "Very likely" (5) that someone might fall from height (5) gives 25, very high risk. That needs serious controls before anyone goes up there.

Step 4: Identify the Controls

Use the hierarchy of controls. It's not a suggestions list. Work through it from the top down. Only move to the next level if the level above isn't reasonably practicable.

1. Eliminate the Hazard

The best option is to remove the hazard entirely. Can the work be done without the risk? If you can eliminate it, do it. No other control measure is as reliable.

2. Substitute With Something Safer

If you can't eliminate, can you substitute with something less hazardous? Using a manual tool instead of a power tool removes the electrical hazard. Using a lighter material reduces manual handling strain. Substitution isn't always possible, but it's worth considering.

3. Engineering Controls

Isolate the hazard physically or redesign the work. Install machine guards, use mechanical lifting aids, put up barriers and guardrails. Engineering controls are more reliable than administrative controls or PPE because they don't depend on people behaving correctly every time.

4. Administrative Controls

If engineering controls aren't reasonably practicable, use procedures and rules. Safe systems of work, training, signage, permit-to-work systems, toolbox talks. Administrative controls work, but they depend on people following the rules, so they're less reliable than engineering controls.

5. Personal Protective Equipment (PPE)

PPE is the last line of defence. It should be the last thing you consider, not the first. PPE is covered by the Personal Protective Equipment at Work Regulations 1992 as amended by the Personal Protective Equipment at Work (Amendment) Regulations 2022. PUWER 1998 covers work equipment itself. Make sure PPE is used in the right situations, kept in good condition, and stored properly.

In your risk assessment, be specific about what controls you have in place for each hazard. Don't just write "wear PPE." Write "hard hat, safety boots, high-visibility vest, gloves" and say why each one is needed.

Step 5: Document It Properly

Everything so far has been thinking work. Now you need to write it down. A risk assessment that only exists in your head isn't worth much. It needs to be recorded in a format you can share, your workers can read, and a principal contractor or HSE inspector can review.

A good risk assessment document includes:

• The scope of work (what you're doing, where, when, who else is involved)
• The hazards identified and who might be harmed
• The pre-risk scores (before controls) for each hazard
• The control measures you've put in place
• The post-risk scores (after controls) for each hazard
• Your name, the date, and a review date
• Any relevant regulation references

HSE's risk assessment template (available free from hse.gov.uk) provides a simple structure. You can use it as a starting point, but you must adapt it for your specific work. A document written for a different job and not adapted for this one is a liability, not a protection.

Use plain language. It needs to make sense to someone who wasn't on site when you wrote it.

Step 6: Review and Update

A risk assessment isn't a one-time document. It needs to stay current. A risk assessment written three months ago might be out of date if the site conditions have changed, the scope has changed, or something happened that revealed a hazard you hadn't considered.

When must you review and update a risk assessment?

• Before the job starts (confirm the assessment still reflects the work)
• If there's an incident or near miss on site
• If the scope of work changes (additional tasks, different area, new equipment)
• If the site conditions change (weather damage, structural changes, new workers)
• At the review date you set (if you wrote 3 months, look at it again in 3 months)

CDM 2015 Regulation 15 makes clear that on a single-contractor project, the contractor is responsible for keeping the construction phase plan and risk assessments up to date. Where a principal contractor has been appointed, Regulation 13 puts that duty on them instead. If the work changes, the assessment must change with it.