Every year, workplace incidents in the UK cost businesses billions of pounds, and the human cost runs higher still. Health and safety law tells employers what they must do, but knowing the law is not the same as following it. The businesses that protect their workers properly are usually the ones that take risk management seriously. When it is done well, risk management becomes the practical method by which legal duties are met and accidents are prevented.
Why being proactive matters
Some workplaces still treat safety reactively. They respond after incidents occur and update procedures based on what went wrong. UK health and safety law requires a more proactive approach. Employers are expected to identify hazards in advance and put controls in place to reduce risk, which is the basic function of a risk assessment.
The Health and Safety at Work etc. Act 1974 puts a general duty on employers to look after their staff so far as reasonably practicable. The Management of Health and Safety at Work Regulations 1999 take it further and specifically require suitable and sufficient risk assessments. Both bits of law assume you have a method in place. Without one, employers tend to end up making it up as they go.
Training that builds real competence
Compliance depends on people. Written policies achieve nothing on their own. Managers, supervisors and frontline staff have to recognise hazards in front of them and know what to do about them. Training is how that knowledge gets built. A practical risk assessment course teaches workers how to spot hazards in their own roles, work out who could be harmed, and choose suitable control measures.
Once staff understand the five steps of a risk assessment, namely identifying hazards, deciding who could be harmed, evaluating risks and precautions, recording the findings, and reviewing them, they take a more active role in safety. Supervisors notice issues on the shop floor that office-based managers would miss. Junior staff feel able to raise concerns. Senior managers can ask better questions when new processes or equipment are proposed. A workforce with this kind of shared competence keeps a business compliant when conditions change.
Not every risk is equal
Not every hazard deserves the same level of attention. A frayed bit of carpet near reception and a leaking drum of cleaning chemicals are technically both risks, but you would not write the same risk assessment for them. Scoring hazards by likelihood and consequence is the standard way to sort one from the other. Once you have done that, you can put your time and budget into the things most likely to put someone in hospital.
Reasonable practicability is a legal concept that requires the cost of a control to be weighed against the risk it prevents. Inspectors expect to see that the more serious hazards have been given the more substantial controls. Without a meaningful ranking of risks, this is difficult to demonstrate during an inspection.
Connecting the parts
Hazard identification and training cover only part of compliance. The various safety records, processes and documents also need to be managed in a coordinated way. A proper risk management system holds completed assessments, risk levels, training records, and review dates in one structured place. Without this, departments tend to hold their own records in their own formats, and information that should be shared across the business often is not.
In practice that means a near-miss report on Monday should trigger a review of the relevant assessment by the end of the week. A new machine on the shop floor needs an updated assessment before anyone is allowed near it. Changes to COSHH or the Work at Height Regulations should be reflected in every site’s procedures, not just head office. The businesses that struggle are usually the ones where any one of those links is broken. You tend to find out which link it was during an audit, or after an accident.
What inspectors want to see
HSE inspectors rely on documentation rather than verbal assurances. A working risk management process produces this documentation as part of its normal operation: completed assessments, training records, audit findings, corrective action logs and minutes from safety meetings. After an incident, these records form most of what an investigator will examine. The quality of the documentation often influences how the HSE responds, including whether Fee for Intervention charges or formal enforcement action are applied.
There are commercial reasons to keep good records anyway. Insurers ask for them at renewal. Most reasonable-sized clients want to see them before signing a contract. They also come up in supply chain due diligence and ESG questionnaires. The admin involved is usually less than it feels, and most firms recover the time spent on it elsewhere.
Reviewing as you go
Workplaces do not stand still. Staff turn over, machines get replaced, processes get redesigned, and the regulatory picture shifts every few years. Your assessments and procedures have to keep up with all of that or they quietly become inaccurate. Annual reviews, near-miss investigations and the occasional internal audit are usually enough to catch the drift, provided someone actually owns the work.
Reviewing properly also tends to improve the culture. Staff who see their reports being acted on tend to report more of them. The earlier issues come in, the easier they are to deal with before anyone gets hurt.
Wider business benefits
Although the main purpose of risk management is to protect people, the commercial benefits are real. Fewer incidents mean less downtime, lower insurance premiums and lower staff turnover. Companies with good safety records win more tenders and attract better people. Customers and supply chain partners increasingly look at safety performance as part of their ESG checks, which makes a strong approach to risk a commercial requirement as well as a legal one.
Takeaway
The basics of risk management are not technically demanding. Identification, training, proportionate controls and accurate records cover most of what the law requires. The harder part is maintaining the system through busy periods, staff turnover and organisational changes. Most compliance failures occur during this maintenance phase.
Adam Mulligan, a psychology graduate from the University of Hertfordshire, has a keen interest in the fields of mental health, wellness, and lifestyle.
