Common questions builders ask about risk assessments.
Is a risk assessment a legal requirement?
Yes. Under the Management of Health and Safety at Work Regulations 1999 (Regulation 3), every employer and every self-employed person must carry out a suitable and sufficient assessment of the risks to their employees and to anyone else who might be affected by their work. This is not guidance or best practice — it is a legal duty, and failing to comply is a criminal offence. For construction work specifically, CDM 2015 reinforces this requirement. Regulation 13 requires contractors to plan, manage, and monitor construction work to ensure it is carried out without risks to health and safety, so far as is reasonably practicable. In practice, a risk assessment is the foundation of that planning. If you employ five or more people, you must record your risk assessment in writing. However, even if you are a sole trader or employ fewer than five, the duty to carry out the assessment still applies — and writing it down is strongly recommended because it demonstrates to the HSE, your clients, and principal contractors that you have done the work. The penalties for failing to carry out a risk assessment can be severe. The HSE can issue improvement notices, prohibition notices (which stop your work immediately), or prosecute. Fines are unlimited in the Crown Court, and in serious cases, individuals can face imprisonment. Beyond the legal risk, a proper risk assessment genuinely protects the people on your site.
Who is responsible for doing the risk assessment?
The employer is legally responsible for ensuring that risk assessments are carried out. If you are a sole trader, that responsibility falls on you. If you run a company, it is the company’s duty, but in practice someone competent needs to actually do the work. The law says you must appoint one or more ‘competent persons’ to help you meet your health and safety obligations, and the person who carries out the risk assessment must be competent to do so. Competence does not mean you need a formal qualification. It means you need sufficient training, experience, knowledge, and understanding to identify the hazards and evaluate the risks for the type of work you are doing. A roofer with twenty years of experience is competent to assess the risks of roofing work. A first-year apprentice is not. For more complex or specialist risks — structural stability, asbestos, contaminated land — you may need to bring in someone with specialist knowledge. On larger sites, the principal contractor will often coordinate risk assessments across all contractors. However, this does not remove your own duty. Every contractor is responsible for the risks arising from their own work, regardless of what the principal contractor does. If you are a subcontractor, you should produce your own risk assessment for your scope of work and share it with the principal contractor.
How detailed does a risk assessment need to be?
The legal standard is ‘suitable and sufficient.’ This does not mean it has to be a hundred pages long, but it does mean it has to cover the real risks on the real site where you are working. The HSE has been very clear that risk assessments should be proportionate. For straightforward work with well-understood risks — like hanging a door or painting a room — a brief assessment covering the key hazards and controls is perfectly acceptable. For higher-risk activities — working at height, demolition, excavation, working near live services — you need more detail. Your risk assessment should identify every significant hazard, evaluate who could be harmed and how, describe the control measures you will put in place, and explain how those controls will be implemented and monitored. The key test is: could someone unfamiliar with the job read your risk assessment and understand what the risks are and how you are managing them? If the answer is yes, it is probably detailed enough. If your risk assessment just says ‘working at height — use appropriate edge protection’ without specifying what kind of edge protection, how it will be installed, or who will inspect it, that is not sufficient. Be specific about your controls. Name the equipment. Describe the method. The more specific you are, the more useful the document becomes — both as a safety tool and as evidence of compliance.
Can I use a generic risk assessment template?
You can use a template as a starting point, but the final document must be tailored to the specific site and specific work you are carrying out. A completely generic risk assessment — one that could apply to any construction site anywhere in the country — is unlikely to meet the legal standard of being ‘suitable and sufficient.’ The HSE has repeatedly made this point in enforcement actions and in their published guidance. The problem with generic templates is that they do not account for site-specific conditions. A template for ‘general roofing work’ will not mention the fragile roof light on this particular building, the overhead power line running across the access route, or the narrow scaffold that limits safe working space. Those are exactly the hazards that cause accidents. That said, starting from a template and adapting it is a perfectly sensible approach. Most experienced builders have a library of risk assessments that they adjust for each project. The key is that you must review the template against the actual conditions on site and add, remove, or modify hazards and controls accordingly. The Site Book takes this approach further by creating your risk assessment from your project description, so the document is site-specific from the start. You describe the work, and it pre-fills hazards and controls based on what you are actually doing — not what a generic template assumes you might be doing.
How often should I review my risk assessment?
There is no fixed legal interval for reviewing risk assessments, but the Management of Health and Safety at Work Regulations 1999 require you to review your assessment whenever there is reason to suspect it is no longer valid, or when there has been a significant change in the work. In construction, this means you should review your risk assessment before each new phase of work begins, whenever site conditions change significantly (for example, bad weather, unexpected ground conditions, or new hazards being introduced by other contractors), after any accident, incident, or near miss, when new workers or subcontractors join the project who may bring different risks or need different information, and at regular intervals on longer projects — weekly is a sensible minimum. A risk assessment that was written on day one and never looked at again is not meeting the legal requirement. Construction sites are dynamic environments — conditions change constantly, and your risk assessment needs to keep pace. The review does not have to be a formal, time-consuming exercise. It can be as simple as reading through the document at the start of each week, checking it still reflects reality, and updating anything that has changed. On larger projects, this review often forms part of the weekly site briefing or toolbox talk. If you discover a new hazard on site that was not in your original assessment, you must update the risk assessment before allowing work to continue in that area.
What is the difference between a risk assessment and a method statement?
A risk assessment and a method statement serve different but complementary purposes, and in construction they are almost always produced together as a combined document known as RAMS. The risk assessment identifies the hazards associated with a piece of work, evaluates the likelihood and severity of harm for each hazard, and sets out the control measures you will put in place to reduce the risk to an acceptable level. It answers the question: what could go wrong, and what are we doing to prevent it? The method statement, on the other hand, describes the step-by-step sequence of operations for carrying out the work safely. It incorporates the control measures identified in the risk assessment and lays out the practical detail: what equipment will be used, what PPE is required, what the sequence of work is, who is responsible for each stage, and what the emergency procedures are. It answers the question: how exactly are we going to do this work? Think of the risk assessment as the thinking and the method statement as the doing. You need both. A risk assessment without a method statement identifies the dangers but does not explain how the work will be done safely. A method statement without a risk assessment describes the process but has not systematically considered what could go wrong. Together, they form a complete safety plan. In practice, most builders produce them as a single RAMS document, and The Site Book creates both parts together from your project description.