Risk Assessment Guide

Risk assessment is the structured process used to identify workplace hazards, understand who may be harmed, evaluate risk, choose suitable controls, record findings and review whether controls remain effective.

This guide connects hazard and risk, control measures, existing and additional controls, residual risk, review, NEBOSH learning, IOSH manager awareness and future risk assessment templates.

This guide helps you
understand

What risk assessment means.
How hazards, risks and controls connect.
The main steps of risk assessment.
How existing and additional controls differ.
How risk assessment connects to NEBOSH and IOSH.

GIC1

Open book examination

GIC2

Practical risk assessment

45%

GIC1 provisional pass mark

60%

GIC2 pass mark

Page sections

Before reading this guide

Many learners hear about risk assessment in HSE, NEBOSH, IOSH, site work, safety officer duties, inspections,
toolbox talks or incident prevention. But they often do not understand the full process.

What is a risk assessment?

Students need the simple meaning before moving into steps, forms or templates.

How do I assess risk?

Learners need to understand likelihood, severity, exposure and existing controls.

How does this connect to NEBOSH?

NEBOSH learners need risk assessment foundations before GIC2 practical guidance.

What is risk assessment?

Risk assessment is the process of identifying workplace hazards, deciding who may be harmed and how, evaluating the level of risk, choosing suitable controls, recording important findings and reviewing whether the controls remain effective.

Key terms explained simply

These definitions help students, Google and LLMs understand the core safety entities behind risk assessment.

Risk assessment =the process of identifying hazards, assessing who may be harmed and how, evaluating risk, choosing controls, recording findings and reviewing controls.

Risk = the likelihood and seriousness of harm occurring when someone is exposed to a hazard.

Control measure= an action used to eliminate a hazard or reduce risk.

Additional control =a further control needed to reduce risk.

Competent person = someone with enough knowledge, training or experience to help assess and control risks.

Hazard= something with the potential to cause harm.

Exposure = contact with, presence near, or involvement with a hazard..

Existing control = a control measure already in place.

Residual risk= the risk that remains after controls are applied. .

Review=checking whether the assessment and controls are still suitable. .

Why risk assessment matters

Protect people

Risk assessment helps identify hazards before harm occurs and supports safer decisions.

Prioritise risk

It helps teams focus on serious hazards, exposed people and weak controls.

Communicate controls

It records what should be done and who is responsible for action.

Review and improve

It helps organisations check whether controls still work after changes or incidents.

Risk assessment turns safety thinking into action

Hazards exist in almost every workplace. Without a structured process, people may miss important risks, rely on weak controls, or only react after an incident.

The 5 steps of risk assessment

This learning workspace uses the HSE step-by-step model: identify hazards, assess risks, control risks,
record findings and review controls.

1. Identify hazards

What can cause harm?

2. Assess risks

Who is exposed?

3. Control risks

What can prevent harm?

4. Record findings

What evidence is needed?

5. Review controls

Has anything changed?

Identify hazards

Find what could cause harm in the workplace. Use walkarounds, worker consultation, incident records, safety data sheets, equipment checks and task observation.

Decide who may be harmed and how

Consider workers, contractors, visitors, cleaners, maintenance staff, drivers, new workers, vulnerable workers and anyone affected by the activity.

Evaluate risk and existing controls

Think about likelihood, severity, frequency, exposure duration, number of people exposed and whether current controls are reliable.

Decide additional control measures

If existing controls are not enough, decide what further actions are needed to reduce risk.

Record and review the assessment

Record significant hazards, risks, controls, responsibilities and review dates. Revisit the assessment when work changes or incidents occur.

Step 1 - Identify hazards

Hazard identification is the first step. If the hazard is missed, the risk may never be properly controlled.

Look at tasks

Observe actual work, unusual tasks, maintenance, cleaning and busy periods.

Speak to people

Workers and supervisors often know where work is difficult, rushed or unsafe.

Review evidence

Use incidents, near misses, inspection records, safety data sheets and maintenance reports.

Step 3 - Evaluate risk and existing controls

Risk evaluation means checking whether current controls are enough. A risk assessment should not
assume a control works simply because it exists.

How likely?

How probable is harm during normal, busy, unusual or emergency conditions?

How serious?

Could the harm be minor, serious, disabling or fatal?

Who and how often?

How many people are exposed, how often and for how long?

Example

Hazard: chemical cleaning product. Existing controls: labelled container, gloves available and basic instruction. Risk issue: poor ventilation and inconsistent glove use may still expose workers.

Step 5 - Record and review the assessment

A risk assessment should stay alive. Recording does not mean writing long documents for the sake of paperwork. It means keeping
a clear record of significant hazards, risks, controls and actions.

1

Hazard and who may be harmed.

2

Existing controls and additional actions needed.

3

Person responsible, target date and review date

Existing controls vs additional controls

This is where many learners make mistakes. Existing controls are what you already do. Additional controls are what you still need to do.

Already in place

Example: Drivers are trained and routes are marked.

Further action needed

Example: Install pedestrian barriers and improve visibility.

Risk after controls

Example: Risk remains but is reduced if barriers and supervision are maintained.

Common mistakes in risk assessment

Confusing hazard with harm

Do not write "broken leg" as the hazard. The hazard may be an unprotected edge while working at height

Writing vague hazards

Avoid vague phrases such as unsafe workplace. Identify blocked walkways, damaged ladders or unguarded blades.

Ignoring who may be harmed

Consider workers, contractors, visitors, cleaners, drivers, maintenance staff and others who may be exposed.

Listing controls without checking them

A control only helps if it is suitable, used correctly, maintained and understood.

Relying only on PPЕ

PPE may be needed, but stronger controls should be considered first.

Never reviewing the assessment

Risk assessments become weak when work changes but the document stays the same.

How risk assessment connects to NEBOSH

NEBOSH learners need risk assessment knowledge because practical safety understanding depends on identifying hazards, evaluating risk and recommending suitable controls.

How risk assessment connects to IOSH

Managers and supervisors influence risk control because they assign tasks, plan work, supervise workers, communicate controls, monitor behaviour and respond to incidents.

This page supports IOSH learners, but the detailed manager route belongs in the IOSH Managing Safely Learner Guide.

What this page does not cover

This guide explains risk assessment as a workplace safety process. It does not cover full NEBOSH GIC2 submission instructions, exact exam or assessment answers, downloadable risk assessment templates, course fees, batch dates, registration, legal advice, salary claims or job claims. ..

The correct learning path is:

Hazard vs Risk - Risk Assessment Guide - Hierarchy of Controls - Risk Assessment Template - NEBOSH Risk Assessment Practical.

Learning risk assessment for NEBOSH, IOSH or HSE work?

If you are learning risk assessment because you want to choose NEBOSH, IOSH or an HSE learning route, use the NEBOSH & IOSH Hub
or speak with a SFAST advisor before checking course dates.

FAQs Questions

What is risk assessment?

Risk assessment is the process of identifying hazards, assessing who may be harmed and how, evaluating risk, choosing suitable controls, recording findings and reviewing controls.

hat are the 5 steps of risk assessment?

A simple template should include the activity or task, hazard, who may be harmed and how, existing controls, further controls, responsible person, target date and review data.

What is the first step in risk assessment?

Write the specific source or situation that can cause harm, such as “moving forklift traffic near pedestrian walkway,” not vague phrases like “unsafe area.”

What is the difference between hazard and risk?

It means identifying the people exposed to the hazard and explaining the possible harm, such as “warehouse staff and contractors may be struck by moving forklifts.”

What are control measures?

Existing controls are the control measures already in place, such as training, guarding, barriers, signs, procedures or ventilation.

What is residual risk?

Further controls are additional actions needed to reduce the risk, such as installing barriers, improving ventilation, replacing equipment or updating procedures.

What should be recorded in a risk assessment?

NEBOSH states that the International General Certificate is accredited and credit-rated by Qualifications
Scotland Accreditation at SCQF Level 6 with 11 SCQF credit points.

When should a risk assessment be reviewed?

No. Examples can help you understand structure, but your risk assessment should match your own workplace, task, hazards and controls.

How does risk assessment connect to NEBOSH?

It can help learners understand how to record hazards, controls and action plans, but it should not be used as a copied NEBOSH GIC2 report.

How does risk assessment connect to IOSH?

It can help learners understand how to record hazards, controls and action plans, but it should not be used as a copied NEBOSH GIC2 report.

Source basis and review note

How this guide is researched

This guide is based on HSE risk assessment guidance, HSE risk assessment templates and examples, ILO workplace risk assessment guidance, IOSH introduction to risk assessment, NEBOSH GIC2 guidance, IOSH Managing Safely positioning and SFAST'S NEBOSH & IOSH learning-hub structure.

This page should be reviewed whenever official risk assessment guidance, NEBOSH GIC2 guidance, IOSH guidance or SFAST learning routes are updated.

Source basis

HSE risk assessment steps are used for the 5-step process and official risk-management framing.

HSE templates and examples are used for recordkeeping structure.

NEBOSH GIC2 guidance is used only to connect hazard/risk understanding with practical risk assessment learning.

IOSH risk assessment guidance is referenced for manager/supervisor risk-assessment relevance.

Student-first NEBOSH & IOSH learning ecosystem for learners who want to understand safety qualifications before choosing structured training.