Home / Guides

How to Write a Construction Risk Assessment: A Step-by-Step UK Guide

5 steps · Updated 20 October 2026

A risk assessment is simply a careful look at what on your job could harm people, so you can decide whether you have done enough to prevent it. On a construction site that means the real tasks in front of you: the work at height, the excavation, the plant movements, the dust from cutting. Done properly it keeps people safe and keeps you on the right side of the law. Done as a generic copy-and-paste it protects no one and will not stand up if the HSE or your principal contractor looks at it.

This guide walks through the recognised HSE five-step method as it applies to UK construction, then shows you how to rate risk, how to choose controls in the right order, and a worked site example. It is written for site managers, supervisors and the competent people who actually sign these off.

The legal duty, in plain terms

Under the Management of Health and Safety at Work Regulations 1999 every employer and self-employed person must make a suitable and sufficient assessment of the risks to workers and anyone else who could be affected. If you employ five or more people you must record the significant findings. On a construction project the Construction (Design and Management) Regulations 2015 add the duty to plan, manage and monitor the work so it is done without risks to health and safety. The legal test for your controls is to reduce risk so far as is reasonably practicable, which means weighing the risk against the time, cost and effort of controlling it, and acting unless the cost is grossly disproportionate to the risk.

How to rate risk: the 5 by 5 matrix

Most construction risk assessments score each risk as likelihood multiplied by severity, each on a scale of 1 to 5, giving a risk rating from 1 to 25. Rate the risk twice: once as it would be with no controls, and once as the residual risk after your controls are in place. The aim is to pull every significant risk down into the low band before work starts.

Risk score	Band	What it means
1 to 6	Low	Acceptable. Monitor and maintain the controls.
8 to 12	Medium	Add further controls where reasonably practicable before work.
15 to 25	High	Do not start. Stronger controls are required first.

The hierarchy of control

The order matters because controls at the top remove the risk for everyone, while PPE only protects the one person wearing it correctly:

1. Eliminate the hazard entirely, for example by ordering materials pre-cut so there is no cutting on site.
2. Substitute it for something safer, for example a less hazardous product or a smaller, lighter plant item.
3. Engineering controls that physically reduce exposure, such as edge protection, guarding, water suppression or on-tool dust extraction.
4. Administrative controls such as safe sequencing, exclusion zones, permits to work, training and job rotation.
5. PPE as the last line of defence, for example an FFP3 mask, hearing protection or a harness, never as the first or only control.

Worked example: cutting blocks on site

Say the task is cutting concrete blocks with a disc cutter. The hazards are respirable crystalline silica dust, noise and hand-arm vibration. People at risk are the operative and anyone nearby. Rated with no controls this is high. Working down the hierarchy: eliminate by ordering blocks pre-cut where the design allows; where cutting is unavoidable, use engineering controls (cut wet with water suppression, or on-tool extraction with the right filter); add administrative controls (limit trigger time, rotate operatives, train them, keep others out of the dust); and finish with PPE (a correctly fitted FFP3 mask and hearing protection). With those in place the residual risk drops into the low band, and that is what you record and brief.

Risk assessment versus method statement

These two are often confused. The risk assessment is the thinking: it identifies the hazards, rates the risk and decides the controls. The method statement is the doing: a step-by-step safe system of work that tells the team how to carry out the task in the right order with those controls in place. Together they are usually called a RAMS. A good risk assessment makes writing the method statement straightforward, because the controls you chose become the steps the team follows.

Common mistakes to avoid

• Copying a generic assessment from another job so it does not match the work actually being done here.
• Writing it at a desk without walking the task or talking to the people who will do it.
• Jumping straight to PPE instead of working down the hierarchy of control.
• Rating risk once and never recording the residual risk after controls.
• Filing it and forgetting it, so it never gets reviewed when the work or the team changes.

Frequently asked questions

Is a risk assessment a legal requirement in the UK?

Yes. The Management of Health and Safety at Work Regulations 1999 require a suitable and sufficient assessment of the risks, and if you employ five or more people you must record the significant findings. On construction, CDM 2015 also requires the work to be planned, managed and monitored.

What makes a risk assessment suitable and sufficient?

It identifies the real, significant hazards of this specific task and site, names who could be harmed and how, and sets out sensible controls that reduce the risk so far as is reasonably practicable using the hierarchy of control. A copied generic template does not meet the test.

How often should a risk assessment be reviewed?

Whenever the work, site, plant, materials or people change, after any accident or near miss, and at regular intervals on a long job. There is no fixed interval, but a stale assessment that no longer matches the work is treated as no assessment at all.

What is the difference between a risk assessment and a method statement?

The risk assessment identifies and rates the hazards and decides the controls. The method statement is the step-by-step safe system of work that puts those controls into practice. Together they are a RAMS.

Who can write a construction risk assessment?

A competent person, meaning someone with the training, knowledge and experience to understand the work and its sensible controls, usually working with the people who will do the task. Competence is about understanding the work, not about one particular certificate.