The law states that a risk assessment must be ‘suitable and sufficient’, i.e. it should show that:
- a proper check was made;
- all those who might be affected are considered, whether they are workers or others such as members of the public;
- all the obvious significant risks have been dealt with, taking into account the number of people who could be involved;
- the precautions are reasonable, and the remaining risk is low;
- workers or their representatives have been involved in the process.
The level of detail in a risk assessment should be proportionate to the risk and appropriate to the nature of the work. Insignificant risks can usually be ignored, as can risks arising from routine activities associated with life in general, unless the work activity compounds or significantly alters those risks.
A risk assessment should only include what could reasonably be expected – you are not expected to anticipate unforeseeable risks.
For small businesses, with few or simple risks, a suitable and sufficient risk assessment can be a very straightforward process based on informed judgement and using appropriate guidance.
For medium-sized businesses or those with greater risks, the risk assessment will need to be more sophisticated. Specialist advice may be required for some areas of the assessment, for example, risks requiring specialist knowledge, e.g. a particularly complex process or technique or risks needing specialist analytical techniques, e.g. being able to measure air quality and to assess its impact.
Large and high-hazard sites will require the most developed and sophisticated risk assessments. For manufacturing sites using or storing bulk hazardous substances, large-scale mineral extraction or nuclear plant, the risk assessment will be a significant part of the legally required safety case or report and may incorporate such techniques as quantified risk assessment.