Free HSE tool · Risk Assessments
Five-Step Risk Assessment
The five-step method is the HSE (UK) risk assessment method, and it is taught from the IOSH Working Safely classroom to the boardroom because it is the shortest honest path from we have hazards to here is what we will do about them, by when, and who owns it.
The Five Steps — Try It Live
Pick a task, see its starting risk, then apply a control in hierarchy order and watch the score move.
Each step below explains what the step actually requires, the way it usually goes wrong, and a live mini-example you can click through: pick a hazard, see its starting risk, apply a control, and watch the score change. The interaction is the whole method in ten seconds.
How to use the tool
- Step 1 — Identify the hazards: walk the workplace and list what can cause harm — the machinery, the chemicals, the electricity, the working pattern, not just the equipment
- Step 2 — Decide who might be harmed: employees, contractors, visitors, the disabled, the lone worker — the who changes the controls, so write it down
- Step 3 — Evaluate the risks and decide on controls: score likelihood × consequence, then select controls in the hierarchy — eliminate, substitute, engineer, manage, PPE
- Step 4 — Record your findings: the significant findings, the controls, the owners, the dates — a record an auditor and an investigator can follow
- Step 5 — Review: after any incident, any change to the work, and at the set interval — because the workplace moves and the paper must move with it
Worked example
Click through the example below: a chemical cleaning task in a canteen starts at likelihood 3 × consequence 3 = 9 (medium). Apply the first control in the hierarchy — substitute a pre-diluted, low-hazard product — and it drops to 2 × 2 = 4 (low). The method works because of the order: most sites would jump straight to gloves (PPE, last in the hierarchy) and land at 2 × 3 = 6. Same hazard, weaker position, more cost — and the control fails every time someone forgets the gloves.
Standard & legal context
The five steps come from the HSE (UK) guidance Five steps to risk assessment and sit inside the Management of Health and Safety at Work Regulations 1999 — regulation 3 imposes the assessment duty, regulation 6 the recording duty at five or more employees, and the HSE guidance sets out the method. The same sequence underlies IOSH Working Safely and Managing Safely, the NEBOSH risk assessment units, and ISO 45001 clause 6.1 — every formal course you take teaches these five steps in slightly different vocabulary.
Common mistakes
- Collapsing steps 1 and 2 — listing hazards without naming who is harmed, then designing controls for an average worker who does not exist
- Skipping the hierarchy — reaching for PPE before substitution or engineering, the single most common finding in a risk assessment audit
- Recording the method and not the decisions — a record that says controls in place instead of interlocked guard, fitted 12 March, by J. Ahmed
- Treating review as a date on a form — the triggers (incident, change, new information) matter more than the calendar
Need the sign-off, not just the tool?
The tool is the preparation; the sign-off is the professional. For the statutory assessments, the audits, the ISO 45001 implementation and the training that comes with them, ask Muhammad Umer — 8+ years across Iraq, KSA and Pakistan, and the programme runs through umer-hse.pro. One message gets the written scope.
Common questions
Five-Step Risk Assessment — answered
What are the 5 steps to risk assessment?
1. Identify the hazards. 2. Decide who might be harmed. 3. Evaluate the risks and decide on precautions. 4. Record the findings. 5. Review the assessment. The order is fixed; most failures are steps done out of order or skipped.
What is the first step of a risk assessment?
Identifying the hazards — and in practice that means walking the workplace, not remembering it. The assessment must be suitable and sufficient, which means it covers what is actually there.
Who created the 5-step risk assessment?
It is the method published by the UK Health and Safety Executive in its Five steps to risk assessment guidance, implementing the Management of HSW Regulations 1999. It has become the standard teaching method across IOSH, NEBOSH and the ISO 45001 courses.
How is the 5-step method different from a risk register?
The five steps are the method; the risk register is one possible output of step 4. A register is a tracking document — the method is what fills it honestly.
Do the 5 steps apply to small businesses?
Yes — the recording duty formally applies at five or more employees in the UK, but the assessment duty applies at one. A two-person shop still needs to know what can hurt the two people in it.
Can I do the 5 steps in a spreadsheet?
Yes — the method is vocabulary-independent. The tool on this page, a spreadsheet, or paper all work; what fails is skipping step 2 or inverting the control hierarchy.
Keep building
Related tools
General Risk Assessment
Free 5-step general risk assessment tool: identify hazards, who is harmed, score the risk, select controls and
Risk AssessmentsRisk Matrix Calculator
Free HSE risk matrix calculator: enter likelihood and consequence, get the 5×5 score, the colour band and the
Risk AssessmentsJob Safety Analysis (JSA/JHA)
Free job safety analysis tool: break the job into steps, list the hazards, existing controls, add new controls
THE HEALTH AND SAFETY is an education and knowledge network. The tools are free and open; the professional assessments and audits run through umer-hse.pro.
Safety disclaimer
These tools are practical guidance, built to the UK baseline with the US equivalents named on each page. They do not replace a competent person assessment for high-risk work, a statutory assessment, or the advice of your insurer. Where a document has legal force — the fire risk assessment, the COSHH register, the permit to work — the responsible person owns it. Use the tool as the preparation, and the competent person as the sign-off.