How to Write a Risk Assessment for Trade Work UK — A Simple Guide (2026)

Most tradespeople know roughly what a risk assessment is. Far fewer have actually written one that would satisfy an HSE inspector. It's not complicated — but there is a right way to do it, and the consequences of getting it wrong range from enforcement notices to serious liability if a worker or member of the public gets hurt. This guide walks through the five steps the HSE expects, how to rate risks properly, and what your written record needs to contain.

What is a risk assessment and why is it required?

A risk assessment is a formal examination of what in your work could cause harm to people, and a judgement about whether you have taken enough precautions. It is not a box-ticking exercise — it is a structured process that forces you to think about hazards before anyone gets hurt.

The legal basis comes from two pieces of legislation. The Health and Safety at Work etc. Act 1974 (HSWA) places a general duty on employers to ensure, so far as reasonably practicable, the health, safety and welfare of their employees and others who might be affected by their work. The Management of Health and Safety at Work Regulations 1999translate that general duty into a specific requirement: every employer must carry out a suitable and sufficient risk assessment of the risks to employees and to anyone else affected by their work.

If you employ anyone — one apprentice, one labourer, anyone on PAYE — you are legally required to carry out risk assessments. If you employ five or more people, your significant findings must be recorded in writing.

Self-employed tradespeople working alone are also covered. If your work could pose a risk to others — clients in their home, members of the public passing a job, workers from another trade on the same site — you have a duty under HSWA. The HSE's guidance is clear: sole traders are strongly recommended to carry out and record risk assessments as a matter of good practice, and many commercial clients and principal contractors will require them before they let you on site regardless of your employment status.

The HSE's 5 steps to risk assessment

The HSE sets out a five-step framework in its guidance document Five Steps to Risk Assessment(INDG163). Every risk assessment you produce should follow this structure, whether it covers a full rewire or a single maintenance visit.

Step 1 — Identify the hazards

A hazard is anything with the potential to cause harm. Walk the job and think about what could go wrong — not just the obvious things, but the ones that are easy to overlook because they happen every day. For trade work in the UK, common hazards include:

• Working at height. Falls from ladders, scaffolding, roofs, and elevated platforms are the single biggest cause of fatal injuries to tradespeople. Any work above ground level is a hazard that needs assessing.
• Electricity. Live circuits, damaged cables, inadequate isolation, and working near overhead lines are all serious hazards for electricians, plumbers, and builders alike.
• Moving vehicles. Plant and vehicles on site — telehandlers, vans reversing, skips being loaded — create strike risks for workers on foot.
• Manual handling. Lifting, carrying, pushing, and pulling heavy or awkward loads causes more injuries to tradespeople than most other hazards combined.
• Dust — silica and wood. Cutting, grinding, drilling, or chasing concrete, masonry, or stone generates respirable crystalline silica (RCS). Cutting or sanding wood generates wood dust, including hardwood dust, which is a known carcinogen. Both have Workplace Exposure Limits set by the HSE.
• Hazardous substances. Solvents, adhesives, paints, primers, drain chemicals, and cleaning products may be flammable, corrosive, or toxic. Where these are in use, a separate COSHH assessment is also required.
• Noise. Power tools, generators, grinders, and compressors frequently exceed 85 dB(A) — the first action level under the Control of Noise at Work Regulations 2005. Prolonged exposure without hearing protection causes permanent hearing damage.
• Hand-arm vibration (HAV). Regular use of vibrating tools — angle grinders, hammer drills, chipping hammers, disc cutters — can cause Hand-Arm Vibration Syndrome (HAVS), a serious and irreversible condition. Daily exposure must be assessed against the Exposure Action Value of 2.5 m/s² A(8).
• Slips, trips, and falls on the same level. Cluttered or wet floors, trailing cables, uneven ground, and materials left in walkways cause a large proportion of workplace injuries on site.

Talk to your workers — they often spot hazards that are not obvious from a walkthrough. Also check manufacturers' instructions, safety data sheets, and HSE guidance for the specific tasks you are assessing.

Step 2 — Decide who might be harmed and how

For each hazard, think about who could be affected. The answer is rarely just "the operative doing the job." Consider:

• Your own employees — including apprentices, trainees, and anyone new to the role who may be less experienced with a particular hazard.
• Subcontractors working on the same site, who may be exposed to hazards created by your work even if they are not involved in it directly.
• Members of the public — pedestrians passing a street-level job, people in adjacent properties affected by noise or dust, children in a home where you are working.
• Customers in their own home. Domestic clients are not contractors. They are unlikely to understand the hazards on their own property during the works. They need to be protected from access to dangerous areas and from exposure to dust, fumes, and trip hazards.
• Neighbouring properties. Vibration, noise, falling debris, and water damage can affect adjoining buildings and their occupants. This is especially relevant for groundwork, demolition, and roofing.

Note the specific way each group might be harmed — inhalation of dust, a falling object, an electric shock, a trip over materials. The more specific you are, the easier it is to choose the right controls.

Step 3 — Evaluate the risks and decide on precautions

This is where you rate the risk and decide what to do about it. Risk is a combination of how likely harm is to occur and how severe the consequences would be if it did.

The most common approach is a risk matrix. A simple 3×3 matrix uses:

• Likelihood: Low (1) / Medium (2) / High (3)
• Severity: Low (1) / Medium (2) / High (3)
• Risk score: Likelihood × Severity = 1–9

A score of 1–2 is low risk, 3–4 is medium, and 6–9 is high. Many organisations use a 5×5 matrix for more granularity, which gives scores from 1 to 25. Either approach is acceptable — what matters is consistency and honesty. Do not underrate likelihood or severity to make a risk look acceptable when it is not.

Once you have your initial (inherent) risk score, decide on controls. The legal standard is ALARP — as low as reasonably practicable. You must reduce risk to the lowest level you reasonably can, weighing the cost and effort of further controls against the reduction in risk they would achieve. "It would cost too much" is not an acceptable reason to leave a serious risk uncontrolled.

After controls are in place, re-rate the risk. This residual risk score should be lower than the inherent risk score. If it is not, your controls are not adequate.

Controls follow a hierarchy: eliminate the hazard if possible, then substitute for something less hazardous, then use engineering controls (guards, extraction, barriers), then administrative controls (safe systems of work, training, permits), and finally personal protective equipment (PPE). PPE is always the last line of defence, not the first.

Step 4 — Record your findings

If you employ five or more people, the law requires a written record of your significant findings. For anyone employing fewer, a written record is still strongly recommended — it demonstrates due diligence and protects you if there is ever an incident or an enforcement visit.

There is no prescribed format, but a practical risk assessment record for each task should include:

• Task or activity being assessed
• Hazard identified
• Who is at risk and how
• Existing controls already in place
• Inherent risk rating (before additional controls) — likelihood, severity, score
• Additional controls required to reduce risk to ALARP
• Residual risk rating (after controls are applied)
• Responsible person for implementing and checking the controls
• Review date
• Assessor name, signature, and date

Keep it readable. A risk assessment that takes half an hour to decode is not going to be used on site. One A4 page per task or activity type is a reasonable target for most trade work.

Step 5 — Review and update

A risk assessment is not a one-time document. It must be reviewed and updated whenever there is reason to believe it is no longer valid. In practice, review your assessments:

• After any incident, near-miss, or health complaint related to the task
• When you introduce new tools, equipment, or materials
• When the work method changes significantly
• When you take on new employees or apprentices who may have different experience levels
• When you move to a new type of site or working environment
• At a minimum, annually — even if nothing has changed

When you review an assessment, date it and record what changed (if anything). An undated review is almost worthless — you cannot show that it was current at the time of an incident.

Risk assessment vs method statement

These two documents are often confused or used interchangeably, but they serve different purposes.

A risk assessment identifies the hazards associated with a task, rates the risks, and specifies the controls needed to manage them. It answers the question: what could go wrong, and how do we stop it?

A method statement (also called a safe system of work) describes, step by step, how the work will be carried out safely. It translates the controls from the risk assessment into a practical sequence of actions. It answers the question: how exactly will this job be done?

On domestic jobs for private clients, a risk assessment alone is usually sufficient. On commercial sites, for principal contractors, or for any job with significant risk, clients will typically ask for both together — often called a RAMS (Risk Assessment and Method Statement). Having your RAMS ready before you start is increasingly a commercial necessity as well as a legal one.

Generic templates vs site-specific assessments

Generic risk assessment templates for common trade tasks — roofing, electrical installation, plumbing, groundwork — are a perfectly acceptable starting point. The HSE has no objection to them as long as they are adapted to reflect the actual conditions of the specific job.

Where generic assessments go wrong is when they are copied directly without any site-specific thought. A generic assessment for working at height was written for a typical scenario. Your job might involve a fragile roof, restricted access, overhead cables nearby, or an occupied property below. None of that will appear in the template unless you put it there.

The rule is simple: use a template to save time on the structure, but review every line against the actual job before you sign it off. If something on the template does not apply, say so. If something specific to this job is missing, add it.

Common mistakes tradespeople make

• Copy-paste assessments that do not reflect actual conditions. Filing the same document job after job with just the date changed is not a risk assessment — it is a liability. The HSE can and does check whether the assessment matches the actual work being done.
• No date or signature. An undated, unsigned assessment cannot be shown to be current or authorised. Every assessment must be dated and signed by the person who carried it out.
• Not sharing with workers. A risk assessment that sits in a folder on your van and is never shown to the people doing the work achieves nothing. Workers must be briefed on the significant hazards and the controls they are required to follow. Record that briefing — a simple sign-off sheet is enough.
• Not reviewing after incidents. If something goes wrong — even a near-miss — the risk assessment must be reviewed immediately to understand whether the assessment was inadequate or the controls were not followed. Failing to review after an incident is an aggravating factor if enforcement action follows.
• Treating PPE as the only control. Issuing gloves and a hard hat and calling it a risk assessment is not compliance. PPE is the last resort after engineering and administrative controls have been applied. Document why PPE is needed, what standard it must meet, and how it will be maintained.
• Underrating risks to avoid taking action. If a hazard is genuinely high-risk, rating it as low to avoid spending money on controls is both dishonest and dangerous. The HSE looks at whether your risk rating is realistic, not whether it is convenient.