How to create a workplace risk assessment step by step

Why is a risk assessment mandatory?

A workplace risk assessment is a legal obligation for every employer under occupational safety and health law - regardless of company size and already from the first employee. It is the foundation of workplace safety and must be in place before work begins.

The aim is to identify hazards to safety and health systematically and to define the necessary protective measures. The assessment must be documented and updated whenever work procedures, equipment or conditions change, or after an incident.

• Duty to assess working conditions for every task.
• Duty to document the results and the measures taken.
• Involvement of the safety officer and occupational physician.
• Applies from the first employee, whatever the sector.

What are the steps of a risk assessment?

A risk assessment follows a proven seven-step model. It starts by defining work areas and tasks and ends with checking effectiveness and updating - a continuous cycle, not a one-off document.

To rate risk, a simple matrix of likelihood against possible severity helps. It gives you priority: high risks are addressed immediately, medium risks on a plan, and low risks as part of ongoing improvement.

What does the STOP hierarchy mean?

The STOP hierarchy sets the binding order of protective measures. Technical and organisational solutions take priority, and personal protective equipment is always the last stage - never the first.

PPE is only specified when the residual risk after S, T and O is not sufficiently removed. Selection follows the specific residual hazard: protection class, fit, comfort and the relevant EN standard (for example EN ISO 20345 for safety footwear, EN 388 for mechanical gloves, EN 166 for eye protection).

• Check substitution first - the most effective yet most overlooked stage.
• Technical measures protect collectively, without action by the individual.
• Organisational measures complement but never replace engineering.
• PPE only against the remaining residual hazard, to the right EN standard.

How do you document it defensibly?

Documentation is a legal requirement and must clearly show which hazards were identified, which measures were defined and how their effectiveness was checked. A free-form but complete record is enough - what matters is completeness of content.

• Work areas, tasks and the hazards identified.
• Risk rating and the measures derived from the STOP hierarchy.
• Responsible person, implementation deadline and current status.
• Date of the effectiveness check and the next review.

A risk assessment must be kept up to date: with new equipment, changed procedures, after accidents or near misses, and at regular intervals. That keeps it a living management tool for occupational safety.

Frequently asked questions