Every other template hands you a blank grid
Which is the easy part. Anybody can draw a table with hazard, likelihood, severity and control measures across the top. The hard part is knowing what goes in it, and that is exactly where the free templates stop.
So the hazards here arrive with the controls a competent person would actually write against them, and every line is editable. You are correcting a draft rather than staring at an empty box, which is a completely different job.
How this tool works
Pick a hazard and it comes in with its likely consequences, who is typically at risk, a starting likelihood and severity, and a list of control measures. Change any of it: the library has not seen your site.
Risk is scored as likelihood multiplied by severity, each from 1 to 5, giving a number from 1 to 25 in four bands. You set the likelihood before controls and again after, and the residual score follows. The highest residual across the whole assessment is put on the front of the document, because that single number is what decides whether the job goes ahead and a reviewer should not have to scan a table for it.
Everything is worked out on this page and the PDF is generated in your browser. Nothing is uploaded and there is no account.
Severity has no "after" value, on purpose
Dropping severity after controls is the most common reason an assessment gets rejected, and the tool will not let you do it.
Control measures reduce how likely harm is. They do not reduce how bad it is when it happens. Edge protection does not make a fall from six metres less fatal; a rescue plan does not make a suspension trauma less serious. What they do is make it less likely to happen at all.
So the severity you set is carried straight through to the residual score. An assessment that drops it after controls has quietly scored itself down to a number somebody wanted, and any reviewer who knows the subject spots it immediately.
It tells you when your controls control nothing
If the likelihood after controls is the same as before, those control measures are not reducing anything, and the tool says so against that hazard while you are still editing it.
It is an easy thing to leave in by accident, particularly on a hazard somebody added late, and it is one of the first things a reviewer looks for.
What makes one suitable and sufficient
The phrase comes from the Management of Health and Safety at Work Regulations 1999, and in practice it means four things a reviewer checks for.
It covers one job. An assessment covering everything a company does covers nothing. It names who is at risk, including the people you do not employ: other trades, delivery drivers, visitors and the public. The controls are realand specific to the work rather than a line saying operatives will be careful.It has a review date, without which it is a piece of paper rather than a live document.
Where this stops
The library is a starting point for common construction hazards. It has not seen your site, it does not know your people, and it cannot know what is unusual about your job. The person who signs it carries it, which is stated on the document itself rather than only here.
Anything involving a substance needs a COSHH assessment alongside this, and a lift needs a lift plan. Those are separate documents for a reason.
Typed, scored and made into a PDF on your own machine
Everything is typed, scored and turned into a PDF on this page using your own machine. Nothing is uploaded, nothing is stored, and there is no account, which matters when the document carries your client, your site address and the names of your operatives.
Common questions
How do I write a risk assessment for free?
Say what work is being assessed, pick the hazards from the list, and check the control measures that come with each one. You get a finished PDF with the 5x5 scoring, the residual ratings and a sign-off block. No account and nothing uploaded.
What is the difference between a risk assessment and a RAMS?
A risk assessment says what could hurt somebody and what is being done about it. A method statement says how the job is done, in order. A RAMS is both in one document. If a principal contractor has asked for "your RA", build this.
Why can I not reduce the severity after controls?
Because controls do not change it. Edge protection does not make a fall from six metres less fatal, it makes it less likely. An assessment showing severity dropping after controls has scored itself down to the number it wanted, and it is the most common reason one gets sent back.
Is this legally compliant?
It lays out significant findings, persons at risk, controls and a review date, which is the layout the HSE guidance uses and the one most principal contractors expect. What it does not do is make the assessment compliant. The Management of Health and Safety at Work Regulations 1999 require the assessment itself to be suitable and sufficient, and require the significant findings to be recorded where five or more people are employed. Whether yours is suitable and sufficient depends on whether it matches your actual site and work, and that judgement belongs to whoever signs it. A tidy layout is not a substitute for it.
What score is acceptable?
There is no legal answer and anybody offering you one is guessing. Five by five scoring is a way of ordering your own work, not a threshold anybody publishes: the duty is to reduce the risk so far as is reasonably practicable, which is a judgement about cost and effort against the harm, and no number replaces it. What the score does well is force the comparison, because a residual sitting near the top of the band next to a control described as "operatives briefed" is visibly not finished.
Who is competent to sign it?
Somebody who knows the work, knows what can go wrong and has the authority to change how the job is done. That is the whole test and it is deliberately not a certificate. A qualification helps and does not substitute: a time-served tradesman who has done the task a thousand times is often the most competent person available, and a card in a wallet is not competence in the eye of anybody investigating afterwards.
How often does it need reviewing?
When something changes, and after anything goes wrong. There is no calendar interval in the regulations, which surprises people expecting an annual review. What triggers one is a change to the work, the plant, the people or the place, plus any incident or near miss, because a near miss is the cheapest information you will ever get about a control that does not work.
Do I need to write a risk assessment at all?
If you employ anybody, yes, and if you have five or more employees the significant findings must be written down. Most principal contractors ask for one whatever the size of the firm before you set foot on site.