Risk assessment for small businesses: what the law asks, and what it doesn't

If you run a small business, health and safety advice tends to arrive in one of two forms. A consultant quoting for a forty-page safety pack, or a free template from the internet that has nothing to do with your work.

Neither is what the law is asking for.

The duty to assess risk is the same whether you employ three people or three thousand. What changes is how much there is to assess, and that's usually a lot less than people are led to believe.

What the law asks

Regulation 3(1) of the Management of Health and Safety at Work Regulations 1999 says every employer must make a "suitable and sufficient" assessment of the risks to their employees, and to anyone else affected by their work.

Every employer. There's no lower size limit on the duty itself.

What does change with size is the paperwork. Regulation 3(6) says that where you employ five or more people, you must record the significant findings of the assessment, and any group of employees identified as especially at risk.

So if you have fewer than five employees, the law doesn't require you to write it down. I'd still do it. If something goes wrong, a short written assessment is the easiest way to show you thought about it beforehand. Without one, it's your word after the event.

What "suitable and sufficient" means for a small business

It means proportionate. A small, low-risk business usually has a handful of significant risks, and the controls for them are often simple and already in place.

For most small businesses, a sensible assessment covers:

• the activities that could genuinely hurt someone: work at height, vehicles, machinery, manual handling, chemicals, electricity, lone working
• who could be harmed, including customers, visitors and contractors, not just staff
• what you already do to control each risk
• what else you need to do, who's doing it and by when

What you don't need

You don't need a consultant to write it for you. For a low-risk business, the person best placed to assess the risks is usually the person running it, ideally with the people who do the work. HSE's guidance is written with exactly that in mind. If you have a genuinely high-risk activity and you're not sure how to control it, that's when outside help is worth paying for.

You don't need a copied template with your name on it. HSE is clear that copying an example and putting your company name to it won't satisfy the law. Examples are useful for seeing what good looks like. They're not a substitute for looking at your own work.

You don't need a long document. Longer is not safer. A two-page assessment your team has read and understood is worth more than a twenty-page one nobody has opened. We've written about that before in Is a 22 page risk assessment suitable?

You don't need an enterprise safety platform. Most EHS software is priced and built for large organisations, with sales demos, annual contracts and modules you'll never use.

What it should cost

This is the part that bothers me most. The legal duty is identical for a five-person firm and a FTSE 100 company, but the tools to meet it properly have mostly been priced for the latter.

A small business shouldn't need to choose between a Word document and a four-figure software contract.

That's why R1SK has a Lite plan at £10 a month, or £100 a year. It covers up to 10 users, up to 100 core assessments and 200 dynamic assessments, a configurable risk matrix with ALARP, action tracking and email support.

That's a full risk assessment record: hazards identified, scored on your own matrix, controls with owners and due dates, digital sign-off and a review date on every assessment.

If you grow, Starter at £60 a month adds a risk register and analytics for up to 100 users. Every plan has a published price, so there's no quote to wait for and no sales call to sit through.

Where to start

If you've never done a risk assessment, or you've got an old one in a drawer, start small:

1. List the three or four activities in your business most likely to injure someone.
2. For each one, write down who could be hurt and how.
3. Write down what you already do to prevent it.
4. Decide what else you need to do, who will do it and by when.
5. Tell your team, and put a date in the diary to check it again.

That's a risk assessment. Everything else is detail.

If you'd like to do it in R1SK, you can try it free in a 24-hour sandbox, with your own hazards, before you pay anything. All the plans are on our pricing page.