A risk assessment is a systematic process for identifying the hazards on a construction job, evaluating how likely someone is to be harmed and how severe that harm could be, and deciding on the control measures to reduce the risk to an acceptable level.
Under the Management of Health and Safety at Work Regulations 1999, every employer and self-employed person must carry out a “suitable and sufficient” risk assessment. For construction work, CDM 2015 reinforces this requirement. The HSE recommends a 5-step approach: identify the hazards, decide who might be harmed, evaluate the risks, record your findings, and review the assessment regularly.
The 5x5 risk matrix
The standard approach in UK construction is to rate each hazard using a 5x5 matrix. You score the likelihood of harm (1-5) and the potential severity (1-5), then multiply them to get a risk score from 1 to 25. This helps you prioritise — a score of 20 (likely and severe) needs urgent attention, while a score of 2 (unlikely and minor) may be acceptable with basic controls.
The hierarchy of controls
When selecting control measures, follow the hierarchy of controls: eliminate the hazard entirely, substitute for something less hazardous, use engineering controls (guards, barriers, ventilation), use administrative controls (procedures, training, signage), and only then rely on PPE as a last resort. A risk assessment that lists “wear PPE” for every hazard without considering higher-level controls will be flagged by an inspector.