#261 The Art Of Appropriate Risk Assessments  

Risk Assessments are a legal requirement under regulations related to the Health & Safety At Work Act here in the UK. It’s a task that may have many rolling their eyes, but they do provide valuable insight into potential risks for any working environment.

However, the mistake many make is the overcomplication of risk assessments. Many businesses operate under the assumption that every possible thing that could be a risk must be documented, even when it’s not applicable to their situation.

In this episode, Ian Battersby dives into the art of risks assessments, including why we need to conduct them, key considerations for identifying proportionate risks and how to quantify risks.

You’ll learn

• Why do we conduct risks assessments?
• Risk assessments and the Health & Safety At Work Act
• Related regulations
• What formats are typically used for risk assessments?
• How to conduct an appropriate risks assessment
• What are the consequences for not completing risk assessments?

Resources

• HSE resources for Risk Assessments
• Isologyhub

In this episode, we talk about:

[02:35] Episode Summary – Ian Battersby explains why we conduct risk assessments, the formats businesses typically use and how to determine what an appropriate risk assessments looks like for your business.

[03:10] Why do we conduct risks assessments – ISO Standards? The international perspective is that ISO 45001 requires it and you can’t get certified without doing it.

Clause 6 – planning is where we see it:

‘6.1 Actions to address risks and opportunities’

There are two distinct ways in which risk should be considered. The first covers the risks to the organisation achieving its outcomes and the Management System being effective. This should ‘take into account’ the risks arising from such things as hazards, but it is not intended to include all the individual hazards which the workforce face.

That’s where Clause 6.1.2 comes in: identification of hazards and assessment of occupational health & safety risks from the identified hazards. Then there’s the planning through the adoption of appropriate controls to mitigate those risks.

[06:10] Why do we conduct risks assessments – The Law? From a national perspective, here in the UK, we have laws governing risk assessment. These are mirrored in other jurisdictions to a greater or lesser extent.

The overarching legislation in the UK is the Health and Safety at Work etc. Act 1974.

The Act itself doesn’t contain an express risk assessment requirement. That duty comes from the regulations made under the Act, such as the Management of Health and Safety at Work Regulations 1999.  

[07:25] Risk assessments and the Health & Safety At Work Act – The Act sets the overarching duties, qualified by “so far as is reasonably practicable”.

The key think to remember is, don’t do things which are not very doable to get risks which aren’t significant!

The Act covers employers’ duties to employees, duties to non-employees affected by the work, and also covers employees’ own duties. Risk assessments are how employers show they are meeting these in practice.

Risk Assessments are specified in regulation 3 – The Management of Health and Safety at Work Regulations.

Every employer must make a suitable and sufficient assessment of the risks to employees at work, and to non-employees affected by the conduct of the undertaking, in order to identify the measures needed to comply with their statutory duties. Self-employed people have a similar duty.

The assessment must identify the hazards and evaluate the risks arising from them. It should be done by a competent person and recorded formally if you have five or more employees.

There is no mandatory qualification or course for carrying out assessments, and the HSE expects every employer to do one regardless of size.

Reviews are required where there is reason to suspect the assessment is no longer valid or there has been a significant change. The assessment must also cover risks to young persons under 18 and to new and expectant mothers. 

[08:35] Other related regulations- Regulation 4 requires preventive and protective measures to be applied on the basis of the principles of prevention in Schedule 1.

Regulation 5 requires appropriate health and safety arrangements based on the assessment outcomes.

Regulation 6 covers health surveillance, and regulation 7 requires competent persons to help the employer meet its duties.

Regulation 10 requires employees to be given information about the risks identified.

Regulation 13 requires adequate health and safety training on recruitment and when new or increased risks arise.

Other regulations require specific assessments, such as COSHH, noise, manual handling, DSE, PPE, asbestos and work at height.

Other frameworks that can assist include ISO 31000 Risk management and ISO 31010 Risk assessment techniques.

But many of us and certainly many of our clients in smaller, less complex environments don’t need all of this!

[12:05] What formats are typically used for risk assessments? – Both ISO 31000 and ISO 31010 provide guidance on the most common form of risk assessment techniques. One of the most popular involving measuring consequence / impacts by likelihood

This is typically done with a simple matrix, (I.e. five by five, three by there, ten by ten). It doesn’t have to be numbers, it could use descriptors like impact from insignificant to catastrophic.

Be careful though, if something is insignificant, why does it feature? If you consider a risk insignificant, then it’s not really a risk at all! So why would you both documenting it?

Risk is all about uncertainty: there’s no knowing what the real chances are of an event materialising are. The law and ISO 45001 require that you consider the history of events in your organisation in determining the risk, so seriously consider what’s happened in the past; do you have a history of accidents of certain types? Have your staff been exposed to specific issues before? How likely are they to happen again?

What actual harm has been suffered?

The key is to be realistic.

Reflect real work in real places.  Review people’s tasks: are you office based? Do people travel? Is there any physical work? Are machines used in any way? Does the environment affect people?

Talk to the people involved, document their feedback, share it with the people affected and make sure you review if anything significant changes.  

[16:25] How to conduct an appropriate risks assessment – TheHSE has some really helpful resources. If you search their website for Managing risks and risk assessment at work, there is a very simple set of guidance. They also have templates to show you what an appropriate assessment might look like.

One example risk assessment template provided is for an office-based business.

However, they do state:

“Do not just copy this example and put your company name to it as that would not satisfy the law and would not protect your employees. You must think about the specific hazards and controls your business needs.”

Their example doesn’t include a matrix, so when you adapt it for your business, you could add a quantification of the risk level, which could be very rudimentary (high, medium. low).

Remember, if you’re not in a complex environment, this type of quantification should not be complex. To be fair, you don’t have to quantify it at all, there’s no specific requirement to do so. However, quantification allows you to judge what actions take precedence and what should be resourced.

Those judgements and the tracking of progress against the proposed actions become more important the more complex you become, so we usually recommend some from of quantification from the start.

[21:00] Risk Assessment checklist:

• Does our assessment describe the tasks and locations people actually work in today, including home and client sites?
• Is the level of detail proportionate to the risk?
• Did we talk to the people doing the work?
• Does every identified risk have a control, an owner and a date?
• Have we checked that the controls are happening in practice?
• Do we have a trigger for review, such as a new site, a change in working pattern, an incident or a near miss?
• Do the people affected know what the assessment says and where to find it?
• If we have five or more employees, is it recorded?
• Have we considered specific groups, such as young workers, new or expectant mothers, and people with disabilities?
• If we lack in-house competence, have we got help?

[23:00] What are the consequences for not completing risk assessments? – In the UK, breaches of the regulations can be prosecuted under The Health & Safety At Work Act. But it’s important to note that failing to carry out a suitable and sufficient risk assessment is itself an offence, even if no one has been harmed.

If something goes wrong and you have to share your documentation with the authorities as part of an investigation, if the risk assessment isn’t appropriate, you may find yourself in hot water.

If you’d like help with ISO 45001 Implementation or on-going support, feel free to reach out to us, we’d be happy to help.

We’d love to hear your views and comments about the ISO Show, here’s how:

• Share the ISO Show on Twitter or Linkedin
• Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List