Risk Assessment That Changes Something: A Five-Step Approach

Every site has risk assessments. Fewer sites have risk assessments that anyone at the point of work has read, and fewer still have assessments that changed how a job is done. The difference is not the template; it is whether the assessment was treated as a decision about real work or as a document to be produced.

The five-step structure below is standard. What matters is how each step is done.

Step 1 — Identify the hazards

A hazard is anything with the potential to cause harm: a fall from height, a moving vehicle, a toxic atmosphere, a manual-handling load, a live conductor, a hot surface, a stressed shift pattern.

The only reliable way to find them is to walk the task as it is actually performed — at the time of day it happens, with the people who do it. Written procedures describe the job as designed; the assessment must describe the job as done, including the shortcuts, the workarounds and the "we always do it this way".

Sources that help: incident and near-miss records, manufacturers' instructions, inspection findings, and the people who do the job, who almost always know where the danger is.

Step 2 — Decide who could be harmed, and how

For each hazard: who is exposed, and what would the harm be? Think beyond the operator:

• Maintenance staff who see the equipment in a different state
• Contractors who do not know the site
• Visitors and the public
• Lone workers and night shifts
• The rescuer — the person who goes in after the first casualty

"How" matters as much as "who". A fall from a ladder and a fall into a tank are both falls, with different consequences and different controls.

Step 3 — Evaluate the risk and choose the controls

Risk combines how likely the harm is with how severe it would be. A simple matrix is enough to prioritise — the purpose is to decide what to fix first, not to produce a precise number.

Controls follow the hierarchy:

1. Eliminate — does the task need doing this way at all? Can the confined-space entry be avoided with a camera?
2. Substitute — a less hazardous material, a lower voltage, a mechanical lift for a manual one
3. Engineer — guardrails, ventilation, interlocks, fixed anchor systems
4. Administrative — permits, procedures, training, supervision, signage
5. PPE — the last line of defence, for what remains

An assessment whose controls are all in categories 4 and 5 is usually an assessment that has not tried categories 1 to 3.

Step 4 — Record it, usably

The record has two audiences: the auditor, who needs to see the assessment was done, and the worker, who needs to know what to do. Most assessments serve only the first.

A usable record is short, specific to the task, and states the controls as actions: "Isolate and lock out the conveyor before clearing a blockage — your own lock, your own key." It is available where the job is done, and it is the basis of the toolbox talk, not a file in an office.

Step 5 — Review it

An assessment is out of date when:

• The task, the equipment or the materials change
• The people change — new starters, contractors, a reorganised shift
• An incident or near miss shows a hazard or a control that was missed
• An inspection or audit finding contradicts it

An annual review is a backstop, not a schedule. The trigger is change.

Signs an assessment has become paperwork

• Every task on site scores "medium"
• The controls are the same sentence — "wear PPE, follow SOP" — on every page
• Nobody at the point of work has seen it
• It was written by someone who has not watched the job
• It has been "reviewed, no change" for five years running

Where Eduforce fits

Our Risk Assessment consultancy is done on site, with the people who do the work, and delivered alongside training so the controls become practice rather than paper. Where the assessments need to sit inside a wider framework, Safety Management Systems consultancy and the EHS Compliance Audit test whether the system as a whole holds up.