A risk assessment is a written answer to three questions about a piece of work: what could hurt someone, how likely and how bad is it with what we already do, and what more should we do about it. This template works for almost anything — a warehouse loading bay, a cleaning job, a school trip, a new machine, a busy reception desk. You describe what you are assessing, then add one entry per hazard. Each entry records who could be harmed, the controls already in place, a rating, any further controls with a named owner and a due date, and the rating once those are done. A hazard that is still High at the end is pulled to the top of the report. Fill it in here and download a finished PDF without creating an account.
Start with what you already do
Most blank risk assessments ask you to rate a hazard as if nothing were in place, then list controls. That overstates the risk of things that are already well managed and hides the gap that matters. Here the first rating is made with the existing controls counted — the guard that is fitted, the training people have had, the procedure that is actually followed. If that rating is already Low, you are done with that hazard apart from keeping things as they are.
If it is Medium or High, the entry asks what more should happen. Write each further control as something a person can do and someone can check: "fit a mirror at the blind corner by dock 3", not "improve visibility".
The four-by-four matrix used here
Likelihood has four steps, from rare to almost certain, and so does severity, from slight to catastrophic. Where they meet gives one of three ratings:
- Rare — Low, Low, Low, Medium.
- Unlikely — Low, Low, Medium, High.
- Likely — Low, Medium, High, High.
- Almost certain — Medium, High, High, High.
- Low: keep it up. Medium: add controls where it is practical, by a set date. High: the activity should not carry on as it is.
Strong controls first
When you choose further controls, start with the ones that change the work itself: get rid of the hazard, swap it for something less harmful, or put a barrier, guard or extraction between people and it. Procedures, training, signs and supervision come next. Protective equipment comes last, because it relies on being worn properly every time. Each entry lets you tick which kinds of control you used, so a reviewer can see at a glance whether the plan leans too heavily on gloves and goggles.
Owners, dates and the review
A further control without a name and a date is a wish. Each one here gets both, and the report lists them together so the follow-up is easy. Set a review date as well, and review sooner whenever the work, the people, the equipment or the layout changes, or after an accident or near miss. The review log at the end keeps a short history of what changed each time.
On the phone, speak while you walk, and the document writes itself: stand in front of each hazard, describe it and take the photo, and the entry fills in.
Common questions
What should a risk assessment include?
What is being assessed and by whom, the hazards, who could be harmed and how, the controls already in place, a rating of the risk, any further controls needed with who will do them and by when, the risk that remains, and a date to review it.
Do US employers have to write risk assessments?
There is no single federal rule that says "write a risk assessment" for every workplace, but OSHA expects employers to find and fix hazards, several standards require a written hazard assessment for specific work, and OSHA's recommended practices for safety programs describe this process. Insurers and clients often ask to see one too.
How is this different from a dynamic risk assessment?
This one is prepared ahead of time, for work that is planned or routine, and reviewed on a date. A dynamic risk assessment is made on the spot, when conditions on the day no longer match the plan.
Who should carry it out?
Someone who knows the work and has some safety training, together with the people who actually do the job. They know the shortcuts, the awkward spots and what really happens on a busy day.
Why is the risk rating picked by hand?
So the form behaves the same on the web and on the phone. The matrix is printed in the hint beside each rating; pick the box where your likelihood and severity meet.