How to write a risk assessment
A practical walkthrough following OSHA’s approach to hazard identification and control. Includes examples, a free template, and our online generator.
You can use the generator without an account. You’ll need a free account to save and edit at a later date.
Quick index
What is a risk assessment?
It’s a sensible, written look at what might cause harm and how you’ll control it.
In the US, OSHA requires employers to identify and control workplace hazards (29 USC §654; relevant 29 CFR parts). A Job Hazard Analysis (JHA) is a common method.
Good to know: Official guidance links for your region are below.
The 5 steps (OSHA)
- Identify hazards: What could cause injury or illness?
- Assess the risks: Who might be harmed and how; how likely/severe is it?
- Control the risks: Decide on practical measures to reduce risk.
- Record your findings: Keep a simple written record.
- Review the controls: Check they work and update when things change.
Helpful references: Hazard Identification & Assessment (OSHA) · Job Hazard Analysis (OSHA 3071, PDF)
Walkthrough
1) Identify hazards
Walk your activity or site and list what could cause harm. Think equipment, environment, substances, people, and tasks. Note anything unusual about your location or group.
2) Assess the risks (who, how, likelihood & severity)
For each hazard: who could be harmed (participants, staff, visitors), how they could be harmed, and how likely/serious it is before controls.
3) Control the risks (measures)
Choose proportionate controls. Prefer simple, proven measures: supervision ratios, equipment checks, training, signage, PPE where appropriate, and clear procedures.
4) Record your findings
Keep a brief record of significant hazards, who could be harmed, the controls, and the risk level before/after controls. Assign responsibilities and target dates.
5) Review and update
Revisit the assessment after incidents, changes in people/kit/locations, or on a routine schedule. Update controls that aren’t working in practice.
Scoring risk (3×3 matrix)
Many teams use a 3×3 matrix to combine likelihood and severity into a score. Keep your thresholds consistent with your organisation’s policy.
- Low: Acceptable with routine controls; monitor.
- Medium: Improve controls and keep under review.
- High: Do not proceed until risks are reduced.
Scoring risk (5×5 matrix)
A 5×5 matrix provides more detail, helping teams prioritise risks where activities are complex or involve higher stakes. It allows for finer distinction between levels of likelihood and severity.
- Very Low / Low: Acceptable with routine controls; monitor.
- Medium: Improve controls and keep under review.
- High: Action required — reduce risks before proceeding.
- Very High: Unacceptable — stop until controls are in place.
For sector-specific examples: Free Templates Library
Recording your findings
Keep a simple written record covering: who might be harmed and how, what you’re already doing, what further action is needed, who will do it, and when it’s due.
Reviews & updates
Review your assessment regularly and when things change — new equipment, locations, team, incidents, or after feedback from sessions. Update controls that aren’t working in practice.
Reminder: This page is guidance, not legal advice. You remain responsible for completeness and accuracy.
FAQs
Is a risk assessment a legal requirement?
OSHA requires employers to identify and control hazards. While a single “risk assessment” document isn’t universally specified, many standards require assessments (for example, PPE hazard assessments under 29 CFR 1910.132) and a JHA is widely used to meet those duties.
Do I have to use a 3×3 matrix?
No. Use scoring that fits your policy. The important part is consistent, reasoned decisions and proportionate controls.
Do I need an account to use the generator?
You can use it without an account. You’ll need a free account to save for a later date.
Get started
Open the generator for a tidy, branded PDF, or download the free blank template and print to PDF.
