For HSE, health and safety and HR managers, the check comes down to three points: does a risk assessment exist, is it up to date, and does it reflect the work actually carried out? This article sets out what the law requires, what it leaves to the employer’s judgement, and how to organise an update that serves prevention.
The CSI division of C2D Prévention supports organisations with the CAP method, whose first phase, Comprehend, combines targeted interviews, field observations and online surveys. It also offers a safety assessment, an immersion that observes real practices and is not a regulatory audit.
Under the Management of Health and Safety at Work Regulations 1999, employers must carry out a suitable and sufficient risk assessment, and review it when it may no longer be valid or when significant changes occur.
What does the law require of employers on risk assessment ?
Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient assessment of the risks to employees and to other people who may be affected by the work.Employers with five or more employees must also record the significant findings of the assessment, together with any groups of employees identified as being especially at risk. The assessment must be reviewed where there is reason to doubt that it is still valid or where there has been a significant change, and any changes it calls for must be made.
The duty to assess risk rests with the employer. C2D Prévention’s support module on the role and legal responsibilities of the executive committee (CODIR, in French) covers the legal environment of workplace health and safety and the responsibilities of senior leaders.
| Recording the assessment and keeping it current: what is the difference ?
The duty to assess and the duty to review apply to every employer, while the duty to record significant findings applies from five employees. HSE’s guidance follows the same sequence: identify the hazards, decide who might be harmed and how, evaluate the risks and decide on controls, record the findings, then review the assessment and update it if necessary.
A missing, unsuitable or outdated assessment can lead to enforcement action by the regulator. More importantly, it leaves hazards uncontrolled. For a small business, an assessment that is brief, accurate and reviewed is worth more than a long document that no one has opened since it was written.
The record itself is not the objective. HSE advises that only the significant findings need to be recorded, so the document should state the main hazards, who may be harmed, the controls in place and what remains to be done.
When should a risk assessment be reviewed ?
A risk assessment should be reviewed whenever there is reason to doubt it is still valid or there has been a significant change, in every organisation, whatever its size. HSE advises reviewing the controls you have put in place to make sure they are working, and again if they may no longer be effective or if changes in the workplace could lead to new risks. Examples include a new process, new equipment or a new hazardous substance. HSE also suggests considering a review if workers have spotted problems or if there have been accidents or near misses.
The Regulations do not set a fixed annual review date for risk assessments. Many organisations nevertheless schedule a yearly review as good practice, so that the actions completed are assessed, less obvious risks come to light, and incidents are taken into account. Employers should also involve their workers, who usually have good ideas, and consult them on matters affecting their health and safety.
| How should successive versions be kept and shared ?
Each version of the risk assessment should be dated and the earlier versions kept. A clear history shows how the assessment has evolved after changes, incidents and consultation. C2D Prévention recommends that the current version is easy to find and that its findings are shared with the workers and representatives concerned, together with the people who supervise the work.
To follow field reports and corrective actions that feed the review of the risk assessment, discover C2D Prévention’s Watson application (page available in French): it lets people report a dangerous situation in a few seconds and track the closure of each report.
How can a risk assessment review become a prevention tool ?
A useful review tests the document against real work: observing tasks, talking to workers and analysing accidents, incidents and near misses. These are the sources that reveal the gap between the work as planned and the work as actually done. The assessment is the starting point of prevention, not an end in itself: it must lead to actions with an owner and a deadline, which are then checked at the next review.
| Which field data should feed the review ?
Observation of real work, accidents that have occurred and dangerous situations reported all feed the review of the risk assessment. Accident figures describe events that have already happened; field reports provide information before the accident.
C2D Prévention’s safety assessment relies on field immersion, targeted interviews and an anonymous survey sent to all employees. It is neither a regulatory audit nor a compliance assessment: it documents what is really done, including trade-offs between safety and production and weak signals. These findings can be compared with the content of the risk assessment when it is reviewed.
Beyond compliance, the risk assessment gains from being regularly compared with real work. C2D Prévention builds this reading of the field into the CAP method, from the interviews and observations of the Comprehend phase to the indicators of continuous infusion.
Work-related stress and other psychosocial risks must also be part of the assessment. HSE states that employers have a legal duty to protect employees from stress at work by carrying out a risk assessment and acting on it, and its Management Standards cover six areas: demands, control, support, relationships, role and change. C2D Prévention supports companies in this process: the psychosocial risk diagnostic (page available in French) from the SMC division measures pressures and resources by team or unit, then leads to an action plan. Its results feed the assessment of psychosocial risks and make the risk assessment easier to update.
Key takeaways
- Employers must carry out a suitable and sufficient risk assessment (Management of Health and Safety at Work Regulations 1999, regulation 3).
- Employers with five or more employees must record the significant findings of the assessment and any groups of employees especially at risk.
- The assessment must be reviewed when it may no longer be valid or when significant changes occur, in organisations of any size.
- Keeping dated versions shows how the assessment has evolved and supports consultation with workers.
- A useful review relies on observing real work, talking to workers and analysing accidents, incidents and near misses.
FAQ
What is a risk assessment and when is it a legal requirement ?
A risk assessment is a careful examination of what in the workplace could cause harm, so that the employer can decide whether enough precautions are in place. Every employer must carry one out. Employers with five or more employees must record the significant findings.
How often should a risk assessment be reviewed ?
The law requires a review when the assessment may no longer be valid or when there has been a significant change. It does not set a fixed interval, but many organisations review at least once a year and after any accident, near miss or change in the work.
What happens if an employer has no risk assessment ?
An employer without a suitable and sufficient assessment is in breach of the 1999 Regulations and may face enforcement action from the regulator. The practical risk is greater still: hazards that have not been identified are not controlled.
Should previous versions of the risk assessment be kept ?
The Regulations require the current significant findings to be recorded. C2D Prévention recommends dating each version and keeping the earlier ones, because they show how the assessment has evolved.
Who should be involved in the risk assessment ?
Workers should be involved because they know how the work is really done. Employers must also consult their workers and their representatives on matters affecting health and safety, and the findings should be shared with those concerned.
Further reading
The General Principles of Prevention (GPP): Origin, Meaning and Content This article presents the nine general principles of prevention, including the risk assessment at the heart of prevention.
Gap Between Prescribed and Actual Work: Why Field-Level Signal Reporting Is Essential to Workplace Safety This article describes the gap between prescribed and actual work and the role of a continuous reporting channel.
Hazard Reporting: 5 Key Steps from Report to Close-Out This article details five stages of a reporting process, from the first report to closing out the action.
See also
The CAP method from C2D Prévention: a four-phase approach, from the Comprehend phase to continuous infusion.
Support modules: tailored programmes for executive committees, managers and leaders.
Safety Day: workshops and conferences: adaptable workshops and conferences, with themes including risk analysis.
Would you like to link your risk assessment to the real work of your teams? Contact the C2D Prévention team to discuss your situation.
Sources
Health and Safety Executive. (2025, 24 March). Risk assessment: overview. https://www.hse.gov.uk/simple-health-safety/risk/index.htm
Health and Safety Executive. (2024, 10 June). Risk assessment: steps needed to manage risk. https://www.hse.gov.uk/simple-health-safety/risk/steps-needed-to-manage-risk.htm
The Management of Health and Safety at Work Regulations 1999, SI 1999/3242, regulation 3: Risk assessment. https://www.legislation.gov.uk/uksi/1999/3242/regulation/3
Health and Safety Executive. Stress and mental health at work: Management Standards. https://www.hse.gov.uk/stress/standards/overview.htm
C2D Prévention. The CAP Method. https://www.c2dprevention.com/en/the-cap-method/
C2D Prévention. Assessment. https://www.c2dprevention.com/en/safety-coaching-support/assessment/
C2D Prévention. Module d’accompagnement Rôle et responsabilités légales du CODIR (in French). https://www.c2dprevention.com/accompagnement-securite-et-coaching/modules-d-accompagnement/module-daccompagnement-role-et-responsabilites-legales-du-codir/
C2D Prévention. Application Watson : Logiciel HSE de signalement des risques (in French). https://www.c2dprevention.com/accompagnement-securite-et-coaching/application-watson/
C2D Prévention. Support Modules. https://www.c2dprevention.com/en/safety-coaching-support/support-modules/
C2D Prévention. Safety Day Workshops. https://www.c2dprevention.com/en/workshops-3/
C2D SMC. Diagnostic RPS (in French). https://c2dsmc.com/diagnostic-rps/
C2D Prévention. The General Principles of Prevention (GPP): Origin, Meaning and Content. https://www.c2dprevention.com/en/blog-en/the-general-principles-of-prevention-gpp-origin-meaning-and-content/
C2D Prévention. Gap Between Prescribed and Actual Work: Why Field-Level Signal Reporting Is Essential to Workplace Safety. https://www.c2dprevention.com/en/blog-en/field-signal-reporting-safety/
C2D Prévention. Hazard Reporting: 5 Key Steps from Report to Close-Out. https://www.c2dprevention.com/en/blog-en/hazard-reporting-process/