Risk Assessment Template (UK): Health and Safety Form for Employers

A health and safety risk assessment is a form, not an agreement — nobody signs it. It is your written record of what could cause harm in your workplace, who could be harmed and how, what you already do about each hazard, and what still needs doing, with an owner and a date.

This risk assessment template for UK workplaces exists because of a specific legal duty. Under regulation 3 of the Management of Health and Safety at Work Regulations 1999, every employer must make a “suitable and sufficient” assessment of the risks their work creates — to employees and to anyone else the business affects: visitors, contractors, the public.

The assess-versus-record split and the family-undertaking exception

That duty applies whatever your headcount. What changes with size is recording: once you employ five or more employees, you must also record the significant findings and any group of employees identified as being especially at risk. This template gives you a structure for that written record. A health and safety policy is a separate document with its own rules — covered on our health and safety policy template page.

The family-undertaking exception concerns young workers. Before employing a young person, the Regulations require the assessment to take particular account of a young worker's inexperience, lack of awareness of risks and immaturity. One narrow exception: that requirement is disapplied for occasional or short-term work in a family undertaking which is regarded as not harmful, damaging or dangerous to young people.

What triggers an assessment — and a review

Taking on your first employee. The duty follows employment itself, so deal with it alongside the employment contract.
New premises, machinery, substances or ways of working. A significant change in the matters your assessment covers is a statutory trigger to review what you already have.
After an accident or near miss. An incident is the clearest reason to suspect your assessment is no longer valid.

What a risk assessment should cover

The sections the form needs, and why:

Activity, location, date and assessor. Anchors the record and shows when review falls due.
Hazards identified. Everything with real potential to cause harm. Machinery, work at height and hazardous substances are the ones people remember; electricity, driving for work, lone working, display screen equipment and work-related stress are the ones that get skipped, so build prompts for them into the form.
Who might be harmed, and how. Not just staff — the duty expressly covers people not in your employment, so visitors, contractors and customers belong here. Where those contractors are carrying out building work, our free construction contract template guide covers the agreement behind it.
Existing controls. What you already do — the assessment measures the gap between this and what the risk needs.
Risk rating. A simple likelihood-and-severity score — not prescribed by the Regulations, but how you show priorities were set rather than guessed.
Further action, owner and deadline. The action plan is the point of the exercise — a risk identified then ignored is the worst paper trail a business can create.
Groups especially at risk. Where the recording duty applies, you must record any group of employees the assessment identifies as being especially at risk — young workers and new or expectant mothers are the usual examples.
Review date and review triggers. The law requires review where there is reason to suspect the assessment is no longer valid, or where there has been a significant change — write both the date and the triggers into the form.

Common mistakes

Filing someone else's assessment. “Suitable and sufficient” means suitable for your undertaking; a form completed for a different workplace and left untouched is neither.
Treating it as a one-off. If the work changed and the form did not, you no longer have an assessment — you have an artefact.
Believing fewer than five employees means exemption. Only the written-record requirement has a headcount threshold. The duty to assess applies to every employer.
Assessing only the dramatic hazards. Driving for work, lone working, display screens and stress cause far more absence and claims than the machinery everyone remembers to list.

England & Wales, Scotland and Northern Ireland

The 1999 Regulations apply across Great Britain: the duty to assess and the recording threshold are the same in England, Wales and Scotland.

Northern Ireland has its own legislation for both duties covered by these two pages, and they come from different instruments. The written-policy duty comes from Article 4(3) of the Health and Safety at Work (Northern Ireland) Order 1978, in wording identical to section 2(3) of the 1974 Act — but the exception to that duty is set by separate Northern Ireland regulations, the Employers' Health and Safety Policy Statements (Exceptions) Regulations (Northern Ireland) 1980, so check the threshold there rather than assuming the Great Britain figure carries across. The risk-assessment duty comes from regulation 3 of the Management of Health and Safety at Work Regulations (Northern Ireland) 2000, which states the duty and the five-or-more recording rule in the same terms as the Great Britain Regulations. That is why these pages state the Northern Ireland recording figure for risk assessments but do not state a Northern Ireland threshold for the written policy.

A Great Britain form works in Northern Ireland — but cite the 2000 Regulations (S.R. 2000 No. 388), not the 1999 ones.

One genuine divergence: since 1 October 2015 the Great Britain assessment duty on the self-employed has applied only to a “relevant self-employed person” — someone conducting an undertaking of a prescribed description — while the Northern Ireland Regulations still apply it to every self-employed person.

Fire is separate: in Great Britain, fire risk assessment was taken out of these Regulations in 2006 and now sits under its own legislation, which differs between England & Wales and Scotland. This form does not replace a fire risk assessment. Northern Ireland has a separate fire safety regime again, which this page does not cover.

Frequently asked questions

Is a risk assessment a legal requirement for every UK employer?

Yes. Every employer must assess the risks their work creates, whatever the size of the business; headcount only affects whether the findings must be written down.

Do I have to write my risk assessment down?

The duty to record significant findings applies once you employ five or more people. Smaller employers still have to assess, and writing it down anyway is the practical way to prove you did.

How often does a risk assessment need to be reviewed?

The law sets no fixed interval: review is required when there is reason to suspect the assessment is no longer valid, or after a significant change. Many businesses also diarise an annual check as good practice.

Can I complete a risk assessment myself using a template?

Yes — a template supplies the structure and you supply the knowledge of your own workplace. For high-hazard or complex work, get competent help rather than stretching a general form.

Statutory references on this page were checked against primary sources (legislation.gov.uk, GOV.UK, HSE, ICO and Acas) on 8 August 2026. Our templates themselves are not solicitor-drafted — see the note below.

This page is legal information, not legal advice.

Dogetlawyer is a Legal-Technology platform, not a law firm.

Our templates are not solicitor-drafted and have not been checked against primary sources. They are starting points to adapt, not finished documents.

This page describes the law of England and Wales unless it says otherwise. For anything significant, consider taking advice from a qualified professional.

That caution applies with particular force to high-hazard work.

How to get this template

This form is one of more than a hundred free UK legal templates on Dogetlawyer. Every title is public on the A–Z template index; downloading needs only a free account, not a payment.

Assessing risk to people’s personal data is a separate exercise under different rules — that one is a data protection impact assessment.